spawnfile 0.1.14 → 0.1.18

package/dist/runtime/daimon/grokWorkerConfigBytes.js

@@ -0,0 +1,53 @@
+/* v8 ignore file -- generated data module */
+// Generated by scripts/vendor-daimon-grok-contract.ts from Daimon's own renderers. Do not edit by hand.
+/** Daimon `renderGrokBrokerWorkerConfig({ model, reasoningEffort })` bytes, verified against the manifest pins on use. */
+export const DAIMON_GROK_WORKER_CONFIG_BYTES = {
+    "grok-4.6": {
+        "low": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"low\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.6\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"low\"\nlabel = \"Low\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n",
+        "medium": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"medium\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.6\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"medium\"\nlabel = \"Medium\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n",
+        "high": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"high\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.6\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"high\"\nlabel = \"High\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n"
+    },
+    "grok-4.5": {
+        "low": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"low\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.5\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"low\"\nlabel = \"Low\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n",
+        "medium": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"medium\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.5\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"medium\"\nlabel = \"Medium\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n",
+        "high": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"high\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.5\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"high\"\nlabel = \"High\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n"
+    },
+    "grok-build": {
+        "low": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"low\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-build\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"low\"\nlabel = \"Low\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n",
+        "medium": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"medium\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-build\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"medium\"\nlabel = \"Medium\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n",
+        "high": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"high\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-build\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"high\"\nlabel = \"High\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n"
+    }
+};
+export const DAIMON_GROK_CLOCKED_WORKER_CONFIG_BYTES = {
+    "grok-4.6": {
+        "low": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"low\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.6\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"low\"\nlabel = \"Low\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n",
+        "medium": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"medium\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.6\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"medium\"\nlabel = \"Medium\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n",
+        "high": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"high\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.6\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"high\"\nlabel = \"High\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n"
+    },
+    "grok-4.5": {
+        "low": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"low\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.5\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"low\"\nlabel = \"Low\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n",
+        "medium": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"medium\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.5\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"medium\"\nlabel = \"Medium\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n",
+        "high": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"high\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-4.5\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"high\"\nlabel = \"High\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n"
+    },
+    "grok-build": {
+        "low": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"low\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-build\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"low\"\nlabel = \"Low\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n",
+        "medium": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"medium\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-build\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"medium\"\nlabel = \"Medium\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n",
+        "high": "[cli]\nauto_update = false\nuse_leader = false\nshow_tips = false\n\n[features]\ntelemetry = false\ntitle_refresh = false\nsession_recap = false\nturn_summary = false\nrepo_status_in_system_prompt = false\ncodebase_indexing = false\nbackend_tools = false\nask_user_question = false\nimage_gen = false\nvideo_gen = false\nweb_fetch = false\ncampaigns = false\nmanaged_config = false\n\n[managed_mcps]\nenabled = false\n\n[skills]\ndisabled = [\"build-with-ai\", \"code-review\", \"create-skill\", \"create-workflow\", \"design\", \"docx\", \"execute-plan\", \"game-animation-frames\", \"game-asset-core\", \"game-character-consistency\", \"game-tilesets\", \"game-ui-icons\", \"imagine\", \"implement\", \"learn\", \"long-running-background-tasks\", \"pdf\", \"pptx\", \"pr-babysit\", \"resume-claude\", \"resume-codex\", \"resume-cursor\", \"review\", \"skill-design-principles\", \"statusline\"]\n\n[workflows]\nenabled = false\n\n[models]\ndefault = \"daimon-broker-grok\"\ndefault_reasoning_effort = \"high\"\nsession_summary = \"daimon-session-title-disabled\"\n\n[model.daimon-session-title-disabled]\nmodel = \"disabled\"\nbase_url = \"http://127.0.0.1:43123/v1\"\napi_key = \"session-title-disabled\"\nmax_retries = 0\nhidden = true\n\n[model.daimon-broker-grok]\nmodel = \"grok-build\"\nbase_url = \"http://127.0.0.1:43123/v1\"\nenv_key = \"DAIMON_PROVIDER_CAPABILITY\"\napi_backend = \"chat_completions\"\ncontext_window = 131072\nsupports_backend_search = false\nmax_retries = 0\n\n[[model.daimon-broker-grok.reasoning_efforts]]\nvalue = \"high\"\nlabel = \"High\"\ndefault = true\n\n[mcp_servers.daimon]\nurl = \"http://127.0.0.1:43124/mcp\"\nbearer_token_env_var = \"DAIMON_MCP_CAPABILITY\"\n\n[shell_environment_policy]\ninherit=\"all\"\nignore_default_excludes=false\nexclude=[]\ninclude_only=[]\nset={\"LD_PRELOAD\"=\"/usr/local/lib/daimon/libfaketime.so.1\",\"FAKETIME_TIMESTAMP_FILE\"=\"/run/daimon-engine-broker/task-clock/slot-0/faketime\",\"FAKETIME_DONT_FAKE_MONOTONIC\"=\"1\",\"LC_ALL\"=\"C\"}\n"
+    }
+};
+/** Daimon `renderGrokWorkerSandboxProfile(denyPaths)` samples; the Spawnfile mirror must reproduce them byte for byte. */
+export const DAIMON_GROK_WORKER_PROFILE_SAMPLES = [
+    {
+        "bytes": "[profiles.daimon-strict]\nextends = \"strict\"\nrestrict_network = true\ndeny = []\n",
+        "denyPaths": []
+    },
+    {
+        "bytes": "[profiles.daimon-strict]\nextends = \"strict\"\nrestrict_network = true\ndeny = [\"/run/daimon-engine-broker\", \"/var/lib/daimon-workers/2201\", \"/var/lib/spawnfile/daimon/usage\"]\n",
+        "denyPaths": [
+            "/var/lib/spawnfile/daimon/usage",
+            "/run/daimon-engine-broker",
+            "/run/daimon-engine-broker",
+            "/var/lib/daimon-workers/2201"
+        ]
+    }
+];

