spawnfile 0.1.17 → 0.1.18

package/dist/compiler/containerDaimonGrokWorkerRender.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { SpawnfileError } from "../shared/index.js";
+import { resolveDaimonGrokRegistrationLimits } from "../runtime/daimon/grokTurnLimits.js";
 import { DAIMON_ORGANIZATION_TARGET_ID, DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY, DAIMON_RUNTIME_HOMES_DIRECTORY, DAIMON_WAKE_FUSE_DIRECTORY } from "../runtime/daimon/config.js";
 import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER, DAIMON_RUNTIME_HOME_ROOT } from "../runtime/daimon/contractManifest.js";
 import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
@@ -193,6 +194,10 @@ export const resolveDaimonGrokRegistrations = (plans) => {
         const { model, reasoningEffort } = declaredModel(plan, agentId);
         const config = resolveDaimonGrokWorkerConfig(model, reasoningEffort);
         const denyPaths = resolveDaimonGrokWorkerDenyPaths(plans, plan, agentId, homes, home);
+        // The registration's per-turn budget: the contract defaults unless the agent declared its own.
+        // A wake may only lower this, so an organization that needs more than four minutes a turn has
+        // to declare it here rather than at wake time, where the broker refuses any raise.
+        const limits = resolveDaimonGrokRegistrationLimits(plan.grokTurnLimitsByNodeId?.[agentId]);
         const profile = renderDaimonGrokWorkerSandboxProfile(denyPaths);
         for (const [label, value] of [["GROK_HOME", grokHome], ["profile", path.posix.join(grokHome, "sandbox.toml")], ["events", path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath)], ["private temp", path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome)]])
             assertCanonicalRegisteredPath(label, value);
@@ -202,6 +207,7 @@ export const resolveDaimonGrokRegistrations = (plans) => {
         const backings = new Set(plans.flatMap((candidate) => candidate.resources ?? []).map((resource) => resource.backingPath));
         return {
             deferredDenyPaths: denyPaths.filter((entry) => backings.has(entry)),
+            limits,
             agentId,
             config: config.bytes,
             configSha256: config.sha256,
@@ -249,9 +255,11 @@ const resolveDaimonGrokInferenceLedger = (inferenceLedgerPath, registrations) =>
 };
 /** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
 export const renderDaimonGrokServiceConfig = (registrations, options = {}) => ({
-    version: DAIMON_GROK_ENGINE_BROKER.serviceConfigVersions[1],
+    version: DAIMON_GROK_ENGINE_BROKER.serviceConfigVersions[options.version === "v3" ? 2 : 1],
     credentialHome: DAIMON_GROK_ENGINE_BROKER.credentialHomePath,
     turnStore: resolveDaimonGrokTurnStore(options.turnStore),
+    ...(options.maxRunRequests === undefined ? {} : { maxRunRequests: options.maxRunRequests }),
+    ...(options.runRequestStore === undefined ? {} : { runRequestStore: assertCanonicalRegisteredPath("run request store", options.runRequestStore) }),
     ...(options.inferenceLedgerPath === undefined ? {} : { inferenceLedgerPath: resolveDaimonGrokInferenceLedger(options.inferenceLedgerPath, registrations) }),
     registrations: registrations.map((entry) => ({
         agentId: entry.agentId,
@@ -261,8 +269,13 @@ export const renderDaimonGrokServiceConfig = (registrations, options = {}) => ({
         profilePath: entry.profilePath,
         eventsPath: entry.eventsPath,
         profileSha256: entry.profileSha256,
-        usageLedgerPath: entry.usageLedgerPath,
-        limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
-        model: { id: entry.model, reasoningEffort: entry.reasoningEffort }
-    }))
+        ...(options.version === "v3" ? {} : { usageLedgerPath: entry.usageLedgerPath,
+            limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
+            model: { id: entry.model, reasoningEffort: entry.reasoningEffort } })
+    })),
+    ...(options.version === "v3" ? { slotPolicies: registrations.map(entry => ({
+            slot: entry.slot, usageLedgerPath: entry.usageLedgerPath,
+            limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
+            model: { id: entry.model, reasoningEffort: entry.reasoningEffort }
+        })) } : {})
 });

package/dist/compiler/containerDaimonOwnershipGuardRender.d.ts

@@ -5,7 +5,20 @@ export declare const renderDaimonOwnershipProgram: (opaqueTargets: string[], opa
 }>, privateDirectories: string[], privateFiles: string[], privateModeDirectories: string[], creatablePrivateDirectories: Array<{
     anchor: string;
     target: string;
-}>) => string;
+}>, 
+/**
+ * A brokered Grok worker's sandbox cannot be applied when `/var` is traverse-only.
+ * Grok 1.0.34 builds every profile inside bubblewrap and then verifies it from the
+ * worker uid; with `/var` at 0711 that verification fails and the worker refuses to
+ * start ("could not apply the 'daimon-strict' sandbox profile"), which is every turn
+ * of every Grok agent. Bisected on the production host: with `/var` at 0755 the
+ * sandbox applies and the turn runs, at 0711 it never does, and the deeper ancestors
+ * (`/var/lib`, the worker root) make no difference either way — so only this one
+ * level is widened, only for an organization that actually runs a Grok worker, and
+ * only to the mode the proven-working training container has always had. Codex- and
+ * AGY-only organizations keep the traverse-only `/var` unchanged.
+ */
+grokWorkersPresent?: boolean) => string;
 export declare const resolveDaimonVolumeIdentityFiles: (runtimePlans: RuntimeTargetPlan[]) => Array<{
     path: string;
     identity: string;

