spawnfile 0.1.19 → 0.1.20

package/dist/compiler/containerArtifactsPlans.js

@@ -103,6 +103,7 @@ export const createRuntimeTargetPlans = async (plan, compiledNodes, worldBinding
                 ...(target.engineByNodeId ? { engineByNodeId: target.engineByNodeId } : {}),
                 ...(target.grokModelByNodeId ? { grokModelByNodeId: target.grokModelByNodeId } : {}),
                 ...(target.grokTurnLimitsByNodeId ? { grokTurnLimitsByNodeId: target.grokTurnLimitsByNodeId } : {}),
+                ...(target.grokSkillsByNodeId ? { grokSkillsByNodeId: target.grokSkillsByNodeId } : {}),
                 envFiles: resolveTargetEnvFiles(instancePaths.configPath, target),
                 packages: resolveTargetPackages(target, targetInputs),
                 id: target.id,

package/dist/compiler/containerArtifactsTypes.d.ts

@@ -30,6 +30,14 @@ export interface RuntimeTargetPlan {
         maxTokens?: number;
         timeoutMs?: number;
     }>;
+    /** Passthrough of `ContainerTarget.grokSkillsByNodeId` for the Daimon broker worker render. */
+    grokSkillsByNodeId?: Record<string, {
+        name: string;
+        files: {
+            path: string;
+            content: string;
+        }[];
+    }[]>;
     packages?: ResolvedPackage[];
     envFiles: Array<{
         envName: string;

package/dist/compiler/containerDaimonGrokWorkerProvisioning.js

@@ -24,8 +24,27 @@ const programRegistration = (entry) => ({
     spillDirectory: entry.spillDirectory,
     slot: entry.slot,
     uid: entry.uid,
-    workspace: entry.workspace
+    workspace: entry.workspace,
+    // By digest only: the tree itself is embedded once per program (`grokWorkerSkillTrees`), never per slot.
+    ...(entry.skills ? { skillsSha256: entry.skills.sha256 } : {})
 });
+/**
+ * `$GROK_HOME/skills`, exactly Daimon's `renderGrokWorkerSkillsTree` entries
+ * (`../runtime/daimon/grokWorkerSkills.ts`): rendered only when some worker
+ * declares skills, so a skill-less program is byte-identical to before. It runs
+ * while `$GROK_HOME` is still `root:root 0700` (pass 1), first removing any
+ * previous tree (a restart, or a worker-planted entry) after reclaiming each
+ * directory, because root holds neither `CAP_FOWNER` nor `CAP_DAC_OVERRIDE`.
+ * Files are created `wx` (single link) and moded `root:root 0444`; directories
+ * are created `0700` and only moded `root:root 0555` once every child exists.
+ * No other user skill root (`GROK_WORKER_FOREIGN_SKILL_ROOTS`) is created.
+ */
+const renderDaimonGrokWorkerSkillsProvisioning = (registrations) => registrations.some((entry) => entry.skills) ? [
+    `const grokWorkerSkillTrees = ${JSON.stringify(Object.fromEntries(registrations.flatMap((entry) => entry.skills ? [[entry.skills.sha256, entry.skills.tree]] : [])))};`,
+    "const removeSkillsTree = (target) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code === 'ENOENT') return; throw error; } if (info.isDirectory() && !info.isSymbolicLink()) { fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o700); for (const name of fs.readdirSync(target)) removeSkillsTree(`${target}/${name}`); fs.rmdirSync(target); } else fs.unlinkSync(target); };",
+    "const provisionSkills = (entry) => { removeSkillsTree(`${entry.grokHome}/skills`); const tree = grokWorkerSkillTrees[entry.skillsSha256]; if (!Array.isArray(tree) || tree.length === 0) throw new Error(`Grok worker skills ${entry.skillsSha256} are not embedded`); const directories = []; for (const item of tree) { const target = `${entry.grokHome}/${item.path}`; if ((item.path !== 'skills' && !item.path.startsWith('skills/')) || item.path.split('/').some((part) => part === '' || part === '.' || part === '..') || item.uid !== 0 || item.gid !== 0) throw new Error(`unsafe Grok worker skill entry: ${item.path}`); if (item.kind === 'directory') { fs.mkdirSync(target, { mode: 0o700 }); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o700); directories.push([target, item.mode]); continue; } fs.writeFileSync(target, item.content, { mode: 0o600, flag: 'wx' }); const info = fs.lstatSync(target); if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) throw new Error(`unsafe Grok worker skill file: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, item.mode); } for (const [target, mode] of directories.reverse()) { fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); } };",
+    "for (const entry of grokWorkers) if (entry.skillsSha256) provisionSkills(entry);"
+] : [];
 /**
  * Root provisioning for every brokered Grok worker, as lines of the broker's
  * node provisioning program (which already defines `crypto`, `fs`, and
@@ -79,6 +98,7 @@ optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_S
     `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ${scope === "container" ? "ensureDirectory(entry.home, 0, 0, 0o700);" : ""} ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
     "for (const denied of optionalDenyPaths) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.mkdirSync(denied, { mode: 0o700 }); fs.chownSync(denied, 0, 0); fs.chmodSync(denied, 0o700); } }",
     "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { try { assertCanonical(denied, 'deny path'); } catch (error) { if (error.code === 'ENOENT' && entry.deferredDenyPaths.includes(denied)) continue; if (error.code === 'ENOENT') throw new Error(`Grok worker deny path is missing: ${denied}`); throw error; } }",
+    ...renderDaimonGrokWorkerSkillsProvisioning(registrations),
     // Pass 2: exact root-owned read-only files, the events file, then the final sticky modes.
     `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ${scope === "container" ? `ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710);` : ""} for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
     // Worker-private temp: the launcher compiles TMPDIR=<home>/tmp, the only temp the worker may write. It is

