spawnfile 0.1.17 → 0.1.18

package/dist/compiler/training/container/prepare.js

@@ -1,33 +1,51 @@
-import { lstat, realpath } from "node:fs/promises";
+import { lstat, mkdir, realpath } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { trainingContextSchema } from "../contract.js";
 import { trainingContainerConfigSchema } from "./contract.js";
+import { allocateTrainingOutputParent } from "../execution.js";
+import { assertTrainingSubjectIsolation } from "./subjectIsolation.js";
 const inside = (root, value) => value === root || value.startsWith(`${root}/`);
-export const prepareTrainingContainer = async (raw, context, args) => {
+export const prepareTrainingContainer = async (raw, context, args, options = {}) => {
     const config = trainingContainerConfigSchema.parse(raw);
+    await assertTrainingSubjectIsolation(config, context);
     const entries = [...config.inputs, config.output];
+    const protectedLeaves = [...config.auth, ...config.evaluatorSecrets ?? []];
     const home = path.resolve(os.homedir());
     const globalConfigRoots = [".codex", ".claude", ".grok", ".ssh", ".config"].map((name) => path.join(home, name));
-    for (const entry of [...entries, ...config.auth]) {
-        const canonical = await realpath(entry.source);
+    let missingOutput = false;
+    for (const entry of [...entries, ...protectedLeaves]) {
+        let canonical;
+        try {
+            canonical = await realpath(entry.source);
+        }
+        catch (error) {
+            if (entry !== config.output || !options.createOutput || error.code !== "ENOENT")
+                throw error;
+            canonical = path.resolve(entry.source);
+            missingOutput = true;
+        }
         if (canonical !== entry.source)
             throw Error("Training bind sources must be canonical, without symlink aliases");
-        const stat = await lstat(canonical);
-        if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory()))
-            throw Error("Training binds require regular files or directories");
-        if (config.auth.includes(entry) && !stat.isFile())
-            throw Error("Auth must be a single regular leaf file");
+        if (entry !== config.output || !missingOutput) {
+            const stat = await lstat(canonical);
+            if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory()))
+                throw Error("Training binds require regular files or directories");
+            if (config.evaluatorSecrets?.includes(entry) && stat.nlink !== 1)
+                throw Error("Evaluator secrets must not have hardlink aliases");
+            if (protectedLeaves.includes(entry) && !stat.isFile())
+                throw Error("Auth must be a single regular leaf file");
+        }
         if (entries.includes(entry)) {
             if (["/", "/etc", "/var", "/run", "/tmp", "/opt", "/usr", "/Users", "/home", home].includes(canonical) || globalConfigRoots.some((root) => inside(root, canonical)))
                 throw Error("Host homes, configuration and system roots cannot be training inputs");
-            if (config.auth.some((auth) => inside(canonical, auth.source)))
+            if (protectedLeaves.some((auth) => inside(canonical, auth.source)))
                 throw Error("Auth must not be exposed through input or output mounts");
         }
     }
     if (config.inputs.some((entry, index) => config.inputs.some((other, otherIndex) => index !== otherIndex && inside(entry.source, other.source))))
         throw Error("Training input source roots must not overlap");
-    if (!(await lstat(config.output.source)).isDirectory())
+    if (!missingOutput && !(await lstat(config.output.source)).isDirectory())
         throw Error("Training output must be an existing directory");
     if (config.inputs.some((entry) => inside(entry.source, config.output.source) || inside(config.output.source, entry.source)))
         throw Error("Training output and inputs must not overlap");
@@ -48,7 +66,7 @@ export const prepareTrainingContainer = async (raw, context, args) => {
     let viewerPort;
     for (let index = 0; index < mappedArgs.length; index++) {
         const flag = mappedArgs[index];
-        if (["--train", "--test", "--out", "--cost-config"].includes(flag)) {
+        if (["--train", "--validation", "--test", "--out", "--cost-config"].includes(flag)) {
             const value = mappedArgs[++index];
             if (!value)
                 throw Error(`Missing ${flag} path`);
@@ -76,5 +94,32 @@ export const prepareTrainingContainer = async (raw, context, args) => {
             mappedArgs[index] = String(port);
         }
     }
+    {
+        const flags = mappedArgs.filter(arg => arg === "--concurrency" || arg.startsWith("--concurrency="));
+        if (flags.length > 1)
+            throw Error("Training accepts one --concurrency value");
+        const flag = flags[0];
+        if (flag !== undefined) {
+            const value = flag === "--concurrency" ? mappedArgs[mappedArgs.indexOf(flag) + 1] : flag.slice("--concurrency=".length);
+            if (!value || !/^[1-8]$/u.test(value) || Number(value) > config.slots) {
+                throw Error("Training concurrency must fit the provisioned slots");
+            }
+            if (flag !== "--concurrency")
+                mappedArgs.splice(mappedArgs.indexOf(flag), 1, "--concurrency", value);
+        }
+    }
+    if (missingOutput) {
+        await allocateTrainingOutputParent(config.output.source);
+        try {
+            await mkdir(config.output.source, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        if (await realpath(config.output.source) !== config.output.source || !(await lstat(config.output.source)).isDirectory()) {
+            throw Error("Training output must be a canonical directory");
+        }
+    }
     return { config, context: mapped, args: mappedArgs, ...(viewerPort === undefined ? {} : { viewerPort }) };
 };