package/dist/compiler/containerDaimonOwnershipGuardRender.js

@@ -1,7 +1,20 @@
 import path from "node:path";
 import { VOLUME_BOOTSTRAP_MARKER, VOLUME_BOOTSTRAP_MARKER_CONTENT } from "./containerVolumeBootstrap.js";
 const SPAWNFILE_PRIVATE_STATE_ROOT = "/var/lib/spawnfile";
-export const renderDaimonOwnershipProgram = (opaqueTargets, opaqueDescendantRoots, immutableRuntimeRoots, volumeIdentityFiles, privateDirectories, privateFiles, privateModeDirectories, creatablePrivateDirectories) => [
+export const renderDaimonOwnershipProgram = (opaqueTargets, opaqueDescendantRoots, immutableRuntimeRoots, volumeIdentityFiles, privateDirectories, privateFiles, privateModeDirectories, creatablePrivateDirectories, 
+/**
+ * A brokered Grok worker's sandbox cannot be applied when `/var` is traverse-only.
+ * Grok 1.0.34 builds every profile inside bubblewrap and then verifies it from the
+ * worker uid; with `/var` at 0711 that verification fails and the worker refuses to
+ * start ("could not apply the 'daimon-strict' sandbox profile"), which is every turn
+ * of every Grok agent. Bisected on the production host: with `/var` at 0755 the
+ * sandbox applies and the turn runs, at 0711 it never does, and the deeper ancestors
+ * (`/var/lib`, the worker root) make no difference either way — so only this one
+ * level is widened, only for an organization that actually runs a Grok worker, and
+ * only to the mode the proven-working training container has always had. Codex- and
+ * AGY-only organizations keep the traverse-only `/var` unchanged.
+ */
+grokWorkersPresent = false) => [
     "const fs = require('node:fs');",
     "const constants = fs.constants;",
     "const uid = Number(process.argv[2]);",
@@ -151,7 +164,7 @@ export const renderDaimonOwnershipProgram = (opaqueTargets, opaqueDescendantRoot
     `const volumeBootstrapMarker = ${JSON.stringify(VOLUME_BOOTSTRAP_MARKER)}, volumeBootstrapContent = ${JSON.stringify(`${VOLUME_BOOTSTRAP_MARKER_CONTENT}\n`)};`,
     "const verifyVolumeIdentityFile = (fd, expected, mode, device) => { const before = fs.fstatSync(fd); if (!before.isFile() || before.nlink !== 1 || before.uid !== 0 || before.gid !== 0 || (before.mode & 0o777) !== mode || before.dev !== device || before.size !== Buffer.byteLength(expected)) fail('volume identity anchor is unsafe'); const bytes = Buffer.alloc(before.size); let offset=0; while(offset<bytes.length){const count=fs.readSync(fd,bytes,offset,bytes.length-offset,offset);if(count<1)fail('volume identity anchor read failed');offset+=count;} const after = fs.fstatSync(fd); if (!bytes.equals(Buffer.from(expected)) || after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs) fail('volume identity anchor changed'); };",
     "const secureVolumeIdentity = (entry) => { const parentPath = require('node:path').posix.dirname(entry.path); if (entry.path !== `${parentPath}/.spawnfile-resource-identity`) fail('volume identity anchor path is invalid'); const parent = openDirectoryPath(parentPath); let marker, sentinel; try { const parentInfo = fs.fstatSync(parent), parentMode = parentInfo.mode & 0o777, freshParent = parentInfo.uid === 0 && parentInfo.gid === 0 && parentMode === 0o755, establishedParent = parentInfo.uid === uid && parentInfo.gid === uid && parentMode === 0o755; if (!freshParent && !establishedParent) fail('volume identity parent is unsafe'); const names = fs.readdirSync(`/proc/self/fd/${parent}`).sort(), hasSentinel = names.includes('.spawnfile-resource-identity'), hasMarker = names.includes(volumeBootstrapMarker); if (hasSentinel) { sentinel = fs.openSync(`/proc/self/fd/${parent}/.spawnfile-resource-identity`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); verifyVolumeIdentityFile(sentinel, `${entry.identity}\n`, 0o644, parentInfo.dev); if (hasMarker) { if (!freshParent || names.length !== 2) fail('volume bootstrap recovery preimage is unsafe'); marker = fs.openSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); verifyVolumeIdentityFile(marker, volumeBootstrapContent, 0o600, parentInfo.dev); fs.fsyncSync(sentinel); fs.fsyncSync(parent); verifyVolumeIdentityFile(sentinel, `${entry.identity}\n`, 0o644, parentInfo.dev); verifyVolumeIdentityFile(marker, volumeBootstrapContent, 0o600, parentInfo.dev); fs.unlinkSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`); fs.fsyncSync(parent); } return; } if (!freshParent || names.length !== 1 || !hasMarker) fail('volume bootstrap preimage is unsafe'); marker = fs.openSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); verifyVolumeIdentityFile(marker, volumeBootstrapContent, 0o600, parentInfo.dev); const expected = Buffer.from(`${entry.identity}\n`); try { sentinel = fs.openSync(`/proc/self/fd/${parent}/.spawnfile-resource-identity`, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o644); let offset=0; while(offset<expected.length){const written=fs.writeSync(sentinel,expected,offset,expected.length-offset,offset);if(written<1)fail('volume identity anchor write failed');offset+=written;} fs.fchownSync(sentinel,0,0);fs.fchmodSync(sentinel,0o644);fs.fsyncSync(sentinel); } finally { expected.fill(0); } fs.closeSync(sentinel); sentinel=undefined; sentinel=fs.openSync(`/proc/self/fd/${parent}/.spawnfile-resource-identity`,constants.O_RDONLY|constants.O_NOFOLLOW|constants.O_NONBLOCK);verifyVolumeIdentityFile(sentinel,`${entry.identity}\n`,0o644,parentInfo.dev);fs.fsyncSync(parent);verifyVolumeIdentityFile(marker,volumeBootstrapContent,0o600,parentInfo.dev);fs.unlinkSync(`/proc/self/fd/${parent}/${volumeBootstrapMarker}`);fs.fsyncSync(parent); } finally { if(marker!==undefined)fs.closeSync(marker);if(sentinel!==undefined)fs.closeSync(sentinel);fs.closeSync(parent); } };",
-    "for (const target of ['/var', '/var/lib']) secureFixedTraversalAncestor(target);",
+    `for (const target of ${grokWorkersPresent ? "['/var/lib']" : "['/var', '/var/lib']"}) secureFixedTraversalAncestor(target);`,
     `secureSharedStateAncestor('${SPAWNFILE_PRIVATE_STATE_ROOT}');`,
     // `/var/lib/spawnfile/daimon` hosts several independently-owned children
     // (AGY/Grok subscription realms and the wake fuse at organization uid, the