package/dist/runtime/daimon/grokWorkerContract.d.ts

@@ -0,0 +1,27 @@
+import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "./contractManifest.js";
+export declare const DAIMON_GROK_WORKER_SANDBOX_PROFILE: "daimon-strict";
+export declare const DAIMON_GROK_WORKER_HOME_DIRECTORY: ".grok";
+/**
+ * The worker `config.toml` bytes for one declared model x effort: Daimon's own
+ * renderer output (vendored by `scripts/vendor-daimon-grok-contract.ts`),
+ * refused unless it hashes to the manifest pin the broker attests every turn.
+ */
+export declare const resolveDaimonGrokWorkerConfig: (model: DaimonGrokBrokerModel, reasoningEffort: DaimonGrokBrokerReasoningEffort, vendored?: Readonly<Record<string, Readonly<Record<string, string>>>>) => {
+    bytes: string;
+    sha256: string;
+};
+/** Validate Daimon's slot-zero template before substituting only the canonical slot path. */
+export declare const resolveDaimonGrokClockedWorkerConfig: (model: DaimonGrokBrokerModel, reasoningEffort: DaimonGrokBrokerReasoningEffort, slot: number, vendored?: Readonly<Record<string, Readonly<Record<string, string>>>>) => {
+    bytes: string;
+    sha256: string;
+};
+/**
+ * Byte mirror of Daimon's `renderGrokWorkerSandboxProfile`
+ * (`daimon/src/runtime/grokWorkerSandboxProfile.ts`), pinned to Daimon's own
+ * output by `DAIMON_GROK_WORKER_PROFILE_SAMPLES`. Grok 1.0.34 runs every profile
+ * inside bubblewrap and enforces a non-empty `deny` list; its strict base still
+ * reads all of `/run`, `/var`, `/tmp` and `/etc`, so this list is what keeps
+ * protected paths from the worker.
+ */
+export declare const renderDaimonGrokWorkerSandboxProfile: (denyPaths: readonly string[]) => string;
+export declare const daimonGrokWorkerSandboxProfileSha256: (denyPaths: readonly string[]) => string;

