spawnfile 0.1.18 → 0.1.20

package/dist/compiler/training/preparation/broker.js

@@ -1,5 +1,8 @@
-import { lstat, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { lstat, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { daimonAgentSkillsFromResolved, parseDaimonAgentSkills } from "../../../runtime/daimon/grokWorkerSkills.js";
+import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_SECCOMP_PROFILE_SHA256 } from "../../../shared/daimonGrokSeccompProfile.js";
 import { assertNotDesktopGrokAuth } from "../broker/entrypoint.js";
 import { parseTrainingBrokerDeclaration } from "../broker/declaration.js";
@@ -15,7 +18,25 @@ import { DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity
  * `docker create` — a dry run, a failed build — must still refuse the
  * developer's desktop Grok login rather than report it later.
  */
-export const prepareTrainingBroker = async (broker, root, staging, write, slots = 4) => {
+/**
+ * The subject's declared skills, read from the context's pinned sources and
+ * refused if any byte changed since capture: exactly the `SKILL.md` files the
+ * compiler emits into its `.agents/skills`, in Daimon's engine-neutral form.
+ * `undefined` for none keeps a skill-less declaration byte-identical.
+ */
+export const trainingBrokerSkills = async (context) => {
+    if (context.skills.length === 0)
+        return undefined;
+    const skills = await Promise.all(context.skills.map(async (skill) => {
+        const bytes = await readFile(skill.sourcePath);
+        if (`sha256:${createHash("sha256").update(bytes).digest("hex")}` !== skill.sha256) {
+            throw new SpawnfileError("validation_error", `Training skill ${skill.name} changed since its context was captured`);
+        }
+        return { name: skill.name, content: bytes.toString("utf8") };
+    }));
+    return parseDaimonAgentSkills(daimonAgentSkillsFromResolved(skills));
+};
+export const prepareTrainingBroker = async (broker, root, staging, write, slots = 4, skills) => {
     const bootstrap = path.resolve(root, broker.bootstrap);
     assertNotDesktopGrokAuth(bootstrap);
     const info = await lstat(bootstrap).catch(() => undefined);
@@ -36,7 +57,8 @@ export const prepareTrainingBroker = async (broker, root, staging, write, slots
         bootstrap: TRAINING_BOOTSTRAP_MOUNT,
         organizationUid: DAIMON_ORGANIZATION_UID,
         seccompProfileSha256: DAIMON_GROK_SECCOMP_PROFILE_SHA256,
-        ...(broker.unenforcedBindPolicy === undefined ? {} : { unenforcedBindPolicy: broker.unenforcedBindPolicy })
+        ...(broker.unenforcedBindPolicy === undefined ? {} : { unenforcedBindPolicy: broker.unenforcedBindPolicy }),
+        ...(skills?.length ? { skills } : {})
     });
     const declarationPath = path.join(staging, "training-broker.json");
     if (write)

package/dist/compiler/training/preparation/prepare.js

@@ -8,7 +8,7 @@ import { assertInputRoot, exactPath, fileIdentity, hashJson, sealTree, within }
 import { planInputs, readBoundedJson, stageInput, verifyCanonicalPins } from "./inputs.js";
 import { planTrainingImage, buildTrainingImage } from "./image.js";
 import { planMeasurementRepair, stageMeasurementRepair, validateMeasurementRepairOutput, writeTrainingWitness } from "../repair/index.js";
-import { prepareTrainingBroker } from "./broker.js";
+import { prepareTrainingBroker, trainingBrokerSkills } from "./broker.js";
 import { claimTrainingPreparationScratch, removeTrainingPreparationScratch } from "./scratch.js";
 function mappedReceipt(digest, image, config) {
     return parseTrainingMappedPreparation({ version: "spawnfile.training-preparation.v1", preparationDigest: digest, imageId: image,
@@ -88,8 +88,9 @@ export async function prepareTraining(options) {
     const digest = hashJson({ config, sources: inputs.map(input => ({ id: input.id, digest: input.digest })), image: imagePlan?.digest ?? config.image,
         canonical: options.context.project.sourceDigest,
         ...(options.execution ? { execution: trainingExecutionIdentity(options.execution) } : {}), ...(repair ? { repair: { witness: repair.witness.digest, parent: repair.manifestDigest } } : {}) });
+    const brokerSkills = config.broker ? await trainingBrokerSkills(options.context) : undefined;
     if (config.broker)
-        await prepareTrainingBroker(config.broker, root, path.dirname(path.resolve(options.configPath)), false, config.slots);
+        await prepareTrainingBroker(config.broker, root, path.dirname(path.resolve(options.configPath)), false, config.slots, brokerSkills);
     if (options.dryRun)
         return { digest, dryRun: true };
     options.signal?.throwIfAborted();
@@ -152,7 +153,7 @@ export async function prepareTraining(options) {
                 image = inspected.stdout.trim();
             }
             const mapped = mappedReceipt(digest, image, config);
-            const preparedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, true, config.slots) : undefined;
+            const preparedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, true, config.slots, brokerSkills) : undefined;
             const launch = trainingContainerConfigSchema.parse({ version: launchVersion, slots: config.slots, dockerContext: config.dockerContext,
                 inputs: inputs.map((input, index) => ({ source: staged[index], destination: input.destination })), output: { source: output, destination: "/run/training/output" }, auth, ...evaluatorConfig,
                 ...(preparedBroker ? { broker: preparedBroker.launch } : {}) });
@@ -171,7 +172,7 @@ export async function prepareTraining(options) {
             throw error;
         }
     }
-    const expectedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, false, config.slots) : undefined;
+    const expectedBroker = config.broker ? await prepareTrainingBroker(config.broker, root, staging, false, config.slots, brokerSkills) : undefined;
     const expectedLaunch = trainingContainerConfigSchema.parse({ version: launchVersion, slots: config.slots, dockerContext: config.dockerContext,
         inputs: inputs.map((input, index) => ({ source: staged[index], destination: input.destination })), output: { source: output, destination: "/run/training/output" }, auth, ...evaluatorConfig,
         ...(expectedBroker ? { broker: expectedBroker.launch } : {}) });

