spawnfile 0.1.17 → 0.1.18

package/dist/compiler/training/broker/supervisor.js

@@ -3,7 +3,7 @@ import { createServer } from "node:net";
 import path from "node:path";
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_ORGANIZATION_UID } from "./paths.js";
-export const TRAINING_SUPERVISOR_PROTOCOL = "spawnfile.training-slot-supervisor.v1";
+export const TRAINING_SUPERVISOR_PROTOCOL = "spawnfile.training-slot-supervisor.v2";
 export const TRAINING_SUPERVISOR_MAX_REQUEST_BYTES = 4_096;
 const NONCE = /^[a-f0-9]{64}$/u;
 /**
@@ -22,8 +22,6 @@ const NONCE = /^[a-f0-9]{64}$/u;
  * publishes, from the same canaries.
  */
 export const startTrainingSlot = async (runtime, nonce) => {
-    await runtime.provision();
-    await runtime.start();
     const canaries = await runtime.canaries();
     const generation = await runtime.nextGeneration();
     const receipt = await runtime.publishReceipt({ generation, nonce, canaries });
@@ -33,47 +31,48 @@ export const startTrainingSlot = async (runtime, nonce) => {
 /**
  * The single-verb root slot supervisor.
  *
- * One verb, one argument, no path or command ever supplied by the caller: the
+ * One verb, slot and nonce, no path or command ever supplied by the caller: the
  * whole point of D4 is that recycling replays the container's own audited
  * provisioning rather than exposing a root file-system API to the evaluator.
- * Recycles are serialized — a second caller waits rather than interleaving a
+ * Recycles of the same slot are serialized — a second caller waits rather than interleaving a
  * wipe with a provision.
  */
 export const createTrainingSlotSupervisor = (options) => {
     const organizationUid = options.organizationUid ?? DAIMON_ORGANIZATION_UID;
     const drainTimeoutMs = options.drainTimeoutMs ?? 120_000;
     const now = options.now ?? Date.now;
-    let queue = Promise.resolve();
-    const recycle = async (nonce, peerUid) => {
+    const queues = new Map();
+    const recycle = async (slot, nonce, peerUid) => {
         if (peerUid !== organizationUid)
             throw new SpawnfileError("validation_error", `Grok slot recycle refused for uid ${peerUid}`);
         if (!NONCE.test(nonce))
             throw new SpawnfileError("validation_error", "Grok slot recycle requires a 32-byte hex nonce");
+        if (!Number.isInteger(slot) || slot < 0 || slot >= options.runtimes.length)
+            throw new SpawnfileError("validation_error", "Grok slot recycle requires a declared slot index");
+        const runtime = options.runtimes[slot];
         const started = now();
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), drainTimeoutMs);
         try {
-            await options.runtime.drain(controller.signal);
+            await runtime.reset(controller.signal);
         }
         finally {
             clearTimeout(timer);
         }
-        await options.runtime.stop();
-        await options.runtime.wipe();
-        await options.runtime.provision();
-        await options.runtime.start();
-        const canaries = await options.runtime.canaries();
-        const generation = await options.runtime.nextGeneration();
-        const receipt = await options.runtime.publishReceipt({ generation, nonce, canaries });
+        await runtime.wipe();
+        await runtime.provision();
+        const canaries = await runtime.canaries();
+        const generation = await runtime.nextGeneration();
+        const receipt = await runtime.publishReceipt({ generation, nonce, canaries });
         const durationMs = now() - started;
-        options.runtime.log(`recycle generation=${generation} canaries=${canaries.length} durationMs=${durationMs}`);
-        return { ok: true, verb: "recycle", generation, nonce, receipt, durationMs };
+        runtime.log(`recycle generation=${generation} canaries=${canaries.length} durationMs=${durationMs}`);
+        return { ok: true, verb: "recycle", slot, generation, nonce, receipt, durationMs };
     };
     return {
         /** Serialized: a recycle already in flight completes before the next one starts. */
-        recycle: (nonce, peerUid) => {
-            const next = queue.then(() => recycle(nonce, peerUid));
-            queue = next.catch(() => undefined);
+        recycle: (slot, nonce, peerUid) => {
+            const next = (queues.get(slot) ?? Promise.resolve()).then(() => recycle(slot, nonce, peerUid));
+            queues.set(slot, next.catch(() => undefined));
             return next;
         }
     };
@@ -142,8 +141,8 @@ export const serveTrainingSlotSupervisor = (supervisor, socketPath, log, organiz
                 answer(failure("request is not JSON"));
                 return;
             }
-            if (request.v !== TRAINING_SUPERVISOR_PROTOCOL || request.verb !== "recycle" || typeof request.nonce !== "string"
-                || Object.keys(request).length !== 3) {
+            if (!request || typeof request !== "object" || Array.isArray(request) || request.v !== TRAINING_SUPERVISOR_PROTOCOL || request.verb !== "recycle" || typeof request.nonce !== "string"
+                || typeof request.slot !== "number" || Object.keys(request).length !== 4) {
                 answer(failure("unsupported request"));
                 return;
             }
@@ -151,7 +150,7 @@ export const serveTrainingSlotSupervisor = (supervisor, socketPath, log, organiz
                 answer(failure("peer identity is unavailable"));
                 return;
             }
-            supervisor.recycle(request.nonce, peerUid)
+            supervisor.recycle(request.slot, request.nonce, peerUid)
                 .then((result) => answer(`${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, ...result })}\n`))
                 .catch((error) => {
                 const message = error instanceof Error ? error.message : "recycle failed";

