spawnfile 0.1.17 → 0.1.18

package/dist/compiler/surfaces.d.ts

@@ -1,10 +1,9 @@
-import { DocsBlock, McpServer, Secret, SkillReference } from "../manifest/index.js";
+import { DocsBlock, Secret, SkillReference } from "../manifest/index.js";
 import { StringMap } from "../shared/index.js";
 import { ResolvedDocument, ResolvedPackage, ResolvedSkill } from "./types.js";
 export declare const mergeSkills: (sharedSkills?: SkillReference[], localSkills?: SkillReference[]) => SkillReference[];
 export declare const mergeResolvedSkills: (sharedSkills?: ResolvedSkill[], localSkills?: ResolvedSkill[]) => ResolvedSkill[];
 export declare const mergePackages: (sharedPackages?: ResolvedPackage[], localPackages?: ResolvedPackage[]) => ResolvedPackage[];
-export declare const mergeMcpServers: (sharedServers?: McpServer[], localServers?: McpServer[]) => McpServer[];
 export declare const mergeSecrets: (sharedSecrets?: Secret[], localSecrets?: Secret[]) => Secret[];
 export declare const mergeEnv: (sharedEnv?: StringMap, localEnv?: StringMap) => StringMap;
 export declare const loadResolvedDocuments: (manifestPath: string, docs: DocsBlock | undefined) => Promise<ResolvedDocument[]>;

package/dist/compiler/surfaces.js

@@ -13,7 +13,6 @@ const mergeByKey = (sharedValues, localValues, getKey) => {
 export const mergeSkills = (sharedSkills = [], localSkills = []) => mergeByKey(sharedSkills, localSkills, (skill) => skill.ref);
 export const mergeResolvedSkills = (sharedSkills = [], localSkills = []) => mergeByKey(sharedSkills, localSkills, (skill) => skill.ref);
 export const mergePackages = (sharedPackages = [], localPackages = []) => mergeByKey(sharedPackages, localPackages, (pkg) => `${pkg.manager}::${pkg.name}`);
-export const mergeMcpServers = (sharedServers = [], localServers = []) => mergeByKey(sharedServers, localServers, (server) => server.name);
 export const mergeSecrets = (sharedSecrets = [], localSecrets = []) => mergeByKey(sharedSecrets, localSecrets, (secret) => secret.name);
 export const mergeEnv = (sharedEnv = {}, localEnv = {}) => ({
     ...sharedEnv,

package/dist/compiler/syncProjectAuth.js

@@ -25,7 +25,8 @@ const resolveAuthRequirements = async (inputPath) => {
                 addProjectSecret(secret);
             }
             for (const server of node.value.shared.mcpServers) {
-                if (server.auth?.secret) {
+                // An opt-in server's secret is required only through the members that select it.
+                if (server.auth?.secret && server.opt_in !== true) {
                     addProjectSecret({ name: server.auth.secret, required: true });
                 }
             }

package/dist/compiler/training/broker/clockProbe.d.ts

@@ -0,0 +1,6 @@
+/** Clock directories are public by contract; prove the sibling mask in the worker's mount namespace. */
+export declare const probeTrainingSiblingClock: (slot: number, target: string, execute?: (command: string, args: string[], options: {
+    timeout: number;
+}) => Promise<{
+    stdout: string;
+}>) => Promise<boolean>;