package/dist/compiler/containerDaimonGrokWorkerRender.d.ts

@@ -1,4 +1,5 @@
 import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../runtime/daimon/contractManifest.js";
+import { type DaimonGrokWorkerSkills } from "../runtime/daimon/grokWorkerSkills.js";
 import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
 export declare const DAIMON_WORKER_ROOT = "/var/lib/daimon-workers";
 export declare const DAIMON_GROK_WORKER_READ_ONLY_FILES: readonly ["config.toml", "managed_config.toml", "requirements.toml", "sandbox.toml", "trusted_folders.toml"];
@@ -77,6 +78,12 @@ export interface DaimonGrokRegistration {
     runtimeHome: string;
     /** Persistent mounts inside this agent's runtime home; Spawnfile keeps each `0700` under the traversable home. */
     runtimeHomeMounts: string[];
+    /**
+     * The agent's declared skills as Daimon renders them into `$GROK_HOME/skills`,
+     * with their digest; absent when it declares none, which keeps the
+     * registration, `service.json` and provisioning byte-identical.
+     */
+    skills?: DaimonGrokWorkerSkills;
     /** `<runtimeHome>/tool-output`: setgid spill directory in the worker's group. */
     spillDirectory: string;
     slot: number;
@@ -149,6 +156,7 @@ export interface DaimonGrokServiceConfigOptions {
 /** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
 export declare const renderDaimonGrokServiceConfig: (registrations: readonly DaimonGrokRegistration[], options?: DaimonGrokServiceConfigOptions) => {
     slotPolicies?: {
+        skillsSha256?: string | undefined;
         slot: number;
         usageLedgerPath: string;
         limits: {
@@ -166,6 +174,7 @@ export declare const renderDaimonGrokServiceConfig: (registrations: readonly Dai
         };
     }[] | undefined;
     registrations: {
+        skillsSha256?: string | undefined;
         usageLedgerPath?: string | undefined;
         limits?: {
             maxRequests: 32;

