spawnfile 0.1.17 → 0.1.19

package/dist/compiler/training/broker/registration.d.ts

@@ -13,8 +13,10 @@ import { type DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRend
  * the profile outright, and masks cannot nest, so an entry covered by another
  * entry is a provisioning bug rather than something to silently drop.
  */
-export declare const resolveTrainingGrokDenyPaths: (added?: readonly string[]) => string[];
+export declare const resolveTrainingGrokDenyPaths: (added?: readonly string[] | undefined, slot?: number, slots?: number) => string[];
 export interface TrainingGrokSlotInput {
+    slot?: number;
+    slots?: number;
     agentId: string;
     model: DaimonGrokBrokerModel;
     reasoningEffort: DaimonGrokBrokerReasoningEffort;

package/dist/compiler/training/broker/registration.js

@@ -1,9 +1,9 @@
 import path from "node:path";
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
+import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
 import { DAIMON_GROK_BASE_PROFILE_GRANTS, assertCanonicalRegisteredPath } from "../../containerDaimonGrokWorkerRender.js";
-import { TRAINING_ADDED_DENY_PATHS, TRAINING_BOOTSTRAP_MOUNT, TRAINING_DEFERRED_DENY_PATHS, TRAINING_REALM_MOUNT, TRAINING_SLOT_INDEX, TRAINING_SLOT_RUNTIME_HOME, TRAINING_SLOT_STATE_ROOT, TRAINING_SLOT_USAGE_LEDGER, TRAINING_SLOT_WORKSPACE, TRAINING_WORKER_HOME, TRAINING_WORKER_UID } from "./paths.js";
+import { trainingSlotPaths, trainingEvaluatorPaths, TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, TRAINING_DEFERRED_DENY_PATHS } from "./paths.js";
 const fail = (message) => {
     throw new SpawnfileError("compile_error", message);
 };
@@ -21,26 +21,32 @@ const within = (candidate, root) => candidate === root || candidate.startsWith(`
  * the profile outright, and masks cannot nest, so an entry covered by another
  * entry is a provisioning bug rather than something to silently drop.
  */
-export const resolveTrainingGrokDenyPaths = (added = TRAINING_ADDED_DENY_PATHS) => {
-    // The wake-acceptance store is masked through `TRAINING_SLOT_STATE_ROOT`, never directly: Grok 1.0.34
+export const resolveTrainingGrokDenyPaths = (added = undefined, slot = 0, slots = 1) => {
+    const p = trainingSlotPaths(slot);
+    const required = trainingEvaluatorPaths(slot, slots).map(entry => entry.path);
+    // The wake-acceptance store is masked through `p.state`, never directly: Grok 1.0.34
     // materializes every deny target inside bubblewrap AS THE WORKER UID, and the store's parent is
     // `2000:2000 0700`, so the store itself is unplaceable and would make Grok refuse the whole profile
     // (`.runtime/grok-deny-placement/EVIDENCE.md`). The state root covers it and nothing else lives there.
-    const daimonOwn = [TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, TRAINING_SLOT_STATE_ROOT];
-    const grokHome = path.posix.join(TRAINING_WORKER_HOME, DAIMON_GROK_WORKER_HOME_DIRECTORY);
+    const daimonOwn = [TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, p.state];
+    const grokHome = path.posix.join(p.workerHome, DAIMON_GROK_WORKER_HOME_DIRECTORY);
     const grants = [
-        ...DAIMON_GROK_BASE_PROFILE_GRANTS, TRAINING_SLOT_WORKSPACE, grokHome,
-        path.posix.join(grokHome, "sessions"), path.posix.join(TRAINING_WORKER_HOME, "tmp")
+        ...DAIMON_GROK_BASE_PROFILE_GRANTS, p.workspace, grokHome,
+        path.posix.join(grokHome, "sessions"), path.posix.join(p.workerHome, "tmp")
     ];
-    const candidates = [...new Set([...daimonOwn, ...added])].sort();
+    const candidates = [...new Set([...daimonOwn, ...required, ...(added ?? [])])].sort();
     for (const entry of candidates) {
         assertCanonicalRegisteredPath("deny path", entry);
         const grant = grants.find((candidate) => within(candidate, entry));
         if (grant)
             fail(`Training Grok deny path ${entry} equals or contains the base profile grant ${grant}; Grok refuses such a profile`);
-        if (within(TRAINING_SLOT_WORKSPACE, entry) || within(TRAINING_WORKER_HOME, entry) || within(TRAINING_SLOT_RUNTIME_HOME, entry)) {
+        if (within(p.workspace, entry) || within(p.workerHome, entry) || within(p.runtimeHome, entry)) {
             fail(`Training Grok deny path ${entry} would hide the subject's own workspace, home, or runtime home`);
         }
+        if ([p.clockFile, DAIMON_GROK_ENGINE_BROKER.worker.taskClock.preloadPath,
+            "/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1", "/usr/lib/aarch64-linux-gnu/faketime/libfaketime.so.1"].some(file => within(file, entry))) {
+            fail(`Training Grok deny path ${entry} would hide the subject's task clock`);
+        }
         const ancestor = candidates.find((other) => other !== entry && within(entry, other));
         if (ancestor)
             fail(`Training Grok deny path ${ancestor} would cover ${entry}; masks cannot nest`);
@@ -55,26 +61,28 @@ export const resolveTrainingGrokDenyPaths = (added = TRAINING_ADDED_DENY_PATHS)
  * not exist here.