package/dist/compiler/training/broker/clockProbe.js

@@ -0,0 +1,27 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { SpawnfileError } from "../../../shared/index.js";
+import { trainingSlotPaths } from "./paths.js";
+const run = promisify(execFile);
+const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
+/** Clock directories are public by contract; prove the sibling mask in the worker's mount namespace. */
+export const probeTrainingSiblingClock = async (slot, target, execute = run) => {
+    const p = trainingSlotPaths(slot);
+    const script = [
+        'set -eu',
+        `cat ${quote(p.clockFile)} >/dev/null`,
+        // Use the same mode-000 directory bind as Grok's deny mounts. Neither an unavailable
+        // namespace nor a hidden own clock is a successful denial.
+        `blocked=$(mktemp -d ${quote(`${p.privateTmp}/clock-probe.XXXXXX`)})`,
+        'trap \'chmod 700 "$blocked"; rmdir "$blocked"\' EXIT',
+        'chmod 000 "$blocked"',
+        `bwrap --die-with-parent --cap-drop ALL --ro-bind / / --dev /dev --ro-bind "$blocked" ${quote(target)} -- /bin/sh -ceu ${quote(`cat ${quote(p.clockFile)} >/dev/null; if ls -A ${quote(target)} >/dev/null 2>&1; then echo reachable; else echo denied; fi`)}`
+    ].join("\n");
+    const result = await execute("setpriv", ["--clear-groups", `--reuid=${p.workerUid}`, `--regid=${p.workerUid}`,
+        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", "/bin/sh", "-ceu", script], { timeout: 10_000 });
+    if (result.stdout.trim() === "denied")
+        return true;
+    if (result.stdout.trim() === "reachable")
+        return false;
+    throw new SpawnfileError("runtime_error", "Training clock canary returned no verified verdict");
+};

package/dist/compiler/training/broker/declaration.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 /**
- * `spawnfile.training-broker.v1`: the only thing the host tells the
+ * `spawnfile.training-broker.v2`: the only thing the host tells the
  * broker-capable training container about its slot. It is data, never code —
  * the image's own Spawnfile distribution renders the provisioning from it with
  * the same renderers production uses, so no host-written executable is ever
@@ -11,7 +11,9 @@ import { z } from "zod";
  * the named realm volume.
  */
 export declare const trainingBrokerDeclarationSchema: z.ZodObject<{
-    version: z.ZodLiteral<"spawnfile.training-broker.v1">;
+    version: z.ZodLiteral<"spawnfile.training-broker.v2">;
+    maxRunRequests: z.ZodDefault<z.ZodNumber>;
+    slots: z.ZodDefault<z.ZodNumber>;
     engine: z.ZodLiteral<"grok">;
     agentId: z.ZodString;
     model: z.ZodEnum<{

package/dist/compiler/training/broker/declaration.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 const canonical = z.string().min(2).max(4_096).refine((value) => path.posix.isAbsolute(value) && path.posix.normalize(value) === value && !value.endsWith("/") && !value.includes("\0"), "canonical absolute path");
 /**
- * `spawnfile.training-broker.v1`: the only thing the host tells the
+ * `spawnfile.training-broker.v2`: the only thing the host tells the
  * broker-capable training container about its slot. It is data, never code —
  * the image's own Spawnfile distribution renders the provisioning from it with
  * the same renderers production uses, so no host-written executable is ever
@@ -14,7 +14,9 @@ const canonical = z.string().min(2).max(4_096).refine((value) => path.posix.isAb
  * the named realm volume.
  */
 export const trainingBrokerDeclarationSchema = z.strictObject({
-    version: z.literal("spawnfile.training-broker.v1"),
+    version: z.literal("spawnfile.training-broker.v2"),
+    maxRunRequests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).default(1000),
+    slots: z.number().int().min(1).max(8).default(4),
     engine: z.literal("grok"),
     agentId: z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u),
     model: z.enum(DAIMON_GROK_BROKER_MODELS),