package/dist/compiler/containerDaimonGrokWorkerRender.js

@@ -4,6 +4,7 @@ import { resolveDaimonGrokRegistrationLimits } from "../runtime/daimon/grokTurnL
 import { DAIMON_ORGANIZATION_TARGET_ID, DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY, DAIMON_RUNTIME_HOMES_DIRECTORY, DAIMON_WAKE_FUSE_DIRECTORY } from "../runtime/daimon/config.js";
 import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER, DAIMON_RUNTIME_HOME_ROOT } from "../runtime/daimon/contractManifest.js";
 import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
+import { resolveDaimonGrokWorkerSkills } from "../runtime/daimon/grokWorkerSkills.js";
 import { DAIMON_FIRST_WORKER_UID } from "../runtime/daimon/runtimeIdentity.js";
 export const DAIMON_WORKER_ROOT = "/var/lib/daimon-workers";
 export const DAIMON_GROK_WORKER_READ_ONLY_FILES = DAIMON_GROK_ENGINE_BROKER.worker.home.readOnlyFiles.names;
@@ -205,7 +206,9 @@ export const resolveDaimonGrokRegistrations = (plans) => {
         if (path.posix.dirname(path.posix.dirname(path.posix.join(grokHome, "sandbox.toml"))) !== home)
             fail(`Grok worker ${agentId} profile is not under its registered home`);
         const backings = new Set(plans.flatMap((candidate) => candidate.resources ?? []).map((resource) => resource.backingPath));
+        const skills = resolveDaimonGrokWorkerSkills(plan.grokSkillsByNodeId?.[agentId]);
         return {
+            ...(skills ? { skills } : {}),
             deferredDenyPaths: denyPaths.filter((entry) => backings.has(entry)),
             limits,
             agentId,
@@ -271,11 +274,13 @@ export const renderDaimonGrokServiceConfig = (registrations, options = {}) => ({
         profileSha256: entry.profileSha256,
         ...(options.version === "v3" ? {} : { usageLedgerPath: entry.usageLedgerPath,
             limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
-            model: { id: entry.model, reasoningEffort: entry.reasoningEffort } })
+            model: { id: entry.model, reasoningEffort: entry.reasoningEffort },
+            ...(entry.skills ? { skillsSha256: entry.skills.sha256 } : {}) })
     })),
     ...(options.version === "v3" ? { slotPolicies: registrations.map(entry => ({
             slot: entry.slot, usageLedgerPath: entry.usageLedgerPath,
             limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
-            model: { id: entry.model, reasoningEffort: entry.reasoningEffort }
+            model: { id: entry.model, reasoningEffort: entry.reasoningEffort },
+            ...(entry.skills ? { skillsSha256: entry.skills.sha256 } : {})
         })) } : {})
 });

package/dist/compiler/training/broker/declaration.d.ts

@@ -42,6 +42,13 @@ export declare const trainingBrokerDeclarationSchema: z.ZodObject<{
         refuse: "refuse";
         "profile-only": "profile-only";
     }>>;
+    skills: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        files: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            content: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type TrainingBrokerDeclaration = z.infer<typeof trainingBrokerDeclarationSchema>;
 export declare const parseTrainingBrokerDeclaration: (value: unknown) => TrainingBrokerDeclaration;

package/dist/compiler/training/broker/declaration.js

@@ -52,6 +52,18 @@ export const trainingBrokerDeclarationSchema = z.strictObject({
      * datasets are held by DAC on their ancestor under both values, and a slot
      * that cannot prove that denial is refused whatever this says.
      */
-    unenforcedBindPolicy: z.enum(["refuse", "profile-only"]).default("refuse")
+    unenforcedBindPolicy: z.enum(["refuse", "profile-only"]).default("refuse"),
+    /**
+     * The subject's declared skills in Daimon's engine-neutral form (the
+     * compiled `.agents/skills` tree), omitted when it declares none. Root
+     * provisioning renders them into every slot's `$GROK_HOME/skills`, and the
+     * entrypoint, supervisor and lease all resolve the projection from this one
+     * read-only input, so they bind the same `skillsSha256`. Daimon's own parser
+     * (mirrored in `runtime/daimon/grokWorkerSkills.ts`) enforces the bounds.
+     */
+    skills: z.array(z.strictObject({
+        name: z.string().min(1).max(128),
+        files: z.array(z.strictObject({ path: z.string().min(1).max(1_024), content: z.string() })).min(1).max(64)
+    })).min(1).max(64).optional()
 }).strict();
 export const parseTrainingBrokerDeclaration = (value) => trainingBrokerDeclarationSchema.parse(value);

