spawnfile 0.1.14 → 0.1.18

package/dist/runtime/daimon/runAuth.js

@@ -0,0 +1,279 @@
+import os from "node:os";
+import path from "node:path";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, readFile } from "node:fs/promises";
+import { SpawnfileError } from "../../shared/index.js";
+import { DAIMON_AGY_SUBSCRIPTION_REALM, assertDaimonRuntimeHome, DAIMON_ENGINE_CREDENTIALS, DAIMON_ENGINE_KINDS, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_ORGANIZATION_RUNTIME_CONFIG_VERSIONS } from "./contractManifest.js";
+import { DAIMON_ORGANIZATION_UID } from "./runtimeIdentity.js";
+const MAX_OPAQUE_CREDENTIAL_BYTES = 64 * 1024;
+export const DAIMON_GROK_ACCESS_TOKEN_MIN_BYTES = 32;
+export const DAIMON_GROK_REFRESH_TOKEN_MIN_BYTES = 16;
+export const DAIMON_AGY_UNLOCK_SOURCE_ENV = "SPAWNFILE_DAIMON_SOURCE_AGY_UNLOCK_SECRET";
+const fail = (message) => {
+    throw new SpawnfileError("validation_error", `Daimon runtime auth ${message}`);
+};
+export const daimonSourceEnvironmentName = (slot) => `SPAWNFILE_DAIMON_SOURCE_${slot.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase()}`;
+export const daimonSourcePathForEngine = (engine, environment = process.env, authProfile = null) => {
+    const declaredSource = environment[daimonSourceEnvironmentName(engine === "grok"
+        ? DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapSourceSlot
+        : DAIMON_ENGINE_CREDENTIALS.codex.sourceSlot)]?.trim();
+    if (declaredSource)
+        return declaredSource;
+    if (engine === "codex" && authProfile) {
+        const imported = authProfile.imports.codex;
+        return path.join(imported?.path ?? fail("selected auth profile has no imported codex credential"), "auth.json");
+    }
+    const home = os.homedir();
+    switch (engine) {
+        case "codex":
+            return path.join(process.env.CODEX_HOME || path.join(home, ".codex"), "auth.json");
+        case "grok":
+            return path.join(process.env.GROK_HOME || path.join(home, ".grok"), "auth.json");
+    }
+};
+const sourceFileIdentity = (entry) => [entry.dev, entry.ino, entry.size, entry.mtimeMs, entry.uid, entry.mode, entry.nlink].join(":");
+/**
+ * The uid a bind-mounted Daimon credential must be owned by on the host.
+ *
+ * Daimon compares the file's owner against its own `process.getuid()` inside
+ * the container, the container runs as {@link DAIMON_ORGANIZATION_UID}, and a
+ * read-only bind mount carries the host uid through unchanged, so the two are
+ * the same number. See `runtimeIdentity.ts` for the full chain.
+ */
+export const DAIMON_CREDENTIAL_CONTAINER_UID = DAIMON_ORGANIZATION_UID;
+/**
+ * The host-side safety gate, isolated from `lstat` so every branch is directly
+ * exercisable. A credential the deploying process does not own is material it
+ * cannot vouch for, and a root deploy (`callerUid <= 0`) is refused outright
+ * so a privileged process never launders someone else's credential into a
+ * container.
+ */
+export const isUnsafeDaimonSourceFile = (entry, callerUid, maxBytes) => !entry.isFile ||
+    entry.isSymbolicLink ||
+    entry.size === 0 ||
+    entry.size > maxBytes ||
+    entry.nlink !== 1 ||
+    (entry.mode & 0o777) !== 0o600 ||
+    typeof callerUid !== "number" ||
+    callerUid <= 0 ||
+    entry.uid !== callerUid;
+/**
+ * Refuses, at deploy time, a credential whose owner is not the uid the
+ * container will demand.
+ *
+ * Without this the host gate above and Daimon's in-container gate impose two
+ * uncoordinated uid requirements on the same file: the host one passes for any
+ * non-root deploying account, and the container one then fails at readiness
+ * with an opaque "credential materialization failed" inside a candidate that
+ * lives ~15 seconds. Naming both numbers here turns that into a refusal the
+ * operator can act on.
+ */
+export const assertDaimonCredentialContainerOwner = (observedUid, label, requiredUid = DAIMON_CREDENTIAL_CONTAINER_UID) => {
+    if (observedUid === requiredUid)
+        return;
+    fail(`selected ${label} artifact is owned by uid ${observedUid} but the Daimon container reads it as uid ` +
+        `${requiredUid}; the credential is bind-mounted read-only and keeps its host owner, so deploy from an ` +
+        `account whose uid is exactly ${requiredUid} (for example \`usermod -u ${requiredUid} <deploy-user>\` ` +
+        `followed by \`chown -R ${requiredUid} <deploy-home>\`) instead of uid ${observedUid}`);
+};
+export const assertSafeDaimonSourceFile = async (sourcePath, label, maxBytes = MAX_OPAQUE_CREDENTIAL_BYTES, portableKind) => {
+    let entry;
+    try {
+        entry = await lstat(sourcePath);
+    }
+    catch {
+        return fail(`is missing the selected ${label} artifact`);
+    }
+    const callerUid = process.getuid?.();
+    if (isUnsafeDaimonSourceFile({
+        isFile: entry.isFile(),
+        isSymbolicLink: entry.isSymbolicLink(),
+        mode: entry.mode,
+        nlink: entry.nlink,
+        size: entry.size,
+        uid: entry.uid
+    }, callerUid, maxBytes) || typeof callerUid !== "number") {
+        return fail(`selected ${label} artifact must be one bounded caller-owned 0600 regular file`);
+    }
+    if (portableKind !== undefined) {
+        let handle;
+        let bytes;
+        try {
+            handle = await open(sourcePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = await handle.stat();
+            if (sourceFileIdentity(opened) !== sourceFileIdentity(entry)) {
+                return fail(`selected ${label} artifact changed during validation`);
+            }
+            bytes = await handle.readFile();
+            const after = await handle.stat();
+            if (sourceFileIdentity(after) !== sourceFileIdentity(opened)) {
+                return fail(`selected ${label} artifact changed during validation`);
+            }
+            if (!hasRefreshableCredential(portableKind, bytes)) {
+                return fail(`selected ${label} artifact is not a refreshable subscription credential`);
+            }
+        }
+        catch (error) {
+            if (error instanceof SpawnfileError)
+                throw error;
+            return fail(`selected ${label} artifact could not be validated`);
+        }
+        finally {
+            bytes?.fill(0);
+            await handle?.close().catch(() => undefined);
+        }
+    }
+    return callerUid;
+};
+const hasRefreshableCredential = (kind, bytes) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    const root = parsed;
+    const source = kind === "codex"
+        ? ((root.tokens && typeof root.tokens === "object" && !Array.isArray(root.tokens)) ? root.tokens : root)
+        : Object.entries(root).find(([key, value]) => /^https:\/\/auth\.x\.ai::/u.test(key) && value && typeof value === "object" && !Array.isArray(value))?.[1];
+    if (!source)
+        return false;
+    const access = kind === "grok" ? source.key : source.access_token ?? source.accessToken ?? source.token;
+    const refresh = kind === "grok" ? source.refresh_token : source.refresh_token ?? source.refreshToken;