package/dist/compiler/training/broker/entrypoint.js

@@ -1,7 +1,12 @@
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import os from "node:os";
+import { promisify } from "node:util";
+import { renderTrainingBrokerProvisioning } from "./provisioning.js";
+import { stageTrainingEvaluatorSecret } from "./evaluatorSecrets.js";
+import { startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
+import { resetTrainingBrokerSlotAsOrganization } from "./reset.js";
 import path from "node:path";
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
@@ -10,7 +15,7 @@ import { loadDaimonProjectionModule, resolveTrainingGrokProjection } from "./pro
 import { resolveTrainingGrokRegistration } from "./registration.js";
 import { createTrainingSlotRuntime } from "./runtime.js";
 import { createTrainingSlotSupervisor, serveTrainingSlotSupervisor, startTrainingSlot } from "./supervisor.js";
-import { DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
+import { trainingSlotDescriptors, assertTrainingSlotsDocument, TRAINING_SLOTS_FILE, DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
 export const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "PAIDEIA_GROK_BROKER_CONTROL_SOCKET";
 export const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "PAIDEIA_GROK_GRANT_HOME_ROOT";
 export const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
@@ -57,23 +62,32 @@ export const runTrainingBrokerEntrypoint = async (options) => {
         throw new SpawnfileError("runtime_error", "The broker-capable training container must start as root");
     const declaration = parseTrainingBrokerDeclaration(JSON.parse(await readFile(options.declarationPath ?? TRAINING_BROKER_DECLARATION_FILE, "utf8")));
     await assertBootstrap(declaration);
-    const registration = resolveTrainingGrokRegistration(declaration);
+    const descriptors = trainingSlotDescriptors(declaration.slots);
+    const document = JSON.parse(await readFile(TRAINING_SLOTS_FILE, "utf8"));
+    assertTrainingSlotsDocument(document, declaration.slots);
+    const registrations = descriptors.map(p => resolveTrainingGrokRegistration({ ...declaration, slot: p.slot }));
     const daimon = await (options.loadDaimon ?? loadDaimonProjectionModule)();
-    // Daimon's projection is I/O-free, so the digest the receipt will bind is known before anything is provisioned.
-    const { projectionSha256 } = await resolveTrainingGrokProjection(declaration, registration, daimon);
-    const runtime = createTrainingSlotRuntime({ declaration, registration, projectionSha256 });
-    // Provision, start, canary and publish the slot preflight receipt before `train` exists at all: the
-    // first trial must not be the one trial that runs on no worker-uid denial evidence, and a refusal
-    // here costs nothing while the same refusal after the first wake costs that trial's spend.
-    const preflight = await startTrainingSlot(runtime, randomBytes(32).toString("hex"));
-    const supervisor = createTrainingSlotSupervisor({ runtime, organizationUid: declaration.organizationUid });
-    const server = serveTrainingSlotSupervisor(supervisor, TRAINING_SUPERVISOR_SOCKET, log, declaration.organizationUid);
-    log(`slot ${registration.slot} provisioned for ${registration.agentId} (${registration.model}/${registration.reasoningEffort}), projection ${projectionSha256}, `
-        + `generation ${preflight.generation} with ${preflight.canaries} denied canaries at ${preflight.receipt}`);
-    const status = await runTrainingChild(options.argv, declaration, log);
-    server.close();
-    await runtime.stop();
-    return status;
+    const reset = resetTrainingBrokerSlotAsOrganization;
+    const runtimes = await Promise.all(registrations.map(async (registration) => {
+        const { projectionSha256 } = await resolveTrainingGrokProjection(declaration, registration, daimon);
+        return createTrainingSlotRuntime({ declaration, registration, projectionSha256, reset });
+    }));
+    await stageTrainingEvaluatorSecret();
+    await promisify(execFile)("/bin/bash", ["--noprofile", "--norc", "-ceu", renderTrainingBrokerProvisioning(registrations, declaration.maxRunRequests).join("\n")], { maxBuffer: 8 * 1024 * 1024 });
+    const children = await startBrokerProcesses({ log });
+    let server;
+    try {
+        for (const runtime of runtimes)
+            await startTrainingSlot(runtime, randomBytes(32).toString("hex"));
+        const supervisor = createTrainingSlotSupervisor({ runtimes, organizationUid: declaration.organizationUid });
+        server = serveTrainingSlotSupervisor(supervisor, TRAINING_SUPERVISOR_SOCKET, log, declaration.organizationUid);
+        log(`provisioned ${registrations.length} training slots with one broker process set`);
+        return await runTrainingChild(options.argv, declaration, log);
+    }
+    finally {
+        server?.close();
+        await stopBrokerProcesses(children, log);
+    }
 };
 /**
  * `train` as uid 2000 with an empty bounding set, proven inside the child
@@ -98,6 +112,7 @@ const runTrainingChild = (argv, declaration, log) => new Promise((resolve) => {
             ...process.env,
             [TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV]: DAIMON_GROK_ENGINE_BROKER.controlSocketPath,
             [TRAINING_GROK_GRANT_HOME_ROOT_ENV]: TRAINING_GRANT_HOME_ROOT,
+            PAIDEIA_TRAINING_SLOTS_FILE: TRAINING_SLOTS_FILE,
             HOME: "/home/training"
         }
     });

