spawnfile 0.1.17 → 0.1.18

package/dist/compiler/cleanCompileOutput.d.ts

@@ -0,0 +1,2 @@
+/** Deployment records and histories are host state, not replaceable compile output. */
+export declare const cleanCompileOutput: (directory: string) => Promise<void>;

package/dist/compiler/cleanCompileOutput.js

@@ -0,0 +1,14 @@
+import path from "node:path";
+import { readdir, rm } from "node:fs/promises";
+/** Deployment records and histories are host state, not replaceable compile output. */
+export const cleanCompileOutput = async (directory) => {
+    const entries = await readdir(directory).catch((error) => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    for (const entry of entries)
+        if (entry !== "deployments") {
+            await rm(path.join(directory, entry), { recursive: true, force: true });
+        }
+};

package/dist/compiler/compilePlanHelpers.js

@@ -26,6 +26,7 @@ export const getAgentFingerprint = (node) => stableStringify({
         requiresMcp: skill.requiresMcp
     })),
     surfaces: node.surfaces,
+    training: node.training,
     workspaceResources: node.workspaceResources
 });
 export const getTeamFingerprint = (node) => stableStringify({
@@ -35,6 +36,7 @@ export const getTeamFingerprint = (node) => stableStringify({
     lead: node.lead,
     external: node.external,
     networks: node.networks ?? [],
+    training: node.training,
     workspaceResources: node.workspaceResources,
     shared: {
         env: node.shared.env,

package/dist/compiler/compileProject.d.ts

@@ -1,10 +1,20 @@
+import type { DaimonContractManifest } from "../runtime/daimon/contractManifest.js";
 import { CompileReport } from "../report/index.js";
 import { type RuntimePackageOverrideRequest } from "./containerPackageOverrides.js";
+import type { BundleIdentityMode } from "./workspaceBundleFiles.js";
 import { type MoltnetTargetArchitecture } from "./moltnetBinaries.js";
 import { type OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
 export { createOrganizationReadinessEvidence, ORGANIZATION_READINESS_EVIDENCE_VERSION } from "./organizationReadyEvidence.js";
 export type { CreateOrganizationReadinessEvidenceInput, OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
 export interface CompileProjectOptions {
+    /** Test seam for the receipt-bound manifest; normal compilation uses the verified vendored bytes. */
+    daimonContractManifest?: DaimonContractManifest;
+    /** Docker CLI for dependency installs and image-run generated bundle steps; defaults to `docker`. */
+    bundleDockerCommand?: string;
+    /** Cache for built workspace bundles; defaults to `$SPAWNFILE_HOME/cache/workspace-bundles`. */
+    bundleCacheDirectory?: string;
+    /** `release` builds bundles only from clean committed inputs; `dev` (default) includes uncommitted edits. */
+    bundleIdentity?: BundleIdentityMode;
     clean?: boolean;
     containerArchitecture?: MoltnetTargetArchitecture;
     /** Stable deployment identity for exclusive credential-realm reattachment. */

package/dist/compiler/compileProject.js

@@ -1,6 +1,8 @@
+import { cleanCompileOutput } from "./cleanCompileOutput.js";
+import { assertRecordingCapability } from "./recordingCapability.js";
 import path from "node:path";
 import { chmod } from "node:fs/promises";
-import { ensureDirectory, removeDirectory } from "../filesystem/index.js";
+import { ensureDirectory } from "../filesystem/index.js";
 import { createCompileReport, createDiagnostic, writeCompileReport } from "../report/index.js";
 import { DEFAULT_OUTPUT_DIRECTORY } from "../shared/index.js";
 import { assertRuntimeCanCompile, createRuntimeLifecycleDiagnostics, getRuntimeAdapter, resolveNoopolisRunId } from "../runtime/index.js";
@@ -8,6 +10,8 @@ import { buildCompilePlan } from "./buildCompilePlan.js";
 import { createContainerArtifacts } from "./containerArtifacts.js";
 import { stageRuntimePackageOverrides } from "./containerPackageOverrides.js";
 import { stageWorkspaceBundles } from "./workspaceBundleArtifacts.js";
+import { resolveWorkspaceBundles } from "./workspaceBundleResolve.js";
+import { resolveWorkspaceGitPins } from "./workspaceGitPins.js";
 import { augmentNodeReports } from "./compileProjectReports.js";
 import { enforcePolicy } from "./compileProjectPolicy.js";
 import { injectMoltnetWorkspaceFiles, injectTeamCompileSupportFiles, prepareTeamCompileSupport, writeEmittedFiles } from "./compileProjectSupport.js";
@@ -141,6 +145,7 @@ const compileTeamNode = async (baseDirectory, node) => {
 };
 export const compileProject = async (inputPath, options = {}) => {
     const plan = await buildCompilePlan(inputPath);
+    await assertRecordingCapability(plan, options.daimonContractManifest);
     const worldBindings = options.worldBindingsPath === undefined
         ? undefined
         : await loadWorldBindingsForCompile(plan, options.worldBindingsPath, resolveNoopolisRunId(process.env));
@@ -150,9 +155,22 @@ export const compileProject = async (inputPath, options = {}) => {
         ? path.resolve(options.outputDirectory)
         : path.join(path.dirname(plan.root), DEFAULT_OUTPUT_DIRECTORY);
     if (options.clean ?? true) {
-        await removeDirectory(outputDirectory);
+        await cleanCompileOutput(outputDirectory);
     }
     await ensureDirectory(outputDirectory);
+    const workspaceBundles = await resolveWorkspaceBundles(plan, {
+        architecture: options.containerArchitecture,
+        cacheDirectory: options.bundleCacheDirectory,
+        ...(options.bundleDockerCommand !== undefined ? { dockerCommand: options.bundleDockerCommand } : {}),
+        identity: options.bundleIdentity,
+        outputDirectory
+    });
+    const workspaceGitPins = await resolveWorkspaceGitPins(plan, {
+        architecture: options.containerArchitecture,
+        bundleCacheDirectory: options.bundleCacheDirectory,
+        identity: options.bundleIdentity,
+        outputDirectory
+    });
     const teamCompileSupport = await prepareTeamCompileSupport(plan);
     const nodeReports = [];
     const compiledNodes = [];
@@ -180,7 +198,7 @@ export const compileProject = async (inputPath, options = {}) => {
         : undefined;
     await injectMoltnetWorkspaceFiles(outputDirectory, compiledNodes, moltnetArtifacts);
     const resolvedRuntimePackageOverrides = await stageRuntimePackageOverrides(outputDirectory, options.runtimePackageOverrides);
-    const hasWorkspaceBundles = await stageWorkspaceBundles(outputDirectory, plan);
+    const hasWorkspaceBundles = await stageWorkspaceBundles(outputDirectory, plan, new Map([...workspaceBundles.built, ...workspaceGitPins.built]));
     const generatedAt = new Date().toISOString();
     const containerArtifacts = await createContainerArtifacts(plan, compiledNodes, {
         deploymentLineage: options.deploymentLineage,
@@ -190,6 +208,8 @@ export const compileProject = async (inputPath, options = {}) => {
         moltnet: moltnetArtifacts,
         moltnetRelease,
         runtimePackageOverrides: resolvedRuntimePackageOverrides,
+        workspaceGitResources: workspaceGitPins.report,
+        workspaceBundles: workspaceBundles.report,
         ...(worldBindings ? { worldBindings } : {})
     });
     await writeEmittedFiles(outputDirectory, containerArtifacts.files);
@@ -200,6 +220,12 @@ export const compileProject = async (inputPath, options = {}) => {
         outputDirectory,
         projectName: containerArtifacts.distribution.report.organization.project
     });
+    if (workspaceBundles.report.length > 0)
+        report.workspace_bundles = workspaceBundles.report;
+    if (workspaceGitPins.report.length > 0)
+        report.workspace_git_resources = workspaceGitPins.report;
+    if (containerArtifacts.distribution.report.recording)
+        report.recording = containerArtifacts.distribution.report.recording;
     const reportPath = await writeCompileReport(outputDirectory, report);
     const organizationReadinessEvidence = createOrganizationReadinessEvidence({
         compileVersion: report.spawnfile_version,