package/dist/compiler/training/broker/entrypoint.js

@@ -1,9 +1,9 @@
-import { execFile, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import os from "node:os";
-import { promisify } from "node:util";
 import { renderTrainingBrokerProvisioning } from "./provisioning.js";
+import { runTrainingRootScript } from "./rootScript.js";
 import { stageTrainingEvaluatorSecret } from "./evaluatorSecrets.js";
 import { startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
 import { resetTrainingBrokerSlotAsOrganization } from "./reset.js";
@@ -11,8 +11,7 @@ import path from "node:path";
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { parseTrainingBrokerDeclaration } from "./declaration.js";
-import { loadDaimonProjectionModule, resolveTrainingGrokProjection } from "./projection.js";
-import { resolveTrainingGrokRegistration } from "./registration.js";
+import { loadDaimonProjectionModule, resolveTrainingSlotProjection } from "./projection.js";
 import { createTrainingSlotRuntime } from "./runtime.js";
 import { createTrainingSlotSupervisor, serveTrainingSlotSupervisor, startTrainingSlot } from "./supervisor.js";
 import { trainingSlotDescriptors, assertTrainingSlotsDocument, TRAINING_SLOTS_FILE, DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
@@ -65,15 +64,13 @@ export const runTrainingBrokerEntrypoint = async (options) => {
     const descriptors = trainingSlotDescriptors(declaration.slots);
     const document = JSON.parse(await readFile(TRAINING_SLOTS_FILE, "utf8"));
     assertTrainingSlotsDocument(document, declaration.slots);
-    const registrations = descriptors.map(p => resolveTrainingGrokRegistration({ ...declaration, slot: p.slot }));
     const daimon = await (options.loadDaimon ?? loadDaimonProjectionModule)();
     const reset = resetTrainingBrokerSlotAsOrganization;
-    const runtimes = await Promise.all(registrations.map(async (registration) => {
-        const { projectionSha256 } = await resolveTrainingGrokProjection(declaration, registration, daimon);
-        return createTrainingSlotRuntime({ declaration, registration, projectionSha256, reset });
-    }));
+    const slots = await Promise.all(descriptors.map(p => resolveTrainingSlotProjection(declaration, p.slot, daimon)));
+    const registrations = slots.map(slot => slot.registration);
+    const runtimes = slots.map(({ registration, projectionSha256 }) => createTrainingSlotRuntime({ declaration, registration, projectionSha256, reset }));
     await stageTrainingEvaluatorSecret();
-    await promisify(execFile)("/bin/bash", ["--noprofile", "--norc", "-ceu", renderTrainingBrokerProvisioning(registrations, declaration.maxRunRequests).join("\n")], { maxBuffer: 8 * 1024 * 1024 });
+    await runTrainingRootScript(renderTrainingBrokerProvisioning(registrations, declaration.maxRunRequests).join("\n"), { maxBuffer: 8 * 1024 * 1024 });
     const children = await startBrokerProcesses({ log });
     let server;
     try {

package/dist/compiler/training/broker/index.d.ts

@@ -1,7 +1,8 @@
 export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema, type TrainingBrokerDeclaration } from "./declaration.js";
 export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
 export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { loadDaimonProjectionModule, resolveTrainingGrokProjection, resolveTrainingSlotProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { recycleTrainingSlot, TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS, TRAINING_RECYCLE_MAX_REPLY_BYTES, type RecycleTrainingSlotOptions, type TrainingSlotRecycleReceipt } from "./recycleClient.js";
 export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
 export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
 export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";