package/dist/compiler/training/subjectDeclaration.d.ts

@@ -0,0 +1,25 @@
+/** The slice of a leased broker section the declaration must agree with. */
+export interface TrainingSubjectDeclaredBroker {
+    limits: {
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    };
+    workerConfigVariant: string;
+}
+/**
+ * Declaration-level policy a training subject must already satisfy in its
+ * resolved Spawnfile (inheritance included), checked before any compiler or
+ * subject runs.
+ *
+ * - Codex: the Daimon declaration states `codex_policy: workspace-no-network`
+ *   and carries neither a broker slot nor `turn_limits`.
+ * - Grok: the declaration states all three `turn_limits`, each equal to the
+ *   leased broker's registration limits, because a wake may only lower a
+ *   registered limit and a trial must not run on a silently different budget;
+ *   and the slot is the `clocked` worker variant, the only one that can hold a
+ *   moment's shell clock.
+ *
+ * Any other runtime or engine is refused. Returns the engine it checked.
+ */
+export declare const assertTrainingSubjectDeclaration: (projectRoot: string, agentId: string, broker?: TrainingSubjectDeclaredBroker) => Promise<"codex" | "grok">;

package/dist/compiler/training/subjectDeclaration.js

@@ -0,0 +1,52 @@
+import { SpawnfileError } from "../../shared/index.js";
+import { resolveDaimonEngine } from "../../runtime/daimon/config.js";
+import { resolveDaimonGrokTurnLimits } from "../../runtime/daimon/grokTurnLimits.js";
+import { loadTrainingProject } from "./plan/load.js";
+import { selectTrainingAgent } from "./selection.js";
+const refuse = (message) => { throw new SpawnfileError("validation_error", message); };
+const LIMITS = [["maxRequests", "max_requests"], ["maxTokens", "max_tokens"], ["timeoutMs", "timeout_ms"]];
+/**
+ * Declaration-level policy a training subject must already satisfy in its
+ * resolved Spawnfile (inheritance included), checked before any compiler or
+ * subject runs.
+ *
+ * - Codex: the Daimon declaration states `codex_policy: workspace-no-network`
+ *   and carries neither a broker slot nor `turn_limits`.
+ * - Grok: the declaration states all three `turn_limits`, each equal to the
+ *   leased broker's registration limits, because a wake may only lower a
+ *   registered limit and a trial must not run on a silently different budget;
+ *   and the slot is the `clocked` worker variant, the only one that can hold a
+ *   moment's shell clock.
+ *
+ * Any other runtime or engine is refused. Returns the engine it checked.
+ */
+export const assertTrainingSubjectDeclaration = async (projectRoot, agentId, broker) => {
+    const project = await loadTrainingProject(projectRoot);
+    const agents = project.compilePlan.nodes.filter((node) => node.value.kind === "agent");
+    const node = selectTrainingAgent(agents, agentId).value;
+    if (node.runtime.name !== "daimon")
+        return refuse(`Training subject ${agentId} must declare runtime daimon, not ${node.runtime.name}`);
+    const engine = resolveDaimonEngine(node);
+    const declared = resolveDaimonGrokTurnLimits(node.runtime.options.turn_limits);
+    if (engine === "codex") {
+        if (node.runtime.options.codex_policy !== "workspace-no-network") {
+            refuse(`Codex training subject ${agentId} requires explicit codex_policy: workspace-no-network on its Daimon declaration`);
+        }
+        if (broker !== undefined || declared !== undefined)
+            refuse(`Codex training subject ${agentId} takes no broker slot and no turn_limits`);
+        return engine;
+    }
+    if (engine !== "grok")
+        return refuse(`Training subject ${agentId} uses Daimon engine ${engine}; only codex and grok subjects train`);
+    if (!broker)
+        return refuse(`Grok training subject ${agentId} requires its leased broker slot`);
+    for (const [native, authored] of LIMITS) {
+        if (declared?.[native] !== broker.limits[native]) {
+            refuse(`Grok training subject ${agentId} turn_limits.${authored} (${String(declared?.[native] ?? "undeclared")}) differs from the broker limit ${broker.limits[native]}`);
+        }
+    }
+    if (broker.workerConfigVariant !== "clocked") {
+        refuse(`Grok training subject ${agentId} requires a broker slot provisioned and attested with workerConfigVariant: clocked`);
+    }
+    return engine;
+};