package/dist/runtime/daimon/grokWorkerContract.js

@@ -0,0 +1,60 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { SpawnfileError } from "../../shared/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "./contractManifest.js";
+import { DAIMON_GROK_WORKER_CONFIG_BYTES, DAIMON_GROK_CLOCKED_WORKER_CONFIG_BYTES } from "./grokWorkerConfigBytes.js";
+export const DAIMON_GROK_WORKER_SANDBOX_PROFILE = "daimon-strict";
+export const DAIMON_GROK_WORKER_HOME_DIRECTORY = ".grok";
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+/** Characters TOML or Grok would reinterpret inside a deny entry (mirrors Daimon's refusal set). */
+const UNSAFE_DENY_PATH_CHARACTER = new RegExp("[\"\\\\\\u0000-\\u001f\\u007f*?[\\]]", "u");
+/**
+ * The worker `config.toml` bytes for one declared model x effort: Daimon's own
+ * renderer output (vendored by `scripts/vendor-daimon-grok-contract.ts`),
+ * refused unless it hashes to the manifest pin the broker attests every turn.
+ */
+export const resolveDaimonGrokWorkerConfig = (model, reasoningEffort, vendored = DAIMON_GROK_WORKER_CONFIG_BYTES) => {
+    const pins = DAIMON_GROK_ENGINE_BROKER.worker.configSha256;
+    const pin = pins[model]?.[reasoningEffort];
+    const bytes = vendored[model]?.[reasoningEffort];
+    if (pin === undefined || bytes === undefined || sha256(bytes) !== pin) {
+        throw new SpawnfileError("compile_error", `Vendored Daimon Grok worker config for ${model}/${reasoningEffort} does not match the contract manifest pin; re-vendor the Daimon contract`);
+    }
+    return { bytes, sha256: pin };
+};
+/** Validate Daimon's slot-zero template before substituting only the canonical slot path. */
+export const resolveDaimonGrokClockedWorkerConfig = (model, reasoningEffort, slot, vendored = DAIMON_GROK_CLOCKED_WORKER_CONFIG_BYTES) => {
+    if (!Number.isSafeInteger(slot) || slot < 0)
+        throw new SpawnfileError("compile_error", "Invalid Grok clock slot");
+    const template = vendored[model]?.[reasoningEffort];
+    const pin = DAIMON_GROK_ENGINE_BROKER.worker.clockedConfigSha256[model]?.[reasoningEffort];
+    if (!template || sha256(template) !== pin)
+        throw new SpawnfileError("compile_error", "Clocked worker config does not match the contract manifest pin");
+    const clock = DAIMON_GROK_ENGINE_BROKER.worker.taskClock;
+    const bytes = template.replaceAll(clock.timestampFilePath, clock.slotFilePattern.replace("{slot}", String(slot)));
+    return { bytes, sha256: sha256(bytes) };
+};
+/**
+ * Byte mirror of Daimon's `renderGrokWorkerSandboxProfile`
+ * (`daimon/src/runtime/grokWorkerSandboxProfile.ts`), pinned to Daimon's own
+ * output by `DAIMON_GROK_WORKER_PROFILE_SAMPLES`. Grok 1.0.34 runs every profile
+ * inside bubblewrap and enforces a non-empty `deny` list; its strict base still
+ * reads all of `/run`, `/var`, `/tmp` and `/etc`, so this list is what keeps
+ * protected paths from the worker.
+ */
+export const renderDaimonGrokWorkerSandboxProfile = (denyPaths) => {
+    const denied = [...new Set(denyPaths)].sort();
+    for (const entry of denied) {
+        if (!path.posix.isAbsolute(entry) || path.posix.normalize(entry) !== entry || entry === "/" || entry.endsWith("/") || UNSAFE_DENY_PATH_CHARACTER.test(entry)) {
+            throw new SpawnfileError("compile_error", `Invalid Grok worker sandbox deny path: ${JSON.stringify(entry)}`);
+        }
+    }
+    return [
+        `[profiles.${DAIMON_GROK_WORKER_SANDBOX_PROFILE}]`,
+        'extends = "strict"',
+        "restrict_network = true",
+        `deny = [${denied.map((entry) => JSON.stringify(entry)).join(", ")}]`,
+        ""
+    ].join("\n");
+};
+export const daimonGrokWorkerSandboxProfileSha256 = (denyPaths) => sha256(renderDaimonGrokWorkerSandboxProfile(denyPaths));