package/dist/compiler/containerArtifactSummaries.js

@@ -71,6 +71,7 @@ export const createMoltnetSummary = (moltnet, release) => {
     }
     return {
         node_plans: moltnet.nodePlans.map((plan) => ({
+            ...(plan.sourceNodeId ? { node_id: plan.sourceNodeId } : {}),
             config_path: plan.configPath,
             ...(plan.credentialAgentId ? { credential_agent_id: plan.credentialAgentId } : {}),
             ...(plan.credentialId ? { credential_id: plan.credentialId } : {}),

package/dist/compiler/containerArtifacts.d.ts

@@ -1,3 +1,4 @@
+import type { CompileReport } from "../report/index.js";
 import { type RuntimeContainerPackageOverrides } from "../runtime/index.js";
 import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
 import type { MoltnetReleaseIdentity } from "./moltnetBinaries.js";
@@ -13,10 +14,9 @@ export interface ContainerArtifactOptions {
     moltnet?: MoltnetArtifacts | null;
     moltnetRelease?: MoltnetReleaseIdentity;
     worldBindings?: ResolvedWorldBindings;
-    /** Resolved local overrides for runtime install npm packages, produced by
-     * stageRuntimePackageOverrides.ts from a compile-time-only
-     * RuntimePackageOverrideRequest (see compileProject.ts). Undefined for a
-     * standard compile. */
+    workspaceGitResources?: CompileReport["workspace_git_resources"];
+    workspaceBundles?: CompileReport["workspace_bundles"];
+    /** Opt-in install overrides resolved by stageRuntimePackageOverrides. */
     runtimePackageOverrides?: RuntimeContainerPackageOverrides;
 }
 export declare const createContainerArtifacts: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[], options?: ContainerArtifactOptions) => Promise<GeneratedContainerArtifacts>;