package/dist/compiler/training/broker/index.js

@@ -1,7 +1,8 @@
 export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema } from "./declaration.js";
 export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
 export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-export { loadDaimonProjectionModule, resolveTrainingGrokProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { loadDaimonProjectionModule, resolveTrainingGrokProjection, resolveTrainingSlotProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
+export { recycleTrainingSlot, TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS, TRAINING_RECYCLE_MAX_REPLY_BYTES } from "./recycleClient.js";
 export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
 export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
 export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";

package/dist/compiler/training/broker/projection.d.ts

@@ -50,3 +50,12 @@ export interface TrainingGrokProjection {
  * list drifted from the bytes provisioning wrote.
  */
 export declare const resolveTrainingGrokProjection: (declaration: TrainingBrokerDeclaration, registration: DaimonGrokRegistration, daimon: DaimonProjectionModule) => Promise<TrainingGrokProjection>;
+/**
+ * One slot's registration and projection, exactly as the root entrypoint binds
+ * them into that slot's preflight receipt. The entrypoint and the public lease
+ * both call this, so the digest a lease hands Paideia cannot drift from the
+ * one the supervisor certified.
+ */
+export declare const resolveTrainingSlotProjection: (declaration: TrainingBrokerDeclaration, slot: number, daimon: DaimonProjectionModule) => Promise<TrainingGrokProjection & {
+    registration: DaimonGrokRegistration;
+}>;

package/dist/compiler/training/broker/projection.js

@@ -1,6 +1,7 @@
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { trainingSlotPaths } from "./paths.js";
+import { resolveTrainingGrokRegistration } from "./registration.js";
 /** Indirect specifier: Daimon is an in-image runtime peer of the training container, never a Spawnfile source dependency. */
 const loadRuntime = async () => {
     const packageName = "@noopolis/daimon/runtime";
@@ -68,8 +69,16 @@ export const resolveTrainingGrokProjection = async (declaration, registration, d
         acceptanceStorePath: trainingSlotPaths(registration.slot).state,
         denyPaths: registration.denyPaths,
         seccompProfileSha256: declaration.seccompProfileSha256,
-        profileSha256: registration.profileSha256
+        profileSha256: registration.profileSha256,
+        // The declaration's skills, exactly as root provisioning renders them; omitted for none so a
+        // skill-less projection stays byte-identical to one computed before skills existed.
+        ...(declaration.skills?.length ? { skills: declaration.skills } : {})
     });
+    // A Daimon older than 0.2.2 ignores `skills`, and a drifted mirror would provision a tree the broker
+    // refuses every turn: either way the projection must carry exactly the provisioned skills digest.
+    if (projection.skillsSha256 !== registration.skills?.sha256) {
+        throw new SpawnfileError("runtime_error", "Daimon's Grok broker projection skills digest differs from the provisioned skills; the training image needs @noopolis/daimon >= 0.2.2");
+    }
     const clock = DAIMON_GROK_ENGINE_BROKER.worker.taskClock;
     const expectedClock = { ...clock, directoryPath: clock.slotDirectoryPattern.replace("{slot}", String(registration.slot)),
         timestampFilePath: clock.slotFilePattern.replace("{slot}", String(registration.slot)) };
@@ -86,3 +95,13 @@ export const resolveTrainingGrokProjection = async (declaration, registration, d
     }
     return { projection, projectionSha256: daimon.grokBrokerProjectionSha256(projection) };
 };
+/**
+ * One slot's registration and projection, exactly as the root entrypoint binds
+ * them into that slot's preflight receipt. The entrypoint and the public lease
+ * both call this, so the digest a lease hands Paideia cannot drift from the
+ * one the supervisor certified.
+ */
+export const resolveTrainingSlotProjection = async (declaration, slot, daimon) => {
+    const registration = resolveTrainingGrokRegistration({ ...declaration, slot });
+    return { registration, ...await resolveTrainingGrokProjection(declaration, registration, daimon) };
+};