package/dist/compiler/training/container/security.d.ts

@@ -1,15 +1,17 @@
 export declare const TRAINING_BROKER_ENTRYPOINT = "/opt/training/bin/train-broker";
+/** Same output directory is the same resumable run; different outputs never share a counter. */
+export declare const trainingRunRequestMount: (outputSource: string, args: readonly string[]) => string;
 /**
- * Writable state of a broker-capable training container, all on tmpfs.
+ * Disposable state of a broker-capable training container, all on tmpfs.
  *
  * The image root stays read-only and nothing here is a host bind, so a trial's
  * worker home, workspace, turn store, wake-acceptance store and ledgers are
  * on a filesystem that enforces unix ownership — which is what lets the slot
  * supervisor's worker-uid canaries mean anything (P0 §5: a host bind under
  * Docker Desktop or Colima silently ignores `chown`). The Grok realm is the
- * one durable mount, and it is a named volume, not a bind.
+ * credential mount. The run request counter has its own persistent named volume.
  */
-export declare const trainingBrokerTmpfsTargets: () => readonly {
+export declare const trainingBrokerTmpfsTargets: (slots?: number) => readonly {
     path: string;
     size: string;
     mode: string;

package/dist/compiler/training/container/security.js

@@ -1,26 +1,36 @@
+import { createHash } from "node:crypto";
 import { DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, materializeDaimonGrokSeccompProfile } from "../../../shared/index.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
 import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
-import { TRAINING_BROKER_TMPDIR, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_PAIDEIA_ROOT, TRAINING_SLOT_ROOT, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_WORKER_ROOT } from "../broker/paths.js";
+import { TRAINING_BROKER_TMPDIR, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_PAIDEIA_ROOT, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_WORKER_ROOT } from "../broker/paths.js";
 export const TRAINING_BROKER_ENTRYPOINT = "/opt/training/bin/train-broker";
+/** Same output directory is the same resumable run; different outputs never share a counter. */
+export const trainingRunRequestMount = (outputSource, args) => {
+    const index = args.indexOf("--out"), output = args[index + 1];
+    if (index < 0 || !output || args.lastIndexOf("--out") !== index)
+        throw Error("Brokered training requires one --out directory");
+    const identity = createHash("sha256").update(JSON.stringify([outputSource, output])).digest("hex");
+    return `type=volume,src=spawnfile-training-budget-${identity},dst=${TRAINING_RUN_REQUEST_STORE}`;
+};
 /**
- * Writable state of a broker-capable training container, all on tmpfs.
+ * Disposable state of a broker-capable training container, all on tmpfs.
  *
  * The image root stays read-only and nothing here is a host bind, so a trial's
  * worker home, workspace, turn store, wake-acceptance store and ledgers are
  * on a filesystem that enforces unix ownership — which is what lets the slot
  * supervisor's worker-uid canaries mean anything (P0 §5: a host bind under
  * Docker Desktop or Colima silently ignores `chown`). The Grok realm is the
- * one durable mount, and it is a named volume, not a bind.