package/dist/compiler/containerArtifacts.js

@@ -8,35 +8,15 @@ import { createDockerIgnoreContent } from "./dockerBuildContext.js";
 import { createDaimonTelemetryArtifacts } from "./daimonTelemetryArtifacts.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
 import { createMemoryArtifactBundle } from "./memoryArtifacts.js";
+import { resolveRecordingReport } from "./recordingReport.js";
 import { resolveWorkspaceResourceVolumes } from "./containerTargetResources.js";
 import { mergePersistentMounts } from "./containerPersistentMounts.js";
 import { SIMFILE_WORLD_BINDINGS_VERSION, WORLD_BINDINGS_OUTPUT_FILE } from "./worldBindings.js";
 /**
- * Enforces the `specs/SURFACES.md` Moltnet/daimon promise: "A release without
- * `daimon-bridge` is rejected; the public pi-only release cannot be relabeled
- * as dual-capability."
- *
- * A daimon Moltnet attachment lowers a node runtime config of
- * `kind: "daimon"` carrying `agent_id`, `token_env`, and `receipt_store_path`
- * (`./moltnetRuntimeConfig.ts`). No published Moltnet release implements that
- * kind -- `pkg/bridgeconfig` has no `RuntimeDaimon` through the latest tag, and
- * `pkg/nodeconfig` decodes with `DisallowUnknownFields()`, so the node exits on
- * `agent_id` at strict decode, before `Validate()` is even reached. The
- * entrypoint launches `moltnet node <config> &` and then `wait -n`
- * (`./containerEntrypointRender.ts`), so that exit tears the whole container
- * down. Both a locally built Moltnet (`./localMoltnetAuthority.ts`) and, since
- * the v0.1.18 pin, the published authority (`./moltnetReleaseAuthority.ts`) can
- * advertise `daimon-bridge`; anything older, including every release through
- * v0.1.17, advertises only `pi-bridge` and is still rejected here.
- *
- * This throws rather than warning, which is the opposite call from the other
- * unlowerable-declaration diagnostics in this compiler. Those keep working
- * projects compiling; here every affected project is already broken, and the
- * failure it replaces is an opaque JSON decode error at container boot.
- *
- * `receiptStorePath` is set on a node plan if and only if the attached agent's
- * runtime is daimon (`./moltnetArtifacts.ts`), so it is the exact daimon
- * signal on an already-resolved plan.
+ * Refuse a Daimon attachment unless the pinned Moltnet release advertises
+ * daimon-bridge (specs/SURFACES.md). Older pi-only releases reject its config
+ * and tear down the container at boot. receiptStorePath identifies resolved
+ * Daimon attachments; unsupported configs are errors, never degradations.
  */
 const assertMoltnetDaimonBridgeCapability = (moltnet, release) => {
     const daimonNetworks = [...new Set((moltnet?.nodePlans ?? [])
@@ -95,6 +75,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .map((variable) => variable.name)
         .sort();
     const memoryArtifacts = createMemoryArtifactBundle(plan, options.deploymentLineage);
+    const recording = resolveRecordingReport(plan, memoryArtifacts.memories, options.workspaceGitResources);
     const { resources: resolvedWorkspaceResources, mounts: workspaceResourceMounts } = resolveWorkspaceResourceVolumes(runtimePlans);
     const persistentMountCandidates = [
         ...memoryArtifacts.mounts,
@@ -130,6 +111,9 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         .map((plan) => {
         const telemetryMountIds = daimonTelemetryArtifacts.telemetryMountIdsByInstance.get(plan.id);
         return {
+            ...(plan.agentPathsByNodeId ? { agent_paths: Object.fromEntries(Object.entries(plan.agentPathsByNodeId).map(([id, paths]) => [id, {
+                        workspace_path: paths.workspacePath, home_path: paths.homePath, skill_roots: paths.skillRoots
+                    }])) } : {}),
             config_path: plan.instancePaths.configPath,
             home_path: plan.instancePaths.homePath ?? null,
             id: plan.id,
@@ -202,15 +186,10 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         modelAuthMethods: mergedModelAuthMethods,
         moltnetNetworks,
         organization,
-        // The report deliberately omits the compiler-DERIVED volume name: it
-        // encodes the creator's plan root and deployment lineage and is private to
-        // that host. An author-DECLARED name is different — it is part of the
-        // declaration the image publishes, so a consumer must honour it verbatim
-        // or an operator who pre-created that volume silently gets an empty one.
+        // Derived volume names encode private host paths. Only author-declared
+        // names are portable; image consumers must honor them verbatim.
         persistentMounts: persistentMounts.map((mount) => ({
-            ...(mount.declared_volume_name
-                ? { declared_volume_name: mount.declared_volume_name }
-                : {}),
+            ...(mount.declared_volume_name ? { declared_volume_name: mount.declared_volume_name } : {}),
             durability: "persistent",
             id: mount.id,
             kind: "volume",
@@ -219,6 +198,11 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
         })),
         portMappings,
         publishedPorts,
+        ...(recording ? {
+            recording,
+            workspaceGitResources: options.workspaceGitResources?.map(({ id, commit, sha256, agent_node_ids, declared_by }) => ({ id, commit, sha256, agent_node_ids: agent_node_ids, ...(declared_by ? { declared_by } : {}) })),
+            workspaceBundles: options.workspaceBundles?.map(({ id, sha256, origin, agent_node_ids, declared_by }) => ({ id, sha256, origin, agent_node_ids: agent_node_ids, ...(declared_by ? { declared_by } : {}) }))
+        } : {}),
         resources: workspaceResources.map((resource) => ({
             id: resource.id,
             kind: resource.kind,
@@ -227,7 +211,7 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             mount: resource.mount,
             sharing: resource.sharing
         })),
-        runtimeInstances,
+        runtimeInstances: runtimeInstances.map(({ agent_paths: _paths, ...instance }) => instance),
         ...(worldBindingsEvidence ? { worldBindings: worldBindingsEvidence } : {})
     });
     const distributionLabels = createDistributionImageLabels(projectSlug, distributionReport.compile_fingerprint);

package/dist/compiler/containerArtifactsPlans.js

@@ -93,9 +93,16 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBinding
             const instancePaths = resolveInstancePaths(runtimeName, target.id, adapter.container);
             const portStride = adapter.container.portStride ?? 1;
             runtimePlans.push({
+                ...(target.agentPathsByNodeId ? { agentPathsByNodeId: Object.fromEntries(Object.entries(target.agentPathsByNodeId).map(([id, paths]) => {
+                        const expand = (value) => value.replaceAll("<instance-root>", instancePaths.instanceRoot)
+                            .replaceAll("<workspace-path>", instancePaths.workspacePath);
+                        return [id, { workspacePath: expand(paths.workspacePath),
+                                homePath: paths.homePath === null ? null : expand(paths.homePath), skillRoots: paths.skillRoots.map(expand) }];
+                    })) } : {}),
                 configEnvBindings: resolveTargetConfigEnvBindings(adapter.container, target) ?? [],
                 ...(target.engineByNodeId ? { engineByNodeId: target.engineByNodeId } : {}),
                 ...(target.grokModelByNodeId ? { grokModelByNodeId: target.grokModelByNodeId } : {}),
+                ...(target.grokTurnLimitsByNodeId ? { grokTurnLimitsByNodeId: target.grokTurnLimitsByNodeId } : {}),
                 envFiles: resolveTargetEnvFiles(instancePaths.configPath, target),
                 packages: resolveTargetPackages(target, targetInputs),
                 id: target.id,

package/dist/compiler/containerArtifactsTypes.d.ts

@@ -14,6 +14,7 @@ export interface ContainerEnvVariable {
     required: boolean;
 }
 export interface RuntimeTargetPlan {
+    agentPathsByNodeId?: import("../runtime/types.js").ContainerTarget["agentPathsByNodeId"];
     configEnvBindings?: RuntimeContainerConfigEnvBinding[];
     /** Passthrough of `ContainerTarget.engineByNodeId` (see `runtime/types.ts`), for
      * `containerArtifacts.ts` to stamp onto `ContainerRuntimeInstanceReport.engine_by_node_id`. */
@@ -23,6 +24,12 @@ export interface RuntimeTargetPlan {
         model: string;
         reasoningEffort: string;
     }>;
+    /** Passthrough of `ContainerTarget.grokTurnLimitsByNodeId` for the Daimon broker worker render. */
+    grokTurnLimitsByNodeId?: Record<string, {
+        maxRequests?: number;
+        maxTokens?: number;
+        timeoutMs?: number;
+    }>;
     packages?: ResolvedPackage[];
     envFiles: Array<{
         envName: string;