+    if (typeof access !== "string" || !access.trim() || typeof refresh !== "string" || !refresh.trim())
+        return false;
+    if (kind === "grok" && (access.length < DAIMON_GROK_ACCESS_TOKEN_MIN_BYTES
+        || refresh.length < DAIMON_GROK_REFRESH_TOKEN_MIN_BYTES))
+        return false;
+    return kind !== "grok" || (typeof source.expires_at === "string" && Number.isFinite(Date.parse(source.expires_at)));
+};
+const assertContainedPath = (root, candidate) => {
+    const normalizedRoot = path.resolve(root);
+    const normalizedCandidate = path.resolve(candidate);
+    const relative = path.relative(normalizedRoot, normalizedCandidate);
+    if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return fail("attempted to stage outside its ephemeral support root");
+    }
+    return normalizedCandidate;
+};
+const configPathInOutput = (input) => {
+    if (!input.instance.config_path.startsWith("/"))
+        fail("has a non-absolute generated config path");
+    return assertContainedPath(path.join(input.outputDirectory, "container", "rootfs"), path.join(input.outputDirectory, "container", "rootfs", `.${input.instance.config_path}`));
+};
+const parseConfigAgents = (source) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        return fail("generated organization config is not JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        fail("generated organization config has an invalid shape");
+    const root = parsed;
+    if (!DAIMON_ORGANIZATION_RUNTIME_CONFIG_VERSIONS.includes(root.version) || !Array.isArray(root.agents))
+        fail("generated organization config is not a supported v1/v2 contract");
+    const rawAgents = root.agents;
+    const seenHomes = new Set();
+    const agents = [];
+    for (const value of rawAgents) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            fail("generated organization config has an invalid agent");
+        const agent = value;
+        const engine = agent.engine;
+        const engineKind = engine && typeof engine === "object" && !Array.isArray(engine)
+            ? engine.kind
+            : undefined;
+        if (typeof agent.id !== "string" || !agent.id || typeof agent.runtimeHomePath !== "string"
+            || typeof engineKind !== "string"
+            || !DAIMON_ENGINE_KINDS.includes(engineKind)) {
+            fail("generated organization config has an invalid agent credential target");
+        }
+        const agentId = agent.id;
+        const runtimeHomePath = assertDaimonRuntimeHome(agent.runtimeHomePath);
+        if (seenHomes.has(runtimeHomePath))
+            fail("generated organization config has overlapping runtime homes");
+        seenHomes.add(runtimeHomePath);
+        agents.push({
+            engine: { kind: engineKind },
+            id: agentId,
+            runtimeHomePath
+        });
+    }
+    return agents.sort((left, right) => left.id.localeCompare(right.id));
+};
+const resolveCredentialSource = (agent, authProfile) => daimonSourcePathForEngine(agent.engine.kind, process.env, authProfile);
+const prepareNeutralIngress = async (outputDirectory, agent) => {
+    const rootfs = path.join(outputDirectory, "container", "rootfs");
+    const runtimeHome = assertContainedPath(rootfs, path.join(rootfs, `.${agent.runtimeHomePath}`));
+    const inbound = assertContainedPath(runtimeHome, path.join(runtimeHome, path.posix.dirname(DAIMON_ENGINE_CREDENTIALS[agent.engine.kind].sourceRelativePath)));
+    await mkdir(runtimeHome, { mode: 0o700, recursive: true });
+    await chmod(runtimeHome, 0o700);
+    await mkdir(inbound, { mode: 0o700, recursive: true });
+    await chmod(inbound, 0o700);
+    return path.posix.join(agent.runtimeHomePath, DAIMON_ENGINE_CREDENTIALS[agent.engine.kind].sourceRelativePath);
+};
+/**
+ * Binds Codex leaves per agent and one Grok bootstrap leaf per organization.
+ * Every leaf is validated from a stable descriptor and mounted read-only;
+ * Daimon alone owns writable credential state and refresh reconciliation.
+ */
+export const prepareDaimonRuntimeAuth = async (input) => {
+    const containerCredentialUid = input.containerCredentialUid ?? DAIMON_CREDENTIAL_CONTAINER_UID;
+    const allowedSourceEnvironments = new Set([
+        ...Object.values(DAIMON_ENGINE_CREDENTIALS).map((credential) => daimonSourceEnvironmentName(credential.sourceSlot)),
+        daimonSourceEnvironmentName(DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapSourceSlot),
+        DAIMON_AGY_UNLOCK_SOURCE_ENV
+    ]);
+    for (const name of Object.keys(process.env)) {
+        if (name.startsWith("SPAWNFILE_DAIMON_SOURCE_") && !allowedSourceEnvironments.has(name)) {
+            return fail(`source slot environment ${name} is not declared by the consumed manifest`);
+        }
+    }
+    const configPath = configPathInOutput(input);
+    let configSource;
+    try {
+        configSource = await readFile(configPath, "utf8");
+    }
+    catch {
+        return fail("could not read its generated organization config");
+    }
+    const agents = parseConfigAgents(configSource);
+    const mountArgs = [];
+    for (const agent of agents) {
+        if (agent.engine.kind !== "codex")
+            continue;
+        const portableAgent = agent;
+        const sourcePath = resolveCredentialSource(portableAgent, input.authProfile);
+        const ingressPath = await prepareNeutralIngress(input.outputDirectory, portableAgent);
+        const ownerUid = await assertSafeDaimonSourceFile(sourcePath, agent.engine.kind, MAX_OPAQUE_CREDENTIAL_BYTES, "codex");
+        assertDaimonCredentialContainerOwner(ownerUid, agent.engine.kind, containerCredentialUid);
+        mountArgs.push("-v", `${sourcePath}:${ingressPath}:ro`);
+    }
+    // No container-owner assertion for the Grok bootstrap leaf: unlike the Codex
+    // credential and the AGY unlock secret, nothing in the organization runtime
+    // process reads it. The live Grok path goes through the engine broker, which
+    // runs under its own uid and reads only its durable realm, so pinning this
+    // leaf to the organization uid would refuse deployments that work today.
+    if (agents.some((agent) => agent.engine.kind === "grok")) {
+        const sourcePath = daimonSourcePathForEngine("grok");
+        await assertSafeDaimonSourceFile(sourcePath, "grok", DAIMON_GROK_SUBSCRIPTION_REALM.maxCredentialBytes, "grok");
+        mountArgs.push("-v", `${sourcePath}:${DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath}:ro`);
+    }
+    if (agents.some((agent) => agent.engine.kind === "agy")) {
+        const source = process.env[DAIMON_AGY_UNLOCK_SOURCE_ENV]?.trim();
+        if (!source)
+            return fail("is missing the operator-authorized AGY realm unlock artifact");
+        const ownerUid = await assertSafeDaimonSourceFile(source, "AGY realm unlock", DAIMON_AGY_SUBSCRIPTION_REALM.maxUnlockBytes);
+        assertDaimonCredentialContainerOwner(ownerUid, "AGY realm unlock", containerCredentialUid);
+        mountArgs.push("-v", `${source}:${DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath}:ro`);
+    }
+    return {
+        coveredModelSecrets: [],
+        mountArgs
+    };
+};