package/dist/compiler/training/broker/taskClock.d.ts

@@ -0,0 +1,5 @@
+import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
+/** Reclaim only the clock subtree before the shared program clears the control root at startup. */
+export declare const renderTrainingTaskClockReset: () => string[];
+/** Before a receipt, bind the actual installed bytes and worker access to the clocked projection. */
+export declare const renderTrainingTaskClockAssertions: (registration: DaimonGrokRegistration) => string[];

package/dist/compiler/training/broker/taskClock.js

@@ -0,0 +1,41 @@
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { SpawnfileError } from "../../../shared/index.js";
+import { resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
+const clock = DAIMON_GROK_ENGINE_BROKER.worker.taskClock;
+const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
+/** Reclaim only the clock subtree before the shared program clears the control root at startup. */
+export const renderTrainingTaskClockReset = () => [
+    `test ! -L ${quote(clock.rootDirectoryPath)}`,
+    `if [ -d ${quote(clock.rootDirectoryPath)} ]; then chown -R 0:0 ${quote(clock.rootDirectoryPath)}; chmod -R u+rwX ${quote(clock.rootDirectoryPath)}; fi`
+];
+/** Before a receipt, bind the actual installed bytes and worker access to the clocked projection. */
+export const renderTrainingTaskClockAssertions = (registration) => {
+    const pin = resolveDaimonGrokClockedWorkerConfig(registration.model, registration.reasoningEffort, registration.slot).sha256;
+    const directoryPath = clock.slotDirectoryPattern.replace("{slot}", String(registration.slot));
+    const timestampFilePath = clock.slotFilePattern.replace("{slot}", String(registration.slot));
+    if (registration.configVariant !== "clocked" || registration.configSha256 !== pin) {
+        throw new SpawnfileError("runtime_error", "Training slot requires the pinned clocked worker config");
+    }
+    const worker = [
+        `test -r ${quote(timestampFilePath)}`, `test ! -w ${quote(timestampFilePath)}`,
+        `test -x ${quote(directoryPath)}`, `test ! -w ${quote(directoryPath)}`,
+        `test -r ${quote(clock.preloadPath)}`
+    ].join(" && ");
+    return [
+        `test ! -L ${quote(directoryPath)} && test -d ${quote(directoryPath)}`,
+        `test ! -L ${quote(timestampFilePath)} && test -f ${quote(timestampFilePath)}`,
+        `test "$(stat -c '%u:%g %a' ${quote(directoryPath)})" = "${clock.ownerUid}:${clock.ownerUid} ${clock.directoryMode.toString(8)}"`,
+        `test "$(stat -c '%u:%g %a %h' ${quote(timestampFilePath)})" = "${clock.ownerUid}:${clock.ownerUid} ${clock.fileMode.toString(8)} 1"`,
+        `test "$(sha256sum ${quote(`${registration.grokHome}/config.toml`)} | cut -d ' ' -f1)" = ${quote(pin)}`,
+        // The read-only image bakes both the fixed symlink and the distro target. Refuse writable or
+        // non-root-owned ancestors/targets; a missing library must never masquerade as a working clock.
+        "node <<'SPAWNFILE_TASK_CLOCK_LIBRARY'",
+        "const fs = require('node:fs'), path = require('node:path');",
+        `const preload = ${JSON.stringify(clock.preloadPath)};`,
+        "const link = fs.lstatSync(preload); if (!link.isSymbolicLink() || link.uid !== 0 || link.gid !== 0) throw new Error('unsafe task clock preload link');",
+        "const library = fs.realpathSync(preload); if (!/^\\/usr\\/lib\\/(x86_64|aarch64)-linux-gnu\\/faketime\\/libfaketime\\.so\\.1$/.test(library) || !fs.statSync(library).isFile()) throw new Error('unexpected task clock library');",
+        "for (const root of [path.dirname(preload), library]) { for (let at = root;; at = path.dirname(at)) { const info = fs.lstatSync(at); if (info.isSymbolicLink() || info.uid !== 0 || info.gid !== 0 || (info.mode & 0o022)) throw new Error(`unsafe task clock library path: ${at}`); if (at === '/') break; } }",
+        "SPAWNFILE_TASK_CLOCK_LIBRARY",
+        `setpriv --clear-groups --reuid ${registration.uid} --regid ${registration.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- /bin/sh -ceu ${quote(worker)}`
+    ];
+};

package/dist/compiler/training/compiledAgent.d.ts

@@ -0,0 +1,21 @@
+export interface CompiledAgentPaths {
+    workspace: string;
+    runtimeConfig: string;
+    home: string | null;
+    skillRoots: string[];
+    moltnet: {
+        networkId: string;
+        memberId: string;
+        nodeConfig: string;
+        serverConfig: string | null;
+    }[];
+}
+export interface CompiledAgent extends CompiledAgentPaths {
+    agentId: string;
+    runtime: string;
+    instanceId: string;
+    /** The same paths in the container's namespace; top-level paths address compileOut/container/rootfs. */
+    containerPaths: CompiledAgentPaths;
+}
+/** Read compiler facts only. Does not load runtime state, credentials, or authored manifests. */
+export declare const resolveCompiledAgent: (compileOut: string, agentName: string) => Promise<CompiledAgent>;