package/dist/compiler/training/subjectLease.d.ts

@@ -0,0 +1,114 @@
+import type { Socket } from "node:net";
+import { DAIMON_GROK_ENGINE_BROKER, type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../runtime/daimon/contractManifest.js";
+/** Paideia's slot freshness floor for this trial: the receipt must echo the nonce at no lower generation. */
+export interface TrainingSubjectFreshness {
+    expectedNonce: string;
+    minGeneration: number;
+}
+/** The evaluator-created per-trial directories (Paideia `TrialPaths`); only Codex subjects live in them. */
+export interface TrainingSubjectTrialRoots {
+    workspace: string;
+    runtimeHome: string;
+}
+export type TrainingSubjectEvaluatorRole = "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
+/** `paideia.daimon-native.launch.v2` `broker`, structurally `grokBrokerLaunchSchema` of Paideia 0.1.1. */
+export interface TrainingSubjectBrokerSection {
+    projectionVersion: typeof DAIMON_GROK_ENGINE_BROKER.projectionVersion;
+    workerConfigVariant: "unclocked" | "clocked";
+    projectionSha256: string;
+    slot: number;
+    workerUid: number;
+    workerHomePath: string;
+    architecture: "arm64" | "x64";
+    usageLedgerPath: string;
+    seccompProfileSha256: string;
+    profileSha256: string;
+    denyPaths: string[];
+    limits: {
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    };
+    evaluatorPaths: {
+        role: TrainingSubjectEvaluatorRole;
+        path: string;
+    }[];
+    slotPreflightReceipt: string;
+    expectedNonce: string;
+    minGeneration: number;
+}
+export type TrainingSubjectAgent = {
+    id: string;
+    engine: "codex";
+    model: string;
+} | {
+    id: string;
+    engine: "grok";
+    model: DaimonGrokBrokerModel;
+    reasoningEffort: DaimonGrokBrokerReasoningEffort;
+};
+export interface TrainingSubjectLease {
+    agent: TrainingSubjectAgent;
+    workspace: {
+        source: string;
+        target: string;
+    };
+    projections: {
+        role: "home" | "memory" | "transport";
+        source: string;
+        target: string;
+    }[];
+    credentials: {
+        source: string;
+        target: string;
+    }[];
+    broker?: TrainingSubjectBrokerSection;
+    /** Named slot roots: always `workspace`, `home` and `control`, plus engine-specific roots (Grok adds `context`). */
+    roots: Record<string, string> & {
+        workspace: string;
+        home: string;
+        control: string;
+    };
+    /** `control` is the worker control port; `moltnet` and `bridge` are provisioner-owned extras. */
+    ports: {
+        moltnet: number;
+        control: number;
+        bridge: number;
+    };
+    /** Recycled generation; Grok only. */
+    generation?: number;
+    /** Subject environment Spawnfile owns for this lease. */
+    env: Record<string, string>;
+}
+export interface LeaseTrainingSubjectOptions {
+    slot: number;
+    engine: string;
+    agentId: string;
+    /** The compiled Codex model; Grok's model comes from the broker declaration and, if given, must match it. */
+    model?: string;
+    /** Required for Grok, refused for Codex (which has no recycle). */
+    freshness?: TrainingSubjectFreshness;
+    /** Required for Codex; a Grok subject lives at the container's fixed slot roots. */
+    trialRoots?: TrainingSubjectTrialRoots;
+    signal: AbortSignal;
+    /** Resolves Daimon's public `@noopolis/daimon/runtime` export. */
+    loadDaimon?: () => Promise<unknown>;
+    /** Test seams: the supervisor connection and the declaration file. */
+    connect?: () => Socket;
+    declarationFile?: string;
+    slotsFile?: string;
+}
+/** The fixed read-only container leaf the training launch binds the Codex login to. */
+export declare const TRAINING_CODEX_CREDENTIAL_INGRESS = "/run/paideia-auth/codex";
+/**
+ * Lease one training slot for an engine-neutral subject and return everything
+ * `paideia.daimon-native.launch.v2` must carry about it.
+ *
+ * Spawnfile owns the container, its slots, the broker declaration and
+ * registration, the projection inputs, the recycle verb and the credential
+ * ingress paths, so an integration names an engine and an agent and never a
+ * container path. Grok recycles the slot with the evaluator's nonce and binds
+ * the supervisor's receipt; Codex derives its per-trial projections from the
+ * evaluator's own trial roots. Any other engine is refused.
+ */
+export declare const leaseTrainingSubject: (options: LeaseTrainingSubjectOptions) => Promise<TrainingSubjectLease>;