  */
 export const resolveTrainingGrokRegistration = (input) => {
+    const p = trainingSlotPaths(input.slot ?? 0);
     if (!input.agentId.trim())
         fail("Training Grok slot requires an agent id");
     if (!DAIMON_GROK_BROKER_MODELS.includes(input.model)
         || !DAIMON_GROK_BROKER_REASONING_EFFORTS.includes(input.reasoningEffort)) {
         fail(`Training Grok slot has no declared broker model and reasoning effort: ${input.agentId}`);
     }
-    const home = assertCanonicalRegisteredPath("home", TRAINING_WORKER_HOME);
+    const home = assertCanonicalRegisteredPath("home", p.workerHome);
     const grokHome = path.posix.join(home, DAIMON_GROK_WORKER_HOME_DIRECTORY);
-    const config = resolveDaimonGrokWorkerConfig(input.model, input.reasoningEffort);
-    const denyPaths = resolveTrainingGrokDenyPaths(input.denyPaths);
+    const config = resolveDaimonGrokClockedWorkerConfig(input.model, input.reasoningEffort, p.slot);
+    const denyPaths = resolveTrainingGrokDenyPaths(input.denyPaths, p.slot, input.slots ?? 1);
     const profile = renderDaimonGrokWorkerSandboxProfile(denyPaths);
     const eventsPath = path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath);
     const profilePath = path.posix.join(grokHome, "sandbox.toml");
     for (const [label, value] of [["GROK_HOME", grokHome], ["profile", profilePath], ["events", eventsPath],
-        ["workspace", TRAINING_SLOT_WORKSPACE], ["runtime home", TRAINING_SLOT_RUNTIME_HOME],
-        ["usage ledger", TRAINING_SLOT_USAGE_LEDGER]])
+        ["workspace", p.workspace], ["runtime home", p.runtimeHome],
+        ["usage ledger", p.usageLedger]])
         assertCanonicalRegisteredPath(label, value);
     return {
         agentId: input.agentId,
         config: config.bytes,
+        configVariant: "clocked",
         ...(input.limits === undefined ? {} : { limits: { ...input.limits } }),
         configSha256: config.sha256,
         deferredDenyPaths: denyPaths.filter((entry) => TRAINING_DEFERRED_DENY_PATHS.includes(entry)),
@@ -88,15 +96,15 @@ export const resolveTrainingGrokRegistration = (input) => {
         profileSha256: daimonGrokWorkerSandboxProfileSha256(denyPaths),
         privateTmp: path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome),
         reasoningEffort: input.reasoningEffort,
-        runtimeHome: TRAINING_SLOT_RUNTIME_HOME,
+        runtimeHome: p.runtimeHome,
         // Empty on purpose: training has no persistent mounts at all. Everything a trial writes under the slot
         // runtime home is per-slot tmpfs the recycle wipes, and the only thing provisioned inside it is the
         // setgid `tool-output/` spill directory, so the traversable `0710` home exposes nothing else.