package/dist/runtime/daimon/memory.d.ts

@@ -0,0 +1,57 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+import type { CapabilityReport } from "../../report/index.js";
+/**
+ * The instance root every Daimon agent's `workspacePath` and `runtimeHomePath`
+ * resolve under (`resolveInstancePaths` in
+ * `src/compiler/containerTargetPlanResolution.ts`). Daimon's own parser rejects
+ * a `memory.runtimeHomePath` that overlaps either of those, so a declared store
+ * inside this subtree must fail at compile time with a Spawnfile message rather
+ * than as an opaque container-side config parse error.
+ *
+ * Restating the literal here is deliberate — importing the compiler's path
+ * builder into a runtime adapter would invert the dependency direction — so it
+ * is pinned to that authority by `config.test.ts`'s "pins the instance-root
+ * guard to resolveInstancePaths" case, which derives the expected value from
+ * `resolveInstancePaths` and fails if either side drifts.
+ */
+export declare const DAIMON_INSTANCE_STATE_ROOT = "/var/lib/spawnfile/instances";
+export declare const resolveDaimonAgentMemory: (node: ResolvedAgentNode) => {
+    runtimeHomePath: string;
+    source: string;
+} | undefined;
+/**
+ * The compile-time warning for an agent that declared several memory banks.
+ *
+ * `selectDaimonMemoryAccess` is deterministic (lexicographically first key),
+ * and the capability row already reports the outcome as `degraded` — but a
+ * capability row does not say *which* bank won. Declaring a new bank whose key
+ * sorts earlier silently re-points this agent's memory home and orphans the
+ * previously wired bank's data, so the wired and ignored ids are named here,
+ * in the diagnostics an operator reads on every compile. The selection rule
+ * itself is unchanged.
+ */
+export declare const daimonMemorySelectionWarning: (node: ResolvedAgentNode) => string | undefined;
+/**
+ * The compile-time warning for a wired memory bank that asked for vector
+ * recall the Daimon organization runtime cannot provide.
+ *
+ * The memory block Spawnfile lowers into the organization runtime config is
+ * `{runtimeHomePath, source?, tokenBudget?}` and nothing more (see
+ * `resolveDaimonAgentMemory` above and the `memory` schema in daimon's
+ * `organizationRuntimeContract.ts`). Daimon's CLI harness path forwards exactly
+ * those three fields and never sets `memory.embeddingProvider`, so Mneme builds
+ * a lexical-only recall path. Embeddings are optional in Mneme and it falls back
+ * safely, so a fixture declaring `index.vector.enabled: true` still compiles and
+ * still recalls — just not the way it asked to. That silence is the defect: the
+ * declaration is accepted verbatim and quietly means something else.
+ *
+ * This says so at compile time rather than forwarding the configuration,
+ * because forwarding it would mean widening the daimon organization runtime
+ * config contract (and its digest-pinned manifest) plus building an embedding
+ * provider on the daimon side — a much larger change than telling the truth.
+ */
+export declare const daimonMemoryVectorRecallWarning: (node: ResolvedAgentNode) => string | undefined;
+export declare const daimonMemoryCapabilityFor: (node: ResolvedAgentNode) => {
+    memoryMessage?: string;
+    memoryOutcome?: CapabilityReport["outcome"];
+};