+ * credential mount. The run request counter has its own persistent named volume.
  */
-export const trainingBrokerTmpfsTargets = () => [
+export const trainingBrokerTmpfsTargets = (slots = 4) => [
     { path: "/tmp", size: "1g", mode: "1777" },
     { path: "/var/tmp", size: "256m", mode: "1777" },
     { path: "/work", size: "4g", mode: "0755" },
     { path: "/home/training", size: "1g", mode: "0755" },
     { path: TRAINING_PAIDEIA_ROOT, size: "64m", mode: "0755" },
-    { path: TRAINING_SLOT_ROOT, size: "4g", mode: "0755" },
+    ...trainingSlotDescriptors(slots).map(p => ({ path: p.root, size: "4g", mode: "0711" })),
+    { path: TRAINING_TURN_STORE_ROOT, size: "256m", mode: "0700" },
     { path: TRAINING_GRANT_HOME_ROOT, size: "64m", mode: "0755" },
     { path: TRAINING_INFERENCE_DIRECTORY, size: "64m", mode: "0755" },
     { path: TRAINING_SUPERVISOR_DIRECTORY, size: "16m", mode: "0755" },

package/dist/compiler/training/container/subjectIsolation.d.ts

@@ -0,0 +1,5 @@
+import { type TrainingContext } from "../contract.js";
+/** Resolve host-side subject policy; the public v1 context carries no sandbox authority. */
+export declare const assertTrainingSubjectIsolation: (config: {
+    subjectIsolation?: "codex-native-sandbox";
+}, context: TrainingContext) => Promise<void>;

package/dist/compiler/training/container/subjectIsolation.js

@@ -0,0 +1,15 @@
+import { resolveDaimonEngine } from "../../../runtime/daimon/config.js";
+import { resolveTrainingContextGraph } from "../context.js";
+import { trainingContextSchema } from "../contract.js";
+/** Resolve host-side subject policy; the public v1 context carries no sandbox authority. */
+export const assertTrainingSubjectIsolation = async (config, context) => {
+    if (config.subjectIsolation !== "codex-native-sandbox")
+        return;
+    const parsed = trainingContextSchema.parse(context);
+    const { selected } = await resolveTrainingContextGraph(parsed.project.manifest, parsed.agent.id);
+    const agent = selected.value;
+    if (agent.runtime.name !== "daimon" || resolveDaimonEngine(agent) !== "codex" ||
+        agent.runtime.options.codex_policy !== "workspace-no-network" || agent.execution?.sandbox?.mode !== "workspace") {
+        throw Error("codex-native-sandbox subject isolation requires the selected training agent to use runtime daimon, engine codex, and strict codex_policy: workspace-no-network (execution.sandbox.mode: workspace)");
+    }
+};

package/dist/compiler/training/context.d.ts

@@ -1,7 +1,15 @@
+import type { CompilePlanNode, ResolvedAgentNode } from "../types.js";
 import { type TrainingContext } from "./contract.js";
 export interface CreateTrainingContextOptions {
     agent?: string;
     packageVersion: string;
 }
+/** Internal host-side resolution shared by context capture and subject admission. */
+export declare const resolveTrainingContextGraph: (inputPath: string, selector?: string) => Promise<{
+    plan: import("../types.js").CompilePlan;
+    selected: CompilePlanNode & {
+        value: ResolvedAgentNode;
+    };
+}>;
 /** Resolves the complete project, preserving inherited selection and source provenance. */
 export declare const createTrainingContext: (inputPath: string, options: CreateTrainingContextOptions) => Promise<TrainingContext>;