package/dist/compiler/containerDaimonUidEntrypointRender.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID, DAIMON_WAKE_FUSE_DIRECTORY } from "../runtime/daimon/config.js";
 import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../runtime/daimon/contractManifest.js";
+import { DAIMON_RECORDING_MOUNT_ID_PREFIX } from "../runtime/daimon/recording.js";
 import { MOLTNET_READINESS_DIRECTORY } from "./containerReadinessPaths.js";
 import { createBackedMountGuard } from "./containerBackedMountRender.js";
 import { renderDaimonOwnershipProgram, resolveDaimonVolumeIdentityFiles } from "./containerDaimonOwnershipGuardRender.js";
@@ -113,18 +114,11 @@ const privateModeDirectories = (runtimePlans, moltnet) => [
         .filter((mount) => mount.id === DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID
         || mount.id === DAIMON_AGY_SUBSCRIPTION_REALM_MOUNT_ID
         || mount.id.startsWith(DAIMON_AGY_RUNTIME_HOME_MOUNT_ID_PREFIX)
+        || mount.id.startsWith(DAIMON_RECORDING_MOUNT_ID_PREFIX)
         || mount.id.startsWith(DAIMON_PORTABLE_ENGINE_HOME_MOUNT_ID_PREFIX))
-        // The acceptance store's own parent — `<instance-root>/state`, i.e.
-        // `DAIMON_ORGANIZATION_STATE_DIRECTORY` — is secured with it. Docker
-        // creates that parent root-owned and world-readable when it materializes
-        // this mount, and the ancestor pass below only *chowns* it, so it stayed
-        // 0755 and was the one path under `/var/lib/spawnfile` a Grok worker uid
-        // could open. Securing it to 0700 2000:2000 backs the acceptance store's
-        // sandbox `deny` entry with unix modes as defense in depth (see
-        // `containerDaimonGrokWorkerRender.ts`). Nothing loses access: the only thing
-        // beneath it is this store, already 0700 2000:2000, so every reader that
-        // works today is the organization uid or a `docker exec` root holding
-        // CAP_DAC_READ_SEARCH.
+        // Secure the acceptance store's parent as well: Docker creates state/ at
+        // 0755 and the ancestor pass only chowns it. Mode 0700 prevents Grok worker
+        // traversal while retaining organization-uid and privileged exec access.
         .flatMap((mount) => mount.id === DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID
         ? [mount.mount_path, path.posix.dirname(mount.mount_path)]
         : [mount.mount_path])
@@ -225,7 +219,7 @@ export const renderDaimonUidEntrypoint = (runtimePlans, persistentMountPaths = [
         ...createBackedMountGuard(persistentMounts),
         `state_roots=(${ownershipPlan.stateRoots.map(quote).join(" ")})`,
         "node - \"$uid\" \"${state_roots[@]}\" <<'SPAWNFILE_DAIMON_OWNERSHIP'",
-        renderDaimonOwnershipProgram(opaqueTargets, ownershipPlan.opaqueDescendantRoots, immutableRuntimeRoots, volumeIdentityFiles, ownershipPlan.privateDirectories, ownershipPlan.privateFiles, ownershipPlan.privateModeDirectories, ownershipPlan.creatablePrivateDirectories),
+        renderDaimonOwnershipProgram(opaqueTargets, ownershipPlan.opaqueDescendantRoots, immutableRuntimeRoots, volumeIdentityFiles, ownershipPlan.privateDirectories, ownershipPlan.privateFiles, ownershipPlan.privateModeDirectories, ownershipPlan.creatablePrivateDirectories, resolveDaimonGrokRegistrations(runtimePlans).length > 0),
         "SPAWNFILE_DAIMON_OWNERSHIP",
         `for fixed_uid in ${DAIMON_ORGANIZATION_UID} ${DAIMON_BROKER_UID} ${resolveDaimonGrokRegistrations(runtimePlans).map((entry) => entry.uid).join(" ")}; do`,
         '  if ! getent group "$fixed_uid" >/dev/null; then groupadd -K GID_MIN=1 --gid "$fixed_uid" "daimon-$fixed_uid"; fi',