package/dist/compiler/training/broker/recycleClient.d.ts

@@ -0,0 +1,33 @@
+import { type Socket } from "node:net";
+/** A reply is one short JSON line; anything longer is not this supervisor. */
+export declare const TRAINING_RECYCLE_MAX_REPLY_BYTES = 65536;
+/** Above the supervisor's 120 s drain deadline plus wipe, provision and canaries. */
+export declare const TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS = 180000;
+export interface RecycleTrainingSlotOptions {
+    slot: number;
+    /** This trial's 32-byte hex nonce; the published receipt must echo it. */
+    nonce: string;
+    signal?: AbortSignal;
+    /** Opens the supervisor connection; defaults to the container's fixed supervisor socket. */
+    connect?: () => Socket;
+    timeoutMs?: number;
+}
+export interface TrainingSlotRecycleReceipt {
+    slot: number;
+    generation: number;
+    nonce: string;
+    /** The receipt path the supervisor says it published; callers compare it to the slot descriptor. */
+    receipt: string;
+    durationMs: number;
+}
+/**
+ * One `recycle` over the root slot supervisor socket (`spawnfile.training-slot-supervisor.v2`).
+ *
+ * The verb takes a slot and a nonce, never a path or a command: the container
+ * replays its own audited provisioning and publishes the slot preflight receipt
+ * echoing this nonce. The answer must bind this request exactly (protocol,
+ * verb, slot, nonce, a generation of at least 1) or it is refused; a supervisor
+ * refusal surfaces with its own reason. The reply is bounded, and the call is
+ * bounded by `timeoutMs` and `signal`.
+ */
+export declare const recycleTrainingSlot: (options: RecycleTrainingSlotOptions) => Promise<TrainingSlotRecycleReceipt>;

