spawnfile 0.1.17 → 0.1.19

package/dist/compiler/training/preparation/files.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { copyFile, lstat, mkdir, readdir, realpath, chmod } from "node:fs/promises";
+import { copyFile, lstat, mkdir, readdir, readlink, realpath, chmod, symlink } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 export const within = (root, file) => file === root || file.startsWith(root + path.sep);
@@ -37,27 +37,50 @@ export async function sealFile(source, destination) {
         throw Error("Training source changed while hashing");
     return { source, destination, sha256: `sha256:${digest.digest("hex")}`, mode: Number(before.mode & 511n), size };
 }
-/** Only explicitly selected trees are traversed. Symlinks never enter Docker context. */
+function assertLink(root, file, target) {
+    // Absolute host paths cannot reproduce a confined link in a relocated snapshot.
+    if (!target || path.isAbsolute(target) || !within(root, path.resolve(path.dirname(file), target))) {
+        throw Error("Training source trees must not contain escaping symlinks");
+    }
+}
+async function sealLink(source, destination) {
+    const before = await lstat(source, { bigint: true }), target = await readlink(source);
+    const after = await lstat(source, { bigint: true });
+    if (!before.isSymbolicLink() || !after.isSymbolicLink() || after.ino !== before.ino ||
+        after.ctimeNs !== before.ctimeNs || after.dev !== before.dev)
+        throw Error("Training source changed while hashing");
+    return { source, destination, target, sha256: hashJson({ type: "symlink", target }), mode: 0o777, size: Buffer.byteLength(target) };
+}
+/** Only physical entries are walked; confined input links retain their own identity. */
 export async function sealTree(source, destination, options = {}) {
     await exactPath(source);
     const files = [];
+    let entries = 0;
     const walk = async (root, target, depth) => {
-        if (depth > 32 || files.length > 10000)
+        if (depth > 32)
+            throw Error("Training source tree exceeds bounds");
+        const stat = await lstat(root);
+        if ((depth > 0 || !stat.isDirectory()) && ++entries > 10000)
             throw Error("Training source tree exceeds bounds");
-        let stat = await lstat(root);
         if (stat.isSymbolicLink()) {
-            const actual = await realpath(root);
-            if (!options.internalSymlinks || !within(source, actual))
+            if (!options.internalSymlinks)
                 throw Error("Training source trees must not contain escaping symlinks");
-            root = actual;
-            stat = await lstat(root);
+            const link = await sealLink(root, target);
+            assertLink(source, root, link.target);
+            // Resolve only for containment validation, never to enumerate or copy the target.
+            if (!within(source, await realpath(root)))
+                throw Error("Training source trees must not contain escaping symlinks");
+            files.push(link);
+            return;
         }
         if (stat.isDirectory()) {
-            for (const entry of (await readdir(root)).sort()) {
-                if (options.ignoreGit && entry === ".git")
-                    continue;
-                if (options.ignoreDevelopment && (ignored.has(entry) || /(?:\.test\.[cm]?[jt]s|_test\.py|\.pyc)$/u.test(entry)))
-                    continue;
+            const children = (await readdir(root)).sort().filter(entry => !(options.ignoreGit && entry === ".git") &&
+                !(options.ignoreDevelopment && (ignored.has(entry) || /(?:\.test\.[cm]?[jt]s|_test\.py|\.pyc)$/u.test(entry))));
+            // Retain empty input directories so their preserved links still resolve after relocation.
+            if (options.internalSymlinks && !children.length && target)
+                files.push({ source: root, destination: target,
+                    directory: true, sha256: hashJson({ type: "directory" }), mode: stat.mode & 0o777, size: 0 });
+            for (const entry of children) {
                 await walk(path.join(root, entry), path.posix.join(target, entry), depth + 1);
             }
         }
@@ -70,16 +93,54 @@ export async function sealTree(source, destination, options = {}) {
     return files;
 }
 export async function copySealed(files, root) {
+    const directories = new Set();
+    const ensureDirectory = async (directory) => {
+        if (directories.has(directory))
+            return;
+        const parent = path.dirname(directory);
+        if (parent !== directory) {
+            await ensureDirectory(parent);
+            await mkdir(directory, { mode: 0o700 }).catch((error) => { if (error.code !== "EEXIST")
+                throw error; });
+        }
+        await exactPath(directory);
+        if (!(await lstat(directory)).isDirectory())
+            throw Error("Training staging parent must be a directory");
+        directories.add(directory);
+    };
+    await ensureDirectory(root);
     for (const file of files) {
         const target = path.resolve(root, file.destination);
         if (!within(root, target) || target === root)
             throw Error("Training destination escapes owned staging");
-        await mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+        await ensureDirectory(path.dirname(target));
+        if (file.directory) {
+            await ensureDirectory(target);
+            await chmod(target, file.mode);
+            continue;
+        }
+        if (file.target !== undefined) {
+            assertLink(root, target, file.target);
+            const current = await sealLink(file.source, file.destination);
+            if (hashJson(fileIdentity([current])) !== hashJson(fileIdentity([file])))
+                throw Error("Training source changed during staging");
+            await symlink(file.target, target);
+            if (await readlink(target) !== file.target)
+                throw Error("Training source changed during staging");
+            continue;
+        }
+        await exactPath(file.source);
         await copyFile(file.source, target, 1);
         await chmod(target, file.mode);
         const copied = await sealFile(target, file.destination);
         if (copied.sha256 !== file.sha256 || copied.size !== file.size)
             throw Error("Training source changed during staging");
     }
+    // Validate chains after every target has been staged, including links ordered before files.
+    for (const file of files.filter(file => file.target !== undefined)) {
+        if (!within(root, await realpath(path.join(root, file.destination))))
+            throw Error("Training staged symlink escapes owned staging");
+    }
 }
-export const fileIdentity = (files) => files.map(({ destination, sha256, mode, size }) => ({ destination, sha256, mode, size }));
+export const fileIdentity = (files) => files.map(({ destination, sha256, mode, size, target, directory }) => ({ destination, sha256, mode, size, ...(target !== undefined ? { type: "symlink", target } : {}),
+    ...(directory ? { type: "directory" } : {}) }));