package/dist/compiler/containerTargetResources.d.ts

@@ -22,4 +22,14 @@ export declare const resolveWorkspaceResourceVolumes: (runtimePlans: readonly Ru
     resources: ResolvedTargetResourcePlan[];
     mounts: WorkspaceResourcePersistentMount[];
 };
+/**
+ * One source agent's workspace path inside its runtime target, still in the
+ * target's placeholder vocabulary (`<instance-root>`, `<workspace-path>`),
+ * which container rendering substitutes once the target's instance paths are
+ * known. Mount link paths and MCP `${workspace}` both resolve through here.
+ */
+export declare const expandSourceWorkspacePathTemplate: (meta: RuntimeContainerMeta, source: {
+    agentName: string;
+    slug: string;
+}) => string;
 export declare const resolveTargetResources: (target: ContainerTarget, inputs: ContainerTargetInput[], instancePaths: RuntimeTargetPlan["instancePaths"], meta: RuntimeContainerMeta, planRoot: string, deploymentLineage?: string) => ResolvedTargetResourcePlan[];

package/dist/compiler/containerTargetResources.js

@@ -2,11 +2,12 @@ import path from "node:path";
 import { createHash } from "node:crypto";
 import { SpawnfileError } from "../shared/index.js";
 import { createExclusiveReattachVolumeName } from "../shared/index.js";
-import { mergeWorkspaceResourcePlans } from "./workspaceResources.js";
+import { mergeWorkspaceResourcePlans, workspaceResourceTargetId } from "./workspaceResources.js";
 const CONFIG_FILE_PLACEHOLDER = "<config-file>";
 const INSTANCE_ROOT_PLACEHOLDER = "<instance-root>";
 const SOURCE_AGENT_PLACEHOLDER = "<agent-name>";
 const SOURCE_SLUG_PLACEHOLDER = "<source-slug>";
+const WORKSPACE_PATH_PLACEHOLDER = "<workspace-path>";
 const digest = (value) => createHash("sha256").update(value).digest("hex");
 export const resolveWorkspaceResourceVolumes = (runtimePlans) => {
     const resources = runtimePlans.flatMap((runtimePlan) => (runtimePlan.resources ?? []));
@@ -43,19 +44,27 @@ export const resolveWorkspaceResourceVolumes = (runtimePlans) => {
             reason: `Workspace ${resource.sharing} resource ${resource.id}`, volume_name: resource.volumeName
         })) };
 };
-const replaceSourceWorkspacePathTemplate = (template, input, instancePaths, meta) => {
-    const agentName = input.value.kind === "agent" ? input.value.name : input.slug;
+/**
+ * One source agent's workspace path inside its runtime target, still in the
+ * target's placeholder vocabulary (`<instance-root>`, `<workspace-path>`),
+ * which container rendering substitutes once the target's instance paths are
+ * known. Mount link paths and MCP `${workspace}` both resolve through here.
+ */
+export const expandSourceWorkspacePathTemplate = (meta, source) => meta.instancePaths.sourceWorkspacePathTemplate
+    ? meta.instancePaths.sourceWorkspacePathTemplate
+        .replaceAll(CONFIG_FILE_PLACEHOLDER, meta.configFileName)
+        .replaceAll(SOURCE_AGENT_PLACEHOLDER, source.agentName)
+        .replaceAll(SOURCE_SLUG_PLACEHOLDER, source.slug)
+    : WORKSPACE_PATH_PLACEHOLDER;
+const resolveSourceWorkspacePath = (input, instancePaths, meta) => {
     const instanceRoot = instancePaths.instanceRoot ?? path.posix.dirname(instancePaths.workspacePath);
-    return template
+    return expandSourceWorkspacePathTemplate(meta, {
+        agentName: input.value.kind === "agent" ? input.value.name : input.slug,
+        slug: input.slug
+    })
         .replaceAll(INSTANCE_ROOT_PLACEHOLDER, instanceRoot)
-        .replaceAll(CONFIG_FILE_PLACEHOLDER, meta.configFileName)
-        .replaceAll(SOURCE_AGENT_PLACEHOLDER, agentName)
-        .replaceAll(SOURCE_SLUG_PLACEHOLDER, input.slug);
+        .replaceAll(WORKSPACE_PATH_PLACEHOLDER, instancePaths.workspacePath);
 };
-const resolveSourceWorkspacePath = (input, instancePaths, meta) => meta.instancePaths.sourceWorkspacePathTemplate
-    ? replaceSourceWorkspacePathTemplate(meta.instancePaths.sourceWorkspacePathTemplate, input, instancePaths, meta)
-    : instancePaths.workspacePath;
-const sourceTargetId = (target, input, isMergedTarget) => isMergedTarget ? `${target.id}:${input.id}` : target.id;
 const pathsOverlap = (left, right) => left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
 const dedupeAndAssertResourcePlans = (target, resources) => {
     const byLinkPath = new Map();
@@ -105,13 +114,12 @@ export const resolveTargetResources = (target, inputs, instancePaths, meta, plan
     if (sourceIds.size === 0) {
         return [];
     }
-    const isMergedTarget = sourceIds.size > 1;
     const resources = inputs.flatMap((input) => {
         if (!sourceIds.has(input.id) || input.value.kind !== "agent") {
             return [];
         }
         return mergeWorkspaceResourcePlans(input.value.workspaceResources ?? [], `${target.id}/${input.id}`, {
-            targetId: sourceTargetId(target, input, isMergedTarget),
+            targetId: workspaceResourceTargetId(target.id, input.id, sourceIds.size),
             workspacePath: resolveSourceWorkspacePath(input, instancePaths, meta)
         }).map((resource) => {
             const canonicalBackingPath = path.posix.normalize(resource.backingPath);