package/dist/compiler/training/broker/recycleClient.js

@@ -0,0 +1,112 @@
+import { createConnection } from "node:net";
+import { SpawnfileError } from "../../../shared/index.js";
+import { TRAINING_MAX_SLOTS, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
+import { TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
+/** A reply is one short JSON line; anything longer is not this supervisor. */
+export const TRAINING_RECYCLE_MAX_REPLY_BYTES = 65_536;
+/** Above the supervisor's 120 s drain deadline plus wipe, provision and canaries. */
+export const TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS = 180_000;
+const NONCE = /^[a-f0-9]{64}$/u;
+const REPLY_KEYS = ["durationMs", "generation", "nonce", "ok", "receipt", "slot", "v", "verb"];
+const refuse = (message) => new SpawnfileError("runtime_error", message);
+/** The supervisor's refusal text is diagnostic only; keep it one bounded printable line. */
+const refusalText = (value) => typeof value === "string" ? value.replace(/[^\x20-\x7e]/gu, "?").slice(0, 512) || "unknown" : "unknown";
+const bindReply = (answer, slot, nonce) => {
+    if (answer.ok !== true)
+        throw refuse(`Training slot ${slot} recycle refused: ${refusalText(answer.error)}`);
+    if (Object.keys(answer).sort().join(",") !== REPLY_KEYS.join(",") || answer.verb !== "recycle") {
+        throw refuse("Training slot recycle answer is not a recycle receipt");
+    }
+    if (answer.slot !== slot)
+        throw refuse(`Training slot recycle answer names slot ${String(answer.slot)}, not the leased slot ${slot}`);
+    if (answer.nonce !== nonce)
+        throw refuse("Training slot recycle answer does not echo this trial's nonce");
+    if (!Number.isSafeInteger(answer.generation) || answer.generation < 1) {
+        throw refuse("Training slot recycle answer carries no valid generation");
+    }
+    if (typeof answer.receipt !== "string" || answer.receipt.length === 0)
+        throw refuse("Training slot recycle answer names no receipt");
+    if (typeof answer.durationMs !== "number" || !Number.isFinite(answer.durationMs) || answer.durationMs < 0) {
+        throw refuse("Training slot recycle answer carries no valid duration");
+    }
+    return { slot, generation: answer.generation, nonce, receipt: answer.receipt, durationMs: answer.durationMs };
+};
+/**
+ * One `recycle` over the root slot supervisor socket (`spawnfile.training-slot-supervisor.v2`).
+ *
+ * The verb takes a slot and a nonce, never a path or a command: the container
+ * replays its own audited provisioning and publishes the slot preflight receipt
+ * echoing this nonce. The answer must bind this request exactly (protocol,
+ * verb, slot, nonce, a generation of at least 1) or it is refused; a supervisor
+ * refusal surfaces with its own reason. The reply is bounded, and the call is
+ * bounded by `timeoutMs` and `signal`.
+ */
+export const recycleTrainingSlot = (options) => {
+    const { slot, nonce } = options;
+    if (!Number.isInteger(slot) || slot < 0 || slot >= TRAINING_MAX_SLOTS) {
+        return Promise.reject(new SpawnfileError("validation_error", `Training slot recycle requires a slot index from 0 to ${TRAINING_MAX_SLOTS - 1}`));
+    }
+    if (!NONCE.test(nonce))
+        return Promise.reject(new SpawnfileError("validation_error", "Training slot recycle requires a 32-byte hex nonce"));
+    try {
+        options.signal?.throwIfAborted();
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    return new Promise((resolve, reject) => {
+        const socket = (options.connect ?? (() => createConnection(TRAINING_SUPERVISOR_SOCKET)))();
+        let buffer = Buffer.alloc(0), settled = false;
+        const onAbort = () => finish(options.signal?.reason instanceof Error ? options.signal.reason : refuse("Training slot recycle was aborted"));
+        const timer = setTimeout(() => finish(refuse(`Training slot ${slot} recycle timed out before the supervisor answered`)), options.timeoutMs ?? TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS);
+        function finish(error, value) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", onAbort);
+            socket.destroy();
+            if (error === undefined)
+                resolve(value);
+            else
+                reject(error);
+        }
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        socket.on("error", (error) => finish(refuse(`Training slot recycle could not reach the root supervisor: ${error.message}`)));
+        socket.on("close", () => finish(refuse("Training slot recycle connection closed before an answer")));
+        socket.on("connect", () => socket.write(`${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, verb: "recycle", slot, nonce })}\n`));
+        socket.on("data", (chunk) => {
+            buffer = Buffer.concat([buffer, chunk]);
+            const end = buffer.indexOf(0x0a);
+            if (end < 0 ? buffer.length > TRAINING_RECYCLE_MAX_REPLY_BYTES : end > TRAINING_RECYCLE_MAX_REPLY_BYTES) {
+                finish(refuse("Training slot recycle answer exceeded its bound"));
+                return;
+            }
+            if (end < 0)
+                return;
+            let answer;
+            try {
+                answer = JSON.parse(buffer.subarray(0, end).toString("utf8"));
+            }
+            catch {
+                finish(refuse("Training slot recycle answer is not JSON"));
+                return;
+            }
+            if (!answer || typeof answer !== "object" || Array.isArray(answer)) {
+                finish(refuse("Training slot recycle answer is not an object"));
+                return;
+            }
+            const record = answer;
+            if (record.v !== TRAINING_SUPERVISOR_PROTOCOL) {
+                finish(refuse("Training slot recycle answer names another protocol"));
+                return;
+            }
+            try {
+                finish(undefined, bindReply(record, slot, nonce));
+            }
+            catch (error) {
+                finish(error);
+            }
+        });
+    });
+};

package/dist/compiler/training/broker/registration.d.ts

@@ -1,4 +1,5 @@
 import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../../runtime/daimon/contractManifest.js";
+import { type DaimonAgentSkill } from "../../../runtime/daimon/grokWorkerSkills.js";
 import { type DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
 /**
  * The one training slot's deny list: Daimon's own protected set for a
@@ -32,6 +33,8 @@ export interface TrainingGrokSlotInput {
         maxTokens: number;
         timeoutMs: number;
     };
+    /** The declaration's skills; rendered into the slot's `$GROK_HOME/skills` and bound as `skillsSha256`. */
+    skills?: readonly DaimonAgentSkill[];
 }
 /**
  * The single brokered Grok registration a training container runs, at the