package/dist/runtime/daimon/runtimeIdentity.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The fixed container-side uids a compiled Daimon image runs under.
+ *
+ * These are compiler-wide constants, not per-organization values: the rendered
+ * Daimon entrypoint pins `uid=DAIMON_ORGANIZATION_UID` and drops to it through
+ * `setpriv --reuid`, so every organization's Daimon runtime process shares the
+ * same uid. The engine broker and its Grok workers run under their own fixed
+ * uids alongside it.
+ *
+ * Why the deploy path cares: Daimon's own credential guards compare a
+ * credential file's owner against `process.getuid()` *inside* the container
+ * (`portableCredentialMaterial.ts` for Codex, `agySubscriptionRealm.ts` for the
+ * AGY unlock secret). Spawnfile bind-mounts those files read-only from the
+ * host, the daemon applies no user-namespace remapping, and the credential
+ * leaves are declared opaque so the entrypoint ownership guard never chowns
+ * them. A host file therefore keeps its host uid inside the container, which
+ * makes "owned by DAIMON_ORGANIZATION_UID" a host-side deployment requirement
+ * rather than something the container can repair.
+ */
+export declare const DAIMON_ORGANIZATION_UID = 2000;
+export declare const DAIMON_BROKER_UID = 2100;
+export declare const DAIMON_FIRST_WORKER_UID = 2200;

