spawnfile 0.1.14 → 0.1.18

package/examples/moltnet-team-chat/agents/coordinator/Spawnfile

@@ -0,0 +1,26 @@
+spawnfile_version: "0.1"
+kind: agent
+name: coordinator
+
+runtime: openclaw
+
+execution:
+  model:
+    auth:
+      method: codex
+    primary:
+      provider: openai
+      name: gpt-5
+  sandbox:
+    mode: workspace
+
+surfaces:
+  moltnet:
+    - network: local_lab
+      rooms:
+        mission-control:
+          wake: all
+
+workspace:
+  docs:
+    system: AGENTS.md

package/examples/moltnet-team-chat/teams/analysis/Spawnfile

@@ -0,0 +1,23 @@
+spawnfile_version: "0.1"
+kind: team
+name: analysis-team
+description: "Child team with an explicit representative and a non-representative descendant"
+
+shared:
+  workspace:
+    docs:
+      system: TEAM.md
+
+members:
+  - id: analysis-representative
+    ref: ./agents/representative
+  - id: analysis-observer
+    ref: ./agents/observer
+
+mode: hierarchical
+lead: analysis-representative
+external: [analysis-representative]
+
+policy:
+  mode: warn
+  on_degrade: warn

package/examples/moltnet-team-chat/teams/analysis/TEAM.md

@@ -0,0 +1,3 @@
+# Analysis Team
+
+The analysis representative is selected for parent-room membership. The observer exists to prove non-representatives are not attached to the parent room.

package/examples/moltnet-team-chat/teams/analysis/agents/observer/AGENTS.md

@@ -0,0 +1,5 @@
+# Analysis Observer
+
+You are a non-representative analysis team member.
+
+Do not send Moltnet messages during the E2E and do not join the parent `mission-control` room.

package/examples/moltnet-team-chat/teams/analysis/agents/observer/Spawnfile

@@ -0,0 +1,19 @@
+spawnfile_version: "0.1"
+kind: agent
+name: analysis-observer
+
+runtime: openclaw
+
+execution:
+  model:
+    auth:
+      method: codex
+    primary:
+      provider: openai
+      name: gpt-5
+  sandbox:
+    mode: workspace
+
+workspace:
+  docs:
+    system: AGENTS.md

package/examples/moltnet-team-chat/teams/analysis/agents/representative/AGENTS.md

@@ -0,0 +1,5 @@
+# Analysis Representative
+
+You are the analysis representative for the Moltnet team-chat E2E fixture.
+
+If asked in `mission-control`, answer only with the exact sentinel requested. Do not answer field-room prompts.

package/examples/moltnet-team-chat/teams/analysis/agents/representative/Spawnfile

@@ -0,0 +1,19 @@
+spawnfile_version: "0.1"
+kind: agent
+name: analysis-representative
+
+runtime: openclaw
+
+execution:
+  model:
+    auth:
+      method: codex
+    primary:
+      provider: openai
+      name: gpt-5
+  sandbox:
+    mode: workspace
+
+workspace:
+  docs:
+    system: AGENTS.md

package/examples/moltnet-team-chat/teams/field/Spawnfile

@@ -0,0 +1,41 @@
+spawnfile_version: "0.1"
+kind: team
+name: field-team
+description: "Child team with an explicit representative and a local Moltnet room"
+
+shared:
+  workspace:
+    docs:
+      system: TEAM.md
+
+members:
+  - id: field-representative
+    ref: ./agents/representative
+  - id: field-observer
+    ref: ./agents/observer
+
+mode: hierarchical
+lead: field-representative
+external: [field-representative]
+
+networks:
+  - id: field_lab
+    name: Field Lab
+    provider: moltnet
+    server:
+      mode: managed
+      listen:
+        bind: 0.0.0.0
+        port: 8787
+      store:
+        kind: memory
+      auth:
+        mode: none
+      human_ingress: true
+    rooms:
+      - id: field-room
+        members: [field-representative, field-observer]
+
+policy:
+  mode: warn
+  on_degrade: warn

package/examples/moltnet-team-chat/teams/field/TEAM.md

@@ -0,0 +1,3 @@
+# Field Team
+
+The field representative is the only team-facing member. The observer stays inside this child team and must not appear in the parent Moltnet room.

package/examples/moltnet-team-chat/teams/field/agents/observer/AGENTS.md

@@ -0,0 +1,5 @@
+# Field Observer
+
+You are a non-representative field team member.
+
+Do not send Moltnet messages during the E2E. You may observe `field-room`, but you must not answer parent-room prompts and must not appear in `mission-control`.