package/dist/runtime/daimon/memory.js

@@ -0,0 +1,125 @@
+import { resolveMnemeDurableMemoryMountPath } from "../mnemeMcp.js";
+import { SpawnfileError } from "../../shared/index.js";
+/**
+ * Daimon's organization runtime accepts exactly one `memory` block per agent
+ * (`OrganizationRuntimeMemory` = `{ runtimeHomePath, source?, tokenBudget? }`),
+ * so lowering picks one declared bank deterministically, the same way the
+ * legacy generated-Pi emitter does in `../pi/appAgentConfig.ts`.
+ */
+const memoryAccessKey = (access) => `${access.source}:${access.bank.id}`;
+const selectDaimonMemoryAccess = (node) => [...(node.memoryAccess ?? [])].sort((left, right) => memoryAccessKey(left).localeCompare(memoryAccessKey(right)))[0];
+/**
+ * The instance root every Daimon agent's `workspacePath` and `runtimeHomePath`
+ * resolve under (`resolveInstancePaths` in
+ * `src/compiler/containerTargetPlanResolution.ts`). Daimon's own parser rejects
+ * a `memory.runtimeHomePath` that overlaps either of those, so a declared store
+ * inside this subtree must fail at compile time with a Spawnfile message rather
+ * than as an opaque container-side config parse error.
+ *
+ * Restating the literal here is deliberate — importing the compiler's path
+ * builder into a runtime adapter would invert the dependency direction — so it
+ * is pinned to that authority by `config.test.ts`'s "pins the instance-root
+ * guard to resolveInstancePaths" case, which derives the expected value from
+ * `resolveInstancePaths` and fails if either side drifts.
+ */
+export const DAIMON_INSTANCE_STATE_ROOT = "/var/lib/spawnfile/instances";
+export const resolveDaimonAgentMemory = (node) => {
+    const access = selectDaimonMemoryAccess(node);
+    if (!access)
+        return undefined;
+    const runtimeHomePath = resolveMnemeDurableMemoryMountPath(access.bank);
+    if (runtimeHomePath === null)
+        return undefined;
+    if (runtimeHomePath === DAIMON_INSTANCE_STATE_ROOT ||
+        runtimeHomePath.startsWith(`${DAIMON_INSTANCE_STATE_ROOT}/`) ||
+        DAIMON_INSTANCE_STATE_ROOT.startsWith(`${runtimeHomePath}/`)) {
+        throw new SpawnfileError("validation_error", `Daimon memory bank ${access.bank.id} resolves to ${runtimeHomePath}, which overlaps the Daimon instance state root ${DAIMON_INSTANCE_STATE_ROOT}; declare the store outside it`);
+    }
+    return {
+        runtimeHomePath,
+        source: `spawnfile:${access.declaringKind}:${access.bank.id}`
+    };
+};
+/**
+ * The compile-time warning for an agent that declared several memory banks.
+ *
+ * `selectDaimonMemoryAccess` is deterministic (lexicographically first key),
+ * and the capability row already reports the outcome as `degraded` — but a
+ * capability row does not say *which* bank won. Declaring a new bank whose key
+ * sorts earlier silently re-points this agent's memory home and orphans the
+ * previously wired bank's data, so the wired and ignored ids are named here,
+ * in the diagnostics an operator reads on every compile. The selection rule
+ * itself is unchanged.
+ */
+export const daimonMemorySelectionWarning = (node) => {
+    const accesses = node.memoryAccess ?? [];
+    const selected = selectDaimonMemoryAccess(node);
+    if (!selected)
+        return undefined;
+    const selectedKey = memoryAccessKey(selected);
+    const ignored = [...new Set(accesses
+            .filter((access) => memoryAccessKey(access) !== selectedKey)
+            .map((access) => access.bank.id))].sort();
+    if (ignored.length === 0)
+        return undefined;
+    return `Daimon organization runtime v1 lowers one memory bank per agent: ${node.name} wires memory bank ${selected.bank.id} and ignores ${ignored.join(", ")}. The wired bank is the lexicographically first declared one, so adding a bank that sorts earlier re-points this agent's memory home and orphans ${selected.bank.id}'s data.`;
+};
+/**
+ * The compile-time warning for a wired memory bank that asked for vector
+ * recall the Daimon organization runtime cannot provide.
+ *
+ * The memory block Spawnfile lowers into the organization runtime config is
+ * `{runtimeHomePath, source?, tokenBudget?}` and nothing more (see
+ * `resolveDaimonAgentMemory` above and the `memory` schema in daimon's
+ * `organizationRuntimeContract.ts`). Daimon's CLI harness path forwards exactly
+ * those three fields and never sets `memory.embeddingProvider`, so Mneme builds
+ * a lexical-only recall path. Embeddings are optional in Mneme and it falls back
+ * safely, so a fixture declaring `index.vector.enabled: true` still compiles and
+ * still recalls — just not the way it asked to. That silence is the defect: the
+ * declaration is accepted verbatim and quietly means something else.
+ *
+ * This says so at compile time rather than forwarding the configuration,
+ * because forwarding it would mean widening the daimon organization runtime
+ * config contract (and its digest-pinned manifest) plus building an embedding
+ * provider on the daimon side — a much larger change than telling the truth.
+ */
+export const daimonMemoryVectorRecallWarning = (node) => {
+    const access = selectDaimonMemoryAccess(node);
+    if (!access || !resolveDaimonAgentMemory(node))
+        return undefined;
+    const vector = access.bank.index?.vector;
+    if (!vector?.enabled)
+        return undefined;
+    return `Daimon organization runtime v1 has no vector recall: memory bank ${access.bank.id} declares `
+        + `index.vector.enabled with model ${vector.model ?? "(unset)"}, but the runtime memory contract carries `
+        + "no embedding configuration, so recall for this agent is lexical only. Declare index.vector on a "
+        + "runtime that lowers it, or drop it from this bank so the declaration matches the behavior.";
+};
+export const daimonMemoryCapabilityFor = (node) => {
+    const access = selectDaimonMemoryAccess(node);
+    if (!access)
+        return {};
+    const memory = resolveDaimonAgentMemory(node);
+    if (!memory) {
+        return {
+            memoryMessage: `Daimon organization runtime v1 lowers only durably mounted file-backed Mneme banks; memory bank ${access.bank.id} (store ${access.bank.store.kind}) has no durable container volume, so no memory block is emitted`,
+            memoryOutcome: "degraded"
+        };
+    }
+    const declaredKeys = new Set((node.memoryAccess ?? []).map(memoryAccessKey));
+    declaredKeys.delete(memoryAccessKey(access));
+    if (declaredKeys.size > 0) {
+        return {
+            memoryMessage: `Daimon organization runtime v1 lowers one memory bank per agent; ${access.bank.id} is wired at ${memory.runtimeHomePath} and ${declaredKeys.size} further declared bank(s) are not lowered`,
+            memoryOutcome: "degraded"
+        };
+    }
+    const vectorWarning = daimonMemoryVectorRecallWarning(node);
+    if (vectorWarning) {
+        return { memoryMessage: vectorWarning, memoryOutcome: "degraded" };
+    }
+    return {
+        memoryMessage: `Daimon lowers Mneme memory bank ${access.bank.id} into the organization runtime agent config at ${memory.runtimeHomePath}`,
+        memoryOutcome: "supported"
+    };
+};