package/dist/compiler/training/broker/evaluatorSecrets.d.ts

@@ -0,0 +1,2 @@
+/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
+export declare const stageTrainingEvaluatorSecret: (env?: NodeJS.ProcessEnv) => Promise<void>;

package/dist/compiler/training/broker/evaluatorSecrets.js

@@ -0,0 +1,60 @@
+import { constants } from "node:fs";
+import { chmod, chown, lstat, mkdir, open } from "node:fs/promises";
+import path from "node:path";
+import { TRAINING_TYPESAFE_SECRET_FILE, TRAINING_TYPESAFE_SECRET_INGRESS } from "../container/evaluators.js";
+import { DAIMON_ORGANIZATION_UID } from "./paths.js";
+/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
+export const stageTrainingEvaluatorSecret = async (env = process.env) => {
+    if (env.PAIDEIA_TYPESAFE_SECRET_FILE === undefined)
+        return;
+    if (process.getuid?.() !== 0 || env.PAIDEIA_TYPESAFE_SECRET_FILE !== TRAINING_TYPESAFE_SECRET_FILE) {
+        throw Error("Invalid evaluator secret staging declaration");
+    }
+    try {
+        const ingress = path.posix.dirname(TRAINING_TYPESAFE_SECRET_INGRESS);
+        const parent = await lstat(ingress);
+        if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== 0)
+            throw Error("Invalid ingress directory");
+        // This directory is tmpfs, never the mounted credential inode.
+        await chmod(ingress, 0o700);
+        const source = await open(TRAINING_TYPESAFE_SECRET_INGRESS, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let bytes;
+        try {
+            const info = await source.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size < 1 || info.size > 64 * 1024)
+                throw Error("Invalid ingress leaf");
+            const buffer = Buffer.alloc(64 * 1024 + 1);
+            const { bytesRead } = await source.read(buffer, 0, buffer.length, 0);
+            const after = await source.stat();
+            if (bytesRead !== info.size || after.size !== info.size || after.mtimeMs !== info.mtimeMs || after.ctimeMs !== info.ctimeMs) {
+                throw Error("Secret changed while staging");
+            }
+            bytes = buffer.subarray(0, bytesRead);
+        }
+        finally {
+            await source.close();
+        }
+        const destination = path.posix.dirname(TRAINING_TYPESAFE_SECRET_FILE);
+        await mkdir(destination, { mode: 0o700 });
+        const target = await open(TRAINING_TYPESAFE_SECRET_FILE, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            await target.writeFile(bytes);
+            await target.sync();
+            await target.chown(DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
+        }
+        finally {
+            bytes.fill(0);
+            await target.close();
+        }
+        await chown(destination, DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
+        const info = await lstat(TRAINING_TYPESAFE_SECRET_FILE), directory = await lstat(destination);
+        if (info.uid !== DAIMON_ORGANIZATION_UID || info.gid !== DAIMON_ORGANIZATION_UID || (info.mode & 0o777) !== 0o600 ||
+            directory.uid !== DAIMON_ORGANIZATION_UID || directory.gid !== DAIMON_ORGANIZATION_UID || (directory.mode & 0o777) !== 0o700) {
+            throw Error("Invalid evaluator secret ownership");
+        }
+    }
+    catch {
+        // Filesystem errors may contain credential bytes supplied by a transport; emit only a fixed diagnostic.
+        throw Error("Evaluator secret staging failed");
+    }
+};

package/dist/compiler/training/broker/index.d.ts

@@ -2,9 +2,10 @@ export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema, type T
 export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
 export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
 export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
-export { renderTrainingBrokerProvisioning, renderTrainingIdentities, trainingSlotDirectories } from "./provisioning.js";
+export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
 export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
 export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
-export { createTrainingSlotRuntime } from "./runtime.js";
+export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
+export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
 export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL, type TrainingSlotRuntime } from "./supervisor.js";
 export * from "./paths.js";