package/examples/moltnet-team-chat/teams/field/agents/observer/Spawnfile

@@ -0,0 +1,26 @@
+spawnfile_version: "0.1"
+kind: agent
+name: field-observer
+
+runtime: openclaw
+
+execution:
+  model:
+    auth:
+      method: codex
+    primary:
+      provider: openai
+      name: gpt-5
+  sandbox:
+    mode: workspace
+
+surfaces:
+  moltnet:
+    - network: field_lab
+      rooms:
+        field-room:
+          wake: never
+
+workspace:
+  docs:
+    system: AGENTS.md

package/examples/moltnet-team-chat/teams/field/agents/representative/AGENTS.md

@@ -0,0 +1,11 @@
+# Field Representative
+
+You are the field representative for the Moltnet team-chat E2E fixture.
+
+When a Moltnet message in `room:mission-control` contains `SF-MOLTNET-E2E-REQUEST`, use the `moltnet` skill and reply to `room:mission-control` on network `local_lab`. The reply must contain the matching `SF-MOLTNET-E2E-ACK` sentinel exactly as written.
+
+When accumulated context in `room:mission-control` includes a burst containing `SF-MOLTNET-E2E-B20` and a requested sentinel matching `SF-MOLTNET-E2E-B20-ACK-...`, use the `moltnet` skill and send exactly one reply to `room:mission-control` on network `local_lab`. The reply must contain that exact requested ack sentinel plus the exact `SF-MOLTNET-E2E-B20-STEP2-...` and `SF-MOLTNET-E2E-B20-STEP3-...` markers from the accumulated burst, sent after reading the burst context and without extra chatter.
+
+When a Moltnet message in `room:field-room` contains `SF-MOLTNET-E2E-CHILD`, use the `moltnet` skill and reply to `room:field-room` on network `field_lab`. The reply must contain the matching `SF-MOLTNET-E2E-CHILD-ACK` sentinel exactly as written.
+
+Send only the requested sentinel response.

package/examples/moltnet-team-chat/teams/field/agents/representative/Spawnfile

@@ -0,0 +1,26 @@
+spawnfile_version: "0.1"
+kind: agent
+name: field-representative
+
+runtime: openclaw
+
+execution:
+  model:
+    auth:
+      method: codex
+    primary:
+      provider: openai
+      name: gpt-5
+  sandbox:
+    mode: workspace
+
+surfaces:
+  moltnet:
+    - network: field_lab
+      rooms:
+        field-room:
+          wake: all
+
+workspace:
+  docs:
+    system: AGENTS.md

package/examples/single-agent/AGENTS.md

@@ -0,0 +1,3 @@
+# Operating Instructions
+
+Start with the user's objective, gather only necessary context, and return a short answer with sources when available.

package/examples/single-agent/HEARTBEAT.md

@@ -0,0 +1,3 @@
+# Heartbeat Intent
+
+Periodically review whether the current line of work is still aligned with the user's request.

package/examples/single-agent/IDENTITY.md

@@ -0,0 +1,3 @@
+# Analyst
+
+You are a research analyst focused on fast, source-backed synthesis.

package/examples/single-agent/MEMORY.md

@@ -0,0 +1,3 @@
+# Memory Intent
+
+Keep lightweight working memory about recent goals and evidence gathered during a task.

package/examples/single-agent/SOUL.md

@@ -0,0 +1,3 @@
+# Voice
+
+Be concise, skeptical, and explicit about uncertainty.

package/examples/single-agent/Spawnfile

@@ -0,0 +1,41 @@
+spawnfile_version: "0.1"
+kind: agent
+name: analyst
+
+runtime: openclaw
+
+execution:
+  model:
+    primary:
+      provider: anthropic
+      name: claude-sonnet-4-5
+  sandbox:
+    mode: workspace
+
+workspace:
+  docs:
+    identity: IDENTITY.md
+    soul: SOUL.md
+    system: AGENTS.md
+    memory: MEMORY.md
+    heartbeat: HEARTBEAT.md
+  skills:
+    - ref: ./skills/web_search
+      requires:
+        mcp:
+          - web_search
+
+environment:
+  mcp_servers:
+    - name: web_search
+      transport: streamable_http
+      url: https://search.mcp.example.com/mcp
+      auth:
+        secret: SEARCH_API_KEY
+  secrets:
+    - name: SEARCH_API_KEY
+      required: true
+
+policy:
+  mode: warn
+  on_degrade: warn

package/examples/single-agent/skills/web_search/SKILL.md

@@ -0,0 +1,6 @@
+---
+name: web_search
+description: "Search the web and summarize the most relevant findings."
+---
+
+Use web search when the task needs current information or direct source verification.