         runtimeHomeMounts: [],
-        slot: TRAINING_SLOT_INDEX,
-        spillDirectory: path.posix.join(TRAINING_SLOT_RUNTIME_HOME, DAIMON_GROK_ENGINE_BROKER.worker.home.spillDirectory.relativeToRuntimeHome),
-        uid: TRAINING_WORKER_UID,
-        usageLedgerPath: TRAINING_SLOT_USAGE_LEDGER,
-        workspace: TRAINING_SLOT_WORKSPACE
+        slot: p.slot,
+        spillDirectory: path.posix.join(p.runtimeHome, DAIMON_GROK_ENGINE_BROKER.worker.home.spillDirectory.relativeToRuntimeHome),
+        uid: p.workerUid,
+        usageLedgerPath: p.usageLedger,
+        workspace: p.workspace
     };
 };

package/dist/compiler/training/broker/reset.d.ts

@@ -0,0 +1,9 @@
+/** Root uses the broker's slot reset seam; the broker owns active-turn, worker-reap and clock checks. */
+export declare const resetTrainingBrokerSlot: (slot: number, signal: AbortSignal, socketPath?: "/run/daimon-engine-broker/control.sock") => Promise<void>;
+/** The native control relay authenticates SO_PEERCRED uid 2000 and rejects root. */
+export declare const resetTrainingBrokerSlotAsOrganization: (slot: number, signal: AbortSignal, execute?: (file: string, args: string[], options: {
+    signal: AbortSignal;
+    timeout: number;
+}) => Promise<{
+    stdout: string;
+}>) => Promise<void>;

package/dist/compiler/training/broker/reset.js

@@ -0,0 +1,71 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { randomUUID } from "node:crypto";
+import { createConnection } from "node:net";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
+import { trainingSlotPaths } from "./paths.js";
+/** Root uses the broker's slot reset seam; the broker owns active-turn, worker-reap and clock checks. */
+export const resetTrainingBrokerSlot = (slot, signal, socketPath = DAIMON_GROK_ENGINE_BROKER.controlSocketPath) => {
+    trainingSlotPaths(slot);
+    signal.throwIfAborted();
+    const requestId = randomUUID();
+    const version = DAIMON_GROK_ENGINE_BROKER.controlProtocolVersion;
+    const payload = Buffer.from(JSON.stringify({ version, kind: "reset_slot", requestId, slot }));
+    const frame = Buffer.alloc(4 + payload.length);
+    frame.writeUInt32BE(payload.length);
+    payload.copy(frame, 4);
+    return new Promise((resolve, reject) => {
+        const socket = createConnection(socketPath);
+        let buffer = Buffer.alloc(0), settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", abort);
+            socket.destroy();
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        const abort = () => finish(new Error("Training broker reset aborted; slot must be quarantined"));
+        signal.addEventListener("abort", abort, { once: true });
+        socket.once("error", error => finish(error));
+        socket.once("close", () => finish(new Error("Training broker reset refused: slot active, unavailable, or reset failed")));
+        socket.once("connect", () => socket.write(frame));
+        socket.on("data", chunk => {
+            buffer = Buffer.concat([buffer, chunk]);
+            if (buffer.length < 4)
+                return;
+            const size = buffer.readUInt32BE(0);
+            if (size < 2 || size > 4096 || buffer.length > size + 4) {
+                finish(new Error("Invalid broker reset response frame"));
+                return;
+            }
+            if (buffer.length < size + 4)
+                return;
+            try {
+                const response = JSON.parse(buffer.subarray(4).toString("utf8"));
+                if (!response || response.version !== version || response.kind !== "slot_reset" || response.requestId !== requestId
+                    || response.slot !== slot || Object.keys(response).length !== 4)
+                    throw Error("Invalid broker reset acknowledgement");
+                finish();
+            }
+            catch (error) {
+                finish(error instanceof Error ? error : new Error("Invalid broker reset response"));
+            }
+        });
+    });
+};
+/** The native control relay authenticates SO_PEERCRED uid 2000 and rejects root. */
+export const resetTrainingBrokerSlotAsOrganization = async (slot, signal, execute = promisify(execFile)) => {
+    trainingSlotPaths(slot);
+    signal.throwIfAborted();
+    const uid = DAIMON_GROK_ENGINE_BROKER.identities.organizationUid;
+    const program = `import { resetTrainingBrokerSlot } from ${JSON.stringify(import.meta.url)}; await resetTrainingBrokerSlot(Number(process.argv[1]), AbortSignal.timeout(10000)); process.stdout.write("slot-reset-complete\\n");`;
+    const result = await execute("setpriv", ["--clear-groups", `--reuid=${uid}`, `--regid=${uid}`,
+        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", process.execPath,
+        "--input-type=module", "--eval", program, String(slot)], { signal, timeout: 15_000 });
+    if (result.stdout !== "slot-reset-complete\n")
+        throw Error("Broker reset child returned no verified acknowledgement");
+};

package/dist/compiler/training/broker/runtime.d.ts

@@ -1,25 +1,22 @@
 import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
 import type { TrainingBrokerDeclaration } from "./declaration.js";
-import { type BrokerChild } from "./processes.js";
 import type { TrainingSlotRuntime } from "./supervisor.js";
 export interface TrainingSlotRuntimeOptions {
     declaration: TrainingBrokerDeclaration;
     registration: DaimonGrokRegistration;
     projectionSha256: string;
+    reset: (slot: number, signal: AbortSignal) => Promise<void>;
     /** Test seam: the shell the provisioning script runs in and the `/proc` it reads identities from. */
     shell?: string;
     procRoot?: string;
     logPath?: string;
 }
-/**
- * The real slot runtime: what `recycle` actually does to this container.