package/dist/compiler/training/broker/index.js

@@ -2,9 +2,10 @@ export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema } from
 export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
 export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
 export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
-export { renderTrainingBrokerProvisioning, renderTrainingIdentities, trainingSlotDirectories } from "./provisioning.js";
+export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
 export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
 export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
-export { createTrainingSlotRuntime } from "./runtime.js";
+export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
+export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
 export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
 export * from "./paths.js";

package/dist/compiler/training/broker/main.js

@@ -2,7 +2,7 @@
 import { runTrainingBrokerEntrypoint } from "./entrypoint.js";
 /**
  * The broker-capable training image's root entrypoint process. The image ships
- * it; the host supplies only the read-only `spawnfile.training-broker.v1`
+ * it; the host supplies only the read-only `spawnfile.training-broker.v2`
  * declaration and never a script, so no host executable enters the container.
  */
 const main = async () => {

package/dist/compiler/training/broker/paths.d.ts

@@ -2,7 +2,7 @@ import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/dai
 /**
  * Every container path the broker-capable training container fixes.
  *
- * They are fixed rather than derived because three parties must agree on them
+ * They are deterministic because three parties must agree on them
  * without talking to each other: the root entrypoint that provisions them, the
  * root slot supervisor that wipes and re-provisions them on recycle, and
  * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
@@ -10,7 +10,7 @@ import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/dai
  * resolves a path, so each one must also be canonical and never a symlink; the
  * provisioning program asserts that before a slot is used.
  *
- * Everything under `/run/training/slot` is per-trial state on tmpfs — never the
+ * Everything under `/run/training/slots/<i>` is per-trial state on tmpfs — never the
  * Grok realm volume (R2). The realm volume holds only `auth.json` and the
  * broker credential journal, so a recycle can wipe the slot without touching
  * the one durable rotating credential.
@@ -19,20 +19,8 @@ export declare const TRAINING_RUN_ROOT = "/run/training/output";
 export declare const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
 export declare const TRAINING_PAIDEIA_ROOT = "/run/paideia";
 export declare const TRAINING_CONTEXT_FILE = "/run/paideia/context.json";
-/** Host-written, read-only `spawnfile.training-broker.v1` declaration the root entrypoint reads. */
+/** Host-written, read-only `spawnfile.training-broker.v2` declaration the root entrypoint reads. */
 export declare const TRAINING_BROKER_DECLARATION_FILE = "/run/paideia/training-broker.json";
-export declare const TRAINING_SLOT_ROOT = "/run/training/slot";
-export declare const TRAINING_SLOT_WORKSPACE = "/run/training/slot/workspace";
-export declare const TRAINING_SLOT_RUNTIME_HOME = "/run/training/slot/runtime-home";
-export declare const TRAINING_SLOT_STATE_ROOT = "/run/training/slot/state";
-export declare const TRAINING_SLOT_ACCEPTANCE_STORE = "/run/training/slot/state/wake-acceptance";
-/** Per-slot turn store. On tmpfs on purpose: a replayed turn from trial N must never satisfy trial N+1 (R2). */
-export declare const TRAINING_SLOT_TURN_STORE = "/run/training/slot/turns";
-export declare const TRAINING_SLOT_USAGE_DIRECTORY = "/run/training/slot/usage";
-export declare const TRAINING_SLOT_USAGE_LEDGER = "/run/training/slot/usage/usage.jsonl";
-export declare const TRAINING_SLOT_PREFLIGHT_RECEIPT = "/run/training/slot/preflight.json";
-/** Supervisor-owned monotonic generation counter; survives a recycle, never a container restart. */
-export declare const TRAINING_SLOT_GENERATION_FILE = "/run/training/slot/generation.json";