package/moltnet-releases.json

@@ -1,20 +1,21 @@
 {
   "version": "spawnfile.moltnet-release-authority.v1",
-  "release_version": "v0.1.14",
-  "source_revision": "7baeb284ba0b1b5e454476141a557d68b5a4af0d",
+  "release_version": "v0.1.18",
+  "source_revision": "988c5284f45705beb3bf59a4a4c0008605ce609e",
   "capabilities": [
+    "daimon-bridge",
     "pi-bridge"
   ],
   "assets": [
     {
       "architecture": "amd64",
       "asset": "moltnet_linux_amd64.tar.gz",
-      "asset_sha256": "sha256:a2e7a0acd44ab548a81d99e51401ebdee9f50a539b24c9450fc12d8e9218e5f6"
+      "asset_sha256": "sha256:92d356cd33841e89b6bc56c6e8c2c37d987124f35c896d033e8766eab09da2c5"
     },
     {
       "architecture": "arm64",
       "asset": "moltnet_linux_arm64.tar.gz",
-      "asset_sha256": "sha256:3d46ad047496dd32a9ad41901e7ae1f10a25e9a21f3b29d3b6ccd2cff62fa58f"
+      "asset_sha256": "sha256:40c1fae1c687a59a9e6d804ac28d00e925f318bd4e922accdca4402ceab88548"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spawnfile",
-  "version": "0.1.14",
+  "version": "0.1.18",
   "description": "Canonical source compiler for autonomous agents and teams.",
   "license": "MIT",
   "type": "module",
@@ -9,6 +9,7 @@
   },
   "files": [
     "dist",
+    "examples",
     "moltnet-releases.json",
     "runtimes.yaml"
   ],
@@ -16,7 +17,9 @@
     "node": ">=22.19.0"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc --project tsconfig.build.json && chmod +x dist/cli/index.js && node ./src/runtime/copyScaffoldAssets.mjs",
+    "compile:explicit-test-mcp": "node --experimental-strip-types scripts/compile-explicit-test-mcp.ts",
+    "build": "rm -rf dist && tsc --project tsconfig.build.json && chmod +x dist/cli/index.js && node --experimental-strip-types ./src/evidenceExportHelper/copyAssets.ts && node --experimental-strip-types ./src/runtime/copyScaffoldAssets.ts && node --experimental-strip-types ./src/deployment/native/copyArtifacts.ts && node --experimental-strip-types ./src/compiler/training/preparation/copyAssets.ts",
+    "build:native": "node --experimental-strip-types ./src/deployment/native/build.ts",
     "clean": "rm -rf coverage dist",
     "coverage": "vitest run --coverage",
     "dev": "tsx src/cli/index.ts",
@@ -25,12 +28,20 @@
     "release:patch": "npm version patch && npm publish",
     "release:minor": "npm version minor && npm publish",
     "release:major": "npm version major && npm publish",
-    "runtime:images": "npm run runtime:openclaw-image && npm run runtime:picoclaw-image",
+    "runtime:images": "npm run runtime:openclaw-image && npm run runtime:picoclaw-image && npm run runtime:daimon-image",
     "runtime:openclaw-image": "docker build -f runtime-images/openclaw/Dockerfile -t noopolis/spawnfile-runtime-openclaw:2026.6.11-local runtime-images/openclaw",
     "runtime:picoclaw-image": "docker build -f runtime-images/picoclaw/Dockerfile -t noopolis/spawnfile-runtime-picoclaw:0.3.1-local runtime-images/picoclaw",
+    "runtime:daimon-image": "npm run build:local-daimon",
     "audit:generate": "tsx src/audit/auditCli.ts",
-    "build:local-moltnet": "node ./scripts/build-local-moltnet.mjs",
-    "verify:package-closure": "node ./scripts/verify-package-closure.mjs",
+    "build:local-moltnet": "node --experimental-strip-types ./scripts/build-local-moltnet.ts",
+    "build:local-daimon": "node --experimental-strip-types ./scripts/build-local-daimon-runtime.ts",
+    "vendor:daimon-contract": "node --import tsx ./scripts/vendor-daimon-grok-contract.ts",
+    "bundle:source-provenance": "node --experimental-strip-types ./scripts/create-source-provenance-bundle.ts",
+    "prepare:linux-amd64-closure": "node --experimental-strip-types ./scripts/create-linux-amd64-dependency-closure.ts",
+    "prepare:linux-amd64-go-closure": "node --experimental-strip-types ./scripts/create-linux-amd64-go-closure.ts",
+    "test:source-provenance-docker": "node --experimental-strip-types --test scripts/source-provenance-bundle.integration.test.ts",
+    "test:moltnet-source-provenance-docker": "node --experimental-strip-types --test scripts/moltnet-source-provenance.integration.test.ts",
+    "verify:package-closure": "node --experimental-strip-types ./scripts/verify-package-closure.ts",
     "test:e2e:docker-auth": "tsx src/e2e/cli.ts",
     "test:e2e:daimon-memory-recall": "tsx src/e2e/cli.ts daimon-memory-recall",
     "test:e2e:jungian-self-org": "tsx src/e2e/cli.ts jungian-self-org",
@@ -41,18 +52,23 @@
     "test:e2e:ollama-embeddings-probe": "tsx src/e2e/cli.ts ollama-embeddings-probe",
     "test:e2e:operational-smoke": "tsx src/e2e/cli.ts operational-smoke",
     "test:e2e:lifecycle-smoke": "tsx src/e2e/cli.ts lifecycle-smoke",
-    "test": "npm run test:vitest; vitest_status=$?; npm run test:verdict; verdict_status=$?; npm run test:coverage-verdict; coverage_status=$?; npm run test:node; node_status=$?; failed_lanes=''; if [ \"$verdict_status\" -eq 2 ]; then failed_lanes='vitest test failures'; fi; if [ \"$node_status\" -eq 2 ]; then if [ -n \"$failed_lanes\" ]; then failed_lanes=\"$failed_lanes; node:test suite\"; else failed_lanes='node:test suite'; fi; fi; result_status=0; if [ -n \"$failed_lanes\" ]; then echo \"FAIL(tests): $failed_lanes\"; result_status=1; fi; if [ \"$verdict_status\" -ne 0 ] && [ \"$verdict_status\" -ne 2 ]; then echo 'FAIL(vitest-verdict): could not determine the vitest result'; result_status=1; fi; if [ \"$node_status\" -ne 0 ] && [ \"$node_status\" -ne 2 ]; then echo 'FAIL(node-lane): could not determine the node:test result'; result_status=1; fi; if [ \"$result_status\" -ne 0 ]; then exit 1; elif [ \"$vitest_status\" -ne 0 ]; then echo \"FAIL(vitest): exited $vitest_status with no test failure\"; exit 1; elif [ \"$coverage_status\" -eq 2 ]; then echo 'FAIL(coverage): thresholds not met (tests all passed)'; exit 2; elif [ \"$coverage_status\" -ne 0 ]; then echo 'FAIL(coverage-verdict): could not evaluate coverage (tests all passed)'; exit 1; else echo 'PASS'; fi",