- *
- * Every mutation goes through the same rendered provisioning the root
- * entrypoint ran at startup, so a recycled slot is byte-identically
- * provisioned — including the credential journal recovery, which is how a
- * recycle that lands on a `refreshing` or `stale` realm either recovers or
- * fails closed with a named error instead of leaving a silently stale realm.
- */
-export declare const createTrainingSlotRuntime: (options: TrainingSlotRuntimeOptions) => TrainingSlotRuntime & {
-    children(): readonly BrokerChild[];
-};
+export declare const createTrainingSlotRuntime: (options: TrainingSlotRuntimeOptions) => TrainingSlotRuntime;
+/** Never remove or change the ownership/mode of a worker home or tmp: siblings attest those inodes. */
+export declare const renderTrainingSlotWipe: (slot: number) => string[];
+/** A failed privilege drop is not evidence of denial; require a positive worker verdict. */
+export declare const probeTrainingWorker: (uid: number, target: string, depth: "read" | "enter", execute?: (command: string, args: string[], options: {
+    timeout: number;
+}) => Promise<{
+    stdout: string;
+}>) => Promise<boolean>;

package/dist/compiler/training/broker/runtime.js

@@ -1,68 +1,23 @@
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
-import { chmod, chown, mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
+import { chmod, chown, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { setTimeout as pause } from "node:timers/promises";
 import { promisify } from "node:util";
 import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { MOUNT_AWARE_CLEAR_HELPER } from "../../containerDaimonBrokerRender.js";
-import { renderTrainingBrokerProvisioning, renderTrainingIdentities } from "./provisioning.js";
-import { startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
+import { probeTrainingSiblingClock } from "./clockProbe.js";
+import { renderTrainingTaskClockAssertions } from "./taskClock.js";
+import { renderTrainingSlotProvisioning } from "./provisioning.js";
 import { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveTrainingCanaries } from "./receipt.js";
-import { DAIMON_ORGANIZATION_UID, TRAINING_HOST_BIND_DENY_PATHS, TRAINING_SEALED_DENY_PATHS, TRAINING_WIPE_TARGETS, TRAINING_SLOT_GENERATION_FILE, TRAINING_SLOT_PREFLIGHT_RECEIPT, TRAINING_SLOT_TURN_STORE, TRAINING_SLOT_USAGE_DIRECTORY, TRAINING_SLOT_WORKSPACE, TRAINING_SUPERVISOR_LOG } from "./paths.js";
+import { DAIMON_ORGANIZATION_UID, TRAINING_HOST_BIND_DENY_PATHS, TRAINING_SEALED_DENY_PATHS, trainingSlotPaths, trainingWipeTargets, trainingClearTargets, TRAINING_SUPERVISOR_LOG } from "./paths.js";
 const run = promisify(execFile);
 const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
-const CREDENTIAL_JOURNAL = `${DAIMON_GROK_ENGINE_BROKER.credentialHomePath}/.daimon-broker/credential-journal.json`;
-/** State the broker's credential authority may be left in; only `promoted` (or no journal at all) is settled. */
-const settledJournal = async () => {
-    const raw = await readFile(CREDENTIAL_JOURNAL, "utf8").catch((error) => {
-        if (error.code === "ENOENT")
-            return undefined;
-        throw error;
-    });
-    if (raw === undefined)
-        return "settled";
-    const journal = JSON.parse(raw);
-    if (journal.version !== "noopolis.daimon.broker-credential-journal.v1")
-        throw new SpawnfileError("runtime_error", "The broker credential journal is not a recognised version");
-    return journal.state === "promoted" ? "settled" : journal.state === "refreshing" ? "refreshing" : "stale";
-};
-/** A turn is active while its registry record says so; a terminal record is finished work and never blocks a recycle. */