package/dist/compiler/training/subjectLease.js

@@ -0,0 +1,175 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { SpawnfileError } from "../../shared/index.js";
+import { DAIMON_ENGINE_CREDENTIALS, DAIMON_GROK_ENGINE_BROKER } from "../../runtime/daimon/contractManifest.js";
+import { parseTrainingBrokerDeclaration } from "./broker/declaration.js";
+import { TRAINING_BROKER_DECLARATION_FILE, TRAINING_PAIDEIA_ROOT, TRAINING_SLOTS_FILE, trainingSlotDescriptors } from "./broker/paths.js";
+import { loadDaimonProjectionModule, resolveTrainingSlotProjection } from "./broker/projection.js";
+import { recycleTrainingSlot } from "./broker/recycleClient.js";
+/** The fixed read-only container leaf the training launch binds the Codex login to. */
+export const TRAINING_CODEX_CREDENTIAL_INGRESS = "/run/paideia-auth/codex";
+const NONCE = /^[a-f0-9]{64}$/u;
+const invalid = (message) => { throw new SpawnfileError("validation_error", message); };
+const refused = (message) => { throw new SpawnfileError("runtime_error", message); };
+const canonical = (label, value) => {
+    if (typeof value !== "string" || !path.posix.isAbsolute(value) || path.posix.normalize(value) !== value
+        || value.length < 2 || value.endsWith("/") || value.includes(","))
+        invalid(`Training subject ${label} must be a canonical absolute path`);
+    return value;
+};
+/**
+ * Lease one training slot for an engine-neutral subject and return everything
+ * `paideia.daimon-native.launch.v2` must carry about it.
+ *
+ * Spawnfile owns the container, its slots, the broker declaration and
+ * registration, the projection inputs, the recycle verb and the credential
+ * ingress paths, so an integration names an engine and an agent and never a
+ * container path. Grok recycles the slot with the evaluator's nonce and binds
+ * the supervisor's receipt; Codex derives its per-trial projections from the
+ * evaluator's own trial roots. Any other engine is refused.
+ */
+export const leaseTrainingSubject = async (options) => {
+    options.signal.throwIfAborted();
+    if (!Number.isInteger(options.slot) || options.slot < 0)
+        invalid("Training subject lease requires a slot index");
+    if (options.engine === "grok")
+        return leaseGrokSubject(options);
+    if (options.engine === "codex")
+        return leaseCodexSubject(options);
+    return invalid(`Training subject engine ${String(options.engine)} is not supported; lease a codex or grok subject`);
+};
+const leaseGrokSubject = async (options) => {
+    const freshness = options.freshness;
+    if (!freshness || !NONCE.test(freshness.expectedNonce) || !Number.isSafeInteger(freshness.minGeneration) || freshness.minGeneration < 1) {
+        return invalid("A Grok training subject requires freshness with a 32-byte hex nonce and a generation floor of at least 1");
+    }
+    const declaration = parseTrainingBrokerDeclaration(JSON.parse(await readFile(options.declarationFile ?? TRAINING_BROKER_DECLARATION_FILE, "utf8")));
+    if (declaration.agentId !== options.agentId)
+        invalid(`The training broker declares ${declaration.agentId}, not ${options.agentId}`);
+    if (options.model !== undefined && options.model !== declaration.model)
+        invalid(`The training broker declares model ${declaration.model}, not ${options.model}`);
+    if (options.slot >= declaration.slots)
+        invalid(`Training slot ${options.slot} is outside the declared pool of ${declaration.slots}`);
+    const descriptor = trainingSlotDescriptors(declaration.slots)[options.slot];
+    // Resolved before the recycle: a Daimon whose contract drifted must refuse without wiping the slot.
+    const daimon = await loadDaimonProjectionModule(options.loadDaimon);
+    const { registration, projection, projectionSha256 } = await resolveTrainingSlotProjection(declaration, options.slot, daimon);
+    options.signal.throwIfAborted();
+    const result = await recycleTrainingSlot({ slot: options.slot, nonce: freshness.expectedNonce, signal: options.signal,
+        ...(options.connect ? { connect: options.connect } : {}) });
+    if (result.receipt !== descriptor.preflightReceipt)
+        refused("The slot supervisor published its receipt outside the leased slot root");
+    if (result.generation < freshness.minGeneration)
+        refused("The slot supervisor published a generation below the evaluator freshness floor");
+    options.signal.throwIfAborted();
+    const roots = {
+        workspace: descriptor.workspace, home: descriptor.runtimeHome, control: descriptor.state, workerHome: descriptor.workerHome,
+        usageLedger: descriptor.usageLedger, preflightReceipt: descriptor.preflightReceipt, context: TRAINING_PAIDEIA_ROOT
+    };
+    return {
+        agent: { id: declaration.agentId, engine: "grok", model: declaration.model, reasoningEffort: declaration.reasoningEffort },
+        workspace: { source: descriptor.workspace, target: descriptor.workspace },
+        // The projection digest binds exactly the slot workspace and runtime home; nothing else may be writable.
+        projections: [{ role: "home", source: descriptor.runtimeHome, target: descriptor.runtimeHome }],
+        credentials: [],
+        broker: {
+            projectionVersion: DAIMON_GROK_ENGINE_BROKER.projectionVersion,
+            workerConfigVariant: projection.workerConfigVariant,
+            projectionSha256,
+            slot: options.slot,
+            workerUid: descriptor.workerUid,