     "test:vitest": "rm -f coverage/vitest-results.json coverage/coverage-summary.json && vitest run --coverage.thresholds.branches=0 --coverage.thresholds.functions=0 --coverage.thresholds.lines=0 --coverage.thresholds.statements=0",
     "test:verdict": "node -e \"const fs=require('fs'); const file='coverage/vitest-results.json'; if (!fs.existsSync(file)) { console.error('VERDICT: results file missing'); process.exit(1); } let result; try { result=JSON.parse(fs.readFileSync(file, 'utf8')); } catch { console.error('VERDICT: results file unparseable'); process.exit(1); } const total=result.numTotalTests; const totalSuites=result.numTotalTestSuites; const passedTests=result.numPassedTests; const failedTests=result.numFailedTests; const pendingTests=result.numPendingTests; const todoTests=result.numTodoTests; const failedSuites=result.numFailedTestSuites; if (typeof result.success !== 'boolean' || !Number.isInteger(passedTests) || passedTests < 0 || !Number.isInteger(failedTests) || failedTests < 0 || !Number.isInteger(pendingTests) || pendingTests < 0 || !Number.isInteger(todoTests) || todoTests < 0 || !Number.isInteger(failedSuites) || failedSuites < 0 || !Number.isInteger(totalSuites) || totalSuites < 0) { console.error('VERDICT: results schema unrecognised'); process.exit(1); } if (!Number.isInteger(total) || total <= 0) { console.error('VERDICT: no tests found'); process.exit(1); } if (passedTests + failedTests + pendingTests + todoTests !== total) { console.error('VERDICT: results counters do not reconcile (tests='+total+', passed='+passedTests+', failed='+failedTests+', skipped='+pendingTests+', todo='+todoTests+')'); process.exit(1); } const failed=result.success === false || failedTests > 0 || failedSuites > 0; if (failed) { console.error('VERDICT: test failures found (tests='+failedTests+', suites='+failedSuites+', success='+result.success+')'); process.exit(2); } if (passedTests === 0) { console.error('VERDICT: no tests actually ran (skipped='+pendingTests+', todo='+todoTests+')'); process.exit(1); } console.log('VERDICT: tests passed (tests='+total+', suites='+totalSuites+', passed='+passedTests+', skipped='+pendingTests+', todo='+todoTests+')');\"",
     "test:coverage-verdict": "node --import tsx -e \"import fs from 'node:fs'; const file='coverage/coverage-summary.json'; const fail=(message)=>{ console.error('COVERAGE VERDICT: '+message); process.exit(1); }; let summary; try { summary=JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) { fail(error && error.code === 'ENOENT' ? 'summary file missing' : 'summary file unparseable'); } import('./vitest.config.ts').then(({default:config})=>{ const thresholds=config.test && config.test.coverage && config.test.coverage.thresholds; if (!thresholds || typeof thresholds !== 'object' || !summary || typeof summary !== 'object' || !summary.total || typeof summary.total !== 'object') fail('summary or threshold schema unrecognised'); const metricNames=['branches','functions','lines','statements']; const metrics=metricNames.filter((metric)=>Object.prototype.hasOwnProperty.call(thresholds, metric)); if (metrics.length === 0) fail('no threshold metrics configured'); let shortfall=false; for (const metric of metrics) { const threshold=thresholds[metric]; const pct=summary.total[metric] && summary.total[metric].pct; if (typeof threshold !== 'number' || !Number.isFinite(threshold) || typeof pct !== 'number' || !Number.isFinite(pct)) fail('missing or non-numeric value for '+metric); console.log('COVERAGE: '+metric+' '+pct+'% (threshold '+threshold+'%)'); if (pct < threshold) shortfall=true; } if (shortfall) { console.error('COVERAGE VERDICT: thresholds not met'); process.exit(2); } console.log('COVERAGE VERDICT: thresholds met'); }).catch((error)=>fail('could not load vitest config: '+error.message));\"",
     "test:node": "mkdir -p coverage || exit 1; rm -f coverage/node-test.tap || exit 1; node --import tsx --test --test-reporter=tap src/runtime/pi/appControlDeliveryMetadata.test.ts > coverage/node-test.tap 2>&1; node_status=$?; cat coverage/node-test.tap; cat_status=$?; npm run test:node-verdict; verdict_status=$?; if [ \"$verdict_status\" -eq 2 ]; then exit 2; fi; if [ \"$verdict_status\" -ne 0 ]; then exit 1; fi; if [ \"$cat_status\" -ne 0 ]; then echo 'NODE VERDICT: could not read TAP output' >&2; exit 1; fi; if [ \"$node_status\" -ne 0 ]; then echo \"NODE VERDICT: node:test runner exited $node_status despite a passing TAP summary\" >&2; exit 1; fi; exit 0",