package/dist/compiler/containerDaimonBrokerRender.d.ts

@@ -109,4 +109,6 @@ optionalDenyPaths?: readonly string[],
  * pass a path outside it: a `tmp/` inside a cleared root is a mount point in
  * the training launch, and clearing a mount point fails `EBUSY`.
  */
-brokerTmpdir?: string) => string[];
+brokerTmpdir?: string, 
+/** Root-owned training deny targets, created after root reset and before worker attestation. */
+beforeWorkerProvisioning?: readonly string[]) => string[];

package/dist/compiler/containerDaimonBrokerRender.js

@@ -146,7 +146,9 @@ optionalDenyPaths,
  * pass a path outside it: a `tmp/` inside a cleared root is a mount point in
  * the training launch, and clearing a mount point fails `EBUSY`.
  */
-brokerTmpdir = DAIMON_BROKER_TMPDIR) => {
+brokerTmpdir = DAIMON_BROKER_TMPDIR, 
+/** Root-owned training deny targets, created after root reset and before worker attestation. */
+beforeWorkerProvisioning = []) => {
     const program = [
         "const crypto = require('node:crypto'); const fs = require('node:fs');",
         `const registrations = ${JSON.stringify(registrations.map(({ agentId, home, slot, uid, workspace }) => ({ agentId, home, slot, uid, workspace })))};`,
@@ -169,8 +171,8 @@ brokerTmpdir = DAIMON_BROKER_TMPDIR) => {
         `const atomicOwned = (target, bytes) => { const temporary = \`${"${target}"}.\${process.pid}.\${crypto.randomUUID()}.tmp\`; try { const output = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600); try { let written = 0; while (written < bytes.length) written += fs.writeSync(output, bytes, written, bytes.length - written, written); fs.fchmodSync(output, 0o600); fs.fchownSync(output, 2100, 2100); fs.fsyncSync(output); } finally { fs.closeSync(output); } fs.renameSync(temporary, target); const directory = fs.openSync(require('node:path').dirname(target), fs.constants.O_RDONLY | fs.constants.O_DIRECTORY); try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); } } catch (error) { try { fs.unlinkSync(temporary); } catch {} throw error; } };`,
         "let existing; try { existing = fs.lstatSync(authority); } catch (error) { if (error.code !== 'ENOENT') throw error; } const bootstrapBytes = readSecure(bootstrap, undefined, 'bootstrap'); let bootstrapRecord; try { const root = JSON.parse(bootstrapBytes.toString('utf8')), rows = root && typeof root === 'object' && !Array.isArray(root) ? Object.entries(root).filter(([key, value]) => /^https:\\/\\/auth\\.x\\.ai::/.test(key) && value && typeof value === 'object' && !Array.isArray(value)).map(([, value]) => value) : []; if (rows.length !== 1 || typeof rows[0].key !== 'string' || !rows[0].key.trim() || typeof rows[0].refresh_token !== 'string' || !rows[0].refresh_token.trim() || typeof rows[0].expires_at !== 'string' || !Number.isFinite(Date.parse(rows[0].expires_at))) throw new Error(); bootstrapRecord = true; } catch { bootstrapBytes.fill(0); throw new Error('invalid broker credential bootstrap'); } if (!bootstrapRecord) throw new Error('invalid broker credential bootstrap'); const bootstrapDigest = crypto.createHash('sha256').update(bootstrapBytes).digest('hex');",
         `const journalRoot = '${DAIMON_BROKER_REALM}/.daimon-broker'; let journalRootExists = false; try { const info = fs.lstatSync(journalRoot); if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== 2100 || info.gid !== 2100 || (info.mode & 0o777) !== 0o700) throw new Error('unsafe broker credential journal directory'); fs.chownSync(journalRoot, 0, 0); fs.chmodSync(journalRoot, 0o700); journalRootExists = true; } catch (error) { if (error.code !== 'ENOENT') throw error; }`,
-        `try { const journalPath = '${DAIMON_BROKER_REALM}/.daimon-broker/credential-journal.json'; let journal; try { const raw = readSecure(journalPath, 2100, 'recovery journal'); journal = JSON.parse(raw.toString('utf8')); raw.fill(0); } catch (error) { if (error.code !== 'ENOENT') throw error; } const stale = journal?.version === 'noopolis.daimon.broker-credential-journal.v1' && journal.state === 'stale'; const recover = () => { if (!stale || !Number.isSafeInteger(journal.generation) || journal.generation < 0 || !/^[a-f0-9]{64}$/.test(journal.sourceDigest) || journal.sourceDigest !== journal.promotedDigest || bootstrapDigest === journal.sourceDigest) throw new Error('unsafe broker credential recovery'); atomicOwned(authority, bootstrapBytes); const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } }; if (!existing) { if (stale) recover(); else atomicOwned(authority, bootstrapBytes); } else { const authorityBytes = readSecure(authority, 2100, 'authority'); try { const authorityDigest = crypto.createHash('sha256').update(authorityBytes).digest('hex'); if (stale) { if (authorityDigest !== journal.sourceDigest && authorityDigest !== bootstrapDigest) throw new Error('unsafe broker credential recovery'); if (authorityDigest === bootstrapDigest) { const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } } else recover(); } } finally { authorityBytes.fill(0); } } } finally { bootstrapBytes.fill(0); }`,
-        "if (journalRootExists) { fs.chownSync(journalRoot, 0, 0); fs.chmodSync(journalRoot, 0o700); fs.chownSync(journalRoot, 2100, 2100); }",
+        "const credentialExpiry = (bytes) => { try { const rows = Object.entries(JSON.parse(bytes.toString('utf8'))).filter(([key]) => /^https:\\/\\/auth\\.x\\.ai::/.test(key)).map(([, value]) => value); const expiry = rows.length === 1 && typeof rows[0]?.expires_at === 'string' ? Date.parse(rows[0].expires_at) : NaN; if (!Number.isFinite(expiry)) throw new Error(); return expiry; } catch { throw new Error('invalid broker credential expiry'); } };",
+        `try { const journalPath = '${DAIMON_BROKER_REALM}/.daimon-broker/credential-journal.json'; let journal; try { const raw = readSecure(journalPath, 2100, 'recovery journal'); journal = JSON.parse(raw.toString('utf8')); raw.fill(0); } catch (error) { if (error.code !== 'ENOENT') throw error; } const stale = journal?.version === 'noopolis.daimon.broker-credential-journal.v1' && journal.state === 'stale'; const recover = () => { if (!stale || !Number.isSafeInteger(journal.generation) || journal.generation < 0 || !/^[a-f0-9]{64}$/.test(journal.sourceDigest) || journal.sourceDigest !== journal.promotedDigest || bootstrapDigest === journal.sourceDigest) throw new Error('unsafe broker credential recovery'); atomicOwned(authority, bootstrapBytes); const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } }; if (!existing) { if (journal) throw new Error('broker credential authority missing; refusing bootstrap rollback'); else atomicOwned(authority, bootstrapBytes); } else { const authorityBytes = readSecure(authority, 2100, 'authority'); try { const authorityDigest = crypto.createHash('sha256').update(authorityBytes).digest('hex'); if (stale) { if (authorityDigest !== journal.sourceDigest && authorityDigest !== bootstrapDigest) throw new Error('unsafe broker credential recovery'); if (authorityDigest === bootstrapDigest && bootstrapDigest === journal.sourceDigest) throw new Error('unsafe broker credential recovery'); if (authorityDigest !== bootstrapDigest && credentialExpiry(bootstrapBytes) <= credentialExpiry(authorityBytes)) throw new Error('older broker bootstrap cannot recover newer realm'); if (authorityDigest === bootstrapDigest) { const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } } else recover(); } } finally { authorityBytes.fill(0); } } } finally { bootstrapBytes.fill(0); if (journalRootExists) { fs.chownSync(journalRoot, 0, 0); fs.chmodSync(journalRoot, 0o700); fs.chownSync(journalRoot, 2100, 2100); } fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700); fs.chownSync('${DAIMON_BROKER_REALM}', 2100, 2100); }`,
         ...renderDaimonWorkspaceResourceSecurity(workspaceResources),
         ...renderDaimonGrokWorkerProvisioning(registrations, serviceOptions, ...(optionalDenyPaths ? [optionalDenyPaths] : [])),
         `fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700); fs.chownSync('${DAIMON_BROKER_REALM}', 2100, 2100);`,
@@ -184,6 +186,7 @@ brokerTmpdir = DAIMON_BROKER_TMPDIR) => {
             : [...MOUNT_AWARE_CLEAR_HELPER, "for broker_root in /etc/daimon-engine-broker /run/daimon-engine-broker; do spawnfile_clear_tree \"$broker_root\"; done"]),
         `install -d -o root -g ${DAIMON_BROKER_UID} -m 0731 /run/daimon-engine-broker`,
         `install -d -o ${DAIMON_BROKER_UID} -g ${DAIMON_BROKER_UID} -m 0700 ${brokerTmpdir}`,
+        ...beforeWorkerProvisioning,
         "node <<'SPAWNFILE_DAIMON_BROKER_PROVISION'",
         program,
         "SPAWNFILE_DAIMON_BROKER_PROVISION"