-const activeTurns = async () => {
-    const names = await readdir(TRAINING_SLOT_TURN_STORE).catch((error) => {
-        if (error.code === "ENOENT")
-            return [];
-        throw error;
-    });
-    let active = 0;
-    for (const name of names) {
-        if (!name.endsWith(".json"))
-            continue;
-        const raw = await readFile(path.join(TRAINING_SLOT_TURN_STORE, name), "utf8").catch(() => "");
-        try {
-            if (JSON.parse(raw).state === "active")
-                active += 1;
-        }
-        catch { /* a half-written record is not an active turn */ }
-    }
-    return active;
-};
-/**
- * The real slot runtime: what `recycle` actually does to this container.
- *
- * Every mutation goes through the same rendered provisioning the root
- * entrypoint ran at startup, so a recycled slot is byte-identically
- * provisioned — including the credential journal recovery, which is how a
- * recycle that lands on a `refreshing` or `stale` realm either recovers or
- * fails closed with a named error instead of leaving a silently stale realm.
- */
 export const createTrainingSlotRuntime = (options) => {
     const shell = options.shell ?? "/bin/bash";
     const logPath = options.logPath ?? TRAINING_SUPERVISOR_LOG;
-    const script = [...renderTrainingIdentities(), ...renderTrainingBrokerProvisioning(options.registration)].join("\n");
-    let children = [];
+    const p = trainingSlotPaths(options.registration.slot);
+    const script = renderTrainingSlotProvisioning(options.registration).join("\n");
     const log = (line) => {
         const entry = `${new Date().toISOString()} ${line}\n`;
         process.stderr.write(`[slot-supervisor] ${entry}`);
@@ -71,61 +26,18 @@ export const createTrainingSlotRuntime = (options) => {
         }
         catch { /* the log is diagnostics, never the gate */ }
     };
-    /**
-     * One worker-uid reachability attempt. The command below *succeeds* when the
-     * worker can still reach the target, so a non-zero exit is the denial.
-     *
-     * `enter` is the stronger question a sealed root needs answered: a directory
-     * can be unreadable (`test -r` fails) and still searchable, and a subject
-     * that knows `test.paideia.yaml` by name needs only search permission.
-     */
-    const probe = async (target, depth) => {
-        const quoted = JSON.stringify(target);
-        const reachable = depth === "enter"
-            ? `test -r ${quoted} || test -x ${quoted} || ls -1 ${quoted} >/dev/null 2>&1`
-            : `test -r ${quoted}`;
-        try {
-            await run("setpriv", ["--clear-groups", `--reuid=${options.registration.uid}`, `--regid=${options.registration.uid}`,
-                "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", "/bin/sh", "-c", reachable], { timeout: 10_000 });
-            return false;
-        }
-        catch {
-            return true;
-        }
-    };
+    const siblingClocks = Array.from({ length: options.declaration.slots }, (_, slot) => trainingSlotPaths(slot))
+        .filter(peer => peer.slot !== p.slot).map(peer => peer.clockDirectory);
+    const probe = (target, depth) => siblingClocks.includes(target)
+        ? probeTrainingSiblingClock(p.slot, target)
+        : probeTrainingWorker(options.registration.uid, target, depth);
     return {
         log,
-        children: () => children,
-        drain: async (signal) => {
-            for (;;) {
-                signal.throwIfAborted();
-                const state = await settledJournal();
-                if (state === "stale") {
-                    // The audited provisioning below owns stale-realm recovery; it promotes the bootstrap or refuses outright.