package/dist/compiler/training/preparation/image.js

@@ -1,6 +1,7 @@
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { TRAINING_EXECUTION_CAPABILITY_LABEL } from "../contract.js";
 import { assertInputRoot, copySealed, fileIdentity, hashJson, sealFile, sealTree } from "./files.js";
 import { bindDaimonParentVerification, resolveTrainingDaimonParent } from "./daimonParent.js";
 import { normalizeTrainingContext } from "./contextModes.js";
@@ -27,11 +28,15 @@ export async function planTrainingImage(build, root, auth, ownRoot = packageRoot
     // Before any Docker call, including --dry-run: the attested Daimon runtime identity
     // and the declared native parent must name one rebuild (see daimonParent.ts).
     const daimonParent = await resolveTrainingDaimonParent(build, declarationPath);
+    assertInputRoot(ownRoot, auth);
     for (const source of [build.paideia, build.bridge, build.claude, build.integration.source, ...build.compiler ? [build.compiler] : [], ...build.bootstrap ? [build.bootstrap] : []])
         assertInputRoot(resolve(source), auth);
     const assets = ownRoot === packageRoot ? trainingAssets : path.join(ownRoot, "runtime-images/training");
+    assertInputRoot(assets, auth);
     const recipe = await readFile(path.join(assets, "Dockerfile"), "utf8");
-    const dockerfile = daimonParent ? bindDaimonParentVerification(recipe, daimonParent) : recipe;
+    // Always override the parent's label: compatibility belongs to this installed integration.
+    const capability = build.integration.execution ?? "";
+    const dockerfile = `${daimonParent ? bindDaimonParentVerification(recipe, daimonParent) : recipe}\nLABEL ${TRAINING_EXECUTION_CAPABILITY_LABEL}=${JSON.stringify(capability)}\n`;
     const ownLock = path.extname(fileURLToPath(import.meta.url)) === ".ts" || ownRoot !== packageRoot
         ? path.join(ownRoot, "package-lock.json") : path.join(assets, "package-lock.json");
     const files = [
@@ -64,12 +69,12 @@ export async function buildTrainingImage(plan, options) {
         timeoutMs: options.timeoutMs, signal: options.signal, ...stream ? options.streams : {}
     });
     const inspect = async () => {
-        const result = await call(["image", "inspect", tag, "--format", '{{json .Id}}\n{{json (index .Config.Labels "com.spawnfile.training.recipe")}}']);
+        const result = await call(["image", "inspect", tag, "--format", `{{json .Id}}\n{{json (index .Config.Labels "com.spawnfile.training.recipe")}}\n{{json (index .Config.Labels "${TRAINING_EXECUTION_CAPABILITY_LABEL}")}}`]);
         if (result.code !== 0)
             return undefined;
         try {
-            const [id, digest] = result.stdout.trim().split("\n").map(line => JSON.parse(line));
-            return /^sha256:[a-f0-9]{64}$/u.test(id) && digest === plan.digest ? id : undefined;
+            const [id, digest, capability] = result.stdout.trim().split("\n").map(line => JSON.parse(line));
+            return /^sha256:[a-f0-9]{64}$/u.test(id) && digest === plan.digest && capability === (plan.build.integration.execution ?? "") ? id : undefined;
         }
         catch {
             return undefined;