+            workerHomePath: descriptor.workerHome,
+            architecture: declaration.architecture,
+            usageLedgerPath: descriptor.usageLedger,
+            seccompProfileSha256: declaration.seccompProfileSha256,
+            // Verbatim provisioner values the digest binds: a deny list re-derived from evaluatorPaths would fork it.
+            profileSha256: registration.profileSha256,
+            denyPaths: [...registration.denyPaths],
+            limits: { ...declaration.limits },
+            evaluatorPaths: descriptor.evaluatorPaths.map((row) => ({ role: row.role, path: row.path })),
+            slotPreflightReceipt: descriptor.preflightReceipt,
+            expectedNonce: freshness.expectedNonce,
+            minGeneration: freshness.minGeneration
+        },
+        roots,
+        ports: { moltnet: descriptor.ports.moltnet, control: descriptor.ports.workerControl, bridge: descriptor.ports.bridge },
+        generation: result.generation,
+        env: { [DAIMON_GROK_ENGINE_BROKER.slotRouting.slotEnvironment]: String(options.slot) }
+    };
+};
+/** Indirect specifier: Daimon is an in-image runtime peer, never a Spawnfile source dependency. */
+const loadDaimonRuntime = async () => {
+    const packageName = "@noopolis/daimon/runtime";
+    return import(packageName);
+};
+/** The Codex credential leaf Daimon reads, from its public export, refused unless it equals the vendored manifest. */
+const codexCredentialRelativePath = async (load = loadDaimonRuntime) => {
+    let daimon;
+    try {
+        daimon = await load();
+    }
+    catch {
+        return refused("The training image must install @noopolis/daimon with its public /runtime export");
+    }
+    const relative = daimon?.ENGINE_CREDENTIAL_MATERIAL?.codex?.sourceRelativePath;
+    if (relative !== DAIMON_ENGINE_CREDENTIALS.codex.sourceRelativePath) {
+        return refused("The installed Daimon Codex credential material differs from this compiler's vendored manifest");
+    }
+    return relative;
+};
+/** Ports from the leased slot's own `slots.json` block (offsets 0=Moltnet, 1=worker control, 2=bridge), refused outside it. */
+const leasedSlotPorts = async (slot, file) => {
+    let entry;
+    try {
+        const document = JSON.parse(await readFile(file, "utf8"));
+        entry = Array.isArray(document.slots) ? document.slots.find((row) => row?.index === slot) : undefined;
+    }
+    catch {
+        return refused("The training slots manifest is missing or unreadable");
+    }
+    const base = entry?.ports?.base, count = entry?.ports?.count;
+    if (!Number.isSafeInteger(base) || !Number.isSafeInteger(count) || base < 1 || count < 3) {
+        return refused(`Training slot ${slot} has no usable port block in the slots manifest`);
+    }
+    const first = base;
+    const offsets = { moltnet: first, control: first + 1, bridge: first + 2 };
+    if (Object.values(offsets).some((port) => port >= first + count || port > 65_535)) {
+        return refused(`Training slot ${slot} ports fall outside its leased block`);
+    }
+    return offsets;
+};
+const leaseCodexSubject = async (options) => {
+    if (options.freshness !== undefined)
+        invalid("A Codex training subject has no slot recycle; freshness does not apply");
+    if (typeof options.model !== "string" || !options.model.trim())
+        invalid("A Codex training subject requires its compiled model");
+    if (!options.trialRoots)
+        return invalid("A Codex training subject requires the evaluator's trial roots");
+    const workspace = canonical("workspace", options.trialRoots.workspace);
+    const runtimeHome = canonical("runtime home", options.trialRoots.runtimeHome);
+    const ports = await leasedSlotPorts(options.slot, options.slotsFile ?? TRAINING_SLOTS_FILE);
+    const relative = await codexCredentialRelativePath(options.loadDaimon);
+    options.signal.throwIfAborted();
+    // Codex's writable data sits beside the workspace, disjoint from the evaluator runtime and its controls.
+    const parent = path.posix.dirname(workspace);
+    const home = path.posix.join(parent, "home"), memory = path.posix.join(parent, "memory");
+    const transport = path.posix.join(runtimeHome, "native/moltnet");
+    const roots = { workspace, home, memory, transport, control: path.posix.join(runtimeHome, "native/root-control/acceptance"),
+        inputs: path.posix.join(runtimeHome, "native/root-control/inputs") };
+    const values = Object.values(roots);
+    if (new Set(values).size !== values.length || values.some((value) => value !== workspace && value.startsWith(`${workspace}/`))) {
+        invalid("Codex trial roots must not overlap the subject workspace");
+    }
+    return {
+        agent: { id: options.agentId, engine: "codex", model: options.model },
+        workspace: { source: workspace, target: workspace },
+        projections: [{ role: "home", source: home, target: home }, { role: "memory", source: memory, target: memory },
+            { role: "transport", source: transport, target: transport }],
+        // The read-only container leaf is the sole ingress; the child stages it into exactly this target
+        // (`stageTrainingAuth` from `spawnfile/auth`), never overwriting a renewed credential.
+        credentials: [{ source: TRAINING_CODEX_CREDENTIAL_INGRESS, target: path.posix.join(home, relative) }],
+        roots,
+        ports,
+        env: {}
+    };
+};