-                    log("credential journal is stale; the recycle will replay the root credential recovery");
-                    return;
-                }
-                if (state === "settled" && await activeTurns() === 0)
-                    return;
-                await pause(100);
-            }
-        },
-        stop: async () => { await stopBrokerProcesses(children, log); children = []; },
+        reset: signal => options.reset(p.slot, signal),
         wipe: async () => {
             // Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_DAC_OVERRIDE`, so it cannot delete
             // inside a directory it handed to the worker or the broker. Reclaim each tree first, then remove it.
-            const targets = TRAINING_WIPE_TARGETS;
-            const contents = [TRAINING_SLOT_WORKSPACE, TRAINING_SLOT_USAGE_DIRECTORY];
-            const script = [
-                ...MOUNT_AWARE_CLEAR_HELPER,
-                // The parent has to be reclaimed too: unlinking is a write to the *directory*, and the slot hands
-                // several of these parents to uid 2000 or the broker. Provisioning restores every mode right after.
-                'reclaim() { parent=$(dirname "$1"); chown 0:0 "$parent"; chmod u+rwx "$parent"; if [ -e "$1" ]; then chown -R 0:0 "$1"; chmod -R u+rwX "$1"; fi; }',
-                ...targets.map((target) => `reclaim ${quote(target)}; spawnfile_remove_tree ${quote(target)}`),
-                // The workspace and the per-slot ledger directory keep their own root: the registered paths must
-                // stay canonical across a recycle, so only what a trial put inside them goes.
-                ...contents.map((target) => `reclaim ${quote(target)}; spawnfile_clear_tree ${quote(target)}`)
-            ].join("\n");
+            const script = renderTrainingSlotWipe(p.slot).join("\n");
             await run(shell, ["--noprofile", "--norc", "-ceu", script], { maxBuffer: 1024 * 1024 }).catch((error) => {
                 const detail = error;
                 throw new SpawnfileError("runtime_error", `Training slot wipe failed: ${(detail.stderr ?? "").slice(-1024).trim() || "no diagnostic"}`);
@@ -139,19 +51,21 @@ export const createTrainingSlotRuntime = (options) => {
             if (result.stdout.trim())
                 log(`provisioning: ${result.stdout.trim().slice(-2048)}`);
         },
-        start: async () => { children = await startBrokerProcesses({ log, procRoot: options.procRoot }); },
-        canaries: async () => resolveTrainingCanaries({
-            denyPaths: options.registration.denyPaths, probe, log, hostBindPaths: TRAINING_HOST_BIND_DENY_PATHS,
-            sealedPaths: TRAINING_SEALED_DENY_PATHS,
-            mountinfo: await readFile(`${options.procRoot ?? "/proc"}/self/mountinfo`, "utf8"),
-            unenforcedBindPolicy: options.declaration.unenforcedBindPolicy
-        }),
+        canaries: async () => {
+            await run(shell, ["--noprofile", "--norc", "-ceu", renderTrainingTaskClockAssertions(options.registration).join("\n")]);
+            return resolveTrainingCanaries({
+                denyPaths: options.registration.denyPaths, probe, log, hostBindPaths: TRAINING_HOST_BIND_DENY_PATHS,
+                sealedPaths: TRAINING_SEALED_DENY_PATHS,
+                mountinfo: await readFile(`${options.procRoot ?? "/proc"}/self/mountinfo`, "utf8"),
+                unenforcedBindPolicy: options.declaration.unenforcedBindPolicy
+            });
+        },
         nextGeneration: async () => {
-            const previous = await readFile(TRAINING_SLOT_GENERATION_FILE, "utf8").catch(() => "");
+            const previous = await readFile(p.generationFile, "utf8").catch(() => "");
             const parsed = Number.parseInt(JSON.parse(previous || "{}").generation ?? "0", 10);
             // Seeded from the wall clock so a container restart cannot hand out a generation an evaluator already accepted.