package/dist/runtime/daimon/runtimeIdentity.js

@@ -0,0 +1,22 @@
+/**
+ * The fixed container-side uids a compiled Daimon image runs under.
+ *
+ * These are compiler-wide constants, not per-organization values: the rendered
+ * Daimon entrypoint pins `uid=DAIMON_ORGANIZATION_UID` and drops to it through
+ * `setpriv --reuid`, so every organization's Daimon runtime process shares the
+ * same uid. The engine broker and its Grok workers run under their own fixed
+ * uids alongside it.
+ *
+ * Why the deploy path cares: Daimon's own credential guards compare a
+ * credential file's owner against `process.getuid()` *inside* the container
+ * (`portableCredentialMaterial.ts` for Codex, `agySubscriptionRealm.ts` for the
+ * AGY unlock secret). Spawnfile bind-mounts those files read-only from the
+ * host, the daemon applies no user-namespace remapping, and the credential
+ * leaves are declared opaque so the entrypoint ownership guard never chowns
+ * them. A host file therefore keeps its host uid inside the container, which
+ * makes "owned by DAIMON_ORGANIZATION_UID" a host-side deployment requirement
+ * rather than something the container can repair.
+ */
+export const DAIMON_ORGANIZATION_UID = 2_000;
+export const DAIMON_BROKER_UID = 2_100;
+export const DAIMON_FIRST_WORKER_UID = 2_200;

package/dist/runtime/daimon/scheduleAuthority.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when the image the build will select attests the compiler's exact
+ * contract manifest (organization runtime v2): either the explicit local
+ * development identity, or the published registry pin with a digest, its
+ * per-architecture capability receipts and a matching contract manifest.
+ * The published receipts embed that manifest digest; the generated image
+ * re-checks the receipt it copies, so the pin is the attestation.
+ */
+export declare const hasDaimonScheduleAuthority: () => Promise<boolean>;
+/** Schedule lowering is allowed only when the selected image receipt binds v2. */
+export declare const assertDaimonScheduleAuthority: () => Promise<void>;