package/dist/compiler/containerDaimonGrokTaskClock.d.ts

@@ -0,0 +1,5 @@
+import type { DaimonGrokRegistration } from "./containerDaimonGrokWorkerRender.js";
+/** Exit without closing/unlinking the listener: the next process needs a socket inode, not a live peer. */
+export declare const GROK_SOCKET_PLACEHOLDER_PROGRAM: string;
+/** Lines inside the shared root program, after its canonical-path and ownership helpers. */
+export declare const renderDaimonGrokTaskClockProvisioning: (registrations: readonly DaimonGrokRegistration[]) => string[];

package/dist/compiler/containerDaimonGrokTaskClock.js

@@ -0,0 +1,29 @@
+import { DAIMON_GROK_ENGINE_BROKER } from "../runtime/daimon/contractManifest.js";
+const broker = DAIMON_GROK_ENGINE_BROKER;
+const clock = broker.worker.taskClock;
+/** Exit without closing/unlinking the listener: the next process needs a socket inode, not a live peer. */
+export const GROK_SOCKET_PLACEHOLDER_PROGRAM = [
+    "const fs = require('node:fs'), net = require('node:net');",
+    "const [file, uid, gid] = process.argv.slice(1);",
+    "const server = net.createServer(); server.on('error', (error) => { console.error(error.message); process.exit(1); });",
+    "server.listen(file, () => { fs.chmodSync(file, 0o600); fs.chownSync(file, Number(uid), Number(gid)); process.exit(0); });"
+].join("\n");
+/** Lines inside the shared root program, after its canonical-path and ownership helpers. */
+export const renderDaimonGrokTaskClockProvisioning = (registrations) => {
+    if (!registrations.some((entry) => entry.configVariant === "clocked"))
+        return [];
+    return [
+        `const taskClock = ${JSON.stringify(clock)};`,
+        `const clocks = ${JSON.stringify(registrations.filter(entry => entry.configVariant === "clocked").map(entry => ({ directoryPath: clock.slotDirectoryPattern.replace("{slot}", String(entry.slot)), timestampFilePath: clock.slotFilePattern.replace("{slot}", String(entry.slot)) })))};`,
+        // All ancestors must stay searchable and non-writable by the worker, including the control root.
+        "for (const entry of grokWorkers) { for (let at = require('node:path').dirname(taskClock.rootDirectoryPath);; at = require('node:path').dirname(at)) { const info = assertCanonical(at, 'task clock ancestor'); const access = info.uid === entry.uid ? (info.mode >> 6) & 7 : info.gid === entry.uid ? (info.mode >> 3) & 7 : info.mode & 7; if (!info.isDirectory() || !(access & 1) || (access & 2)) throw new Error(`unsafe task clock ancestor: ${at}`); if (at === '/') break; } }",
+        "ensureDirectory(taskClock.rootDirectoryPath, 0, 0, taskClock.directoryMode); assertCanonical(taskClock.rootDirectoryPath, 'task clock root');",
+        "for (const current of clocks) { ensureDirectory(current.directoryPath, 0, 0, taskClock.directoryMode); assertCanonical(current.directoryPath, 'task clock');",
+        "ensureExactFile(current.timestampFilePath, '+0\\n', taskClock.fileMode); fs.chownSync(current.timestampFilePath, taskClock.ownerUid, taskClock.ownerUid);",
+        "withMode(current.directoryPath, taskClock.directoryMode, taskClock.ownerUid, taskClock.ownerUid); }",
+        // Startup attestation runs BEFORE the backend listens. All deny targets must already exist,
+        // and the backend only replaces a socket owned by its uid. Listeners unlink these real socket
+        // nodes in turn; readiness must prove replacement, never certify a placeholder as a listener.
+        `for (const socket of ${JSON.stringify([broker.controlSocketPath, broker.backendSocketPath, broker.launcherSocketPath])}) { require('node:child_process').execFileSync(process.execPath, ['-e', ${JSON.stringify(GROK_SOCKET_PLACEHOLDER_PROGRAM)}, socket, '${clock.ownerUid}', '${clock.ownerUid}'], { timeout: 5000, stdio: 'pipe' }); const info = fs.lstatSync(socket); if (!info.isSocket() || info.uid !== ${clock.ownerUid} || info.gid !== ${clock.ownerUid} || (info.mode & 0o7777) !== 0o600) throw new Error('unsafe broker socket placeholder'); }`
+    ];
+};