package/dist/runtime/daimon/recording.d.ts

@@ -0,0 +1,19 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+import type { ContainerTargetInput } from "../types.js";
+export interface DaimonAgentRecording {
+    directory: string;
+    keepMs: number;
+    snapshots: Array<{
+        id: string;
+        path: string;
+    }>;
+}
+export declare const daimonRecordingDirectory: (slug: string) => string;
+export declare const DAIMON_RECORDING_MOUNT_ID_PREFIX = "daimon-recording-";
+export declare const daimonRecordingMountId: (slug: string) => string;
+/** Snapshot paths share the container resource placement authority, never workspace links. */
+export declare const resolveDaimonAgentRecording: (input: ContainerTargetInput & {
+    value: ResolvedAgentNode;
+}, targetId: string, agentCount: number) => DaimonAgentRecording | undefined;
+/** Generated workspaces/homes live under instances; sources under resources; stores must remain separate. */
+export declare const assertDaimonRecordingIsolation: (recordings: Array<DaimonAgentRecording | undefined>, instanceRoot: string) => void;

package/dist/runtime/daimon/recording.js

@@ -0,0 +1,50 @@
+import path from "node:path";
+// The public plan barrel also loads buildCompilePlan -> runtime registry. Keep
+// the adapter on its pure resolver to avoid cycling through its own registration.
+import { resolveTrainingRecordVolumes } from "../../compiler/training/plan/references.js";
+import { toWorkspaceResourcePlan, workspaceResourceTargetId } from "../../compiler/workspaceResources.js";
+import { recordingKeepMs, SpawnfileError } from "../../shared/index.js";
+import { DAIMON_WAKE_MOMENTS } from "./wakeMoments.js";
+export const daimonRecordingDirectory = (slug) => {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(slug)) {
+        throw new SpawnfileError("validation_error", `Daimon recording requires a nonempty safe agent slug: ${slug}`);
+    }
+    return `/var/lib/spawnfile/recording/${slug}`;
+};
+export const DAIMON_RECORDING_MOUNT_ID_PREFIX = "daimon-recording-";
+export const daimonRecordingMountId = (slug) => `${DAIMON_RECORDING_MOUNT_ID_PREFIX}${slug}`;
+/** Snapshot paths share the container resource placement authority, never workspace links. */
+export const resolveDaimonAgentRecording = (input, targetId, agentCount) => {
+    const keepMs = recordingKeepMs(input.value.training?.record);
+    if (keepMs === undefined)
+        return undefined;
+    const snapshots = resolveTrainingRecordVolumes(input).map((resource) => ({
+        id: resource.id,
+        path: toWorkspaceResourcePlan(resource, {
+            targetId: workspaceResourceTargetId(targetId, input.id, agentCount),
+            workspacePath: `<workspace-path>/agents/${input.slug}`
+        }).backingPath
+    }));
+    if (snapshots.length > DAIMON_WAKE_MOMENTS.maxSnapshotRoots) {
+        throw new SpawnfileError("validation_error", `Daimon recording for ${input.id} supports at most ${DAIMON_WAKE_MOMENTS.maxSnapshotRoots} snapshot roots`);
+    }
+    for (const snapshot of snapshots) {
+        if (!/^[A-Za-z0-9._-]{1,128}$/u.test(snapshot.id) || snapshot.path.length > 4096) {
+            throw new SpawnfileError("validation_error", `Daimon recording snapshot ${snapshot.id} for ${input.id} exceeds the runtime id or path bounds`);
+        }
+    }
+    return { directory: daimonRecordingDirectory(input.slug), keepMs, snapshots };
+};
+const overlaps = (left, right) => left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
+/** Generated workspaces/homes live under instances; sources under resources; stores must remain separate. */
+export const assertDaimonRecordingIsolation = (recordings, instanceRoot) => {
+    for (const [index, recording] of recordings.entries()) {
+        if (!recording)
+            continue;
+        const conflicting = [instanceRoot, ...recordings.flatMap((peer, peerIndex) => peer
+                ? [...(peerIndex === index ? [] : [peer.directory]), ...peer.snapshots.map((snapshot) => snapshot.path)] : [])];
+        if (recording.directory.length > 4096 || conflicting.some((root) => overlaps(path.posix.normalize(root), recording.directory))) {
+            throw new SpawnfileError("validation_error", `Daimon recording store ${recording.directory} overlaps a runtime or snapshot root or another recording store`);
+        }
+    }
+};