package/dist/runtime/daimon/scheduleAuthority.js

@@ -0,0 +1,31 @@
+import { SpawnfileError } from "../../shared/index.js";
+import { DAIMON_LOCAL_RUNTIME_IDENTITY_ENV, loadLocalDaimonRuntimeIdentity } from "../localDaimonAuthority.js";
+import { DAIMON_CONTRACT_MANIFEST_SHA256 } from "./contractManifest.js";
+/**
+ * True when the image the build will select attests the compiler's exact
+ * contract manifest (organization runtime v2): either the explicit local
+ * development identity, or the published registry pin with a digest, its
+ * per-architecture capability receipts and a matching contract manifest.
+ * The published receipts embed that manifest digest; the generated image
+ * re-checks the receipt it copies, so the pin is the attestation.
+ */
+export const hasDaimonScheduleAuthority = async () => {
+    const identityPath = process.env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
+    if (identityPath) {
+        return (await loadLocalDaimonRuntimeIdentity(identityPath)).manifestSha256 ===
+            DAIMON_CONTRACT_MANIFEST_SHA256;
+    }
+    // Lazy: install.js -> registry.js -> this adapter would otherwise form an import cycle.
+    const { resolveRuntimeInstallSelection } = await import("../install.js");
+    const selection = await resolveRuntimeInstallSelection("daimon");
+    return selection.kind === "container_image" &&
+        Boolean(selection.digest) &&
+        Boolean(selection.capabilityReceipt || selection.capabilityReceipts) &&
+        selection.contractManifestSha256 === DAIMON_CONTRACT_MANIFEST_SHA256;
+};
+/** Schedule lowering is allowed only when the selected image receipt binds v2. */
+export const assertDaimonScheduleAuthority = async () => {
+    if (!await hasDaimonScheduleAuthority()) {
+        throw new SpawnfileError("runtime_error", "Daimon schedules are disabled: the selected image capability receipt does not attest organization runtime v2");
+    }
+};

package/dist/runtime/daimon/wakeMoments.d.ts

@@ -0,0 +1,15 @@
+/** Exact data-only wake recording contract advertised by Daimon's image receipt. */
+export declare const DAIMON_WAKE_MOMENTS: {
+    readonly version: "noopolis.daimon.wake-moment.v1";
+    readonly rowsFile: "wake-moments.jsonl";
+    readonly snapshotsDirectory: "snapshots";
+    readonly completionSuffix: ".complete";
+    readonly maxSnapshotRoots: 16;
+    readonly maxSnapshotEntries: 200000;
+    readonly maxRowBytes: 4194304;
+    readonly maxManifestBytes: 134217728;
+    readonly captureDeadlineMs: 60000;
+    readonly finalizationDeadlineMs: 1000;
+    readonly configField: "agents[].recording";
+};
+export declare const isDaimonWakeMoments: (value: unknown) => value is typeof DAIMON_WAKE_MOMENTS;

package/dist/runtime/daimon/wakeMoments.js

@@ -0,0 +1,17 @@
+/** Exact data-only wake recording contract advertised by Daimon's image receipt. */
+export const DAIMON_WAKE_MOMENTS = {
+    version: "noopolis.daimon.wake-moment.v1",
+    rowsFile: "wake-moments.jsonl",
+    snapshotsDirectory: "snapshots",
+    completionSuffix: ".complete",
+    maxSnapshotRoots: 16,
+    maxSnapshotEntries: 200_000,
+    maxRowBytes: 4_194_304,
+    maxManifestBytes: 134_217_728,
+    captureDeadlineMs: 60_000,
+    finalizationDeadlineMs: 1_000,
+    configField: "agents[].recording"
+};
+export const isDaimonWakeMoments = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    && Object.keys(value).length === Object.keys(DAIMON_WAKE_MOMENTS).length
+    && Object.entries(DAIMON_WAKE_MOMENTS).every(([key, expected]) => Object.hasOwn(value, key) && value[key] === expected);

package/dist/runtime/daimonInstall.d.ts

@@ -0,0 +1,3 @@
+import type { DaimonCapabilityReceipts } from "./registry.js";
+/** Shared install verification and launchers for organization and training images. */
+export declare const createDaimonInstallCommands: (installRoot: string, capabilityReceipt: string | DaimonCapabilityReceipts) => string[];