     "test:node-verdict": "node -e \"const fs=require('fs'); const text=fs.readFileSync('coverage/node-test.tap', 'utf8'); const tests=text.match(/^# tests ([0-9]+)\\r?$/m); const suites=text.match(/^# suites ([0-9]+)\\r?$/m); const passed=text.match(/^# pass ([0-9]+)\\r?$/m); const failed=text.match(/^# fail ([0-9]+)\\r?$/m); const skipped=text.match(/^# skipped ([0-9]+)\\r?$/m); const todo=text.match(/^# todo ([0-9]+)\\r?$/m); const cancelled=text.match(/^# cancelled ([0-9]+)\\r?$/m); if (!tests || !suites || !passed || !failed || !skipped || !todo || !cancelled) { console.error('NODE VERDICT: TAP summary unrecognised'); process.exit(1); } const testCount=Number(tests[1]); const suiteCount=Number(suites[1]); const passCount=Number(passed[1]); const failCount=Number(failed[1]); const skippedCount=Number(skipped[1]); const todoCount=Number(todo[1]); const cancelledCount=Number(cancelled[1]); if (failCount > 0) { console.error('NODE VERDICT: test failures found (tests='+testCount+', failed='+failCount+')'); process.exit(2); } if (cancelledCount > 0) { console.error('NODE VERDICT: incomplete run (cancelled='+cancelledCount+')'); process.exit(1); } if (passCount + skippedCount + todoCount + cancelledCount !== testCount) { console.error('NODE VERDICT: TAP counts do not reconcile (tests='+testCount+', passed='+passCount+', skipped='+skippedCount+', todo='+todoCount+', cancelled='+cancelledCount+')'); process.exit(1); } if (testCount < 10) { console.error('NODE VERDICT: expected at least 10 node:test cases, found '+testCount+' — cases were removed or the file was gutted'); process.exit(1); } if (passCount < 10) { console.error('NODE VERDICT: expected at least 10 passing node:test cases, found '+passCount+' (skipped='+skippedCount+', todo='+todoCount+')'); process.exit(1); } if (suiteCount < 1) { console.error('NODE VERDICT: expected at least 1 node:test suite, found '+suiteCount); process.exit(1); } console.log('NODE VERDICT: tests passed (tests='+testCount+', suites='+suiteCount+', passed='+passCount+', skipped='+skippedCount+', todo='+todoCount+', failed=0)');\"",
+    "verify:training-image-modes": "tsx scripts/verify-training-image-modes.ts",
+    "test:product-state-volume": "node --experimental-strip-types scripts/product-state-volume-integration.test.ts",
     "test:boundaries": "vitest run --coverage.enabled=false src/ownership/rootOwnershipBoundary.test.ts src/deployment/providerRuntimeBoundary.test.ts src/ownership/mnemePublicImportBoundary.test.ts src/target/containerBundleArchive.test.ts",
     "test:causal-conformance": "tsx src/ledger/causalConformanceCli.ts",
-    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "typecheck": "tsc --project tsconfig.json --noEmit && tsc --project scripts/tsconfig.json && tsc --project .github/scripts/ci/tsconfig.json",
     "test:e2e:distribution-image": "tsx src/e2e/cli.ts distribution-image",
     "test:e2e:distribution-roundtrip": "tsx src/e2e/cli.ts distribution-roundtrip",
-    "test:e2e:daimon-org": "tsx src/e2e/cli.ts daimon-org"
+    "test:e2e:daimon-org": "tsx src/e2e/cli.ts daimon-org",
+    "test:live:grok-lean-worker": "node --experimental-strip-types ./scripts/grok-lean-worker-live-check.ts",
+    "test:scripts": "node --experimental-strip-types --test scripts/build-local-daimon-runtime.test.ts scripts/daimon-publish-inputs.test.ts scripts/runtime-image-workflows.test.ts scripts/grok-lean-worker-live-check.test.ts scripts/build-local-moltnet.test.ts scripts/compile-explicit-test-mcp.test.ts scripts/native-helper-workflows.test.ts scripts/typescript-policy.test.ts scripts/training-image-modes.test.ts && node --import tsx --test scripts/training-native-image.test.ts",
+    "test:unit": "npm run test:vitest; vitest_status=$?; npm run test:verdict; verdict_status=$?; npm run test:coverage-verdict; coverage_status=$?; npm run test:node; node_status=$?; failed_lanes=''; if [ \"$verdict_status\" -eq 2 ]; then failed_lanes='vitest test failures'; fi; if [ \"$node_status\" -eq 2 ]; then if [ -n \"$failed_lanes\" ]; then failed_lanes=\"$failed_lanes; node:test suite\"; else failed_lanes='node:test suite'; fi; fi; result_status=0; if [ -n \"$failed_lanes\" ]; then echo \"FAIL(tests): $failed_lanes\"; result_status=1; fi; if [ \"$verdict_status\" -ne 0 ] && [ \"$verdict_status\" -ne 2 ]; then echo 'FAIL(vitest-verdict): could not determine the vitest result'; result_status=1; fi; if [ \"$node_status\" -ne 0 ] && [ \"$node_status\" -ne 2 ]; then echo 'FAIL(node-lane): could not determine the node:test result'; result_status=1; fi; if [ \"$result_status\" -ne 0 ]; then exit 1; elif [ \"$vitest_status\" -ne 0 ]; then echo \"FAIL(vitest): exited $vitest_status with no test failure\"; exit 1; elif [ \"$coverage_status\" -eq 2 ]; then echo 'FAIL(coverage): thresholds not met (tests all passed)'; exit 2; elif [ \"$coverage_status\" -ne 0 ]; then echo 'FAIL(coverage-verdict): could not evaluate coverage (tests all passed)'; exit 1; else echo 'PASS'; fi",
+    "test": "npm run test:unit && npm run test:scripts"
   },
   "dependencies": {
     "@noopolis/stele": "0.0.2",
@@ -68,5 +84,16 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
   },
-  "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be"
+  "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be",
+  "exports": {
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "import": "./dist/auth/index.js"
+    },
+    "./*": "./*",
+    "./training": {
+      "types": "./dist/compiler/training/index.d.ts",
+      "import": "./dist/compiler/training/index.js"
+    }
+  }
 }