package/dist/runtime/daimon/adapter.d.ts

@@ -1,14 +1,12 @@
 import type { ResolvedAgentNode } from "../../compiler/types.js";
 import type { RuntimeAdapter } from "../types.js";
 /**
- * Workspace skill roots per Daimon engine.
- *
- * Codex and AGY keep both CLI-engine roots. A brokered Grok worker loads no
- * workspace skill at all: Grok 1.0.34 discovers `.agents/skills` (never
- * `.codex/skills`) only in a trusted folder, and Daimon keeps the workspace
- * untrusted (root-owned empty `trusted_folders.toml`) and replaces the system
- * prompt, whose fixed text references no skill. Emitting either root would ship
- * files nothing reads, so none are emitted and the declaration is reported.
+ * Workspace skill roots per Daimon engine: every engine gets both CLI-engine
+ * roots. Codex and AGY read them in place. A brokered Grok worker cannot (its
+ * workspace stays untrusted), so root provisioning renders the same
+ * `.agents/skills` tree into the worker's `$GROK_HOME/skills`, which Grok loads
+ * as user-scoped skills, and the broker attests it against `skillsSha256`
+ * before every turn (`containerDaimonGrokWorkerProvisioning.ts`).
  */
-export declare const daimonSkillBaseDirectories: (node: ResolvedAgentNode) => readonly string[];
+export declare const daimonSkillBaseDirectories: (_node: ResolvedAgentNode) => readonly string[];
 export declare const daimonAdapter: RuntimeAdapter;