package/dist/compiler/training/compiledAgent.js

@@ -0,0 +1,62 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { WORKSPACE_SKILL_BASE_DIRECTORY } from "../../runtime/common.js";
+const text = z.string().min(1);
+const absolute = text.refine((value) => value.startsWith("/") && value !== "/"
+    && path.posix.normalize(value) === value && !/[\\\0]/u.test(value), "Expected a normalized container absolute path");
+const agentPaths = z.object({ workspace_path: absolute, home_path: absolute.nullable(), skill_roots: z.array(absolute) });
+// Validate the consumed projection, allowing unrelated report fields to evolve.
+const reportSchema = z.object({
+    spawnfile_version: z.literal("0.1"),
+    nodes: z.array(z.object({ id: text, kind: z.enum(["agent", "team"]) })),
+    container: z.object({
+        runtime_instances: z.array(z.object({ id: text, runtime: text, node_ids: z.array(text), config_path: absolute,
+            workspace_path: absolute, home_path: absolute.nullable(), agent_paths: z.record(text, agentPaths).optional() })),
+        moltnet: z.object({
+            node_plans: z.array(z.object({ node_id: text, member_id: text, network_id: text, config_path: absolute })),
+            server_plans: z.array(z.object({ network_id: text, mode: z.enum(["managed", "external"]), config_path: absolute.optional() }))
+        }).optional()
+    })
+});
+/** Read compiler facts only. Does not load runtime state, credentials, or authored manifests. */
+export const resolveCompiledAgent = async (compileOut, agentName) => {
+    const file = path.resolve(compileOut, "spawnfile-report.json");
+    const report = reportSchema.parse(JSON.parse(await readFile(file, "utf8")));
+    const agents = report.nodes.filter((node) => node.kind === "agent");
+    const exact = agents.filter((node) => node.id === agentName);
+    const candidates = exact.length ? exact : agents.filter((node) => node.id === `agent:${agentName}`);
+    if (candidates.length !== 1)
+        throw new Error(`Unknown or ambiguous compiled agent: ${agentName}`);
+    const agentId = candidates[0].id;
+    const instances = report.container.runtime_instances.filter((instance) => instance.node_ids.includes(agentId));
+    if (instances.length !== 1)
+        throw new Error(`Expected one compiled runtime instance for ${agentId}`);
+    const instance = instances[0];
+    let paths = instance.agent_paths?.[agentId];
+    if (!paths) {
+        // Single-agent runtime adapters already report their exact workspace and home.
+        if (!["openclaw", "picoclaw"].includes(instance.runtime) || instance.node_ids.length !== 1) {
+            throw new Error(`Compile report lacks per-agent paths for ${agentId}; recompile with a current compiler`);
+        }
+        paths = { workspace_path: instance.workspace_path, home_path: instance.home_path,
+            skill_roots: [path.posix.join(instance.workspace_path, path.posix.relative("workspace", WORKSPACE_SKILL_BASE_DIRECTORY))] };
+    }
+    const moltnet = report.container.moltnet;
+    const attachments = (moltnet?.node_plans ?? []).filter((node) => node.node_id === agentId).map((node) => {
+        const servers = moltnet.server_plans.filter((server) => server.network_id === node.network_id);
+        if (servers.length !== 1 || (servers[0].mode === "managed" && !servers[0].config_path)) {
+            throw new Error(`Missing or ambiguous Moltnet server plan for ${node.network_id}`);
+        }
+        return { networkId: node.network_id, memberId: node.member_id, nodeConfig: node.config_path,
+            serverConfig: servers[0].config_path ?? null };
+    });
+    const containerPaths = { workspace: paths.workspace_path, runtimeConfig: instance.config_path,
+        home: paths.home_path, skillRoots: paths.skill_roots, moltnet: attachments };
+    const host = (value) => path.resolve(compileOut, "container/rootfs", `.${value}`);
+    return { agentId, runtime: instance.runtime, instanceId: instance.id, containerPaths,
+        workspace: host(containerPaths.workspace), runtimeConfig: host(containerPaths.runtimeConfig),
+        home: containerPaths.home === null ? null : host(containerPaths.home), skillRoots: containerPaths.skillRoots.map(host),
+        moltnet: attachments.map((entry) => ({ ...entry, nodeConfig: host(entry.nodeConfig),
+            serverConfig: entry.serverConfig === null ? null : host(entry.serverConfig) })) };
+};