package/runtimes.yaml

@@ -12,13 +12,18 @@
 #
 runtimes:
   daimon:
-    remote: git@github.com:noopolis/daimon.git
-    ref: v0.1.2
+    remote: git@github.com:noopolis/daimon-harness.git
+    ref: 14d0298c00861f949bb6993d1af9751cde53319f
     default_branch: main
     install:
       kind: container_image
       image: noopolis/spawnfile-runtime-daimon
-      tag: 0.1.2
+      tag: 0.2.1-14d0298
+      digest: sha256:2de3bd522ce88202b3295efa4f19c72c350e5e18c25ccba55e5acf3395e8569c
+      capability_receipts:
+        amd64: sha256:26fe7ff328bb45fb6643b0792ab38b2658d5fcc3d2d8bd67d9848ea2987c04cc
+        arm64: sha256:347da7c613ad3430e018de829587a6d686c498c6168ef4be6b8dd501fdb07ebb
+      contract_manifest_sha256: sha256:e39551277c6727c8807b1247e759f57addcee3f17f1405ebc927179647d64de6
     status: active
 
   openclaw:

package/dist/cli/targetWorldClockCrossProcess.test-helper.d.ts

@@ -1,13 +0,0 @@
-import { type TargetWorldClockRequest } from "../target/worldClock.js";
-export type BuiltWorldClockMode = "success" | "tick-zero" | "stale" | "topology" | "activation" | "nonzero-action";
-export interface BuiltWorldClockState {
-    readonly callsPath: string;
-    readonly config: Readonly<Record<string, unknown>>;
-    readonly home: string;
-    readonly modePath: string;
-    readonly request: TargetWorldClockRequest;
-    readonly requestPath: string;
-    readonly root: string;
-}
-export declare const createBuiltWorldClockState: () => Promise<BuiltWorldClockState>;
-export declare const selectBuiltWorldClockMode: (state: BuiltWorldClockState, mode: BuiltWorldClockMode) => Promise<void>;