             const generation = Math.max(Number.isSafeInteger(parsed) && parsed > 0 ? parsed + 1 : 1, Math.floor(Date.now() / 1000));
-            await writeFile(TRAINING_SLOT_GENERATION_FILE, `${JSON.stringify({ generation })}\n`, { mode: 0o600 });
+            await writeFile(p.generationFile, `${JSON.stringify({ generation })}\n`, { mode: 0o600 });
             return generation;
         },
         publishReceipt: async ({ generation, nonce, canaries }) => {
@@ -161,13 +75,53 @@ export const createTrainingSlotRuntime = (options) => {
                 seccompProfileSha256: options.declaration.seccompProfileSha256,
                 grokExecutableSha256: readGrokExecutableSha256(), canaries, createdAt: new Date()
             });
-            const temporary = `${TRAINING_SLOT_PREFLIGHT_RECEIPT}.${randomUUID()}.tmp`;
-            await mkdir(path.dirname(TRAINING_SLOT_PREFLIGHT_RECEIPT), { recursive: true });
+            const temporary = `${p.preflightReceipt}.${randomUUID()}.tmp`;
+            await mkdir(path.dirname(p.preflightReceipt), { recursive: true });
             await writeFile(temporary, `${JSON.stringify(receipt)}\n`, { mode: 0o600, flag: "wx" });
             await chown(temporary, 0, DAIMON_ORGANIZATION_UID);
             await chmod(temporary, 0o640);
-            await rename(temporary, TRAINING_SLOT_PREFLIGHT_RECEIPT);
-            return TRAINING_SLOT_PREFLIGHT_RECEIPT;
+            await rename(temporary, p.preflightReceipt);
+            return p.preflightReceipt;
         }
     };
 };
+/** Never remove or change the ownership/mode of a worker home or tmp: siblings attest those inodes. */
+export const renderTrainingSlotWipe = (slot) => {
+    const p = trainingSlotPaths(slot);
+    const worker = `setpriv --clear-groups --reuid=${p.workerUid} --regid=${p.workerUid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all --`;
+    return [
+        ...MOUNT_AWARE_CLEAR_HELPER,
+        // Attested roots must still be canonical before any recursive mutation.
+        ...[p.workerHome, p.privateTmp, ...trainingWipeTargets(slot), ...trainingClearTargets(slot)].map(target => `if [ -e ${quote(target)} ] || [ -L ${quote(target)} ]; then if [ -L ${quote(target)} ] || [ "$(realpath ${quote(target)})" != ${quote(target)} ]; then echo "noncanonical slot wipe target" >&2; exit 1; fi; fi`),
+        'reclaim() { parent=$(dirname "$1"); chown 0:0 "$parent"; chmod u+rwx "$parent"; if [ -e "$1" ]; then chown -R 0:0 "$1"; chmod -R u+rwX "$1"; fi; }',
+        ...trainingWipeTargets(slot).map(target => `reclaim ${quote(target)}; spawnfile_remove_tree ${quote(target)}`),
+        ...trainingClearTargets(slot).map(target => `reclaim ${quote(target)}; spawnfile_clear_tree ${quote(target)}`),
+        // Reclaim descendants only, then unlink as the worker, who owns the stable parent. No sibling inode changes.
+        `for worker_entry in ${quote(p.workerHome)}/* ${quote(p.workerHome)}/.[!.]* ${quote(p.workerHome)}/..?*; do`,
+        '  if [ ! -e "$worker_entry" ] && [ ! -L "$worker_entry" ]; then continue; fi',
+        `  if [ "$worker_entry" = ${quote(p.privateTmp)} ]; then continue; fi`,
+        '  if spawnfile_holds_mount "$worker_entry"; then echo "worker home contains a mount" >&2; exit 1; fi',
+        `  chown -hR ${p.workerUid}:${p.workerUid} "$worker_entry"`,
+        `  ${worker} /bin/sh -ceu 'if [ ! -L "$1" ]; then chmod -R u+rwX "$1"; fi; rm -rf "$1"' sh "$worker_entry"`,
+        'done',
+        `for worker_entry in ${quote(p.privateTmp)}/* ${quote(p.privateTmp)}/.[!.]* ${quote(p.privateTmp)}/..?*; do`,
+        '  if [ ! -e "$worker_entry" ] && [ ! -L "$worker_entry" ]; then continue; fi',
+        '  if spawnfile_holds_mount "$worker_entry"; then echo "worker tmp contains a mount" >&2; exit 1; fi',
+        `  chown -hR ${p.workerUid}:${p.workerUid} "$worker_entry"`,
+        `  ${worker} /bin/sh -ceu 'if [ ! -L "$1" ]; then chmod -R u+rwX "$1"; fi; rm -rf "$1"' sh "$worker_entry"`,
+        'done'
+    ];
+};
+/** A failed privilege drop is not evidence of denial; require a positive worker verdict. */