package/dist/compiler/containerWorkspaceResourceRender.js

@@ -104,7 +104,10 @@ export const createWorkspaceResourceShellFunctions = () => [
     '  local id="$1" link_path="$2" backing_path="$3" archive="$4" identity="$5"',
     '  [ -f "$archive" ] || { echo "Workspace bundle $id archive missing" >&2; exit 1; }',
     '  local sentinel="$backing_path/.spawnfile-bundle-identity"',
-    '  if [ -e "$backing_path" ]; then',
+    // An empty directory is not a materialized bundle: the Grok broker preflight starts before this runs and
+    // needs every worker deny target to exist, so the Daimon entrypoint pre-creates missing resource backings
+    // empty. Anything with content still has to attest its identity, exactly as a git backing does above.
+    '  if [ -e "$backing_path" ] && { [ ! -d "$backing_path" ] || [ -L "$backing_path" ] || ! directory_is_empty "$backing_path"; }; then',
     '    [ -f "$sentinel" ] && [ "$(cat "$sentinel")" = "$identity" ] || { echo "Workspace bundle $id identity mismatch" >&2; exit 1; }',
     "  else",
     '    mkdir -p "$backing_path"',

package/dist/compiler/index.d.ts

@@ -10,6 +10,7 @@ export * from "./dockerBuildContext.js";
 export * from "./dockerBuildSkip.js";
 export * from "./initProject.js";
 export * from "./moltnetRoomMemberships.js";
+export * from "./preflightCompilePlan.js";
 export * from "./runProject.js";
 export * from "./syncProjectAuth.js";
 export * from "./types.js";
@@ -20,3 +21,4 @@ export * from "./upReceipt.js";
 export * from "./worldBindings.js";
 export * from "./view/index.js";
 export * from "./training/index.js";
+export * from "./recordingReport.js";

package/dist/compiler/index.js

@@ -10,6 +10,7 @@ export * from "./dockerBuildContext.js";
 export * from "./dockerBuildSkip.js";
 export * from "./initProject.js";
 export * from "./moltnetRoomMemberships.js";
+export * from "./preflightCompilePlan.js";
 export * from "./runProject.js";
 export * from "./syncProjectAuth.js";
 export * from "./types.js";
@@ -20,3 +21,4 @@ export * from "./upReceipt.js";
 export * from "./worldBindings.js";
 export * from "./view/index.js";
 export * from "./training/index.js";
+export * from "./recordingReport.js";

package/dist/compiler/mcpPlaceholders.d.ts

@@ -0,0 +1,11 @@
+import type { McpServer } from "../manifest/index.js";
+import type { CompilePlanNode } from "./types.js";
+export interface McpPlaceholderContext {
+    agentId: string;
+    agentName: string;
+    /** Lazy: only runtimes whose servers use `${workspace}` need a resolvable path. */
+    workspace: () => string;
+}
+export declare const resolveMcpServerPlaceholders: (servers: McpServer[], context: McpPlaceholderContext) => McpServer[];
+/** Resolves every agent node's MCP placeholders in place, once node ids and slugs exist. */
+export declare const resolvePlanMcpPlaceholders: (nodes: CompilePlanNode[]) => void;

package/dist/compiler/mcpPlaceholders.js

@@ -0,0 +1,58 @@
+import { getRuntimeAdapter } from "../runtime/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { expandSourceWorkspacePathTemplate } from "./containerTargetResources.js";
+/**
+ * Compiler-owned placeholders an MCP server may use in `command`, `args` and
+ * `env` values. They are resolved per agent after the compile plan assigns
+ * node ids, so one `shared.environment.mcp_servers` entry serves every member:
+ *
+ * - `${workspace}`  the agent's workspace path inside its runtime target
+ *                   (the same path `./` workspace resource mounts link under)
+ * - `${agent.id}`   the agent's compile-plan node id, e.g. `agent:writer`
+ * - `${agent.name}` the agent manifest name
+ *
+ * `${workspace}` and anything under `${agent.` are reserved: an unknown name
+ * fails the compile instead of reaching a runtime as a literal string. Other
+ * `${...}` text is left untouched.
+ */
+const RESERVED_PLACEHOLDER = /\$\{(workspace|agent\.[^}]*)\}/gu;
+const SUPPORTED = "${workspace}, ${agent.id}, ${agent.name}";
+const fail = (context, server, detail) => {
+    throw new SpawnfileError("validation_error", `Agent ${context.agentName} MCP server ${server.name}: ${detail}`);
+};
+const resolveValue = (value, server, context) => value.replace(RESERVED_PLACEHOLDER, (match, name) => {
+    if (name === "workspace")
+        return context.workspace();
+    if (name === "agent.id")
+        return context.agentId;
+    if (name === "agent.name")
+        return context.agentName;
+    return fail(context, server, `unknown placeholder ${match}; supported placeholders are ${SUPPORTED}`);
+});
+const hasReservedPlaceholder = (value) => value !== undefined && new RegExp(RESERVED_PLACEHOLDER.source, "u").test(value);
+export const resolveMcpServerPlaceholders = (servers, context) => servers.map((server) => {
+    if (hasReservedPlaceholder(server.url) || hasReservedPlaceholder(server.auth?.secret)) {
+        fail(context, server, `placeholders (${SUPPORTED}) are only supported in command, args and env values`);
+    }
+    return {
+        ...server,
+        ...(server.command === undefined ? {} : { command: resolveValue(server.command, server, context) }),
+        ...(server.args === undefined ? {} : { args: server.args.map((arg) => resolveValue(arg, server, context)) }),
+        ...(server.env === undefined ? {} : {
+            env: Object.fromEntries(Object.entries(server.env).map(([key, value]) => [key, resolveValue(value, server, context)]))
+        })
+    };
+});
+/** Resolves every agent node's MCP placeholders in place, once node ids and slugs exist. */
+export const resolvePlanMcpPlaceholders = (nodes) => {
+    for (const node of nodes) {
+        if (node.value.kind !== "agent" || node.value.mcpServers.length === 0)
+            continue;
+        const agent = node.value;
+        agent.mcpServers = resolveMcpServerPlaceholders(agent.mcpServers, {
+            agentId: node.id,
+            agentName: agent.name,
+            workspace: () => expandSourceWorkspacePathTemplate(getRuntimeAdapter(node.runtimeName ?? agent.runtime.name).container, { agentName: agent.name, slug: node.slug })
+        });
+    }
+};