package/dist/cli/targetWorldClockCrossProcess.test-helper.js

@@ -1,109 +0,0 @@
-import { chmod, mkdtemp, realpath, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { parseOpaqueTargetHandle } from "../target/contracts.js";
-import { createDockerArtifactSpec } from "../target/dockerArtifactsProvider.js";
-import { createDockerResourceSpec } from "../target/dockerResourcesProvider.js";
-import { createWorldServiceAuthorization, parseWorldServiceResolution } from "../target/dockerWorldServiceAuthority.js";
-import { worldServiceSpecForBinding } from "../target/dockerWorldServiceLifecycle.js";
-import { createWorldServiceBinding, initializeWorldServiceAuthorityStore, worldServiceResourceBindings, } from "../target/dockerWorldServiceStore.js";
-import { createCanonicalWorldServiceActivationBytes, createTargetTopologyActivationReceiptDigest, createWorldServiceActivationDigest, parseWorldServiceActivation, } from "../target/topologyActivation.js";
-import { parseTargetWorldClockRequest } from "../target/worldClock.js";
-const d = (value) => `sha256:${value.repeat(64).slice(0, 64)}`;
-const h = (value) => parseOpaqueTargetHandle(`opaque_${value.repeat(16)}`);
-const containerId = "c".repeat(64);
-const after = (args, flag) => args[args.indexOf(flag) + 1];
-const inspection = (spec) => ({
-    AutoRemove: false, BindCount: 0, CapAddCount: 0, CapDrop: ["ALL"], CgroupnsMode: "private", DeviceCount: 0,
-    DeviceRequestCount: 0, DnsCount: 0, Domainname: "", ExposedPortCount: 0, ExtraHostCount: 0, GroupAddCount: 0,
-    Hostname: spec.containerName, Id: containerId, Image: spec.imageReference, IpcMode: "none", Labels: spec.receiptLabels,
-    LinkCount: 0, LogType: "none", Mounts: spec.createArgs.filter((value, index, values) => values[index - 1] === "--mount")
-        .map((value) => Object.fromEntries(value.split(",").map((part) => part.split("=", 2))))
-        .map((mount) => ({ Destination: mount.dst, Name: mount.src, RW: mount.dst === spec.evidenceMountPath, Type: "volume" })),
-    Name: `/${spec.containerName}`, NetworkAliases: spec.networkAlias ? [spec.networkAlias] : null,
-    NetworkAttachmentCount: 1, NetworkAttachmentId: "b".repeat(64), NetworkAttachmentName: after(spec.createArgs, "--network"),
-    NetworkMode: after(spec.createArgs, "--network"), PidMode: "", PortBindingCount: 0, Privileged: false,
-    PublishAllPorts: false, ReadonlyRootfs: true, RestartMaximumRetryCount: 0, RestartPolicyName: "no",
-    SecurityOpt: ["no-new-privileges=true"], Status: "running", Tmpfs: { "/tmp": "rw,noexec,nosuid,nodev,size=1m,mode=1777" },
-    UTSMode: "", UsernsMode: "", VolumesFromCount: 0,
-});
-const fixture = () => {
-    const selectedTarget = { fingerprint: `sha256:${"1".repeat(32)}`, handle: h("1") };
-    const runId = "run-built-clock";
-    const dataClaim = { operationHandle: h("2"), requestDigest: d("2") };
-    const evidenceClaim = { operationHandle: h("3"), requestDigest: d("3") };
-    const data = createDockerResourceSpec({ kind: "data_network", ...dataClaim, runId, selectedTargetHandle: selectedTarget.handle });
-    const evidence = createDockerResourceSpec({ kind: "evidence_volume", ...evidenceClaim, runId, selectedTargetHandle: selectedTarget.handle });
-    const artifact = createDockerArtifactSpec({ artifactManifestDigest: d("4"), imageDigest: d("5"),
-        imageReference: `registry.example/world@${d("5")}`, operationHandle: h("4"), requestDigest: d("4"),
-        selectedTargetHandle: selectedTarget.handle });
-    const authorization = createWorldServiceAuthorization({ dataNetworkHandle: data.resultHandle, descriptorDigest: d("6"),
-        evidenceMountPath: "/run/world/evidence", evidenceVolumeHandle: evidence.resultHandle, operationHandle: h("6"),
-        requestDigest: d("6"), runId, secretBindingsHandle: h("7"), selectedTarget, worldArtifactHandle: artifact.resultHandle });
-    const resolution = parseWorldServiceResolution({ artifact: { artifact_manifest_digest: d("4"), identity_kind: "oci_image_manifest",
-            image_digest: artifact.imageDigest, image_reference: artifact.imageReference, operation_handle: h("4"),
-            request_digest: d("4"), result_handle: artifact.resultHandle }, authorization });
-    const resources = worldServiceResourceBindings({ dataNetworkClaim: dataClaim, evidenceVolumeClaim: evidenceClaim, resolution });
-    const spec = worldServiceSpecForBinding({ resolution, resources });
-    const binding = createWorldServiceBinding({ containerId, dataNetwork: resources.data_network, evidenceVolume: resources.evidence_volume,
-        resolution, secretBindings: resources.secret_bindings, spec });
-    const marker = parseWorldServiceActivation({ bundle_digest: d("8"), run_id: runId, state: "activated",
-        topology_receipt_digest: d("9"), topology_request_digest: d("a"), version: "spawnfile.world-service-activation.v1" });
-    const activationDigest = createWorldServiceActivationDigest(marker);
-    const activationReceiptDigest = createTargetTopologyActivationReceiptDigest({ activation_digest: activationDigest,
-        bundle_digest: marker.bundle_digest, receipt_digest: d("0"), run_id: runId, state: "activated",