package/dist/compiler/training/preparation/inputs.d.ts

@@ -11,6 +11,7 @@ export interface PlannedInput {
         tree: string;
         common: string;
         overlays: SealedFile[];
+        paths: string[];
     };
 }
 export declare function planInputs(config: TrainingPreparationConfig, root: string, auth: string[]): Promise<PlannedInput[]>;

package/dist/compiler/training/preparation/inputs.js

@@ -1,16 +1,18 @@
 import { execFile } from "node:child_process";
-import { mkdir, readFile } from "node:fs/promises";
+import { mkdir, readFile, realpath } from "node:fs/promises";
 import path from "node:path";
 import { promisify } from "node:util";
 import { pathToFileURL } from "node:url";
-import { assertInputRoot, copySealed, exactPath, fileIdentity, hashJson, sealFile, sealTree } from "./files.js";
+import { assertInputRoot, copySealed, exactPath, fileIdentity, hashJson, sealFile, sealTree, within } from "./files.js";
 const execute = promisify(execFile);
-const git = async (cwd, args) => {
+const git = async (cwd, args, input) => {
     const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith("GIT_")));
-    return (await execute("git", ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", ...args], {
+    const operation = execute("git", ["-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", ...args], {
         cwd, env: { ...env, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_ATTR_NOSYSTEM: "1", GIT_TERMINAL_PROMPT: "0" },
         timeout: 120000, maxBuffer: 8 * 1024 * 1024
-    })).stdout;
+    });
+    operation.child.stdin?.end(input);
+    return (await operation).stdout;
 };
 export async function planInputs(config, root, auth) {
     return Promise.all(config.inputs.map(async (input) => {
@@ -49,7 +51,7 @@ export async function planInputs(config, root, auth) {
                 throw Error("Git overlay digest mismatch or duplicate destination");
             overlays.push(file);
         }
-        return { id: input.id, source, destination: input.destination, git: { revision: input.git.revision, tree, common, overlays },
+        return { id: input.id, source, destination: input.destination, git: { revision: input.git.revision, tree, common, overlays, paths: entries.map(entry => entry.slice(entry.indexOf("\t") + 1)) },
             digest: hashJson({ revision: input.git.revision, tree, overlays: fileIdentity(overlays) }) };
     }));
 }
@@ -65,7 +67,12 @@ export async function stageInput(input, target) {
     await mkdir(target, { mode: 0o700 });
     await git(target, ["init", "--quiet", "--template="]);
     await git(target, ["-c", "protocol.file.allow=always", "fetch", "--quiet", "--depth=1", pathToFileURL(input.git.common).href, input.git.revision]);
-    await git(target, ["-c", "advice.detachedHead=false", "checkout", "--quiet", "--detach", input.git.revision]);
+    // Populate the index/HEAD without writing paths that the overlay owns.
+    await git(target, ["update-ref", "--no-deref", "HEAD", input.git.revision]);
+    await git(target, ["read-tree", input.git.revision]);
+    const overlayPaths = new Set(input.git.overlays.map(file => file.destination));
+    const basePaths = input.git.paths.filter(file => !overlayPaths.has(file));
+    await git(target, ["checkout-index", "--stdin", "-z"], basePaths.map(file => `${file}\0`).join(""));
     if ((await git(target, ["rev-parse", "HEAD^{tree}"])).trim() !== input.git.tree ||
         (await git(target, ["rev-parse", "--path-format=absolute", "--git-common-dir"])).trim() !== path.join(target, ".git"))
         throw Error("Git training snapshot identity mismatch");
@@ -78,10 +85,11 @@ export async function verifyCanonicalPins(inputs, sources, staged) {
         const index = inputs.findIndex(input => source.sourcePath === input.source || source.sourcePath.startsWith(input.source + path.sep));
         if (index < 0)
             throw Error("Canonical training source is outside declared inputs");
-        if (!inputs[index].git && !inputs[index].files)
-            continue;
         const file = path.join(staged[index], path.relative(inputs[index].source, source.sourcePath));
-        if ((await sealFile(file, "pin")).sha256 !== source.sha256)
+        const canonicalFile = await realpath(file);
+        if (!within(staged[index], canonicalFile))
+            throw Error("Canonical training source escapes its staged input");
+        if ((await sealFile(canonicalFile, "pin")).sha256 !== source.sha256)
             throw Error("Pinned Git snapshot differs from the selected canonical agent");
     }
 }