package/dist/runtime/daimon/adapter.js

@@ -1,6 +1,7 @@
 import { SpawnfileError } from "../../shared/index.js";
 import { CLI_ENGINE_SKILL_BASE_DIRECTORIES, createAgentCapabilities, createDiagnostic, createDocumentFiles, createSkillFiles } from "../common.js";
 import { parseEveryScheduleMs } from "../scheduleUtils.js";
+import { daimonGrokSkillsError } from "./grokSkillsSupport.js";
 import { assertDaimonAgentOptions, assertDaimonInstructionBounds, createDaimonContainerTargets, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, DAIMON_CONFIG_FILE, DAIMON_CONTROL_PORT, DAIMON_ENGINES, resolveDaimonEngine } from "./config.js";
 import { resolveDaimonGrokModel } from "./grokModel.js";
 import { prepareDaimonRuntimeAuth } from "./runAuth.js";
@@ -58,23 +59,14 @@ const daimonWorkspaceRestrictionWarning = (node) => {
         + "the container boundary as this agent's only isolation.";
 };
 /**
- * Workspace skill roots per Daimon engine.
- *
- * Codex and AGY keep both CLI-engine roots. A brokered Grok worker loads no
- * workspace skill at all: Grok 1.0.34 discovers `.agents/skills` (never
- * `.codex/skills`) only in a trusted folder, and Daimon keeps the workspace
- * untrusted (root-owned empty `trusted_folders.toml`) and replaces the system
- * prompt, whose fixed text references no skill. Emitting either root would ship
- * files nothing reads, so none are emitted and the declaration is reported.
+ * Workspace skill roots per Daimon engine: every engine gets both CLI-engine
+ * roots. Codex and AGY read them in place. A brokered Grok worker cannot (its
+ * workspace stays untrusted), so root provisioning renders the same
+ * `.agents/skills` tree into the worker's `$GROK_HOME/skills`, which Grok loads
+ * as user-scoped skills, and the broker attests it against `skillsSha256`
+ * before every turn (`containerDaimonGrokWorkerProvisioning.ts`).
  */
-export const daimonSkillBaseDirectories = (node) => resolveDaimonEngine(node) === "grok" ? [] : CLI_ENGINE_SKILL_BASE_DIRECTORIES;
-const daimonGrokSkillWarning = (node) => {
-    if (resolveDaimonEngine(node) !== "grok" || node.skills.length === 0)
-        return undefined;
-    return `Daimon Grok agent ${node.name} declares workspace skills (${node.skills.map((skill) => skill.name).sort().join(", ")}) `
-        + "that its brokered worker never loads: Grok discovers project skills only in a trusted workspace, and Daimon keeps the "
-        + "workspace untrusted and supplies instructions through the prompt. No skill files are emitted; move the guidance into the agent's docs.";
-};
+export const daimonSkillBaseDirectories = (_node) => CLI_ENGINE_SKILL_BASE_DIRECTORIES;
 const daimonCodexPolicyError = (node) => {
     if (node.runtime.options.codex_policy === undefined)
         return undefined;
@@ -185,7 +177,7 @@ export const daimonAdapter = {
         const memoryVectorWarning = daimonMemoryVectorRecallWarning(node);
         const workspaceRestrictionWarning = daimonWorkspaceRestrictionWarning(node);
         const codexPolicyError = daimonCodexPolicyError(node);
-        const grokSkillWarning = daimonGrokSkillWarning(node);
+        const grokSkillsError = daimonGrokSkillsError(node, resolveDaimonEngine(node));
         return {
             capabilities: createAgentCapabilities(node, {
                 mcpOutcome: "supported",
@@ -202,8 +194,8 @@ export const daimonAdapter = {
                 ...(memorySelectionWarning ? [createDiagnostic("warn", memorySelectionWarning)] : []),
                 ...(memoryVectorWarning ? [createDiagnostic("warn", memoryVectorWarning)] : []),
                 ...(workspaceRestrictionWarning ? [createDiagnostic("warn", workspaceRestrictionWarning)] : []),
-                ...(grokSkillWarning ? [createDiagnostic("warn", grokSkillWarning)] : []),
-                ...(codexPolicyError ? [createDiagnostic("error", codexPolicyError)] : [])
+                ...(codexPolicyError ? [createDiagnostic("error", codexPolicyError)] : []),
+                ...(grokSkillsError ? [createDiagnostic("error", grokSkillsError)] : [])
             ],
             files: [
                 ...createDocumentFiles("workspace", node.docs),
@@ -218,6 +210,9 @@ export const daimonAdapter = {
         const codexPolicyError = daimonCodexPolicyError(node);
         if (codexPolicyError)
             throw new SpawnfileError("validation_error", codexPolicyError);
+        const grokSkillsError = daimonGrokSkillsError(node, resolveDaimonEngine(node));
+        if (grokSkillsError)
+            throw new SpawnfileError("validation_error", grokSkillsError);
         assertDaimonAgentOptions(nodeId, node);
         assertDaimonInstructionBounds(nodeId, node);
     },