package/dist/compiler/containerDaimonGrokWorkerProvisioning.d.ts

@@ -26,7 +26,7 @@ export declare const renderDaimonGrokWorkerProvisioning: (registrations: readonl
  * are tmpfs mounts and `/run/secrets` and the shared state roots do not
  * exist there at all.
  */
-optionalDenyPaths?: readonly string[]) => string[];
+optionalDenyPaths?: readonly string[], scope?: "container" | "slot") => string[];
 /**
  * Grok 1.0.34 runs every sandbox profile inside bubblewrap, which needs
  * unprivileged user namespaces. Ubuntu 24.04+ hosts (and Colima's default VM)

package/dist/compiler/containerDaimonGrokWorkerProvisioning.js

@@ -1,4 +1,6 @@
+import { renderDaimonGrokTaskClockProvisioning } from "./containerDaimonGrokTaskClock.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../runtime/daimon/contractManifest.js";
+import { resolveDaimonGrokClockedWorkerConfig, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
 import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
 import { DAIMON_GROK_DENIED_STATE_ROOTS, DAIMON_GROK_OPTIONAL_DENY_PATHS, DAIMON_GROK_WORKER_READ_ONLY_FILES, DAIMON_WORKER_ROOT, renderDaimonGrokServiceConfig } from "./containerDaimonGrokWorkerRender.js";
 /** Only the bytes the program writes; everything else it needs is recomputed or checked in place. */
@@ -51,47 +53,67 @@ export const renderDaimonGrokWorkerProvisioning = (registrations, serviceOptions
  * are tmpfs mounts and `/run/secrets` and the shared state roots do not
  * exist there at all.
  */
-optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS]) => [
+optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS], scope = "container") => [
     `const grokWorkers = ${JSON.stringify(registrations.map(programRegistration))};`,
     `const optionalDenyPaths = new Set(${JSON.stringify([...optionalDenyPaths])});`,
-    `const pinnedConfigSha256 = ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.configSha256)};`,
+    // Derive each expected hash from manifest-validated bytes, never from the registration's digest.
+    // Clocked templates are pinned at slot zero, then specialized by the contract resolver.
+    `const pinnedConfigSha256 = ${JSON.stringify(registrations.map(entry => (entry.configVariant === "clocked"
+        ? resolveDaimonGrokClockedWorkerConfig(entry.model, entry.reasoningEffort, entry.slot)
+        : resolveDaimonGrokWorkerConfig(entry.model, entry.reasoningEffort)).sha256))};`,
     "const sha256Hex = (value) => crypto.createHash('sha256').update(value).digest('hex');",
-    "for (const entry of grokWorkers) { if (sha256Hex(entry.config) !== entry.configSha256 || !Object.hasOwn(pinnedConfigSha256, entry.model) || !Object.hasOwn(pinnedConfigSha256[entry.model], entry.reasoningEffort) || pinnedConfigSha256[entry.model][entry.reasoningEffort] !== entry.configSha256 || sha256Hex(entry.profile) !== entry.profileSha256 || entry.denyPaths.length === 0) throw new Error(`Grok worker contract bytes for ${entry.agentId} do not match their pins`); }",
+    "for (const [index, entry] of grokWorkers.entries()) { if (sha256Hex(entry.config) !== entry.configSha256 || pinnedConfigSha256[index] !== entry.configSha256 || sha256Hex(entry.profile) !== entry.profileSha256 || entry.denyPaths.length === 0) throw new Error(`Grok worker contract bytes for ${entry.agentId} do not match their pins`); }",
     // Root holds no CAP_FOWNER: every mode change reclaims the inode, sets the mode, then restores or hands over ownership.
     "const withMode = (target, mode, uid, gid) => { const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`unsafe Grok worker directory: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
+    // Root holds no CAP_DAC_OVERRIDE either: before it may create inside a directory the ownership pass
+    // already handed to another uid, it takes the inode back. The caller sets the final owner and mode.
+    "const reclaimForRoot = (target) => { const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`unsafe Grok worker directory: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o700); };",
     "const traversable = (target) => { for (let ancestor = require('node:path').dirname(target); ancestor.startsWith('/var/lib/spawnfile/') && ancestor.length > '/var/lib/spawnfile'.length; ancestor = require('node:path').dirname(ancestor)) { const info = fs.lstatSync(ancestor); if ((info.mode & 0o011) !== 0o011) withMode(ancestor, (info.mode & 0o7777) | 0o011, info.uid, info.gid); } };",
     "const assertCanonical = (target, label) => { const info = fs.lstatSync(target); if (info.isSymbolicLink() || fs.realpathSync(target) !== target) throw new Error(`Grok worker ${label} is not a canonical non-symlink path: ${target}`); return info; };",
     "const ensureDirectory = (target, uid, gid, mode) => { fs.mkdirSync(target, { recursive: true, mode: 0o700 }); const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('unsafe worker runtime directory'); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
     "const ensureExactFile = (target, content, mode) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, content, { mode, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) throw new Error('unsafe worker runtime file'); if (fs.readFileSync(target, 'utf8') !== content) throw new Error(`worker runtime file identity mismatch: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); };",
     `const ensureEventsFile = (target, uid) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, '', { mode: 0o640, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (info.uid !== uid && info.uid !== 0) || ![0, uid, ${DAIMON_BROKER_UID}].includes(info.gid) || ![0o600, 0o640, 0o644].includes(info.mode & 0o777)) throw new Error('unsafe worker attestation events'); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o640); fs.chownSync(target, uid, ${DAIMON_BROKER_UID}); };`,
-    `fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`,
+    ...(scope === "slot" ? [] : renderDaimonGrokTaskClockProvisioning(registrations)),
+    ...(scope === "slot" ? [] : [`fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`]),
     // Pass 1: every workspace and home exists, root-held, before any deny list is checked.
-    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ensureDirectory(entry.home, 0, 0, 0o700); ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
+    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ${scope === "container" ? "ensureDirectory(entry.home, 0, 0, 0o700);" : ""} ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
     "for (const denied of optionalDenyPaths) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.mkdirSync(denied, { mode: 0o700 }); fs.chownSync(denied, 0, 0); fs.chmodSync(denied, 0o700); } }",
     "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { try { assertCanonical(denied, 'deny path'); } catch (error) { if (error.code === 'ENOENT' && entry.deferredDenyPaths.includes(denied)) continue; if (error.code === 'ENOENT') throw new Error(`Grok worker deny path is missing: ${denied}`); throw error; } }",
     // Pass 2: exact root-owned read-only files, the events file, then the final sticky modes.
-    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710); for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
+    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ${scope === "container" ? `ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710);` : ""} for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