+export const probeTrainingWorker = async (uid, target, depth, execute = run) => {
+    const q = quote(target);
+    const reachable = depth === "enter" ? `test -r ${q} || test -x ${q} || ls -1 ${q} >/dev/null 2>&1` : `test -r ${q}`;
+    const result = await execute("setpriv", ["--clear-groups", `--reuid=${uid}`, `--regid=${uid}`,
+        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", "/bin/sh", "-c",
+        `if ${reachable}; then echo reachable; else echo denied; fi`], { timeout: 10_000 });
+    if (result.stdout.trim() === "denied")
+        return true;
+    if (result.stdout.trim() === "reachable")
+        return false;
+    throw new SpawnfileError("runtime_error", "Training worker canary returned no verified verdict");
+};

package/dist/compiler/training/broker/supervisor.d.ts

@@ -1,4 +1,4 @@
-export declare const TRAINING_SUPERVISOR_PROTOCOL: "spawnfile.training-slot-supervisor.v1";
+export declare const TRAINING_SUPERVISOR_PROTOCOL: "spawnfile.training-slot-supervisor.v2";
 export declare const TRAINING_SUPERVISOR_MAX_REQUEST_BYTES = 4096;
 /**
  * Everything the recycle verb does to the running slot. It is an interface so
@@ -8,14 +8,12 @@ export declare const TRAINING_SUPERVISOR_MAX_REQUEST_BYTES = 4096;
  * of bug a live check finds far too late.
  */
 export interface TrainingSlotRuntime {
-    /** Waits for no active turn and a settled credential journal; throws a named error on an unrecoverable realm. */
-    drain(signal: AbortSignal): Promise<void>;
-    stop(): Promise<void>;
-    /** Removes worker home, slot workspace, wake-acceptance, turn store, per-slot ledger and Grok session state. */
+    /** Broker refuses active turns and live workers, then resets only this slot clock/turn store. */
+    reset(signal: AbortSignal): Promise<void>;
+    /** Clears this slot while preserving the worker-home/tmp identities attested by sibling turns. */
     wipe(): Promise<void>;
-    /** Replays the audited root provisioning: registrations, service.json, worker home, temp, spill, ledgers. */
+    /** Reuses the audited worker provisioning; shared broker files are untouched. */
     provision(): Promise<void>;
-    start(): Promise<void>;
     /** Worker-uid denial canaries over every deny path; throws when one is still reachable. */
     canaries(): Promise<{
         path: string;
@@ -57,7 +55,7 @@ export declare const startTrainingSlot: (runtime: TrainingSlotRuntime, nonce: st
     canaries: number;
 }>;
 export interface TrainingSlotSupervisorOptions {
-    runtime: TrainingSlotRuntime;
+    runtimes: readonly TrainingSlotRuntime[];
     /** Only this uid may recycle. Paideia, DSPy and the judges all run as it; every worker uid is refused. */
     organizationUid?: number;
     drainTimeoutMs?: number;
@@ -66,6 +64,7 @@ export interface TrainingSlotSupervisorOptions {
 export interface TrainingRecycleResult {
     ok: true;
     verb: "recycle";
+    slot: number;
     generation: number;
     nonce: string;
     receipt: string;
@@ -74,15 +73,15 @@ export interface TrainingRecycleResult {
 /**
  * The single-verb root slot supervisor.
  *
- * One verb, one argument, no path or command ever supplied by the caller: the
+ * One verb, slot and nonce, no path or command ever supplied by the caller: the
  * whole point of D4 is that recycling replays the container's own audited
  * provisioning rather than exposing a root file-system API to the evaluator.
- * Recycles are serialized — a second caller waits rather than interleaving a
+ * Recycles of the same slot are serialized — a second caller waits rather than interleaving a
  * wipe with a provision.
  */
 export declare const createTrainingSlotSupervisor: (options: TrainingSlotSupervisorOptions) => {
     /** Serialized: a recycle already in flight completes before the next one starts. */
-    recycle: (nonce: string, peerUid: number) => Promise<TrainingRecycleResult>;
+    recycle: (slot: number, nonce: string, peerUid: number) => Promise<TrainingRecycleResult>;
 };
 export type TrainingSlotSupervisor = ReturnType<typeof createTrainingSlotSupervisor>;
 /**