package/dist/compiler/mcpServerInheritance.d.ts

@@ -0,0 +1,18 @@
+import { type McpServer, type McpServerEntry, type SharedMcpServer } from "../manifest/index.js";
+/**
+ * Resolves an agent's effective MCP servers from its team's
+ * `shared.environment.mcp_servers` and its own entries.
+ *
+ * - A local entry that declares `transport` is a complete server and replaces
+ *   any inherited server of the same name (SPEC §4.4: member-local wins).
+ * - A local entry without `transport` narrows the inherited server of the same
+ *   name: `tools` replaces the inherited allowlist, `env` merges key by key
+ *   with local keys winning. Every other field stays inherited.
+ * - A bare `{ name }` takes the inherited server unchanged.
+ * - A shared server marked `opt_in: true` is inherited only by members that
+ *   list its name (bare or narrowing). Members never remove an inherited
+ *   server (SPEC §4.4); an opt-in server is simply not offered by default.
+ * - An override with no shared server to narrow is a compile error naming
+ *   the agent, because there is nothing to complete it from.
+ */
+export declare const resolveInheritedMcpServers: (agentName: string, sharedServers?: SharedMcpServer[], localEntries?: McpServerEntry[]) => McpServer[];

package/dist/compiler/mcpServerInheritance.js

@@ -0,0 +1,43 @@
+import { isMcpServerDeclaration } from "../manifest/index.js";
+import { SpawnfileError } from "../shared/index.js";
+/**
+ * Resolves an agent's effective MCP servers from its team's
+ * `shared.environment.mcp_servers` and its own entries.
+ *
+ * - A local entry that declares `transport` is a complete server and replaces
+ *   any inherited server of the same name (SPEC §4.4: member-local wins).
+ * - A local entry without `transport` narrows the inherited server of the same
+ *   name: `tools` replaces the inherited allowlist, `env` merges key by key
+ *   with local keys winning. Every other field stays inherited.
+ * - A bare `{ name }` takes the inherited server unchanged.
+ * - A shared server marked `opt_in: true` is inherited only by members that
+ *   list its name (bare or narrowing). Members never remove an inherited
+ *   server (SPEC §4.4); an opt-in server is simply not offered by default.
+ * - An override with no shared server to narrow is a compile error naming
+ *   the agent, because there is nothing to complete it from.
+ */
+export const resolveInheritedMcpServers = (agentName, sharedServers = [], localEntries = []) => {
+    const inherited = new Map();
+    const resolved = new Map();
+    for (const { opt_in: optIn, ...server } of sharedServers) {
+        inherited.set(server.name, server);
+        if (optIn !== true)
+            resolved.set(server.name, server);
+    }
+    for (const entry of localEntries) {
+        if (isMcpServerDeclaration(entry)) {
+            resolved.set(entry.name, entry);
+            continue;
+        }
+        const base = inherited.get(entry.name);
+        if (!base) {
+            throw new SpawnfileError("validation_error", `Agent ${agentName} overrides MCP server ${entry.name}, but its team declares no shared.environment.mcp_servers entry named ${entry.name}; declare transport to define the server locally`);
+        }
+        resolved.set(entry.name, {
+            ...base,
+            ...(entry.tools === undefined ? {} : { tools: entry.tools }),
+            ...(entry.env === undefined ? {} : { env: { ...base.env, ...entry.env } })
+        });
+    }
+    return [...resolved.values()];
+};

package/dist/compiler/moltnetArtifactTypes.d.ts

@@ -23,6 +23,7 @@ export interface MoltnetServerPlan {
     teamSource: string;
 }
 export interface MoltnetNodePlan {
+    sourceNodeId?: string;
     configPath: string;
     credentialAgentId?: string;
     credentialId?: string;

package/dist/compiler/moltnetArtifacts.js

@@ -193,6 +193,7 @@ export const generateMoltnetArtifacts = async (plan, deploymentLineage = "compil
                 path: configPath
             });
             nodePlans.push({
+                sourceNodeId: node.id,
                 configPath: toContainerRootfsPath(configPath),
                 ...(clientAuth.credentialAgentId
                     ? { credentialAgentId: clientAuth.credentialAgentId }

package/dist/compiler/preflightCompilePlan.d.ts

@@ -0,0 +1,9 @@
+import type { CompilePlan } from "./types.js";
+/**
+ * Runs, without emitting anything, the per-agent checks compile would refuse
+ * on: runtime-option errors and each adapter's `preflightAgent` (for Daimon:
+ * MCP allowlists and absolute commands, engine/model pairing, and the public
+ * instruction-size limit). Every failing agent is reported, each named by its
+ * node id, so `spawnfile validate` can be an organization's structural check.
+ */
+export declare const preflightCompilePlan: (plan: CompilePlan) => void;