package/dist/compiler/training/context.js

@@ -6,6 +6,8 @@ import { getManifestPath } from "../../filesystem/index.js";
 import { buildCompilePlan } from "../buildCompilePlan.js";
 import { stableStringify } from "../helpers.js";
 import { resolveEffectiveModelTarget } from "../modelEnv.js";
+import { pinWorkspaceBundle } from "../workspaceBundleResolve.js";
+import { selectTrainingAgent } from "./selection.js";
 import { TRAINING_CONTEXT_VERSION, trainingContextSchema } from "./contract.js";
 const sha256 = (value) => `sha256:${createHash("sha256").update(value).digest("hex")}`;
 const invalid = (message) => { throw new SpawnfileError("validation_error", message); };
@@ -13,17 +15,15 @@ const inside = (root, file) => {
     const relative = path.relative(root, file);
     return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 };
-/** Resolves the complete project, preserving inherited selection and source provenance. */
-export const createTrainingContext = async (inputPath, options) => {
+/** Internal host-side resolution shared by context capture and subject admission. */
+export const resolveTrainingContextGraph = async (inputPath, selector) => {
     const plan = await buildCompilePlan(await realpath(getManifestPath(inputPath)));
     const agents = plan.nodes.filter((node) => node.kind === "agent");
-    const selected = options.agent === undefined
-        ? agents.length === 1 ? agents[0] : undefined
-        : agents.find((node) => node.id === options.agent);
-    if (!selected)
-        invalid(options.agent === undefined
-            ? "Training requires --agent with an exact node id when the project does not contain exactly one agent"
-            : `No canonical agent matches ${options.agent}`);
+    return { plan, selected: selectTrainingAgent(agents, selector) };
+};
+/** Resolves the complete project, preserving inherited selection and source provenance. */
+export const createTrainingContext = async (inputPath, options) => {
+    const { plan, selected } = await resolveTrainingContextGraph(inputPath, options.agent);
     const agent = selected.value;
     const manifest = await realpath(plan.root);
     const root = path.dirname(manifest);
@@ -83,11 +83,11 @@ export const createTrainingContext = async (inputPath, options) => {
             model: primary ? { provider: primary.provider, name: primary.name, authMethod: primary.auth.method } : null
         },
         sources, documents, skills,
-        resources: (agent.workspaceResources ?? []).map((resource) => ({
+        resources: await Promise.all((agent.workspaceResources ?? []).map(async (resource) => ({
             id: resource.id, kind: resource.kind, mount: resource.mount, mode: resource.mode, sharing: resource.sharing,
             definitionDigest: sha256(stableStringify(resource)),
-            pin: resource.kind === "bundle" ? resource.sha256 : resource.kind === "git" ? resource.ref ?? null : null
-        })),
+            pin: resource.kind === "bundle" ? await pinWorkspaceBundle(resource) : resource.kind === "git" ? resource.ref ?? null : null
+        }))),
         requirements: { nativeCompilation: true, isolatedPreparation: true }
     });
 };

package/dist/compiler/training/contract.d.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 export declare const TRAINING_CONTEXT_VERSION: "spawnfile.training-context.v1";
+export declare const TRAINING_EXECUTION_CAPABILITY_LABEL = "com.spawnfile.training.execution";
+export declare const TRAINING_EXECUTION_VERSION = "spawnfile.training-execution.v1";
 export declare const trainingSourceSchema: z.ZodObject<{
     sourcePath: z.ZodString;
     destinationPath: z.ZodString;

package/dist/compiler/training/contract.js

@@ -1,5 +1,7 @@
 import { z } from "zod";
 export const TRAINING_CONTEXT_VERSION = "spawnfile.training-context.v1";
+export const TRAINING_EXECUTION_CAPABILITY_LABEL = "com.spawnfile.training.execution";
+export const TRAINING_EXECUTION_VERSION = "spawnfile.training-execution.v1";
 const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
 const absolutePath = z.string().min(1).regex(/^(?:\/|[A-Za-z]:[\\/])/u);
 const relativePath = z.string().min(1).regex(/^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[^\\]+$/u);