 export declare const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
 export declare const TRAINING_INFERENCE_LEDGER = "/run/training/inference/inference.jsonl";
 /** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
@@ -54,9 +42,6 @@ export declare const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
 export declare const TRAINING_SUPERVISOR_SOCKET = "/run/training/supervisor/control.sock";
 export declare const TRAINING_SUPERVISOR_LOG = "/run/training/supervisor/supervisor.log";
 export declare const TRAINING_WORKER_ROOT = "/var/lib/daimon-workers";
-export declare const TRAINING_SLOT_INDEX = 0;
-export declare const TRAINING_WORKER_UID: number;
-export declare const TRAINING_WORKER_HOME: string;
 /**
  * Paideia's own fixed container paths (`containerPaths` in its native launch
  * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
@@ -82,43 +67,99 @@ export declare const TRAINING_CALLER_PROTECTED_PATHS: readonly ["/run/paideia/co
  * tagged `context` — the caller-state role — since there is no other way to
  * carry a path through that contract.
  */
-export declare const TRAINING_EVALUATOR_PATHS: readonly {
-    role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
-    path: string;
-}[];
-/**
- * One entry per evaluator role, in declaration order: the launch receipt requires all five roles,
- * and several `context` paths share that role, so the first of each role is the role's root.
- */
-export declare const TRAINING_EVALUATOR_ROOTS: {
+export declare const TRAINING_SLOTS_FILE = "/run/paideia/slots.json";
+export declare const TRAINING_SLOTS_VERSION: "spawnfile.training-slots.v1";
+export declare const TRAINING_DEFAULT_SLOTS = 4;
+export declare const TRAINING_MAX_SLOTS = 8;
+/** 100 ports per slot: offsets 0=Moltnet, 1=worker control, 2=bridge; 3..99 reserved. */
+export declare const TRAINING_PORT_BASE = 20000;
+export declare const TRAINING_PORT_STRIDE = 100;
+export declare const TRAINING_BROKER_SOCKET_PATHS: readonly ["/run/daimon-engine-broker/control.sock", "/run/daimon-engine-broker/backend.sock", "/run/daimon-engine-broker/launcher.sock"];
+export declare const TRAINING_TURN_STORE_ROOT = "/run/training/turns";
+/** Persistent, broker-only run counter; never part of a slot recycle. */
+export declare const TRAINING_RUN_REQUEST_STORE = "/run/training/request-budget";
+export declare const assertTrainingSlotCount: (slots: number) => number;
+export declare const trainingSlotPaths: (slot: number) => {
+    slot: number;
+    workerUid: number;
+    root: string;
+    workerHome: string;
+    workspace: string;
+    runtimeHome: string;
+    state: string;
+    acceptanceStore: string;
+    turns: string;
+    usageDirectory: string;
+    usageLedger: string;
+    preflightReceipt: string;
+    generationFile: string;
+    sealedInputsAttestation: string;
+    privateTmp: string;
+    clockDirectory: string;
+    clockFile: string;
+    ports: {
+        base: number;
+        stride: number;
+        moltnet: number;
+        workerControl: number;
+        bridge: number;
+    };
+};
+export type TrainingSlotPaths = ReturnType<typeof trainingSlotPaths>;
+export type TrainingEvaluatorPath = {
     role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
     path: string;
+};
+/** The complete additional projection deny set. Sibling roots and homes never nest with own masks. */
+export declare const trainingEvaluatorPaths: (slot: number, slots: number) => TrainingEvaluatorPath[];
+export declare const trainingSlotDescriptors: (slots?: number) => {
+    evaluatorPaths: TrainingEvaluatorPath[];
+    containerPaths: {
+        path: "/run/paideia/config.json" | "/run/paideia/control" | "/run/paideia/launch.json" | "/run/paideia/token" | "/run/paideia/env" | "/run/paideia/preparation.json" | "/run/paideia/repair.json";
+    }[];
+    controlRoot: string;
+    slot: number;
+    workerUid: number;
+    root: string;
+    workerHome: string;
+    workspace: string;
+    runtimeHome: string;
+    state: string;
+    acceptanceStore: string;
+    turns: string;
+    usageDirectory: string;