     // Worker-private temp: the launcher compiles TMPDIR=<home>/tmp, the only temp the worker may write. It is
     // created in the pass above, while the home is still root-owned: root here holds no CAP_DAC_OVERRIDE, so
     // once the home is `<worker>:<broker> 0710` root can no longer create anything inside it.
-    "for (const entry of grokWorkers) { ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); assertCanonical(entry.privateTmp, 'private temp'); }",
+    `for (const entry of grokWorkers) { ${scope === "container" ? "ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700);" : ""} assertCanonical(entry.privateTmp, 'private temp'); }`,
     // Spills: <runtimeHome>/tool-output 2000:<worker> 2750 (setgid) under a runtime home the worker's group can
-    // traverse. The spill directory is created before the runtime home is narrowed to 0710: without
-    // CAP_DAC_OVERRIDE root cannot create inside a directory it does not own once the mode excludes it.
-    `for (const entry of grokWorkers) { traversable(entry.runtimeHome); fs.mkdirSync(entry.runtimeHome, { recursive: true, mode: 0o700 }); assertCanonical(entry.runtimeHome, 'runtime home'); try { fs.mkdirSync(entry.spillDirectory, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; } assertCanonical(entry.spillDirectory, 'spill directory'); withMode(entry.spillDirectory, 0o2750, ${DAIMON_ORGANIZATION_UID}, entry.uid); for (const mounted of entry.runtimeHomeMounts) { assertCanonical(mounted, 'runtime home mount'); withMode(mounted, 0o700, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } withMode(entry.runtimeHome, 0o710, ${DAIMON_ORGANIZATION_UID}, entry.uid); }`,
+    // traverse. Root reclaims the runtime home before creating the spill directory: the compiler lists every
+    // organization runtime home as a private directory, so the container's ownership pass has already handed
+    // it to the organization uid by the time this runs, and root here holds no CAP_DAC_OVERRIDE — a bare
+    // `mkdir` inside a home root no longer owns fails EACCES and the container exits 1 at start. The trailing
+    // `withMode` still narrows the home to its final `2000:<worker> 0710`, so the end state is unchanged.
+    `for (const entry of grokWorkers) { traversable(entry.runtimeHome); fs.mkdirSync(entry.runtimeHome, { recursive: true, mode: 0o700 }); assertCanonical(entry.runtimeHome, 'runtime home'); reclaimForRoot(entry.runtimeHome); try { fs.mkdirSync(entry.spillDirectory, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; } assertCanonical(entry.spillDirectory, 'spill directory'); withMode(entry.spillDirectory, 0o2750, ${DAIMON_ORGANIZATION_UID}, entry.uid); for (const mounted of entry.runtimeHomeMounts) { assertCanonical(mounted, 'runtime home mount'); withMode(mounted, 0o700, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } withMode(entry.runtimeHome, 0o710, ${DAIMON_ORGANIZATION_UID}, entry.uid); }`,
     // Shared temp: Grok refuses a profile denying /tmp or /var/tmp, so modes close them: root:<org group> 1774 lets workers list names only.
-    `for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`,
-    // Deny-path placement, asserted once every mode above is final. Grok 1.0.34 materializes each deny
+    ...(scope === "slot" ? [] : [`for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`]),
+    // Deny-path placement, asserted once every mode above is final. A resource backing the organization
+    // entrypoint only materializes later is created here, empty and root-owned, rather than skipped: the
+    // engine broker starts before that entrypoint runs and its own placement preflight refuses a deny target
+    // that does not exist, which exits the container 1 before any agent attaches. `prepare_bundle_resource`
+    // and `prepare_git_resource` both treat an empty backing as unmaterialized, so the content still lands.
+    // Grok 1.0.34 materializes each deny
     // target inside bubblewrap AS THE WORKER UID, so the worker must be able to search every ancestor and
     // the target must already exist; one unplaceable entry makes Grok refuse the whole profile and every
     // turn of that worker fails with a bare `bwrap: Can't create file at ...: Permission denied`. Root here
     // holds CAP_DAC_READ_SEARCH, so it can read every mode the worker cannot, and decides for it.
+    // A deferred backing usually sits under a resource instance directory the ownership pass has already
+    // handed to the organization uid, so root has to borrow each missing ancestor to create inside it and
+    // hand it straight back: the entrypoint that materializes the resource depends on those modes.
+    `const createDeferredDenyTarget = (target) => { const parent = require('node:path').dirname(target); let info; try { info = fs.lstatSync(parent); } catch (error) { if (error.code !== 'ENOENT') throw error; createDeferredDenyTarget(parent); info = fs.lstatSync(parent); } if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(\`unsafe deferred deny parent: \${parent}\`); const mode = info.mode & 0o7777, borrowed = info.uid !== 0 || (mode & 0o300) !== 0o300; if (borrowed) { fs.chownSync(parent, 0, 0); fs.chmodSync(parent, 0o700); } try { fs.mkdirSync(target, { mode: 0o755 }); fs.chmodSync(target, 0o755); fs.chownSync(target, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } finally { if (borrowed) { fs.chmodSync(parent, mode); fs.chownSync(parent, info.uid, info.gid); } } };`,
     "const searches = (info, uid, gid) => info.uid === uid ? (info.mode & 0o100) !== 0 : info.gid === gid ? (info.mode & 0o010) !== 0 : (info.mode & 0o001) !== 0;",
     "const assertPlaceable = (denied, uid, gid) => { const parts = denied.split('/').slice(1); let at = ''; for (const part of parts.slice(0, -1)) { at += `/${part}`; let info; try { info = fs.lstatSync(at); } catch (error) { throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} could not be read (${error.code})`); } if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} is not a directory`); if (!searches(info, uid, gid)) throw new Error(`Grok worker deny path ${denied} is not placeable: worker uid ${uid} cannot search ${at} (${(info.mode & 0o7777).toString(8)} ${info.uid}:${info.gid}); deny that directory itself instead`); } };",
-    "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { if (entry.deferredDenyPaths.includes(denied)) { try { fs.lstatSync(denied); } catch (error) { if (error.code === 'ENOENT') continue; throw error; } } assertPlaceable(denied, entry.uid, entry.uid); }",
-    `const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations, serviceOptions))};`,
-    "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.agentId === registration.agentId); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
-    `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`
+    "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { if (entry.deferredDenyPaths.includes(denied)) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; createDeferredDenyTarget(denied); } } assertPlaceable(denied, entry.uid, entry.uid); }",
+    ...(scope === "slot" ? [] : [`const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations, serviceOptions))};`,
+        "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.slot === registration.slot); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
+        `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`])
 ];
 const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
 /**

package/dist/compiler/containerDaimonGrokWorkerRender.d.ts

@@ -48,6 +48,8 @@ export interface DaimonGrokRegistration {
     agentId: string;
     config: string;
     configSha256: string;
+    /** Selects trusted config bytes; production retains the unclocked default. */
+    configVariant?: "unclocked" | "clocked";
     denyPaths: string[];
     /** Deny entries the main entrypoint materializes after root provisioning (workspace resource backings); absent is allowed there, a symlink never. */
     deferredDenyPaths: string[];
@@ -130,6 +132,10 @@ export declare const DAIMON_GROK_DENIED_STATE_ROOTS: readonly ["/var/lib/spawnfi
 export declare const resolveDaimonGrokWorkerDenyPaths: (plans: readonly RuntimeTargetPlan[], plan: RuntimeTargetPlan, agentId: string, workerHomes: readonly string[], ownHome: string) => string[];
 export declare const resolveDaimonGrokRegistrations: (plans: RuntimeTargetPlan[]) => DaimonGrokRegistration[];
 export interface DaimonGrokServiceConfigOptions {
+    /** Repeated agent IDs use v3 slot policies; production retains v2 by default. */
+    version?: "v3";
+    maxRunRequests?: number;
+    runRequestStore?: string;
     /**
      * Where the broker keeps its durable turn registry. Production keeps it on
      * the realm volume beside the credential; training overrides it to per-slot
@@ -142,14 +148,8 @@ export interface DaimonGrokServiceConfigOptions {
 }
 /** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
 export declare const renderDaimonGrokServiceConfig: (registrations: readonly DaimonGrokRegistration[], options?: DaimonGrokServiceConfigOptions) => {
-    registrations: {
-        agentId: string;
+    slotPolicies?: {
         slot: number;
-        workerUid: number;
-        workspace: string;
-        profilePath: string;
-        eventsPath: string;
-        profileSha256: string;
         usageLedgerPath: string;
         limits: {
             maxRequests: 32;
@@ -164,9 +164,34 @@ export declare const renderDaimonGrokServiceConfig: (registrations: readonly Dai
             id: "grok-4.6" | "grok-4.5" | "grok-build";
             reasoningEffort: "high" | "medium" | "low";
         };
+    }[] | undefined;
+    registrations: {
+        usageLedgerPath?: string | undefined;
+        limits?: {
+            maxRequests: 32;
+            maxTokens: 300000;
+            timeoutMs: 240000;
+        } | {
+            maxRequests: number;
+            maxTokens: number;
+            timeoutMs: number;
+        } | undefined;
+        model?: {
+            id: "grok-4.6" | "grok-4.5" | "grok-build";
+            reasoningEffort: "high" | "medium" | "low";
+        } | undefined;
+        agentId: string;
+        slot: number;
+        workerUid: number;
+        workspace: string;
+        profilePath: string;
+        eventsPath: string;
+        profileSha256: string;
     }[];
     inferenceLedgerPath?: string | undefined;
-    version: "noopolis.daimon.engine-broker-service.v2";
+    runRequestStore?: string | undefined;
+    maxRunRequests?: number | undefined;
+    version: "noopolis.daimon.engine-broker-service.v2" | "noopolis.daimon.engine-broker-service.v3";
     credentialHome: "/var/lib/spawnfile/daimon/grok-subscription-realm";
     turnStore: string;
 };