package/dist/runtime/daimon/runAuth.d.ts

@@ -0,0 +1,51 @@
+import type { ResolvedAuthProfile } from "../../auth/index.js";
+import type { RuntimeAuthPreparationInput, RuntimeAuthPreparationResult } from "../types.js";
+export declare const DAIMON_GROK_ACCESS_TOKEN_MIN_BYTES = 32;
+export declare const DAIMON_GROK_REFRESH_TOKEN_MIN_BYTES = 16;
+export declare const DAIMON_AGY_UNLOCK_SOURCE_ENV = "SPAWNFILE_DAIMON_SOURCE_AGY_UNLOCK_SECRET";
+export declare const daimonSourceEnvironmentName: (slot: string) => string;
+export declare const daimonSourcePathForEngine: (engine: "codex" | "grok", environment?: Record<string, string | undefined>, authProfile?: ResolvedAuthProfile | null) => string;
+/**
+ * The uid a bind-mounted Daimon credential must be owned by on the host.
+ *
+ * Daimon compares the file's owner against its own `process.getuid()` inside
+ * the container, the container runs as {@link DAIMON_ORGANIZATION_UID}, and a
+ * read-only bind mount carries the host uid through unchanged, so the two are
+ * the same number. See `runtimeIdentity.ts` for the full chain.
+ */
+export declare const DAIMON_CREDENTIAL_CONTAINER_UID = 2000;
+export interface DaimonSourceFileFacts {
+    isFile: boolean;
+    isSymbolicLink: boolean;
+    mode: number;
+    nlink: number;
+    size: number;
+    uid: number;
+}
+/**
+ * The host-side safety gate, isolated from `lstat` so every branch is directly
+ * exercisable. A credential the deploying process does not own is material it
+ * cannot vouch for, and a root deploy (`callerUid <= 0`) is refused outright
+ * so a privileged process never launders someone else's credential into a
+ * container.
+ */
+export declare const isUnsafeDaimonSourceFile: (entry: DaimonSourceFileFacts, callerUid: number | undefined, maxBytes: number) => boolean;
+/**
+ * Refuses, at deploy time, a credential whose owner is not the uid the
+ * container will demand.
+ *
+ * Without this the host gate above and Daimon's in-container gate impose two
+ * uncoordinated uid requirements on the same file: the host one passes for any
+ * non-root deploying account, and the container one then fails at readiness
+ * with an opaque "credential materialization failed" inside a candidate that
+ * lives ~15 seconds. Naming both numbers here turns that into a refusal the
+ * operator can act on.
+ */
+export declare const assertDaimonCredentialContainerOwner: (observedUid: number, label: string, requiredUid?: number) => void;
+export declare const assertSafeDaimonSourceFile: (sourcePath: string, label: string, maxBytes?: number, portableKind?: "codex" | "grok") => Promise<number>;
+/**
+ * Binds Codex leaves per agent and one Grok bootstrap leaf per organization.
+ * Every leaf is validated from a stable descriptor and mounted read-only;
+ * Daimon alone owns writable credential state and refresh reconciliation.
+ */
+export declare const prepareDaimonRuntimeAuth: (input: RuntimeAuthPreparationInput) => Promise<RuntimeAuthPreparationResult>;