package/dist/compiler/training/preparation/prepare.d.ts

@@ -1,6 +1,10 @@
+import { type TrainingExecution } from "../execution.js";
 import type { TrainingContext } from "../contract.js";
 import type { TrainingDockerProcess } from "../container/process.js";
 export interface PrepareTrainingOptions {
+    execution?: TrainingExecution;
+    outputOverride?: string;
+    imageOverride?: string;
     configPath: string;
     context: TrainingContext;
     args: readonly string[];
@@ -18,6 +22,7 @@ export interface PrepareTrainingOptions {
     repairWitness?: string;
 }
 export interface PreparedTraining {
+    execution?: TrainingExecution;
     digest: string;
     image: string;
     configPath: string;

package/dist/compiler/training/preparation/prepare.js

@@ -1,13 +1,15 @@
-import { lstat, mkdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { mapTrainingExecution, trainingExecutionIdentity } from "../execution.js";
 import { trainingContainerConfigSchema } from "../container/contract.js";
+import { assertTrainingSubjectIsolation } from "../container/subjectIsolation.js";
 import { trainingPreparationSchema, parseTrainingMappedPreparation } from "./contract.js";
 import { assertInputRoot, exactPath, fileIdentity, hashJson, sealTree, within } from "./files.js";
 import { planInputs, readBoundedJson, stageInput, verifyCanonicalPins } from "./inputs.js";
 import { planTrainingImage, buildTrainingImage } from "./image.js";
-import { planMeasurementRepair, stageMeasurementRepair, writeTrainingWitness } from "../repair/index.js";
+import { planMeasurementRepair, stageMeasurementRepair, validateMeasurementRepairOutput, writeTrainingWitness } from "../repair/index.js";
 import { prepareTrainingBroker } from "./broker.js";
-import { claimTrainingPreparationScratch } from "./scratch.js";
+import { claimTrainingPreparationScratch, removeTrainingPreparationScratch } from "./scratch.js";
 function mappedReceipt(digest, image, config) {
     return parseTrainingMappedPreparation({ version: "spawnfile.training-preparation.v1", preparationDigest: digest, imageId: image,
         bindings: config.inputs.map(input => ({ inputId: input.id, destination: input.destination })), outputRoot: "/run/training/output",
@@ -17,11 +19,20 @@ function mappedReceipt(digest, image, config) {
 }
 /** Reads only until the explicit dry-run boundary; preparation never executes project code. */
 export async function prepareTraining(options) {
-    const config = trainingPreparationSchema.parse(await readBoundedJson(options.configPath));
-    // A v2 declaration still lowers to the unchanged v1 launch config; only v3 carries a broker slot into Docker.
-    const launchVersion = config.version === "spawnfile.training-container.v3" ? config.version : "spawnfile.training-container.v1";
+    const raw = await readBoundedJson(options.configPath);
+    const config = trainingPreparationSchema.parse({ ...raw,
+        ...(options.outputOverride ? { output: { source: options.outputOverride, destination: "/run/training/output" } } : {}),
+        ...(options.imageOverride ? { image: { ref: options.imageOverride } } : {}) });
+    await assertTrainingSubjectIsolation(config, options.context);
+    // A v2 declaration still lowers to the unchanged v1 launch config; v4 carries the broker slots into Docker.
+    const launchVersion = config.version === "spawnfile.training-container.v4" ? config.version : "spawnfile.training-container.v1";
     const root = path.dirname(path.resolve(options.configPath));
     const auth = config.auth.map(entry => ({ ...entry, source: path.resolve(root, entry.source) }));
+    const evaluatorSecrets = config.evaluatorSecrets?.map(entry => ({ ...entry, source: path.resolve(root, entry.source) }));
+    const protectedLeaves = [...auth, ...evaluatorSecrets ?? []];
+    const evaluatorConfig = { ...(config.evaluatorRoutes ? { evaluatorRoutes: config.evaluatorRoutes } : {}),
+        ...(config.subjectIsolation ? { subjectIsolation: config.subjectIsolation } : {}),
+        ...(evaluatorSecrets ? { evaluatorSecrets } : {}) };
     const output = path.resolve(root, config.output.source), parent = path.dirname(output);
     for (let index = 0; index < options.args.length; index++) {
         if (options.args[index] !== "--out")
@@ -30,42 +41,58 @@ export async function prepareTraining(options) {
         if (declared === undefined || path.resolve(declared) !== output)
             throw Error("Training --out must match configured output");
     }
-    assertInputRoot(output, auth.map(entry => entry.source));
+    // Refuse invalid repair destinations before auth validation or source/witness reads.
+    if (options.repairMeasurements)
+        await validateMeasurementRepairOutput({ parent: options.repairMeasurements,
+            output, resume: options.args.includes("--resume") });
+    // Validate references before traversing image/input sources; aliases must never bypass secret exclusions.
+    for (const entry of options.dryRun ? evaluatorSecrets ?? [] : protectedLeaves) {
+        const source = await exactPath(entry.source), info = await lstat(source);
+        if (source !== entry.source || !info.isFile())
+            throw Error("Training auth must be a canonical regular leaf");
+        if (evaluatorSecrets?.includes(entry) && info.nlink !== 1)
+            throw Error("Evaluator secrets must not have hardlink aliases");
+    }
+    assertInputRoot(output, protectedLeaves.map(entry => entry.source));
     if (await realpath(parent) !== parent)
         throw Error("Training output parent must be canonical and already exist");
-    const inputs = await planInputs(config, root, auth.map(entry => entry.source));
+    const inputs = await planInputs(config, root, protectedLeaves.map(entry => entry.source));
+    const canonicalPins = [...options.context.sources, ...options.execution?.datasetPins ?? []];
     const roots = inputs.map(input => input.source);
     for (let index = 0; index < inputs.length; index++) {
         const input = inputs[index];
-        if (within(input.source, output) || within(output, input.source))
+        // A selected/Git snapshot is staged before launch; never bind the source project over its own output.
+        const snapshotPaths = input.files?.map(file => path.join(input.source, file.destination))
+            ?? (input.git ? [...input.git.paths, ...input.git.overlays.map(file => file.destination)].map(file => path.join(input.source, file)) : undefined);
+        if (within(output, input.source) || (within(input.source, output) &&
+            (!snapshotPaths || snapshotPaths.some(file => within(output, file) || within(file, output))))) {
             throw Error("Training output overlaps readonly input");
+        }
         for (const other of inputs.slice(index + 1))
             if (within(input.source, other.source) || within(other.source, input.source) ||
                 within(input.destination, other.destination) || within(other.destination, input.destination))
                 throw Error("Training inputs overlap");
     }
     const imagePlan = "build" in config.image
-        ? await planTrainingImage(config.image.build, root, auth.map(entry => entry.source), options.packageRoot, path.resolve(options.configPath))
+        ? await planTrainingImage(config.image.build, root, protectedLeaves.map(entry => entry.source), options.packageRoot, path.resolve(options.configPath))
         : undefined;
     if (options.repairWitness && !options.repairMeasurements)
         throw Error("A repair witness requires --repair-measurements");
     if (options.repairMeasurements && !imagePlan)
         throw Error("Measurement repair requires a verifiable image build recipe");
     const repair = options.repairMeasurements ? await planMeasurementRepair({ parent: options.repairMeasurements,
-        witness: options.repairWitness, output, auth: auth.map(entry => entry.source), image: imagePlan, inputs,
+        witness: options.repairWitness, output, auth: protectedLeaves.map(entry => entry.source), image: imagePlan, inputs,
         context: options.context, resume: options.args.includes("--resume") }) : undefined;
     if (repair && hashJson(config.integration) !== hashJson(repair.witness.manifest.config.integration))
         throw Error("Repair integration settings binding changed");
     const digest = hashJson({ config, sources: inputs.map(input => ({ id: input.id, digest: input.digest })), image: imagePlan?.digest ?? config.image,
-        canonical: options.context.project.sourceDigest, ...(repair ? { repair: { witness: repair.witness.digest, parent: repair.manifestDigest } } : {}) });
+        canonical: options.context.project.sourceDigest,
+        ...(options.execution ? { execution: trainingExecutionIdentity(options.execution) } : {}), ...(repair ? { repair: { witness: repair.witness.digest, parent: repair.manifestDigest } } : {}) });
     if (config.broker)
-        await prepareTrainingBroker(config.broker, root, path.dirname(path.resolve(options.configPath)), false);
+        await prepareTrainingBroker(config.broker, root, path.dirname(path.resolve(options.configPath)), false, config.slots);
     if (options.dryRun)
         return { digest, dryRun: true };
     options.signal?.throwIfAborted();
-    for (const entry of auth)
-        if (await exactPath(entry.source) !== entry.source || !(await lstat(entry.source)).isFile())
-            throw Error("Training auth must be a canonical regular leaf");
     const execute = (args) => options.process(args, { timeoutMs: options.timeoutMs, signal: options.signal });
     const endpoint = await execute(["context", "inspect", config.dockerContext, "--format", "{{json .Endpoints.docker.Host}}"]);
     if (endpoint.code !== 0 || !/^unix:\/\//u.test(JSON.parse(endpoint.stdout)))
@@ -82,6 +109,7 @@ export async function prepareTraining(options) {
     const resume = options.args.includes("--resume");
     let image, staged;
     if (resume) {
+        await claimTrainingPreparationScratch(staging, digest, options.streams.stderr, "resume");
         const previous = JSON.parse(await readFile(statePath, "utf8"));
         if (previous.digest !== digest || !/^sha256:[a-f0-9]{64}$/u.test(previous.image) ||
             JSON.stringify(previous.staged) !== JSON.stringify(inputs.map(input => input.git || input.files ? path.join(staging, input.id) : input.source)))
@@ -94,7 +122,7 @@ export async function prepareTraining(options) {
         const mapped = parseTrainingMappedPreparation(await readBoundedJson(preparationPath));
         if (mapped.preparationDigest !== digest || mapped.imageId !== image)
             throw Error("Persisted training preparation identity mismatch");
-        await verifyCanonicalPins(inputs, options.context.sources, staged);
+        await verifyCanonicalPins(inputs, canonicalPins, staged);
     }
     else {
         let owned = false;
@@ -108,8 +136,13 @@ export async function prepareTraining(options) {
                 if (error.code !== "EEXIST" || !(await lstat(output)).isDirectory() || await realpath(output) !== output)
                     throw error;
             }
-            staged = await Promise.all(inputs.map(input => stageInput(input, path.join(staging, input.id))));
-            await verifyCanonicalPins(inputs, options.context.sources, staged);
+            // Do not remove owned staging while sibling input jobs can still write into it.
+            const results = await Promise.allSettled(inputs.map(input => stageInput(input, path.join(staging, input.id))));
+            const failure = results.find(result => result.status === "rejected");
+            if (failure?.status === "rejected")
+                throw failure.reason;
+            staged = results.map(result => result.value);
+            await verifyCanonicalPins(inputs, canonicalPins, staged);
             image = imagePlan ? (await buildTrainingImage(imagePlan, { parent, dockerContext: config.dockerContext, process: options.process,
                 timeoutMs: options.timeoutMs, signal: options.signal, streams: options.streams })).imageId : "ref" in config.image ? config.image.ref : "";
             if (!image.startsWith("sha256:")) {
@@ -119,9 +152,9 @@ export async function prepareTraining(options) {
                 image = inspected.stdout.trim();
             }
             const mapped = mappedReceipt(digest, image, config);
-            const preparedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, true) : undefined;
-            const launch = trainingContainerConfigSchema.parse({ version: launchVersion, dockerContext: config.dockerContext,
-                inputs: inputs.map((input, index) => ({ source: staged[index], destination: input.destination })), output: { source: output, destination: "/run/training/output" }, auth,
+            const preparedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, true, config.slots) : undefined;
+            const launch = trainingContainerConfigSchema.parse({ version: launchVersion, slots: config.slots, dockerContext: config.dockerContext,
+                inputs: inputs.map((input, index) => ({ source: staged[index], destination: input.destination })), output: { source: output, destination: "/run/training/output" }, auth, ...evaluatorConfig,
                 ...(preparedBroker ? { broker: preparedBroker.launch } : {}) });
             await writeFile(configPath, JSON.stringify(launch), { flag: "wx", mode: 0o600 });
             await writeFile(preparationPath, JSON.stringify(parseTrainingMappedPreparation(mapped)), { flag: "wx", mode: 0o400 });
@@ -129,18 +162,18 @@ export async function prepareTraining(options) {
             await writeFile(statePath, JSON.stringify({ digest, image, staged, snapshots }), { flag: "wx", mode: 0o600 });
             if (imagePlan)
                 await writeTrainingWitness({ directory: staging, digest, image, config, context: options.context,
-                    args: options.args, inputs, staged, snapshots, plan: imagePlan,
+                    args: options.args, execution: options.execution, inputs, staged, snapshots, plan: imagePlan,
                     ...(repair ? { repair: { witness: repair.witness.digest, parent: repair.manifestDigest } } : {}) });
         }
         catch (error) {
             if (owned)
-                await rm(staging, { recursive: true, force: true });
+                await removeTrainingPreparationScratch(staging);
             throw error;
         }
     }
-    const expectedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, false) : undefined;
-    const expectedLaunch = trainingContainerConfigSchema.parse({ version: launchVersion, dockerContext: config.dockerContext,
-        inputs: inputs.map((input, index) => ({ source: staged[index], destination: input.destination })), output: { source: output, destination: "/run/training/output" }, auth,
+    const expectedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, false, config.slots) : undefined;
+    const expectedLaunch = trainingContainerConfigSchema.parse({ version: launchVersion, slots: config.slots, dockerContext: config.dockerContext,
+        inputs: inputs.map((input, index) => ({ source: staged[index], destination: input.destination })), output: { source: output, destination: "/run/training/output" }, auth, ...evaluatorConfig,
         ...(expectedBroker ? { broker: expectedBroker.launch } : {}) });
     if (hashJson(await readBoundedJson(configPath)) !== hashJson(expectedLaunch) ||
         hashJson(await readBoundedJson(preparationPath)) !== hashJson(mappedReceipt(digest, image, config)))
@@ -150,6 +183,8 @@ export async function prepareTraining(options) {
         throw Error("Saved training image is missing or changed");
     const map = (file) => {
         const absolute = path.resolve(file);
+        if (within(output, absolute))
+            return absolute;
         const index = roots.findIndex(source => within(source, absolute));
         return index < 0 ? absolute : path.join(staged[index], path.relative(roots[index], absolute));
     };
@@ -161,7 +196,7 @@ export async function prepareTraining(options) {
         skills: options.context.skills.map(source => ({ ...source, sourcePath: map(source.sourcePath) })) };
     const args = [...options.args];
     for (let index = 0; index < args.length; index++) {
-        if (["--train", "--test", "--cost-config"].includes(args[index]))
+        if (["--train", "--validation", "--test", "--cost-config"].includes(args[index]))
             args[++index] = map(args[index]);
         else if (args[index] === "--resource") {
             const value = args[++index], split = value.indexOf("=");
@@ -180,7 +215,9 @@ export async function prepareTraining(options) {
         else
             await writeFile(repairConfig, JSON.stringify(repairLaunch), { flag: "wx", mode: 0o600 });
         return { digest, image, configPath: repairConfig, preparationPath, repairPath: projected.repairPath, context,
+            ...(options.execution ? { execution: mapTrainingExecution(options.execution, map) } : {}),
             args: [...args, "--repair-measurements", "/run/training/inputs/repair-parent", "--repair-context", "/run/paideia/repair.json"] };
     }
-    return { digest, image, configPath, preparationPath, context, args };
+    return { digest, image, configPath, preparationPath, context, args,
+        ...(options.execution ? { execution: mapTrainingExecution(options.execution, map) } : {}) };
 }

package/dist/compiler/training/preparation/scratch.d.ts

@@ -1,19 +1,8 @@
 /**
- * Claims the private preparation scratch directory for one launch.
- *
- * A launch that fails anywhere past staging — a failed build, a container that
- * aborted in its entrypoint — leaves this directory behind, and the next
- * attempt used to die on `EEXIST: mkdir '.spawnfile-training-preparation-…'`
- * before it could report anything useful. A live P8 run lost its second attempt
- * to exactly that.
- *
- * Leftovers from the *same* preparation are reclaimed: `state.json` records the
- * preparation digest, which pins the config, every input identity, the image
- * plan and the canonical source digest, so a matching one can only have staged
- * the same bytes and nothing is lost by staging them again (the image is
- * content-addressed and resolves from its tag). Anything else — a different
- * digest, or a run that aborted before it wrote its state — is left untouched
- * and reported by name, because only the operator can know whether it is
- * wanted or whether another launch is still using it.
+ * The receipt binds identity AND the owning process before staging starts.
+ * A matching digest alone never permits deletion. Unknown/remote/reused PIDs
+ * fail closed; only ESRCH on this host proves that a writer has stopped.
  */
-export declare const claimTrainingPreparationScratch: (staging: string, digest: string, notify: (line: string) => void) => Promise<void>;
+export declare const claimTrainingPreparationScratch: (staging: string, digest: string, notify: (line: string) => void, mode?: "fresh" | "resume") => Promise<void>;
+/** Make sealed directories removable without following input links out of owned scratch. */
+export declare const removeTrainingPreparationScratch: (staging: string) => Promise<void>;

package/dist/compiler/training/preparation/scratch.js

@@ -1,31 +1,59 @@
-import { lstat, mkdir, readFile, realpath, rm } from "node:fs/promises";
+import path from "node:path";
+import { hostname } from "node:os";
+import { chmod, lstat, mkdir, readFile, readdir, realpath, rm, writeFile } from "node:fs/promises";
 /**
- * Claims the private preparation scratch directory for one launch.
- *
- * A launch that fails anywhere past staging — a failed build, a container that
- * aborted in its entrypoint — leaves this directory behind, and the next
- * attempt used to die on `EEXIST: mkdir '.spawnfile-training-preparation-…'`
- * before it could report anything useful. A live P8 run lost its second attempt
- * to exactly that.
- *
- * Leftovers from the *same* preparation are reclaimed: `state.json` records the
- * preparation digest, which pins the config, every input identity, the image
- * plan and the canonical source digest, so a matching one can only have staged
- * the same bytes and nothing is lost by staging them again (the image is
- * content-addressed and resolves from its tag). Anything else — a different
- * digest, or a run that aborted before it wrote its state — is left untouched
- * and reported by name, because only the operator can know whether it is
- * wanted or whether another launch is still using it.
+ * The receipt binds identity AND the owning process before staging starts.
+ * A matching digest alone never permits deletion. Unknown/remote/reused PIDs
+ * fail closed; only ESRCH on this host proves that a writer has stopped.
  */
-export const claimTrainingPreparationScratch = async (staging, digest, notify) => {
+export const claimTrainingPreparationScratch = async (staging, digest, notify, mode = "fresh") => {
+    const recordOwner = (flag = "wx") => writeFile(path.join(staging, "owner.json"), JSON.stringify({ digest, host: hostname(), pid: process.pid }), { flag, mode: 0o600 });
+    // This guard lives outside scratch so removal/recreation cannot drop the
+    // exclusion barrier. Never break a stranded guard automatically: its absence
+    // of a receipt cannot establish that its holder stopped.
+    const guard = `${staging}.reclaim`;
     try {
-        await mkdir(staging, { mode: 0o700 });
-        return;
+        await mkdir(guard, { mode: 0o700 });
     }
     catch (error) {
         if (error.code !== "EEXIST")
             throw error;
+        throw Error(`Training preparation scratch recovery is already claimed: ${guard}; if no preparation is running, remove that guard and retry`);
+    }
+    try {
+        if (mode === "fresh") {
+            let created = false;
+            try {
+                await mkdir(staging, { mode: 0o700 });
+                created = true;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+            if (created) {
+                await recordOwner();
+                return;
+            }
+        }
+        // Re-read under exclusion, never delete based on an earlier observation.
+        await assertAbandonedScratch(staging, digest, mode === "resume");
+        if (mode === "resume") {
+            // Claim before validating or reading snapshots: fresh recovery must see
+            // this live process rather than the stopped original preparer.
+            await recordOwner("w");
+            return;
+        }
+        notify(`Reusing the preparation scratch left by an earlier launch of this exact preparation: ${staging}`);
+        await removeTrainingPreparationScratch(staging);
+        await mkdir(staging, { mode: 0o700 });
+        await recordOwner();
+    }
+    finally {
+        await rm(guard, { recursive: true });
     }
+};
+const assertAbandonedScratch = async (staging, digest, resume) => {
     const info = await lstat(staging);
     if (!info.isDirectory() || info.isSymbolicLink() || await realpath(staging) !== staging) {
         throw Error(`Training preparation scratch ${staging} is not a canonical directory; remove it and retry`);
@@ -35,14 +63,52 @@ export const claimTrainingPreparationScratch = async (staging, digest, notify) =
         previous = JSON.parse(await readFile(`${staging}/state.json`, "utf8"));
     }
     catch {
-        previous = undefined;
+        try {
+            previous = JSON.parse(await readFile(path.join(staging, "owner.json"), "utf8"));
+        }
+        catch {
+            previous = undefined;
+        }
     }
     if (previous?.digest !== digest) {
+        if (resume)
+            throw Error("Training preparation changed; exact resume rejected");
         throw Error(previous === undefined
             ? `Training preparation scratch ${staging} is left over from an interrupted launch that never recorded its identity; remove it to retry: rm -rf ${JSON.stringify(staging)}`
             : `Training preparation scratch ${staging} belongs to a different preparation (${String(previous.digest)}); remove it to retry: rm -rf ${JSON.stringify(staging)}`);
     }
-    notify(`Reusing the preparation scratch left by an earlier launch of this exact preparation: ${staging}`);
+    let owner;
+    try {
+        owner = JSON.parse(await readFile(path.join(staging, "owner.json"), "utf8"));
+    }
+    catch { /* Unknown ownership fails closed. */ }
+    if (owner?.digest !== digest || owner.host !== hostname() || typeof owner.pid !== "number" ||
+        !Number.isSafeInteger(owner.pid) || owner.pid <= 0) {
+        throw Error(`Training preparation scratch ${staging} has no verifiable local owner; cannot prove its previous launch stopped`);
+    }
+    // Revalidation by the owning process is idempotent; other live owners refuse.
+    if (resume && owner.pid === process.pid)
+        return;
+    let stopped = false;
+    try {
+        process.kill(owner.pid, 0);
+    }
+    catch (error) {
+        stopped = error.code === "ESRCH";
+    }
+    if (!stopped)
+        throw Error(`Training preparation scratch ${staging} still has an active or unverifiable owner (${owner.pid}); retry after it stops`);
+};
+/** Make sealed directories removable without following input links out of owned scratch. */
+export const removeTrainingPreparationScratch = async (staging) => {
+    const writable = async (entry) => {
+        const info = await lstat(entry);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            return;
+        await chmod(entry, (info.mode & 0o777) | 0o700);
+        for (const child of await readdir(entry))
+            await writable(path.join(entry, child));
+    };
+    await writable(staging);
     await rm(staging, { recursive: true, force: true });
-    await mkdir(staging, { mode: 0o700 });
 };