package/dist/compiler/training/container/contract.d.ts

@@ -1,10 +1,14 @@
 import { z } from "zod";
+/** Fixed libfaketime symlink installed and mode-verified by the training image. */
+export declare const TRAINING_FAKETIME_LIBRARY_PATH: "/usr/local/lib/daimon/libfaketime.so.1";
 export declare const trainingImageSchema: z.ZodString;
 export declare const trainingContainerConfigSchema: z.ZodObject<{
     version: z.ZodEnum<{
         "spawnfile.training-container.v1": "spawnfile.training-container.v1";
         "spawnfile.training-container.v3": "spawnfile.training-container.v3";
+        "spawnfile.training-container.v4": "spawnfile.training-container.v4";
     }>;
+    slots: z.ZodDefault<z.ZodNumber>;
     dockerContext: z.ZodString;
     inputs: z.ZodArray<z.ZodObject<{
         source: z.ZodString;
@@ -21,6 +25,25 @@ export declare const trainingContainerConfigSchema: z.ZodObject<{
             claude: "claude";
         }>;
     }, z.core.$strict>>;
+    evaluatorRoutes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        purpose: z.ZodEnum<{
+            decisions: "decisions";
+            extraction: "extraction";
+            proposals: "proposals";
+        }>;
+        provider: z.ZodEnum<{
+            "codex-subscription": "codex-subscription";
+            typesafe: "typesafe";
+        }>;
+        model: z.ZodString;
+        maxRequests: z.ZodNumber;
+        maxSpendUsd: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    evaluatorSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        provider: z.ZodLiteral<"typesafe">;
+        source: z.ZodString;
+    }, z.core.$strict>>>;
+    subjectIsolation: z.ZodOptional<z.ZodLiteral<"codex-native-sandbox">>;
     broker: z.ZodOptional<z.ZodObject<{
         engine: z.ZodLiteral<"grok">;
         realmVolume: z.ZodString;

package/dist/compiler/training/container/contract.js

@@ -1,5 +1,8 @@
 import path from "node:path";
 import { z } from "zod";
+import { trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema } from "./evaluators.js";
+/** Fixed libfaketime symlink installed and mode-verified by the training image. */
+export const TRAINING_FAKETIME_LIBRARY_PATH = "/usr/local/lib/daimon/libfaketime.so.1";
 const hostPath = z.string().min(1).refine((value) => path.isAbsolute(value) && !/[,\r\n\0]/u.test(value), "Expected an absolute bind path");
 const inputPath = z.string().regex(/^\/run\/training\/inputs\/[A-Za-z0-9._/-]+$/u).refine((value) => path.posix.normalize(value) === value && !value.endsWith("/"));
 export const trainingImageSchema = z.string().regex(/^(?:sha256:[a-f0-9]{64}|[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[a-f0-9]{64})$/u);
@@ -9,25 +12,40 @@ const brokerLaunchSchema = z.object({
     realmVolume: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
     /** Host leaf of the dedicated training Grok login. Never the desktop `~/.grok/auth.json`. */
     bootstrap: hostPath,
-    /** `spawnfile.training-broker.v1`, written beside the launch config and bound read-only into the container. */
+    /** `spawnfile.training-broker.v2`, written beside the launch config and bound read-only into the container. */
     declaration: hostPath
 }).strict();
 export const trainingContainerConfigSchema = z.object({
-    version: z.enum(["spawnfile.training-container.v1", "spawnfile.training-container.v3"]),
+    version: z.enum(["spawnfile.training-container.v1", "spawnfile.training-container.v3", "spawnfile.training-container.v4"]),
+    slots: z.number().int().min(1).max(8).default(4),
     dockerContext: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
     inputs: z.array(z.object({ source: hostPath, destination: inputPath }).strict()).min(1).max(64),
     output: z.object({ source: hostPath, destination: z.literal("/run/training/output") }).strict(),
     auth: z.array(z.object({ source: hostPath, provider: z.enum(["codex", "claude"]) }).strict()).max(2),
-    /** Present only on `spawnfile.training-container.v3`: the brokered Grok slot this container runs as root. */
+    evaluatorRoutes: trainingEvaluatorRoutesSchema.optional(),
+    evaluatorSecrets: trainingEvaluatorSecretsSchema(hostPath).optional(),
+    subjectIsolation: z.literal("codex-native-sandbox").optional(),
+    /** Present only on `spawnfile.training-container.v4`: the brokered Grok slot this container runs as root. */
     broker: brokerLaunchSchema.optional()
 }).strict().superRefine((value, context) => {
+    if (value.evaluatorSecrets && !value.broker && !value.subjectIsolation)
+        context.addIssue({ code: "custom", message: "Evaluator secrets require brokered v4 isolation or explicit codex-native-sandbox subject isolation" });
+    if (value.subjectIsolation && value.version !== "spawnfile.training-container.v1")
+        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a non-brokered v1 launch" });
+    if (value.subjectIsolation && !value.evaluatorRoutes?.some(route => route.provider === "typesafe"))
+        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a TypeSafe evaluator route" });
+    if (value.evaluatorSecrets && !value.evaluatorRoutes?.some(route => route.provider === "typesafe")) {
+        context.addIssue({ code: "custom", message: "TypeSafe secret requires a declared evaluator route" });
+    }
+    if (value.version === "spawnfile.training-container.v3")
+        context.addIssue({ code: "custom", message: "Training-container v3 is unsupported; migrate to v4 with slots: 1" });
     const destinations = value.inputs.map((entry) => entry.destination);
     if (destinations.some((entry, index) => destinations.some((other, otherIndex) => otherIndex !== index && (entry === other || entry.startsWith(`${other}/`))))) {
         context.addIssue({ code: "custom", message: "Input destinations must not overlap" });
     }
     if (new Set(value.auth.map((entry) => entry.provider)).size !== value.auth.length)
         context.addIssue({ code: "custom", message: "Duplicate auth provider" });
-    if ((value.version === "spawnfile.training-container.v3") !== (value.broker !== undefined)) {
-        context.addIssue({ code: "custom", message: "Only spawnfile.training-container.v3 declares a broker slot, and it always does" });
+    if ((value.version === "spawnfile.training-container.v4") !== (value.broker !== undefined)) {
+        context.addIssue({ code: "custom", message: "Only spawnfile.training-container.v4 declares broker slots; migrate v3 by setting version to v4 and slots to 1" });
     }
 });

package/dist/compiler/training/container/evaluators.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+export declare const TRAINING_EVALUATOR_ROUTES_FILE = "/run/paideia/evaluator-routes.json";
+export declare const TRAINING_TYPESAFE_SECRET_FILE = "/run/paideia/secrets/typesafe";
+export declare const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/paideia/secret-ingress/typesafe";
+export declare const trainingEvaluatorRouteSchema: z.ZodObject<{
+    purpose: z.ZodEnum<{
+        decisions: "decisions";
+        extraction: "extraction";
+        proposals: "proposals";
+    }>;
+    provider: z.ZodEnum<{
+        "codex-subscription": "codex-subscription";
+        typesafe: "typesafe";
+    }>;
+    model: z.ZodString;
+    maxRequests: z.ZodNumber;
+    maxSpendUsd: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const trainingEvaluatorRoutesSchema: z.ZodArray<z.ZodObject<{
+    purpose: z.ZodEnum<{
+        decisions: "decisions";
+        extraction: "extraction";
+        proposals: "proposals";
+    }>;
+    provider: z.ZodEnum<{
+        "codex-subscription": "codex-subscription";
+        typesafe: "typesafe";
+    }>;
+    model: z.ZodString;
+    maxRequests: z.ZodNumber;
+    maxSpendUsd: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>>;
+/** Only a reference is declared. Secret bytes are never read by the compiler or launcher. */
+export declare const trainingEvaluatorSecretsSchema: (source: z.ZodString) => z.ZodArray<z.ZodObject<{
+    provider: z.ZodLiteral<"typesafe">;
+    source: z.ZodString;
+}, z.core.$strict>>;
+export declare const prepareTrainingEvaluators: (root: string, config: {
+    evaluatorRoutes?: z.infer<typeof trainingEvaluatorRoutesSchema>;
+    evaluatorSecrets?: {
+        provider: "typesafe";
+        source: string;
+    }[];
+    subjectIsolation?: "codex-native-sandbox";
+}, mappedArgs: readonly string[]) => Promise<{
+    mounts: string[];
+    env: string[];
+}>;

package/dist/compiler/training/container/evaluators.js

@@ -0,0 +1,50 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+export const TRAINING_EVALUATOR_ROUTES_FILE = "/run/paideia/evaluator-routes.json";
+export const TRAINING_TYPESAFE_SECRET_FILE = "/run/paideia/secrets/typesafe";
+export const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/paideia/secret-ingress/typesafe";
+export const trainingEvaluatorRouteSchema = z.object({
+    purpose: z.enum(["extraction", "proposals", "decisions"]),
+    provider: z.enum(["codex-subscription", "typesafe"]),
+    model: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/u),
+    maxRequests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    maxSpendUsd: z.number().finite().nonnegative().optional()
+}).strict().superRefine((route, context) => {
+    if (route.provider === "codex-subscription" ? route.purpose === "decisions" || route.maxSpendUsd !== undefined
+        : route.purpose !== "decisions" || route.maxSpendUsd === undefined) {
+        context.addIssue({ code: "custom", message: "Evaluator provider/purpose mismatch or missing TypeSafe spend budget" });
+    }
+});
+export const trainingEvaluatorRoutesSchema = z.array(trainingEvaluatorRouteSchema).min(1).max(64)
+    .refine(routes => new Set(routes.map(route => JSON.stringify([route.purpose, route.provider, route.model]))).size === routes.length, "Duplicate evaluator route");
+/** Only a reference is declared. Secret bytes are never read by the compiler or launcher. */
+export const trainingEvaluatorSecretsSchema = (source) => z.array(z.object({
+    provider: z.literal("typesafe"), source
+}).strict()).min(1).max(1);
+export const prepareTrainingEvaluators = async (root, config, mappedArgs) => {
+    const mounts = [], env = [];
+    if (config.evaluatorRoutes) {
+        const outputs = mappedArgs.flatMap((arg, index) => arg === "--out" ? [mappedArgs[index + 1]] : []);
+        const output = outputs[0];
+        if (outputs.length !== 1 || !output || path.posix.normalize(output) !== output ||
+            !(output === "/run/training/output" || output.startsWith("/run/training/output/"))) {
+            throw Error("Evaluator receipts require one mapped training --out directory");
+        }
+        const source = path.join(root, "evaluator-routes.json");
+        await writeFile(source, JSON.stringify({ version: "paideia.evaluator-routes.v1", routes: config.evaluatorRoutes,
+            receiptPath: path.posix.join(output, "evaluator-requests.jsonl") }), { mode: 0o444, flag: "wx" });
+        mounts.push(`type=bind,src=${source},dst=${TRAINING_EVALUATOR_ROUTES_FILE},readonly`);
+        env.push(`PAIDEIA_EVALUATOR_ROUTES_FILE=${TRAINING_EVALUATOR_ROUTES_FILE}`);
+    }
+    for (const secret of config.evaluatorSecrets ?? []) {
+        // The host-uid v1 launcher cannot stage a root-owned copy; bind the canonical leaf at the consumer path.
+        if (config.subjectIsolation === "codex-native-sandbox") {
+            mounts.push(`type=bind,src=${secret.source},dst=${TRAINING_TYPESAFE_SECRET_FILE},readonly`);
+        }
+        else
+            mounts.push(`type=bind,src=${secret.source},dst=${TRAINING_TYPESAFE_SECRET_INGRESS},readonly`);
+        env.push(`PAIDEIA_TYPESAFE_SECRET_FILE=${TRAINING_TYPESAFE_SECRET_FILE}`);
+    }
+    return { mounts, env };
+};

package/dist/compiler/training/container/grokWriteback.d.ts

@@ -0,0 +1,8 @@
+type DockerCall = (args: string[], cleanup: boolean) => Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+/** Called only for an ownership-verified container, before removal, including failure/cancellation. */
+export declare const persistTrainingGrokCredential: (id: string, profile: string, scratch: string, call: DockerCall) => Promise<void>;
+export {};

package/dist/compiler/training/container/grokWriteback.js

@@ -0,0 +1,26 @@
+import path from "node:path";
+import { writeBackTrainingGrokCredential } from "../../../auth/index.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+/** Called only for an ownership-verified container, before removal, including failure/cancellation. */
+export const persistTrainingGrokCredential = async (id, profile, scratch, call) => {
+    const state = await call(["inspect", "--format", "{{json .State}}", id], true);
+    if (state.code !== 0)
+        throw Error("Cannot verify training credential writer state");
+    if (JSON.parse(state.stdout).Running === true) {
+        const stopped = await call(["stop", "--time", "5", id], true);
+        if (stopped.code !== 0)
+            throw Error("Cannot stop training credential writer");
+    }
+    const terminal = await call(["inspect", "--format", "{{json .State}}", id], true);
+    if (terminal.code !== 0 || JSON.parse(terminal.stdout).Running !== false)
+        throw Error("Training credential writer is still active");
+    const realm = DAIMON_GROK_ENGINE_BROKER.credentialHomePath;
+    const candidate = path.join(scratch, "grok-auth.json"), journal = path.join(scratch, "grok-journal.json");
+    // Docker writes directly into a host-private directory: no credential bytes in stdout, logs or arguments.
+    const copied = await call(["cp", `${id}:${realm}/auth.json`, candidate], true);
+    if (copied.code !== 0)
+        throw Error("Cannot export training Grok credential");
+    const journalCopy = await call(["cp", `${id}:${realm}/.daimon-broker/credential-journal.json`, journal], true);
+    // A realm that never rotated has no journal. The auth owner accepts only unchanged bytes in that case.
+    await writeBackTrainingGrokCredential(profile, candidate, journalCopy.code === 0 ? journal : `${journal}.absent`);
+};

package/dist/compiler/training/container/index.d.ts

@@ -1,4 +1,5 @@
-export { trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
+export { TRAINING_FAKETIME_LIBRARY_PATH, trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
 export type { TrainingContainerConfig } from "./contract.js";
 export { launchTrainingContainer } from "./launch.js";
 export type { LaunchTrainingContainerOptions } from "./launch.js";
+export { trainingEvaluatorRouteSchema, trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema, TRAINING_EVALUATOR_ROUTES_FILE, TRAINING_TYPESAFE_SECRET_FILE } from "./evaluators.js";

package/dist/compiler/training/container/index.js

@@ -1,2 +1,3 @@
-export { trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
+export { TRAINING_FAKETIME_LIBRARY_PATH, trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
 export { launchTrainingContainer } from "./launch.js";
+export { trainingEvaluatorRouteSchema, trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema, TRAINING_EVALUATOR_ROUTES_FILE, TRAINING_TYPESAFE_SECRET_FILE } from "./evaluators.js";

package/dist/compiler/training/container/launch.d.ts

@@ -1,5 +1,7 @@
+import { type TrainingExecution } from "../execution.js";
 import type { TrainingContext } from "../contract.js";
 import { type TrainingDockerProcess } from "./process.js";
+export declare const TRAINING_INPUTS_GID = 2000;
 export interface LaunchTrainingContainerOptions {
     image: string;
     configPath: string;
@@ -12,6 +14,7 @@ export interface LaunchTrainingContainerOptions {
         stderr(line: string): void;
     };
     process?: TrainingDockerProcess;
+    execution?: TrainingExecution;
     preparationPath?: string;
     repairPath?: string;
 }