package/dist/compiler/preflightCompilePlan.js

@@ -0,0 +1,38 @@
+import { getRuntimeAdapter } from "../runtime/index.js";
+import { SpawnfileError } from "../shared/index.js";
+/**
+ * Runs, without emitting anything, the per-agent checks compile would refuse
+ * on: runtime-option errors and each adapter's `preflightAgent` (for Daimon:
+ * MCP allowlists and absolute commands, engine/model pairing, and the public
+ * instruction-size limit). Every failing agent is reported, each named by its
+ * node id, so `spawnfile validate` can be an organization's structural check.
+ */
+export const preflightCompilePlan = (plan) => {
+    const failures = new Map();
+    for (const node of plan.nodes) {
+        if (node.value.kind !== "agent")
+            continue;
+        const runtimeName = node.runtimeName ?? node.value.runtime.name;
+        const adapter = getRuntimeAdapter(runtimeName);
+        const key = `${node.id} (${runtimeName})`;
+        const report = (message) => {
+            failures.set(key, (failures.get(key) ?? new Set()).add(message));
+        };
+        for (const diagnostic of adapter.validateRuntimeOptions?.(node.value.runtime.options) ?? []) {
+            if (diagnostic.level === "error")
+                report(diagnostic.message);
+        }
+        try {
+            adapter.preflightAgent?.(node.value, node.id);
+        }
+        catch (error) {
+            if (!(error instanceof SpawnfileError))
+                throw error;
+            report(error.message);
+        }
+    }
+    if (failures.size > 0) {
+        const lines = [...failures].flatMap(([agent, messages]) => [...messages].map((message) => `- ${agent}: ${message}`));
+        throw new SpawnfileError("validation_error", [`Compile would refuse ${failures.size} agent(s):`, ...lines].join("\n"));
+    }
+};

package/dist/compiler/recordingAgentFacts.d.ts

@@ -0,0 +1,4 @@
+import type { CompileReportWorkspaceGitResource, RecordingAgentReport } from "../report/index.js";
+import type { CompilePlan } from "./types.js";
+/** Only compiled, portable identities: no host sources and no history reads. */
+export declare const resolveRecordingAgentFacts: (plan: CompilePlan, gitPins?: readonly CompileReportWorkspaceGitResource[]) => RecordingAgentReport[];

package/dist/compiler/recordingAgentFacts.js

@@ -0,0 +1,35 @@
+import path from "node:path";
+import { resolveMnemeDurableMemoryMountPath } from "../runtime/mnemeMcp.js";
+import { daimonRecordingDirectory } from "../runtime/daimon/recording.js";
+import { recordingKeepMs, SpawnfileError } from "../shared/index.js";
+import { resolveTrainingRecordVolumes } from "./training/plan/index.js";
+/** Only compiled, portable identities: no host sources and no history reads. */
+export const resolveRecordingAgentFacts = (plan, gitPins = []) => plan.nodes.flatMap((node) => {
+    if (node.value.kind !== "agent" || node.value.training?.record === undefined)
+        return [];
+    const agent = node.value;
+    const memory = new Map();
+    for (const access of agent.memoryAccess ?? []) {
+        const declaring = plan.nodes.find((entry) => entry.value.source === access.source);
+        if (!declaring)
+            throw new SpawnfileError("validation_error", `Recording bank ${access.bank.id} has no declaring node`);
+        const home = resolveMnemeDurableMemoryMountPath(access.bank);
+        memory.set(`${declaring.id}\0${access.bank.id}`, {
+            id: access.bank.id, declared_by: declaring.id,
+            ledger_path: home === null ? null : path.posix.join(home, "memory/events.jsonl")
+        });
+    }
+    const resources = agent.workspaceResources ?? [];
+    return [{
+            node_id: node.id, slug: node.slug, directory: daimonRecordingDirectory(node.slug),
+            keep_ms: recordingKeepMs(agent.training.record),
+            networks: [...new Set((agent.surfaces?.moltnet ?? []).map((entry) => entry.network))].sort(),
+            memory: [...memory.values()].sort((a, b) => `${a.declared_by}:${a.id}`.localeCompare(`${b.declared_by}:${b.id}`)),
+            feeds: resources.flatMap((resource) => resource.kind === "volume" && resource.feed
+                ? [{ id: resource.id, volume_name: resource.name }] : []).sort((a, b) => a.id.localeCompare(b.id)),
+            resources: resources.flatMap((resource) => resource.kind === "volume" ? []
+                : [{ id: resource.id, kind: gitPins.some((pin) => pin.id === resource.id && pin.agent_node_ids?.includes(node.id)) ? "git" : resource.kind }])
+                .sort((a, b) => a.id.localeCompare(b.id)),
+            snapshots: resolveTrainingRecordVolumes({ id: node.id, value: agent }).map((resource) => resource.id)
+        }];
+}).sort((a, b) => a.node_id.localeCompare(b.node_id));

package/dist/compiler/recordingCapability.d.ts

@@ -0,0 +1,4 @@
+import { type DaimonContractManifest } from "../runtime/daimon/contractManifest.js";
+import type { CompilePlan } from "./types.js";
+/** No runtime lookup, check output, or manifest I/O when recording is absent. */
+export declare const assertRecordingCapability: (plan: CompilePlan, injectedManifest?: DaimonContractManifest) => Promise<void>;