+    usageLedger: string;
+    preflightReceipt: string;
+    generationFile: string;
+    sealedInputsAttestation: string;
+    privateTmp: string;
+    clockDirectory: string;
+    clockFile: string;
+    ports: {
+        base: number;
+        stride: number;
+        moltnet: number;
+        workerControl: number;
+        bridge: number;
+    };
 }[];
-/**
- * What `paideia.daimon-native.launch.v2`'s `controlRoot` must be.
- *
- * Paideia's worker passes it to Daimon as `acceptanceStorePath`, and Daimon adds
- * it to the projection's deny list, so it has to be the same path this
- * container masks as its slot state root. Its own default
- * (`/run/paideia/control`) would both change the digest and nest inside the
- * `/run/paideia` mask, which Grok refuses — Daimon renders a nested mask
- * without complaining, so the failure would only appear at the first turn.
- */
-export declare const TRAINING_CALLER_CONTROL_ROOT = "/run/training/slot/state";
-/**
- * Everything this container provisions that the one training worker must not
- * read, beyond Daimon's own protected set (realm, bootstrap, acceptance store).
- * Each entry sits strictly below a Grok 1.0.34 base-profile grant — Grok
- * refuses a profile whose deny entry equals or contains `/run`, `/var`, `/etc`
- * or `/tmp` — and no entry covers another, because masks cannot nest.
- */
-/**
- * The added deny set is exactly the launch's `evaluatorPaths`, so Spawnfile and
- * Paideia hand Daimon's resolver the same list. `TRAINING_SLOT_STATE_ROOT` is
- * deliberately absent: Daimon adds it itself, from the control root above.
- */
-export declare const TRAINING_ADDED_DENY_PATHS: readonly string[];
-/** Paths the provisioning program creates root-owned `0700` when absent, so every deny entry always has a target inode. */
+export type TrainingSlotDescriptor = ReturnType<typeof trainingSlotDescriptors>[number];
+export interface TrainingSlotsDocument {
+    schema: typeof TRAINING_SLOTS_VERSION;
+    slots: {
+        index: number;
+        workerUid: number;
+        roots: Record<string, string>;
+        ports: {
+            base: number;
+            count: number;
+        };
+    }[];
+}
+export declare const trainingSlotsDocument: (slots?: number) => TrainingSlotsDocument;
+/** Both sides derive the descriptor bytes; a stale or edited bind must never certify a different pool. */
+export declare const assertTrainingSlotsDocument: (value: unknown, slots: number) => void;
+/** Shared deny targets exist before worker attestation; no per-slot subtree is touched here. */
 export declare const TRAINING_OPTIONAL_DENY_DIRECTORIES: readonly string[];
 /**
  * Deny entries a launch may legitimately not have mounted. Everything else must
@@ -170,7 +211,6 @@ export declare const TRAINING_HOST_BIND_DENY_PATHS: readonly string[];
  */
 export declare const TRAINING_SEALED_DENY_PATHS: readonly string[];
 /** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
-export declare const TRAINING_SEALED_INPUTS_ATTESTATION = "/run/training/slot/sealed-inputs.json";
 /** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
 export declare const TRAINING_SEALED_INPUTS_IDENTITY: {
     readonly uid: 0;
@@ -188,9 +228,9 @@ export declare const TRAINING_SEALED_INPUTS_IDENTITY: {
  * anyway, so an undeclared one degrades to "left in place and reported" rather
  * than a failed provision.
  */
-export declare const TRAINING_WIPE_TARGETS: readonly string[];
-/** Emptied but kept: their paths are registered with Daimon and must stay canonical across a recycle. */
-export declare const TRAINING_CLEAR_TARGETS: readonly string[];
+export declare const trainingWipeTargets: (slot: number) => readonly string[];
+/** Broker-owned turns and clocks are reset through its control seam, never by filesystem deletion. */
+export declare const trainingClearTargets: (slot: number) => readonly string[];
 export declare const TRAINING_REALM_MOUNT: "/var/lib/spawnfile/daimon/grok-subscription-realm";
 export declare const TRAINING_BOOTSTRAP_MOUNT: "/var/lib/spawnfile/daimon/grok-bootstrap-auth";
 export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };