spawnfile 0.1.17 → 0.1.19

package/dist/compiler/training/broker/paths.js

@@ -6,7 +6,7 @@ import { DAIMON_WORKER_ROOT } from "../../containerDaimonGrokWorkerRender.js";
 /**
  * Every container path the broker-capable training container fixes.
  *
- * They are fixed rather than derived because three parties must agree on them
+ * They are deterministic because three parties must agree on them
  * without talking to each other: the root entrypoint that provisions them, the
  * root slot supervisor that wipes and re-provisions them on recycle, and
  * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
@@ -14,7 +14,7 @@ import { DAIMON_WORKER_ROOT } from "../../containerDaimonGrokWorkerRender.js";
  * resolves a path, so each one must also be canonical and never a symlink; the
  * provisioning program asserts that before a slot is used.
  *
- * Everything under `/run/training/slot` is per-trial state on tmpfs — never the
+ * Everything under `/run/training/slots/<i>` is per-trial state on tmpfs — never the
  * Grok realm volume (R2). The realm volume holds only `auth.json` and the
  * broker credential journal, so a recycle can wipe the slot without touching
  * the one durable rotating credential.
@@ -23,20 +23,8 @@ export const TRAINING_RUN_ROOT = "/run/training/output";
 export const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
 export const TRAINING_PAIDEIA_ROOT = "/run/paideia";
 export const TRAINING_CONTEXT_FILE = `${TRAINING_PAIDEIA_ROOT}/context.json`;
-/** Host-written, read-only `spawnfile.training-broker.v1` declaration the root entrypoint reads. */
+/** Host-written, read-only `spawnfile.training-broker.v2` declaration the root entrypoint reads. */
 export const TRAINING_BROKER_DECLARATION_FILE = `${TRAINING_PAIDEIA_ROOT}/training-broker.json`;
-export const TRAINING_SLOT_ROOT = "/run/training/slot";
-export const TRAINING_SLOT_WORKSPACE = `${TRAINING_SLOT_ROOT}/workspace`;
-export const TRAINING_SLOT_RUNTIME_HOME = `${TRAINING_SLOT_ROOT}/runtime-home`;
-export const TRAINING_SLOT_STATE_ROOT = `${TRAINING_SLOT_ROOT}/state`;
-export const TRAINING_SLOT_ACCEPTANCE_STORE = `${TRAINING_SLOT_STATE_ROOT}/wake-acceptance`;
-/** Per-slot turn store. On tmpfs on purpose: a replayed turn from trial N must never satisfy trial N+1 (R2). */
-export const TRAINING_SLOT_TURN_STORE = `${TRAINING_SLOT_ROOT}/turns`;
-export const TRAINING_SLOT_USAGE_DIRECTORY = `${TRAINING_SLOT_ROOT}/usage`;
-export const TRAINING_SLOT_USAGE_LEDGER = `${TRAINING_SLOT_USAGE_DIRECTORY}/usage.jsonl`;
-export const TRAINING_SLOT_PREFLIGHT_RECEIPT = `${TRAINING_SLOT_ROOT}/preflight.json`;
-/** Supervisor-owned monotonic generation counter; survives a recycle, never a container restart. */
-export const TRAINING_SLOT_GENERATION_FILE = `${TRAINING_SLOT_ROOT}/generation.json`;
 export const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
 export const TRAINING_INFERENCE_LEDGER = `${TRAINING_INFERENCE_DIRECTORY}/inference.jsonl`;
 /** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
@@ -58,9 +46,6 @@ export const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
 export const TRAINING_SUPERVISOR_SOCKET = `${TRAINING_SUPERVISOR_DIRECTORY}/control.sock`;
 export const TRAINING_SUPERVISOR_LOG = `${TRAINING_SUPERVISOR_DIRECTORY}/supervisor.log`;
 export const TRAINING_WORKER_ROOT = DAIMON_WORKER_ROOT;
-export const TRAINING_SLOT_INDEX = 0;
-export const TRAINING_WORKER_UID = DAIMON_FIRST_WORKER_UID + TRAINING_SLOT_INDEX;
-export const TRAINING_WORKER_HOME = path.posix.join(TRAINING_WORKER_ROOT, String(TRAINING_WORKER_UID));
 /**
  * Paideia's own fixed container paths (`containerPaths` in its native launch
  * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
@@ -94,63 +79,93 @@ export const TRAINING_CALLER_PROTECTED_PATHS = [
  * tagged `context` — the caller-state role — since there is no other way to
  * carry a path through that contract.
  */
-export const TRAINING_EVALUATOR_PATHS = [
-    { role: "run-root", path: TRAINING_RUN_ROOT },
-    { role: "sealed-inputs", path: TRAINING_SEALED_INPUTS_ROOT },
-    { role: "judge-home", path: TRAINING_GRANT_HOME_ROOT },
-    { role: "slot-ledger", path: TRAINING_SLOT_USAGE_DIRECTORY },
-    { role: "context", path: TRAINING_PAIDEIA_ROOT },
-    { role: "context", path: TRAINING_BROKER_TMPDIR },
-    { role: "context", path: TRAINING_INFERENCE_DIRECTORY },
-    { role: "context", path: TRAINING_SLOT_TURN_STORE },
-    { role: "context", path: TRAINING_SUPERVISOR_DIRECTORY },
-    { role: "context", path: path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath) },
-    { role: "context", path: path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath) },
-    { role: "context", path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath },
-    { role: "context", path: DAIMON_WAKE_FUSE_DIRECTORY }
+export const TRAINING_SLOTS_FILE = `${TRAINING_PAIDEIA_ROOT}/slots.json`;
+export const TRAINING_SLOTS_VERSION = "spawnfile.training-slots.v1";
+export const TRAINING_DEFAULT_SLOTS = 4;
+export const TRAINING_MAX_SLOTS = 8;
+/** 100 ports per slot: offsets 0=Moltnet, 1=worker control, 2=bridge; 3..99 reserved. */
+export const TRAINING_PORT_BASE = 20_000;
+export const TRAINING_PORT_STRIDE = 100;
+export const TRAINING_BROKER_SOCKET_PATHS = [
+    DAIMON_GROK_ENGINE_BROKER.controlSocketPath, DAIMON_GROK_ENGINE_BROKER.backendSocketPath,
+    DAIMON_GROK_ENGINE_BROKER.launcherSocketPath
 ];
-/**
- * One entry per evaluator role, in declaration order: the launch receipt requires all five roles,
- * and several `context` paths share that role, so the first of each role is the role's root.
- */
-export const TRAINING_EVALUATOR_ROOTS = TRAINING_EVALUATOR_PATHS
-    .filter((entry, index) => TRAINING_EVALUATOR_PATHS.findIndex((first) => first.role === entry.role) === index);
-/**
- * What `paideia.daimon-native.launch.v2`'s `controlRoot` must be.
- *
- * Paideia's worker passes it to Daimon as `acceptanceStorePath`, and Daimon adds
- * it to the projection's deny list, so it has to be the same path this
- * container masks as its slot state root. Its own default
- * (`/run/paideia/control`) would both change the digest and nest inside the
- * `/run/paideia` mask, which Grok refuses — Daimon renders a nested mask
- * without complaining, so the failure would only appear at the first turn.
- */
-export const TRAINING_CALLER_CONTROL_ROOT = TRAINING_SLOT_STATE_ROOT;
-/**
- * Everything this container provisions that the one training worker must not
- * read, beyond Daimon's own protected set (realm, bootstrap, acceptance store).
- * Each entry sits strictly below a Grok 1.0.34 base-profile grant — Grok
- * refuses a profile whose deny entry equals or contains `/run`, `/var`, `/etc`
- * or `/tmp` — and no entry covers another, because masks cannot nest.
- */
-/**
- * The added deny set is exactly the launch's `evaluatorPaths`, so Spawnfile and
- * Paideia hand Daimon's resolver the same list. `TRAINING_SLOT_STATE_ROOT` is
- * deliberately absent: Daimon adds it itself, from the control root above.
- */
-export const TRAINING_ADDED_DENY_PATHS = [...new Set(TRAINING_EVALUATOR_PATHS.map((entry) => entry.path))].sort();
-/** Paths the provisioning program creates root-owned `0700` when absent, so every deny entry always has a target inode. */
+export const TRAINING_TURN_STORE_ROOT = "/run/training/turns";
+/** Persistent, broker-only run counter; never part of a slot recycle. */
+export const TRAINING_RUN_REQUEST_STORE = "/run/training/request-budget";
+export const assertTrainingSlotCount = (slots) => {
+    if (!Number.isInteger(slots) || slots < 1 || slots > TRAINING_MAX_SLOTS)
+        throw Error("Training slots must be an integer from 1 to 8");
+    return slots;
+};
+export const trainingSlotPaths = (slot) => {
+    if (!Number.isInteger(slot) || slot < 0 || slot >= TRAINING_MAX_SLOTS)
+        throw Error("Training slot index must be an integer from 0 to 7");
+    const root = `/run/training/slots/${slot}`;
+    const workerUid = DAIMON_FIRST_WORKER_UID + slot;
+    const workerHome = `${TRAINING_WORKER_ROOT}/${workerUid}`;
+    const portBase = TRAINING_PORT_BASE + slot * TRAINING_PORT_STRIDE;
+    const clockDirectory = `/run/daimon-engine-broker/task-clock/slot-${slot}`;
+    return {
+        slot, workerUid, root, workerHome, workspace: `${root}/workspace`, runtimeHome: `${root}/runtime-home`,
+        state: `${root}/state`, acceptanceStore: `${root}/state/wake-acceptance`,
+        turns: `${TRAINING_TURN_STORE_ROOT}/slot-${slot}`, usageDirectory: `${root}/usage`, usageLedger: `${root}/usage/usage.jsonl`,
+        preflightReceipt: `${root}/preflight.json`, generationFile: `${root}/generation.json`,
+        sealedInputsAttestation: `${root}/sealed-inputs.json`, privateTmp: `${workerHome}/tmp`,
+        clockDirectory, clockFile: `${clockDirectory}/faketime`,
+        ports: { base: portBase, stride: TRAINING_PORT_STRIDE, moltnet: portBase, workerControl: portBase + 1, bridge: portBase + 2 }
+    };
+};
+/** The complete additional projection deny set. Sibling roots and homes never nest with own masks. */
+export const trainingEvaluatorPaths = (slot, slots) => {
+    assertTrainingSlotCount(slots);
+    if (slot >= slots)
+        throw Error("Training slot is outside the declared pool");
+    const own = trainingSlotPaths(slot);
+    return [
+        { role: "run-root", path: TRAINING_RUN_ROOT },
+        { role: "sealed-inputs", path: TRAINING_SEALED_INPUTS_ROOT },
+        { role: "judge-home", path: TRAINING_GRANT_HOME_ROOT },
+        { role: "slot-ledger", path: own.usageDirectory },
+        ...[TRAINING_PAIDEIA_ROOT, TRAINING_BROKER_TMPDIR, TRAINING_INFERENCE_DIRECTORY,
+            TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, TRAINING_SUPERVISOR_DIRECTORY,
+            ...TRAINING_BROKER_SOCKET_PATHS,
+            path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath),
+            DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, DAIMON_WAKE_FUSE_DIRECTORY,
+            ...Array.from({ length: slots }, (_, i) => trainingSlotPaths(i)).filter(p => p.slot !== slot)
+                .flatMap(p => [p.root, p.workerHome, p.clockDirectory])
+        ].map(path => ({ role: "context", path }))
+    ];
+};
+export const trainingSlotDescriptors = (slots = TRAINING_DEFAULT_SLOTS) => Array.from({ length: assertTrainingSlotCount(slots) }, (_, slot) => ({
+    ...trainingSlotPaths(slot), evaluatorPaths: trainingEvaluatorPaths(slot, slots),
+    containerPaths: TRAINING_CALLER_PROTECTED_PATHS.map(path => ({ path })),
+    controlRoot: trainingSlotPaths(slot).state
+}));
+export const trainingSlotsDocument = (slots = TRAINING_DEFAULT_SLOTS) => ({
+    schema: TRAINING_SLOTS_VERSION,
+    slots: trainingSlotDescriptors(slots).map(p => ({
+        index: p.slot, workerUid: p.workerUid,
+        // Paideia owns a runtime-neutral lease pool: its strict descriptor carries opaque named paths.
+        roots: {
+            ...Object.fromEntries(Object.entries(p).filter((entry) => typeof entry[1] === "string")),
+            home: p.runtimeHome, control: p.state, context: TRAINING_PAIDEIA_ROOT,
+            ...Object.fromEntries(p.evaluatorPaths.map((entry, index) => [`evaluator:${entry.role}:${index}`, entry.path])),
+            ...Object.fromEntries(p.containerPaths.map((entry, index) => [`container:${index}`, entry.path]))
+        },
+        ports: { base: p.ports.base, count: p.ports.stride }
+    }))
+});
+/** Both sides derive the descriptor bytes; a stale or edited bind must never certify a different pool. */
+export const assertTrainingSlotsDocument = (value, slots) => {
+    if (JSON.stringify(value) !== JSON.stringify(trainingSlotsDocument(slots)))
+        throw Error("Training slots manifest differs from the broker declaration");
+};
+/** Shared deny targets exist before worker attestation; no per-slot subtree is touched here. */
 export const TRAINING_OPTIONAL_DENY_DIRECTORIES = [
-    TRAINING_BROKER_TMPDIR,
-    TRAINING_INFERENCE_DIRECTORY,
-    TRAINING_SLOT_STATE_ROOT,
-    TRAINING_SLOT_TURN_STORE,
-    TRAINING_SUPERVISOR_DIRECTORY,
-    TRAINING_GRANT_HOME_ROOT,
-    // Denied and unused here — training meters per slot — but the mask still needs an inode. The launch
-    // mounts each as tmpfs, so this only creates them when a caller ran the entrypoint without them.
-    DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath,
-    DAIMON_WAKE_FUSE_DIRECTORY
+    TRAINING_BROKER_TMPDIR, TRAINING_INFERENCE_DIRECTORY, TRAINING_TURN_STORE_ROOT,
+    TRAINING_SUPERVISOR_DIRECTORY, TRAINING_GRANT_HOME_ROOT,
+    DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, DAIMON_WAKE_FUSE_DIRECTORY
 ];
 /**
  * Deny entries a launch may legitimately not have mounted. Everything else must
@@ -207,7 +222,6 @@ export const TRAINING_HOST_BIND_DENY_PATHS = [TRAINING_RUN_ROOT, DAIMON_GROK_SUB
  */
 export const TRAINING_SEALED_DENY_PATHS = [TRAINING_SEALED_INPUTS_ROOT];
 /** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
-export const TRAINING_SEALED_INPUTS_ATTESTATION = `${TRAINING_SLOT_ROOT}/sealed-inputs.json`;
 /** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
 export const TRAINING_SEALED_INPUTS_IDENTITY = { uid: 0, gid: DAIMON_ORGANIZATION_UID, mode: "750" };
 /**
@@ -221,21 +235,15 @@ export const TRAINING_SEALED_INPUTS_IDENTITY = { uid: 0, gid: DAIMON_ORGANIZATIO
  * anyway, so an undeclared one degrades to "left in place and reported" rather
  * than a failed provision.
  */
-export const TRAINING_WIPE_TARGETS = [
-    TRAINING_WORKER_HOME,
-    TRAINING_SLOT_RUNTIME_HOME,
-    TRAINING_SLOT_TURN_STORE,
-    TRAINING_SLOT_ACCEPTANCE_STORE,
-    DAIMON_GROK_ENGINE_BROKER.serviceConfigPath,
-    DAIMON_GROK_ENGINE_BROKER.registrationPath
-];
-/** Emptied but kept: their paths are registered with Daimon and must stay canonical across a recycle. */
-export const TRAINING_CLEAR_TARGETS = [
-    TRAINING_SLOT_WORKSPACE,
-    TRAINING_SLOT_USAGE_DIRECTORY,
-    path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath),
-    path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath)
-];
+export const trainingWipeTargets = (slot) => {
+    const p = trainingSlotPaths(slot);
+    return [p.runtimeHome, p.state, p.preflightReceipt, p.sealedInputsAttestation];
+};
+/** Broker-owned turns and clocks are reset through its control seam, never by filesystem deletion. */
+export const trainingClearTargets = (slot) => {
+    const p = trainingSlotPaths(slot);
+    return [p.workspace, p.usageDirectory];
+};
 export const TRAINING_REALM_MOUNT = DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath;
 export const TRAINING_BOOTSTRAP_MOUNT = DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath;
 export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };

package/dist/compiler/training/broker/processes.d.ts

@@ -1,4 +1,12 @@
 import { type ChildProcess } from "node:child_process";
+interface SocketIdentity {
+    dev: number;
+    ino: number;
+    ctimeMs: number;
+    isSocket(): boolean;
+}
+/** An existing placement socket is not readiness. Its inode (or reuse timestamp) must change. */
+export declare const isStartedBrokerSocket: (current: SocketIdentity | undefined, previous: SocketIdentity | undefined) => boolean;
 export declare const DAIMON_RUNTIME_ROOT = "/opt/spawnfile/runtime-installs/daimon";
 /** `00000000000000c1` = CHOWN|SETGID|SETUID, the launcher's bounding set after `setpriv`. */
 export declare const LAUNCHER_CAPABILITY_BOUND = "00000000000000c1";
@@ -40,3 +48,4 @@ export interface StartBrokerOptions {
 export declare const startBrokerProcesses: (options: StartBrokerOptions) => Promise<BrokerChild[]>;
 /** Graceful stop in reverse start order: relay, backend, launcher. `SIGKILL` only after the grace window. */
 export declare const stopBrokerProcesses: (children: readonly BrokerChild[], log: (line: string) => void, graceMs?: number) => Promise<void>;
+export {};

package/dist/compiler/training/broker/processes.js

@@ -4,6 +4,8 @@ import { setTimeout as pause } from "node:timers/promises";
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { DAIMON_BROKER_UID, TRAINING_BROKER_TMPDIR } from "./paths.js";
+/** An existing placement socket is not readiness. Its inode (or reuse timestamp) must change. */
+export const isStartedBrokerSocket = (current, previous) => current?.isSocket() === true && (!previous || current.dev !== previous.dev || current.ino !== previous.ino || current.ctimeMs !== previous.ctimeMs);
 export const DAIMON_RUNTIME_ROOT = "/opt/spawnfile/runtime-installs/daimon";
 /** `00000000000000c1` = CHOWN|SETGID|SETUID, the launcher's bounding set after `setpriv`. */
 export const LAUNCHER_CAPABILITY_BOUND = "00000000000000c1";
@@ -52,6 +54,7 @@ export const startBrokerProcesses = async (options) => {
     const deadline = Date.now() + timeoutMs;
     try {
         for (const entry of brokerProcessPlan()) {
+            const previousSocket = await stat(entry.socket).catch(() => undefined);
             const child = spawn(entry.argv[0], entry.argv.slice(1), { stdio: ["ignore", "inherit", "inherit"] });
             if (child.pid === undefined)
                 throw new SpawnfileError("runtime_error", `${entry.name} did not start`);
@@ -64,7 +67,7 @@ export const startBrokerProcesses = async (options) => {
                 if (Date.now() > deadline)
                     throw new SpawnfileError("runtime_error", `${entry.name} readiness timed out`);
                 const socket = await stat(entry.socket).catch(() => undefined);
-                if (socket?.isSocket()) {
+                if (isStartedBrokerSocket(socket, previousSocket)) {
                     const identity = await processIdentity(child.pid, procRoot);
                     if (identity.uid === String(entry.uid) && identity.capBnd === entry.capBnd)
                         break;

package/dist/compiler/training/broker/projection.d.ts

@@ -18,6 +18,7 @@ export interface DaimonProjectionModule {
         projectionVersion: string;
         slotPreflightVersion: string;
         nativeAbiVersion: number;
+        controlProtocolVersion: string;
     };
 }
 export declare const loadDaimonProjectionModule: (load?: () => Promise<unknown>) => Promise<DaimonProjectionModule>;
@@ -31,13 +32,13 @@ export declare const loadDaimonProjectionModule: (load?: () => Promise<unknown>)
  * of peers reach `resolveOrganizationGrokBrokerProjection`, so this minimal
  * config and Paideia's fuller one compute the same projection digest. A peer
  * agent would change Daimon's protected set and the digest with it, which is
- * exactly why training runs one slot.
+ * why each slot resolves its own one-agent projection with explicit sibling deny paths.
  */
 export declare const trainingOrganizationRuntimeConfig: (declaration: {
     agentId: string;
     model: DaimonGrokBrokerModel;
     reasoningEffort: DaimonGrokBrokerReasoningEffort;
-}) => Record<string, unknown>;
+}, slot?: number) => Record<string, unknown>;
 export interface TrainingGrokProjection {
     projection: Record<string, unknown>;
     projectionSha256: string;

package/dist/compiler/training/broker/projection.js

@@ -1,6 +1,6 @@
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { TRAINING_SLOT_RUNTIME_HOME, TRAINING_SLOT_STATE_ROOT, TRAINING_SLOT_WORKSPACE, TRAINING_WORKER_HOME } from "./paths.js";
+import { trainingSlotPaths } from "./paths.js";
 /** Indirect specifier: Daimon is an in-image runtime peer of the training container, never a Spawnfile source dependency. */
 const loadRuntime = async () => {
     const packageName = "@noopolis/daimon/runtime";
@@ -16,6 +16,7 @@ export const loadDaimonProjectionModule = async (load = loadRuntime) => {
     }
     if (typeof daimon.resolveOrganizationGrokBrokerProjection !== "function" || typeof daimon.grokBrokerProjectionSha256 !== "function"
         || daimon.GROK_ENGINE_BROKER?.projectionVersion !== DAIMON_GROK_ENGINE_BROKER.projectionVersion
+        || daimon.GROK_ENGINE_BROKER.controlProtocolVersion !== DAIMON_GROK_ENGINE_BROKER.controlProtocolVersion
         || daimon.GROK_ENGINE_BROKER.slotPreflightVersion !== DAIMON_GROK_ENGINE_BROKER.slotPreflightVersion
         || daimon.GROK_ENGINE_BROKER.nativeAbiVersion !== DAIMON_GROK_ENGINE_BROKER.nativeAbiVersion) {
         throw new SpawnfileError("runtime_error", "The installed Daimon Grok broker contract differs from this compiler's vendored manifest");
@@ -32,17 +33,17 @@ export const loadDaimonProjectionModule = async (load = loadRuntime) => {
  * of peers reach `resolveOrganizationGrokBrokerProjection`, so this minimal
  * config and Paideia's fuller one compute the same projection digest. A peer
  * agent would change Daimon's protected set and the digest with it, which is
- * exactly why training runs one slot.
+ * why each slot resolves its own one-agent projection with explicit sibling deny paths.
  */
-export const trainingOrganizationRuntimeConfig = (declaration) => ({
+export const trainingOrganizationRuntimeConfig = (declaration, slot = 0) => ({
     version: "noopolis.daimon.organization-runtime.v1",
-    host: { bindHost: "127.0.0.1", port: 19_700, controlTokenEnv: "SPAWNFILE_DAIMON_CONTROL_TOKEN" },
+    host: { bindHost: "127.0.0.1", port: trainingSlotPaths(slot).ports.workerControl, controlTokenEnv: "SPAWNFILE_DAIMON_CONTROL_TOKEN" },
     agents: [{
             id: declaration.agentId,
             name: declaration.agentId,
             instructions: "training subject",
-            workspacePath: TRAINING_SLOT_WORKSPACE,
-            runtimeHomePath: TRAINING_SLOT_RUNTIME_HOME,
+            workspacePath: trainingSlotPaths(slot).workspace,
+            runtimeHomePath: trainingSlotPaths(slot).runtimeHome,
             engine: { kind: "grok", model: declaration.model, reasoningEffort: declaration.reasoningEffort }
         }]
 });
@@ -53,21 +54,32 @@ export const trainingOrganizationRuntimeConfig = (declaration) => ({
  * list drifted from the bytes provisioning wrote.
  */
 export const resolveTrainingGrokProjection = async (declaration, registration, daimon) => {
-    const projection = daimon.resolveOrganizationGrokBrokerProjection(trainingOrganizationRuntimeConfig(declaration), declaration.agentId, {
+    const projection = daimon.resolveOrganizationGrokBrokerProjection(trainingOrganizationRuntimeConfig(declaration, registration.slot), declaration.agentId, {
         slot: registration.slot,
+        workerConfigVariant: "clocked",
         workerUid: registration.uid,
-        workerHomePath: TRAINING_WORKER_HOME,
+        workerHomePath: registration.home,
         architecture: declaration.architecture,
         usageLedgerPath: registration.usageLedgerPath,
         limits: declaration.limits,
         // The mask that protects the wake-acceptance store is the slot state root it lives in: the store's
         // own parent is `2000:2000 0700`, so bubblewrap could not materialize a deny target inside it as
         // the worker uid. Every party that recomputes this projection must pass the same value.
-        acceptanceStorePath: TRAINING_SLOT_STATE_ROOT,
+        acceptanceStorePath: trainingSlotPaths(registration.slot).state,
         denyPaths: registration.denyPaths,
         seccompProfileSha256: declaration.seccompProfileSha256,
         profileSha256: registration.profileSha256
     });
+    const clock = DAIMON_GROK_ENGINE_BROKER.worker.taskClock;
+    const expectedClock = { ...clock, directoryPath: clock.slotDirectoryPattern.replace("{slot}", String(registration.slot)),
+        timestampFilePath: clock.slotFilePattern.replace("{slot}", String(registration.slot)) };
+    const actualClock = projection.taskClock;
+    if (registration.configVariant !== "clocked" || projection.version !== DAIMON_GROK_ENGINE_BROKER.projectionVersion
+        || projection.profileSha256 !== registration.profileSha256 || actualClock === undefined
+        || Object.entries(expectedClock).some(([key, value]) => actualClock[key] !== value)
+        || projection.workerConfigVariant !== "clocked" || projection.workerConfigSha256 !== registration.configSha256) {
+        throw new SpawnfileError("runtime_error", "Daimon's clocked worker config differs from the provisioned registration");
+    }
     const denied = [...projection.denyPaths];
     if (denied.length !== registration.denyPaths.length || denied.some((entry, index) => entry !== registration.denyPaths[index])) {
         throw new SpawnfileError("runtime_error", "Daimon's Grok broker projection deny list differs from the provisioned sandbox profile");

package/dist/compiler/training/broker/provisioning.d.ts

@@ -7,7 +7,7 @@ import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRend
  * `2100:2000 2750` uid 2000 — Paideia, DSPy and every judge — cannot read a
  * single subject usage row or inference row it paid for.
  */
-export declare const trainingSlotDirectories: () => readonly {
+export declare const trainingSlotDirectories: (slot?: number) => readonly {
     path: string;
     mode: string;
     uid: number;
@@ -22,20 +22,11 @@ export declare const trainingSlotDirectories: () => readonly {
  * and the worker uid instead, and this refuses to provision a slot in an image
  * that did not.
  */
-export declare const renderTrainingIdentities: () => string[];
-/**
- * Root provisioning for the training container's one broker slot, as bash
- * lines run by the image's own root entrypoint and replayed verbatim by the
- * slot supervisor on every recycle.
- *
- * Everything below the slot skeleton is Daimon's audited production
- * provisioning: the same credential bootstrap and journal recovery, the same
- * `registrations.bin`, the same attested worker `GROK_HOME` layout, the same
- * P1b private worker temp, closed shared temp and setgid spill directory, and
- * the same `service.json` — here v2 with the per-slot usage ledger, the
- * per-slot tmpfs turn store and the evaluator `inferenceLedgerPath`.
- */
-export declare const renderTrainingBrokerProvisioning: (registration: DaimonGrokRegistration) => string[];
+export declare const renderTrainingIdentities: (slots?: number) => string[];
+/** Full container provisioning runs exactly once, before any broker process starts. */
+export declare const renderTrainingBrokerProvisioning: (input: DaimonGrokRegistration | readonly DaimonGrokRegistration[], maxRunRequests?: number) => string[];
+/** Reuse the audited worker renderer; never touch service config, credentials, shared temps or siblings. */
+export declare const renderTrainingSlotProvisioning: (registration: DaimonGrokRegistration) => string[];
 /**
  * The sealed-inputs seal, asserted and then attacked before any slot is used.
  *

package/dist/compiler/training/broker/provisioning.js

@@ -1,10 +1,11 @@
 import path from "node:path";
+import { renderTrainingTaskClockReset } from "./taskClock.js";
 import { DAIMON_GROK_SECCOMP_PROFILE_SHA256 } from "../../../shared/daimonGrokSeccompProfile.js";
 import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
 import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
-import { renderDaimonBrokerProvisioningProgram } from "../../containerDaimonBrokerRender.js";
-import { renderDaimonGrokHostPreflight } from "../../containerDaimonGrokWorkerProvisioning.js";
-import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_INFERENCE_LEDGER, TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_PAIDEIA_ROOT, TRAINING_SLOT_ACCEPTANCE_STORE, TRAINING_SEALED_INPUTS_ATTESTATION, TRAINING_SEALED_INPUTS_IDENTITY, TRAINING_SEALED_INPUTS_ROOT, TRAINING_SLOT_ROOT, TRAINING_SLOT_STATE_ROOT, TRAINING_SLOT_TURN_STORE, TRAINING_SLOT_USAGE_DIRECTORY, TRAINING_SLOT_USAGE_LEDGER, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_BROKER_TMPDIR, TRAINING_SLOT_WORKSPACE, TRAINING_WORKER_ROOT, TRAINING_WORKER_UID } from "./paths.js";
+import { renderDaimonBrokerProvisioningProgram, renderDaimonWorkspaceResourceSecurity } from "../../containerDaimonBrokerRender.js";
+import { renderDaimonGrokHostPreflight, renderDaimonGrokWorkerProvisioning } from "../../containerDaimonGrokWorkerProvisioning.js";
+import { trainingSlotPaths, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_INFERENCE_LEDGER, TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_PAIDEIA_ROOT, TRAINING_SEALED_INPUTS_IDENTITY, TRAINING_SEALED_INPUTS_ROOT, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_BROKER_TMPDIR, TRAINING_WORKER_ROOT, } from "./paths.js";
 import { trainingNamespaceDenialMechanism } from "./seccompRoutes.js";
 const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
 /**
@@ -28,21 +29,22 @@ const PROVISION_DIRECTORY_HELPER = [
  * `2100:2000 2750` uid 2000 — Paideia, DSPy and every judge — cannot read a
  * single subject usage row or inference row it paid for.
  */
-export const trainingSlotDirectories = () => [
+export const trainingSlotDirectories = (slot = 0) => [
     // `/run/training` itself is deliberately absent: it is a mount-point parent on the read-only
     // image root, and every writable child below it is its own tmpfs or bind.
-    { path: TRAINING_SLOT_ROOT, mode: "0755", uid: 0, gid: 0 },
+    { path: trainingSlotPaths(slot).root, mode: "0711", uid: 0, gid: 0 },
     { path: TRAINING_PAIDEIA_ROOT, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
     { path: "/home/training", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
     { path: "/work", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: TRAINING_SLOT_WORKSPACE, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: TRAINING_WORKER_UID },
+    { path: trainingSlotPaths(slot).workspace, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: trainingSlotPaths(slot).workerUid },
     // The agent runtime home is deliberately absent: the shared broker provisioning creates it root-owned,
     // fills its setgid `tool-output/`, and only then narrows it to `2000:<worker> 0710`. Handing it over here
     // would leave root — which holds no `CAP_DAC_OVERRIDE` — unable to create the spill directory inside it.
-    { path: TRAINING_SLOT_STATE_ROOT, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: TRAINING_SLOT_ACCEPTANCE_STORE, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: TRAINING_SLOT_TURN_STORE, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
-    { path: TRAINING_SLOT_USAGE_DIRECTORY, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: trainingSlotPaths(slot).state, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: trainingSlotPaths(slot).acceptanceStore, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_TURN_STORE_ROOT, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
+    { path: TRAINING_RUN_REQUEST_STORE, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
+    { path: trainingSlotPaths(slot).usageDirectory, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
     { path: TRAINING_INFERENCE_DIRECTORY, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
     { path: TRAINING_GRANT_HOME_ROOT, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
     // Traverse only: the supervisor socket inside it is the uid gate, and a directory nobody but root may
@@ -66,52 +68,68 @@ export const trainingSlotDirectories = () => [
  * and the worker uid instead, and this refuses to provision a slot in an image
  * that did not.
  */
-export const renderTrainingIdentities = () => [
-    `for fixed_uid in ${DAIMON_ORGANIZATION_UID} ${DAIMON_BROKER_UID} ${TRAINING_WORKER_UID}; do`,
+export const renderTrainingIdentities = (slots = 4) => [
+    `for fixed_uid in ${DAIMON_ORGANIZATION_UID} ${DAIMON_BROKER_UID} ${trainingSlotDescriptors(slots).map(p => p.workerUid).join(" ")}; do`,
     '  getent passwd "$fixed_uid" >/dev/null && getent group "$fixed_uid" >/dev/null || { echo "the training image must bake uid/gid $fixed_uid; the container root is read-only" >&2; exit 1; }',
     "done"
 ];
-/**
- * Root provisioning for the training container's one broker slot, as bash
- * lines run by the image's own root entrypoint and replayed verbatim by the
- * slot supervisor on every recycle.
- *
- * Everything below the slot skeleton is Daimon's audited production
- * provisioning: the same credential bootstrap and journal recovery, the same
- * `registrations.bin`, the same attested worker `GROK_HOME` layout, the same
- * P1b private worker temp, closed shared temp and setgid spill directory, and
- * the same `service.json` — here v2 with the per-slot usage ledger, the
- * per-slot tmpfs turn store and the evaluator `inferenceLedgerPath`.
- */
-export const renderTrainingBrokerProvisioning = (registration) => [
+/** Slot-local skeleton, shared by initial provisioning and recycle. */
+const slotDirectories = (slot) => trainingSlotDirectories(slot).filter(entry => entry.path === trainingSlotPaths(slot).root || entry.path.startsWith(`${trainingSlotPaths(slot).root}/`));
+const renderDirectories = (entries, ledgers) => [
     ...PROVISION_DIRECTORY_HELPER,
-    // Two passes, because root here holds neither `CAP_DAC_OVERRIDE` nor `CAP_FOWNER`: create every
-    // directory while they are all still root-owned and traversable, then set ownership and mode from the
-    // deepest path up, so tightening a parent to `0700` never strands a child that still has to be created.
-    ...trainingSlotDirectories().map((entry) => `mkdir -p ${quote(entry.path)}`),
-    // Every deny entry needs an inode to mask; a bind the host did not supply is created root-owned and unreadable.
-    ...TRAINING_OPTIONAL_DENY_DIRECTORIES.map((target) => `if [ ! -e ${quote(target)} ]; then mkdir -p ${quote(target)}; provision_dir ${quote(target)} 0700 0 0; fi`),
-    // Both ledgers exist before their directories are handed to the broker: the broker appends rows `0640` in
-    // its own group, and the setgid directory below is what lets uid 2000 read a row it paid for.
-    ...[TRAINING_SLOT_USAGE_LEDGER, TRAINING_INFERENCE_LEDGER].map((ledger) => `if [ ! -e ${quote(ledger)} ]; then : > ${quote(ledger)}; fi; chown 0:0 ${quote(ledger)}; chmod 0640 ${quote(ledger)}; chown ${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} ${quote(ledger)}`),
-    ...[...trainingSlotDirectories()].sort((left, right) => right.path.split("/").length - left.path.split("/").length)
-        .map((entry) => `provision_dir ${quote(entry.path)} ${entry.mode} ${entry.uid} ${entry.gid}`),
-    ...renderDaimonGrokHostPreflight(),
-    ...renderDaimonBrokerProvisioningProgram([registration], [], {
-        turnStore: TRAINING_SLOT_TURN_STORE,
-        inferenceLedgerPath: TRAINING_INFERENCE_LEDGER
-    }, "clear", TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_BROKER_TMPDIR),
-    // The shared program leaves the broker's `/etc` root `0555 root:root`, which every uid can list. Training
-    // denies that directory to its worker, and a canary can only observe a denial the kernel actually enforces.
-    `chmod 0550 /etc/daimon-engine-broker; chown 0:${DAIMON_BROKER_UID} /etc/daimon-engine-broker`,
-    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_SLOT_USAGE_DIRECTORY)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
+    ...entries.map(entry => `mkdir -p ${quote(entry.path)}`),
+    ...ledgers.map(ledger => `if [ ! -e ${quote(ledger)} ]; then : > ${quote(ledger)}; fi; chown 0:0 ${quote(ledger)}; chmod 0640 ${quote(ledger)}; chown ${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} ${quote(ledger)}`),
+    ...[...entries].sort((a, b) => b.path.split("/").length - a.path.split("/").length)
+        .map(entry => `provision_dir ${quote(entry.path)} ${entry.mode} ${entry.uid} ${entry.gid}`)
+];
+const renderSlotAssertions = (r) => [
+    `test "$(stat -c '%u:%g %a' ${quote(trainingSlotPaths(r.slot).usageDirectory)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
     `test "$(stat -c '%u:%g %a' ${quote(TRAINING_INFERENCE_DIRECTORY)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
     `test "$(stat -c '%u:%g %a' ${quote(TRAINING_GRANT_HOME_ROOT)})" = "${DAIMON_ORGANIZATION_UID}:${DAIMON_ORGANIZATION_UID} 700"`,
-    // The judge grant home root is the evaluator's alone: no worker uid may even traverse it.
-    `setpriv --clear-groups --reuid ${TRAINING_WORKER_UID} --regid ${TRAINING_WORKER_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '! test -r ${quote(TRAINING_GRANT_HOME_ROOT)}'`,
-    `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'test -r ${quote(TRAINING_SLOT_USAGE_LEDGER)} && test -r ${quote(TRAINING_INFERENCE_LEDGER)}'`,
-    // The sealed train and test datasets: the one boundary here that must hold against the subject's own
-    // namespace, not only against an honest tool. Last, so it runs with every mode already final.
+    `setpriv --clear-groups --reuid ${r.uid} --regid ${r.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '! test -r ${quote(TRAINING_GRANT_HOME_ROOT)}'`,
+    `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'test -r ${quote(r.usageLedgerPath)} && test -r ${quote(TRAINING_INFERENCE_LEDGER)}'`
+];
+/** Full container provisioning runs exactly once, before any broker process starts. */
+export const renderTrainingBrokerProvisioning = (input, maxRunRequests = 1000) => {
+    if (!Number.isSafeInteger(maxRunRequests) || maxRunRequests < 1)
+        throw new Error("Invalid run request cap");
+    const registrations = Array.isArray(input) ? input : [input];
+    const directories = [...new Map(registrations.flatMap(r => trainingSlotDirectories(r.slot)).map(d => [d.path, d])).values()];
+    return [
+        ...renderTrainingIdentities(registrations.length),
+        ...renderTrainingTaskClockReset(),
+        ...renderDirectories(directories, [...registrations.map(r => r.usageLedgerPath), TRAINING_INFERENCE_LEDGER]),
+        ...renderDaimonGrokHostPreflight(),
+        ...renderDaimonBrokerProvisioningProgram(registrations, [], {
+            version: "v3", maxRunRequests, runRequestStore: TRAINING_RUN_REQUEST_STORE,
+            turnStore: TRAINING_TURN_STORE_ROOT, inferenceLedgerPath: TRAINING_INFERENCE_LEDGER
+        }, "clear", TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_BROKER_TMPDIR, [
+            `mkdir -p ${quote(DAIMON_GROK_ENGINE_BROKER.worker.taskClock.rootDirectoryPath)}; chmod 0755 ${quote(DAIMON_GROK_ENGINE_BROKER.worker.taskClock.rootDirectoryPath)}`,
+            ...registrations.flatMap(r => {
+                const p = trainingSlotPaths(r.slot);
+                return [
+                    `mkdir -p ${quote(p.clockDirectory)}; chown 0:0 ${quote(p.clockDirectory)}; chmod 0755 ${quote(p.clockDirectory)}`,
+                    `printf '+0\\n' > ${quote(p.clockFile)}; chmod 0644 ${quote(p.clockFile)}; chown ${DAIMON_BROKER_UID}:${DAIMON_BROKER_UID} ${quote(p.clockFile)}`,
+                    `chown ${DAIMON_BROKER_UID}:${DAIMON_BROKER_UID} ${quote(p.clockDirectory)}`
+                ];
+            })
+        ]),
+        `chmod 0550 /etc/daimon-engine-broker; chown 0:${DAIMON_BROKER_UID} /etc/daimon-engine-broker`,
+        ...registrations.flatMap(r => [...renderSlotAssertions(r), ...renderTrainingSealedInputsAssertions(r.uid, r.privateTmp)])
+    ];
+};
+/** Reuse the audited worker renderer; never touch service config, credentials, shared temps or siblings. */
+export const renderTrainingSlotProvisioning = (registration) => [
+    ...renderDirectories(slotDirectories(registration.slot), [registration.usageLedgerPath]),
+    // Keep worker-home and private-tmp identities stable: sibling turns attest them concurrently.
+    `setpriv --clear-groups --reuid=${registration.uid} --regid=${registration.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- mkdir -p ${quote(registration.grokHome)}`,
+    `chown 0:0 ${quote(registration.grokHome)}; chmod 0700 ${quote(registration.grokHome)}`,
+    "node <<'SPAWNFILE_TRAINING_SLOT_PROVISION'",
+    "const crypto = require('node:crypto'); const fs = require('node:fs');",
+    ...renderDaimonWorkspaceResourceSecurity([]),
+    ...renderDaimonGrokWorkerProvisioning([registration], {}, [], "slot"),
+    "SPAWNFILE_TRAINING_SLOT_PROVISION",
+    ...renderSlotAssertions(registration),
     ...renderTrainingSealedInputsAssertions(registration.uid, registration.privateTmp)
 ];
 /**
@@ -158,11 +176,11 @@ export const renderTrainingBrokerProvisioning = (registration) => [
  * every trial on `namespace-rebind reached no verdict` — the `mkdir` failed, not
  * the seal. The private tmp is also the workspace the subject itself has.
  */
-export const renderTrainingSealedInputsAssertions = (workerUid = TRAINING_WORKER_UID, privateTmp = path.posix.join(TRAINING_WORKER_ROOT, String(TRAINING_WORKER_UID), "tmp"), mechanism = trainingNamespaceDenialMechanism()) => [
+export const renderTrainingSealedInputsAssertions = (workerUid = trainingSlotPaths(0).workerUid, privateTmp = trainingSlotPaths(0).privateTmp, mechanism = trainingNamespaceDenialMechanism()) => [
     // Diagnostics go to a file rather than into the verdict: a route's stderr is util-linux prose that
     // would turn every real verdict into "unknown", but a no-verdict refusal with no diagnostic is what
     // made the first live failure unreadable, so the unknown branch prints it back.
-    `seal_diagnostic=${quote(`${TRAINING_SLOT_ROOT}/seal-probe.err`)}`,
+    `seal_diagnostic=${quote(`${trainingSlotPaths(workerUid - trainingSlotPaths(0).workerUid).root}/seal-probe.err`)}`,
     `seal_worker() { setpriv --clear-groups --reuid ${workerUid} --regid ${workerUid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- /bin/sh -c "$1" 2>"$seal_diagnostic"; }`,
     "seal_rows=''",
     'seal_record() { if [ -n "$seal_rows" ]; then seal_rows="$seal_rows,"; fi; seal_rows="$seal_rows{\\"route\\":\\"$1\\",\\"verdict\\":\\"$2\\"}"; }',
@@ -198,7 +216,7 @@ export const renderTrainingSealedInputsAssertions = (workerUid = TRAINING_WORKER
     // cross-repo `noopolis.daimon.grok-slot-preflight.v2` canary shape is deliberately untouched — its
     // schema lives in Daimon and no consumer here can validate an added member — so the per-route
     // mechanism is recorded here rather than implied by a bare `result: "denied"` there.
-    `seal_attestation=${quote(TRAINING_SEALED_INPUTS_ATTESTATION)}`,
+    `seal_attestation=${quote(trainingSlotPaths(workerUid - trainingSlotPaths(0).workerUid).sealedInputsAttestation)}`,
     `printf '{"version":"spawnfile.training-sealed-inputs.v1","root":"%s","worker_uid":%s,"identity":"%s","pinned_seccomp_profile_sha256":"%s","namespace_routes":"%s","routes":[%s]}\\n' `
         + `${quote(TRAINING_SEALED_INPUTS_ROOT)} ${workerUid} `
         + `"$(stat -c '%u:%g %a' ${quote(TRAINING_SEALED_INPUTS_ROOT)})" ${quote(DAIMON_GROK_SECCOMP_PROFILE_SHA256)} `