package/dist/runtime/daimonInstall.js

@@ -0,0 +1,25 @@
+import { DAIMON_CONTRACT_MANIFEST_SHA256, DAIMON_GROK_ENGINE_BROKER } from "./daimon/contractManifest.js";
+/**
+ * A published multi-architecture Daimon index embeds a different receipt per
+ * platform (the packaged broker and pinned CLIs are per-architecture), so the
+ * generated image checks the receipt pinned for the architecture it builds.
+ */
+const createDaimonReceiptCheck = (receiptPath, receipt) => {
+    const actual = `test -f ${receiptPath} && actual="$(sha256sum ${receiptPath} | awk '{print "sha256:" $1}')"`;
+    if (typeof receipt === "string")
+        return `${actual} && test "$actual" = ${JSON.stringify(receipt)}`;
+    const cases = Object.entries(receipt)
+        .map(([architecture, digest]) => `${architecture}) expected=${JSON.stringify(digest)} ;;`)
+        .join(" ");
+    return `${actual} && arch="$(dpkg --print-architecture)" && case "$arch" in ${cases} *) echo "No pinned Daimon capability receipt for $arch" >&2; exit 1 ;; esac && test "$actual" = "$expected"`;
+};
+/** Shared install verification and launchers for organization and training images. */
+export const createDaimonInstallCommands = (installRoot, capabilityReceipt) => [
+    createDaimonReceiptCheck(`${installRoot}/capability-receipt.json`, capabilityReceipt),
+    `test -f ${installRoot}/contract-manifest.json && test -f ${installRoot}/contract-manifest.sha256 && manifest="$(cat ${installRoot}/contract-manifest.sha256)" && test "$manifest" = ${JSON.stringify(DAIMON_CONTRACT_MANIFEST_SHA256)} && test "$(sha256sum ${installRoot}/contract-manifest.json | awk '{print "sha256:" $1}')" = "$manifest" && node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));if(r.manifest_sha256!==process.argv[2])process.exit(1)' ${installRoot}/capability-receipt.json "$manifest"`,
+    `ln -sf ${installRoot}/bin/daimon-runtime /usr/local/bin/daimon-runtime`,
+    `ln -sf ${installRoot}/bin/codex /usr/local/bin/codex`,
+    `install -o root -g root -m 0555 ${installRoot}/bin/grok /usr/local/bin/grok && arch="$(dpkg --print-architecture)" && case "$arch" in amd64) expected=${DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.x64.sha256} ;; arm64) expected=${DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.arm64.sha256} ;; *) exit 1 ;; esac && test "$(sha256sum /usr/local/bin/grok | awk '{print $1}')" = "$expected"`,
+    `ln -sf ${installRoot}/bin/agy /usr/local/bin/agy`,
+    `mkdir -p /opt/daimon/bin && install -o root -g root -m 0555 ${installRoot}/bin/daimon-engine-broker /opt/daimon/bin/daimon-engine-broker && arch="$(dpkg --print-architecture)" && case "$arch" in amd64) expected=${DAIMON_GROK_ENGINE_BROKER.artifacts.x64Sha256} ;; arm64) expected=${DAIMON_GROK_ENGINE_BROKER.artifacts.arm64Sha256} ;; *) exit 1 ;; esac && test "$(sha256sum /opt/daimon/bin/daimon-engine-broker | awk '{print $1}')" = "$expected"`
+];

package/dist/runtime/index.d.ts

@@ -2,6 +2,11 @@ export * from "./common.js";
 export * from "./container.js";
 export * from "./containerPackageOverrides.js";
 export * from "./install.js";
+export * from "./localDaimonAuthority.js";
 export * from "./registry.js";
 export * from "./statusProbes.js";
 export * from "./types.js";
+export * from "./usageLedger.js";
+export * from "./usageLedgerRead.js";
+export * from "./usageRequestLedger.js";
+export * from "./daimonInstall.js";

package/dist/runtime/index.js

@@ -2,6 +2,11 @@ export * from "./common.js";
 export * from "./container.js";
 export * from "./containerPackageOverrides.js";
 export * from "./install.js";
+export * from "./localDaimonAuthority.js";
 export * from "./registry.js";
 export * from "./statusProbes.js";
 export * from "./types.js";
+export * from "./usageLedger.js";
+export * from "./usageLedgerRead.js";
+export * from "./usageRequestLedger.js";
+export * from "./daimonInstall.js";