package/dist/runtime/daimon/config.js

@@ -1,5 +1,7 @@
 import path from "node:path";
 import { CLI_ENGINE_SKILL_BASE_DIRECTORIES } from "../common.js";
+import { daimonGrokSkillsError } from "./grokSkillsSupport.js";
+import { daimonAgentSkillsFromResolved } from "./grokWorkerSkills.js";
 import { parseEveryScheduleMs } from "../scheduleUtils.js";
 import { SpawnfileError } from "../../shared/index.js";
 import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_ENGINE_CREDENTIALS, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "./contractManifest.js";
@@ -208,6 +210,15 @@ export const createDaimonContainerTargets = async (inputs) => {
     const grokModelByNodeId = Object.fromEntries(configAgents
         .filter((agent) => agent.engine.kind === "grok" && agent.engine.model !== undefined && agent.engine.reasoningEffort !== undefined)
         .map((agent) => [agent.id, { model: agent.engine.model, reasoningEffort: agent.engine.reasoningEffort }]));
+    // The compiled `.agents/skills` tree, in Daimon's engine-neutral form: root provisioning renders it into the worker's `$GROK_HOME/skills`.
+    for (const input of agents) {
+        const refused = daimonGrokSkillsError(input.value, engineByNodeId[input.id]);
+        if (refused)
+            throw new SpawnfileError("validation_error", refused);
+    }
+    const grokSkillsByNodeId = Object.fromEntries(agents
+        .filter((input) => engineByNodeId[input.id] === "grok" && input.value.skills.length > 0)
+        .map((input) => [input.id, daimonAgentSkillsFromResolved(input.value.skills)]));
     const hasAgy = configAgents.some((agent) => agent.engine.kind === "agy");
     const hasGrok = configAgents.some((agent) => agent.engine.kind === "grok");
     const agyRuntimeHomeMounts = configAgents
@@ -250,11 +261,12 @@ export const createDaimonContainerTargets = async (inputs) => {
     return [{
             agentPathsByNodeId: Object.fromEntries(configAgents.map((agent) => [agent.id, {
                     workspacePath: agent.workspacePath, homePath: agent.runtimeHomePath,
-                    skillRoots: agent.engine.kind === "grok" ? [] : CLI_ENGINE_SKILL_BASE_DIRECTORIES.map((root) => path.posix.join(agent.workspacePath, path.posix.relative("workspace", root)))
+                    skillRoots: CLI_ENGINE_SKILL_BASE_DIRECTORIES.map((root) => path.posix.join(agent.workspacePath, path.posix.relative("workspace", root)))
                 }])),
             engineByNodeId,
             ...(hasGrok ? { grokModelByNodeId } : {}),
             ...(hasGrok && Object.keys(grokTurnLimitsByNodeId).length > 0 ? { grokTurnLimitsByNodeId } : {}),
+            ...(Object.keys(grokSkillsByNodeId).length > 0 ? { grokSkillsByNodeId } : {}),
             files: [
                 ...agents.flatMap((input) => input.emittedFiles.map((file) => moveWorkspaceFile(file, input.slug))),
                 { content: serializedConfig, path: DAIMON_CONFIG_FILE },

package/dist/runtime/daimon/grokSkillsSupport.d.ts

@@ -0,0 +1,20 @@
+import type { ResolvedAgentNode } from "../../compiler/types.js";
+/** The first Daimon whose broker accepts `skillsSha256` and renders `$GROK_HOME/skills` (noopolis/daimon-harness#55). */
+export declare const DAIMON_GROK_SKILLS_MIN_VERSION = "0.2.2";
+/**
+ * The Daimon package version of the runtime image `runtimes.yaml` pins, from
+ * its never-moved `<package version>-<short commit>` tag. Read synchronously
+ * because `preflightAgent` (`spawnfile validate`) is synchronous.
+ */
+export declare const pinnedDaimonRuntimeVersion: (source?: string) => string;
+/**
+ * Why a brokered Grok agent's declared skills cannot compile, or `undefined`.
+ *
+ * Two causes, both refused before anything is emitted: a skill Daimon's own
+ * parser would refuse (a name outside its component rule, a missing
+ * `SKILL.md`, a size past `AGENT_SKILLS_BOUNDS`), and a pinned runtime image
+ * older than 0.2.2, whose strict service parser rejects the `skillsSha256`
+ * key — so the broker, and every Grok agent of the organization, would fail
+ * to start.
+ */
+export declare const daimonGrokSkillsError: (node: ResolvedAgentNode, engine: string, version?: () => string) => string | undefined;