-        topology_receipt_digest: marker.topology_receipt_digest, topology_request_digest: marker.topology_request_digest,
-        version: "spawnfile.target-topology-activation-receipt.v1" });
-    const request = parseTargetWorldClockRequest({ activation_digest: activationDigest,
-        activation_receipt_digest: activationReceiptDigest, descriptor_digest: authorization.descriptor_digest,
-        endpoint: { internal_port: 4_070, path: "/v1/world/clock" },
-        expected: { document_version: "world.clock-document.v1", world_instance_id: "world-built-clock" }, run_id: runId,
-        selected_target: selectedTarget, topology_receipt_digest: marker.topology_receipt_digest,
-        topology_request_digest: marker.topology_request_digest, version: "spawnfile.target-world-clock.request.v1",
-        world_service_handle: binding.world_service_handle });
-    return { binding, marker, request, spec };
-};
-export const createBuiltWorldClockState = async () => {
-    const root = await realpath(await mkdtemp(path.join(os.tmpdir(), "spawnfile-built-world-clock-")));
-    const home = path.join(root, "home");
-    const callsPath = path.join(root, "docker-calls.ndjson");
-    const modePath = path.join(root, "mode");
-    const scenariosPath = path.join(root, "scenarios.json");
-    const fakeDocker = path.join(root, "docker-clock");
-    const requestPath = path.join(root, "request.json");
-    const { binding, marker, request, spec } = fixture();
-    const store = await initializeWorldServiceAuthorityStore(path.join(home, "target", "world-authority"));
-    await store.bindService(binding);
-    const observation = { action_count: 0, clock: { completed_tick: 1, next_tick: 2, state: "running" },
-        run_id: request.run_id, version: request.expected.document_version, world_instance_id: request.expected.world_instance_id };
-    const topologyMarker = parseWorldServiceActivation({ ...marker, topology_receipt_digest: d("b") });
-    const activationMarker = parseWorldServiceActivation({ ...marker, bundle_digest: d("c") });
-    const scenarios = {
-        success: { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify(observation) },
-        "tick-zero": { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify({ ...observation,
-                clock: { completed_tick: 0, next_tick: 1, state: "running" } }) },
-        stale: { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify({ ...observation, run_id: "run-stale-clock" }) },
-        topology: { marker: createCanonicalWorldServiceActivationBytes(topologyMarker), observation: JSON.stringify(observation) },
-        activation: { marker: createCanonicalWorldServiceActivationBytes(activationMarker), observation: JSON.stringify(observation) },
-        "nonzero-action": { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify({ ...observation, action_count: 1 }) },
-    };
-    await writeFile(callsPath, "", { mode: 0o600 });
-    await writeFile(modePath, "success", { mode: 0o600 });
-    await writeFile(scenariosPath, JSON.stringify(scenarios), { mode: 0o600 });
-    await writeFile(requestPath, JSON.stringify(request), { mode: 0o600 });
-    await writeFile(fakeDocker, `#!${process.execPath}
-const fs=require("node:fs");const args=process.argv.slice(2);
-fs.appendFileSync(${JSON.stringify(callsPath)},JSON.stringify(args)+"\\n");
-const all=JSON.parse(fs.readFileSync(${JSON.stringify(scenariosPath)},"utf8"));
-const current=all[fs.readFileSync(${JSON.stringify(modePath)},"utf8").trim()];
-if(args[2]==="container"&&args[3]==="inspect")process.stdout.write(${JSON.stringify(JSON.stringify([inspection(spec)]))});
-else if(args[2]==="container"&&args[3]==="exec"&&args.includes("/bin/cat"))process.stdout.write(current.marker);
-else if(args[2]==="container"&&args[3]==="exec"&&args.includes("/usr/local/bin/node"))process.stdout.write(current.observation);
-else{process.stderr.write("unexpected fake Docker command\\n");process.exitCode=71;}
-`, { mode: 0o700 });
-    await chmod(fakeDocker, 0o700);
-    return { callsPath, config: { context: "built_clock", dockerCommand: fakeDocker,
-            evidenceDestination: path.join(root, "unused.tar"), timeoutMs: 10_000,
-            version: "spawnfile.target-default-config.v1" }, home, modePath, request, requestPath, root };
-};
-export const selectBuiltWorldClockMode = async (state, mode) => { await writeFile(state.modePath, mode, { mode: 0o600 }); };

package/dist/deployment/providerRuntimeBoundaryScanner.test-helper.d.ts

@@ -1,8 +0,0 @@
-export type ProviderRuntimeViolationKind = "moltnet-live-endpoint" | "provider-authenticated-http" | "docker-exec-http-transport" | "transport-receipt" | "generated-client" | "cursor-operation";
-export type ProviderRuntimeViolation = {
-    classification: ProviderRuntimeViolationKind;
-    file: string;
-    matched: string;
-};
-export declare const scanProviderRuntimeSource: (source: string, file?: string) => ProviderRuntimeViolation[];
-export declare const scanProviderRuntimeTree: (repositoryRoot: string) => Promise<ProviderRuntimeViolation[]>;