package/dist/compiler/recordingCapability.js

@@ -0,0 +1,22 @@
+import { fileURLToPath } from "node:url";
+import { DAIMON_CONTRACT_MANIFEST_SHA256, daimonSupportsWakeMoments, readVerifiedDaimonContractManifest } from "../runtime/daimon/contractManifest.js";
+import { SpawnfileError } from "../shared/index.js";
+/** No runtime lookup, check output, or manifest I/O when recording is absent. */
+export const assertRecordingCapability = async (plan, injectedManifest) => {
+    const agents = plan.nodes.filter((node) => node.kind === "agent" && node.value.training?.record !== undefined);
+    if (agents.length === 0)
+        return;
+    for (const agent of agents) {
+        if (agent.runtimeName !== "daimon")
+            throw new SpawnfileError("validation_error", `Training recording for ${agent.id} requires Daimon; runtime ${agent.runtimeName ?? "unknown"} does not support wake moments`);
+    }
+    let manifest = injectedManifest;
+    if (manifest === undefined) {
+        const verified = await readVerifiedDaimonContractManifest(fileURLToPath(new URL("../runtime/daimon/", import.meta.url)));
+        if (verified.digest !== DAIMON_CONTRACT_MANIFEST_SHA256)
+            throw new SpawnfileError("validation_error", "Pinned Daimon contract manifest does not match the capability-receipt digest");
+        manifest = verified.manifest;
+    }
+    if (!daimonSupportsWakeMoments(manifest))
+        throw new SpawnfileError("validation_error", "The pinned Daimon runtime image does not declare the wakeMoments capability; a Daimon release with it and a runtimes.yaml / contract-manifest re-pin are required");
+};

package/dist/compiler/recordingReport.d.ts

@@ -0,0 +1,4 @@
+import type { CompileReport, ContainerMemoryReport, RecordingReport } from "../report/index.js";
+import type { CompilePlan } from "./types.js";
+/** Project effective agent declarations and existing memory access facts only. */
+export declare const resolveRecordingReport: (plan: CompilePlan, memories: readonly ContainerMemoryReport[], gitPins?: CompileReport["workspace_git_resources"]) => RecordingReport | undefined;

package/dist/compiler/recordingReport.js

@@ -0,0 +1,18 @@
+import { maxRecordingKeepMs } from "../shared/index.js";
+import { daimonRecordingMountId } from "../runtime/daimon/recording.js";
+import { resolveRecordingAgentFacts } from "./recordingAgentFacts.js";
+/** Project effective agent declarations and existing memory access facts only. */
+export const resolveRecordingReport = (plan, memories, gitPins = []) => {
+    const agents = plan.nodes.filter((node) => node.kind === "agent" && node.value.training?.record !== undefined);
+    const keepMs = maxRecordingKeepMs(agents.map((node) => node.value.training?.record));
+    if (keepMs === undefined)
+        return undefined;
+    const agentIds = new Set(agents.map((node) => node.id));
+    const memoryMountIds = memories.flatMap((memory) => memory.store.persistent_mount_id !== undefined && memory.accessible_node_ids.some((id) => agentIds.has(id))
+        ? [memory.store.persistent_mount_id] : []);
+    return {
+        keep_ms: keepMs, memory_mount_ids: [...new Set(memoryMountIds)].sort(),
+        recording_mount_ids: agents.filter((agent) => agent.runtimeName === "daimon").map((agent) => daimonRecordingMountId(agent.slug)).sort(),
+        agents: resolveRecordingAgentFacts(plan, gitPins)
+    };
+};

package/dist/compiler/runProject.d.ts

@@ -1,5 +1,5 @@
 import { type ResolvedAuthProfile } from "../auth/index.js";
-import { type DockerTargetExecFile } from "../deployment/index.js";
+import { type DeploymentRecord, type DockerTargetExecFile } from "../deployment/index.js";
 import { type CompileProjectOptions, type CompileProjectResult } from "./compileProject.js";
 import { inspectDetachedContainer as recoverDetachedDockerRun, runDockerContainer, type DockerRunInvocation, type DockerRunResult, type DockerRunRunner } from "./runProjectDocker.js";
 export { recoverDetachedDockerRun, runDockerContainer };
@@ -40,6 +40,7 @@ export declare const createDockerRunInvocation: (compileResult: CompileProjectRe
     envFilePath?: string;
 }) => Promise<DockerRunInvocation>;
 interface ResolvedRunDeploymentOptions {
+    previousRecord?: DeploymentRecord;
     authProfile?: string;
     containerName?: string;
     deploymentName?: string;

package/dist/compiler/runProject.js

@@ -153,6 +153,7 @@ export const resolveDetachedDeploymentOptions = async (outputDirectory, options)
         });
     }
     return {
+        previousRecord: record,
         authProfile: options.authProfile ?? record.auth_profile ?? undefined,
         containerName: options.containerName ?? unit?.container_name ?? undefined,
         deploymentName,
@@ -212,6 +213,7 @@ export const runProject = async (inputPath, options = {}) => {
     const runMetadata = await executeDockerRunWithSupportCleanup(invocation, options.runRunner ?? runDockerContainer);
     const deploymentRecordPath = invocation.detach && invocation.deploymentName
         ? await writeDockerDeploymentRecordForRun({
+            previousRecord: resolvedOptions.previousRecord,
             authProfileName: authProfile?.name ?? null,
             envFilePath: resolvedOptions.envFilePath,
             imageTag,