package/dist/runtime/install.d.ts

@@ -1,5 +1,10 @@
+import { type DaimonCapabilityReceipts } from "./registry.js";
 export type RuntimeInstallSelection = {
     ecosystem: "go" | "node";
+    capabilityReceipt?: string;
+    capabilityReceipts?: DaimonCapabilityReceipts;
+    contractManifestSha256?: string;
+    digest?: string;
     image: string;
     installHint: string;
     kind: "container_image";

package/dist/runtime/install.js

@@ -104,6 +104,10 @@ export const resolveRuntimeInstallSelection = async (runtimeName) => {
         case "container_image":
             return {
                 ecosystem: installProfile.container_image.ecosystem,
+                capabilityReceipt: runtime.install.capabilityReceipt,
+                ...(runtime.install.capabilityReceipts ? { capabilityReceipts: runtime.install.capabilityReceipts } : {}),
+                contractManifestSha256: runtime.install.contractManifestSha256,
+                digest: runtime.install.digest,
                 image: runtime.install.image,
                 installHint: installProfile.container_image.installHint,
                 kind: "container_image",

package/dist/runtime/localDaimonAuthority.d.ts

@@ -0,0 +1,11 @@
+export declare const DAIMON_LOCAL_RUNTIME_IDENTITY_ENV = "SPAWNFILE_DAIMON_LOCAL_RUNTIME_IDENTITY";
+export interface LocalDaimonRuntimeIdentity {
+    capabilityReceipt: string;
+    imageArchitecture: "amd64" | "arm64";
+    imageConfigDigest: string;
+    imageManifestDigest: string;
+    imageReference: string;
+    manifestSha256: string;
+    registryAuthority: string;
+}
+export declare const loadLocalDaimonRuntimeIdentity: (identityPath: string) => Promise<LocalDaimonRuntimeIdentity>;

package/dist/runtime/localDaimonAuthority.js

@@ -0,0 +1,77 @@
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { SpawnfileError } from "../shared/index.js";
+import { DAIMON_CONTRACT_MANIFEST_SHA256 } from "./daimon/contractManifest.js";
+export const DAIMON_LOCAL_RUNTIME_IDENTITY_ENV = "SPAWNFILE_DAIMON_LOCAL_RUNTIME_IDENTITY";
+const LOCAL_DAIMON_REPOSITORY_PATH = "noopolis/spawnfile-runtime-daimon";
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const MAX_IDENTITY_BYTES = 16 * 1024;
+const localDaimonRuntimeIdentitySchema = z
+    .object({
+    capability_receipt_sha256: z.string().regex(DIGEST),
+    development: z
+        .object({
+        mode: z.literal("local-development"),
+        non_production: z.literal(true),
+        unpublished: z.literal(true),
+        unsigned: z.literal(true)
+    })
+        .strict(),
+    image_architecture: z.union([z.literal("amd64"), z.literal("arm64")]),
+    image_config_digest: z.string().regex(DIGEST),
+    image_manifest_digest: z.string().regex(DIGEST),
+    image_reference: z.string(),
+    manifest_sha256: z.string().regex(DIGEST),
+    registry_authority: z.string().regex(/^127\.0\.0\.1:(?:[1-9]\d{0,3}|[1-5]\d{4}|6[0-4]\d{3}|65[0-4]\d{2}|655[0-2]\d|6553[0-5])$/u),
+    version: z.literal("spawnfile.local-daimon-runtime-identity.v3")
+})
+    .strict()
+    .superRefine((identity, context) => {
+    const expected = `${identity.registry_authority}/${LOCAL_DAIMON_REPOSITORY_PATH}@${identity.image_manifest_digest}`;
+    if (identity.image_reference !== expected) {
+        context.addIssue({
+            code: "custom",
+            message: "image_reference must bind the approved local registry repository and manifest digest",
+            path: ["image_reference"]
+        });
+    }
+});
+const fail = (message) => {
+    throw new SpawnfileError("runtime_error", message);
+};
+export const loadLocalDaimonRuntimeIdentity = async (identityPath) => {
+    if (!path.isAbsolute(identityPath)) {
+        return fail("Local Daimon runtime identity path must be absolute");
+    }
+    let entry;
+    try {
+        entry = await lstat(identityPath);
+    }
+    catch {
+        return fail("Local Daimon runtime identity is missing or unreadable");
+    }
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.size === 0 || entry.size > MAX_IDENTITY_BYTES) {
+        return fail("Local Daimon runtime identity must be a bounded nonempty regular file");
+    }
+    let value;
+    try {
+        value = JSON.parse(await readFile(identityPath, "utf8"));
+    }
+    catch {
+        return fail("Local Daimon runtime identity must contain valid JSON");
+    }
+    const parsed = localDaimonRuntimeIdentitySchema.safeParse(value);
+    if (!parsed.success || parsed.data.manifest_sha256 !== DAIMON_CONTRACT_MANIFEST_SHA256) {
+        return fail("Local Daimon runtime identity is invalid or incomplete");
+    }
+    return Object.freeze({
+        capabilityReceipt: parsed.data.capability_receipt_sha256,
+        imageArchitecture: parsed.data.image_architecture,
+        imageConfigDigest: parsed.data.image_config_digest,
+        imageManifestDigest: parsed.data.image_manifest_digest,
+        imageReference: parsed.data.image_reference,
+        manifestSha256: parsed.data.manifest_sha256,
+        registryAuthority: parsed.data.registry_authority
+    });
+};

package/dist/runtime/mnemeMcp.d.ts

@@ -7,6 +7,19 @@ interface MnemeMcpServerOptions {
 }
 export declare const resolveMnemeMemoryRuntimeHomePath: (access: MnemeMemoryAccess) => string | null;
 export declare const isMnemeMemoryAccessSupported: (access: MnemeMemoryAccess) => boolean;
+/**
+ * The container path a bank's Mneme runtime home is durably mounted at, or
+ * `null` when the compiler emits no persistent volume for it.
+ *
+ * This is the single authority shared by two sides that must never disagree:
+ * `src/compiler/memoryArtifacts.ts`, which emits the persistent mount (and
+ * therefore the directory the Daimon UID entrypoint creates and chowns to the
+ * runtime uid), and the runtime config emitters, which may only point an
+ * in-process Mneme runtime at a path the container actually mounts. A path
+ * without a mount is either absent at runtime or root-owned, so an in-process
+ * runtime pointed at one fails its first `mkdir`/write instead of degrading.
+ */
+export declare const resolveMnemeDurableMemoryMountPath: (bank: MnemeMemoryAccess["bank"]) => string | null;
 export declare const mnemeMemoryServerBaseName: (node: ResolvedAgentNode, access: MnemeMemoryAccess) => string;
 export declare const mnemeMemoryServerName: (node: ResolvedAgentNode, access: MnemeMemoryAccess, mode: MnemeMcpMode) => string;
 export declare const buildMnemeMemoryMcpServers: (node: ResolvedAgentNode, options?: MnemeMcpServerOptions) => Record<string, Record<string, unknown>>;

package/dist/runtime/mnemeMcp.js

@@ -13,6 +13,32 @@ export const resolveMnemeMemoryRuntimeHomePath = (access) => {
     return store.path ? path.dirname(store.path) : null;
 };
 export const isMnemeMemoryAccessSupported = (access) => resolveMnemeMemoryRuntimeHomePath(access) !== null;
+const normalizePosixPath = (value) => path.normalize(value).replace(/\/+$/u, "") || "/";
+/**
+ * The container path a bank's Mneme runtime home is durably mounted at, or
+ * `null` when the compiler emits no persistent volume for it.
+ *
+ * This is the single authority shared by two sides that must never disagree:
+ * `src/compiler/memoryArtifacts.ts`, which emits the persistent mount (and
+ * therefore the directory the Daimon UID entrypoint creates and chowns to the
+ * runtime uid), and the runtime config emitters, which may only point an
+ * in-process Mneme runtime at a path the container actually mounts. A path
+ * without a mount is either absent at runtime or root-owned, so an in-process
+ * runtime pointed at one fails its first `mkdir`/write instead of degrading.
+ */
+export const resolveMnemeDurableMemoryMountPath = (bank) => {
+    const store = bank.store;
+    if (store.kind !== "sqlite" && store.kind !== "json") {
+        return null;
+    }
+    if (store.persistence?.mode === "ephemeral") {
+        return null;
+    }
+    if (store.persistence?.mount) {
+        return normalizePosixPath(store.persistence.mount);
+    }
+    return store.path ? path.dirname(normalizePosixPath(store.path)) : null;
+};
 const memoryAccessKey = (access) => `${access.source}:${access.bank.id}`;
 const sourceDiscriminatorFor = (access) => {
     const nameSlug = slugify(`${access.declaringKind}-${access.bank.declaredName}`) || access.declaringKind;