package/dist/compiler/training/broker/registration.js

@@ -2,6 +2,7 @@ import path from "node:path";
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
+import { resolveDaimonGrokWorkerSkills } from "../../../runtime/daimon/grokWorkerSkills.js";
 import { DAIMON_GROK_BASE_PROFILE_GRANTS, assertCanonicalRegisteredPath } from "../../containerDaimonGrokWorkerRender.js";
 import { trainingSlotPaths, trainingEvaluatorPaths, TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, TRAINING_DEFERRED_DENY_PATHS } from "./paths.js";
 const fail = (message) => {
@@ -79,7 +80,9 @@ export const resolveTrainingGrokRegistration = (input) => {
         ["workspace", p.workspace], ["runtime home", p.runtimeHome],
         ["usage ledger", p.usageLedger]])
         assertCanonicalRegisteredPath(label, value);
+    const skills = resolveDaimonGrokWorkerSkills(input.skills);
     return {
+        ...(skills ? { skills } : {}),
         agentId: input.agentId,
         config: config.bytes,
         configVariant: "clocked",

package/dist/compiler/training/broker/rootScript.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Linux `MAX_ARG_STRLEN`: the most bytes one `execve` argument may carry. A
+ * generated root program passed as `bash -c <script>` dies with `E2BIG` past
+ * it — and a slot program embeds its declared skills, so the size grows with
+ * the declaration. macOS has no per-argument limit, which is why this is
+ * asserted in tests rather than observed.
+ */
+export declare const LINUX_MAX_ARG_STRLEN = 131072;
+export type TrainingRootScriptRunner = (file: string, args: readonly string[], options: {
+    maxBuffer: number;
+}) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export interface TrainingRootScriptOptions {
+    shell?: string;
+    maxBuffer?: number;
+    run?: TrainingRootScriptRunner;
+    tmpRoot?: string;
+}
+/** The argv a generated script runs under: bounded and independent of the script's size. */
+export declare const trainingRootScriptArgv: (scriptFile: string) => string[];
+/**
+ * Runs a generated root shell program from a fresh `0700` directory holding a
+ * `0600` script file, never from argv and never from stdin (a child that reads
+ * stdin would consume the rest of the program). The directory is removed
+ * afterwards, whatever the outcome.
+ */
+export declare const runTrainingRootScript: (script: string, options?: TrainingRootScriptOptions) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;

package/dist/compiler/training/broker/rootScript.js

@@ -0,0 +1,33 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+/**
+ * Linux `MAX_ARG_STRLEN`: the most bytes one `execve` argument may carry. A
+ * generated root program passed as `bash -c <script>` dies with `E2BIG` past
+ * it — and a slot program embeds its declared skills, so the size grows with
+ * the declaration. macOS has no per-argument limit, which is why this is
+ * asserted in tests rather than observed.
+ */
+export const LINUX_MAX_ARG_STRLEN = 131_072;
+const execFileAsync = promisify(execFile);
+/** The argv a generated script runs under: bounded and independent of the script's size. */
+export const trainingRootScriptArgv = (scriptFile) => ["--noprofile", "--norc", "-eu", scriptFile];
+/**
+ * Runs a generated root shell program from a fresh `0700` directory holding a
+ * `0600` script file, never from argv and never from stdin (a child that reads
+ * stdin would consume the rest of the program). The directory is removed
+ * afterwards, whatever the outcome.
+ */
+export const runTrainingRootScript = async (script, options = {}) => {
+    const directory = await mkdtemp(path.join(options.tmpRoot ?? os.tmpdir(), "spawnfile-root-script-"));
+    try {
+        const file = path.join(directory, "script.sh");
+        await writeFile(file, script, { mode: 0o600, flag: "wx" });
+        return await (options.run ?? execFileAsync)(options.shell ?? "/bin/bash", trainingRootScriptArgv(file), { maxBuffer: options.maxBuffer ?? 1024 * 1024 });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+};

package/dist/compiler/training/broker/runtime.js

@@ -9,6 +9,7 @@ import { MOUNT_AWARE_CLEAR_HELPER } from "../../containerDaimonBrokerRender.js";
 import { probeTrainingSiblingClock } from "./clockProbe.js";
 import { renderTrainingTaskClockAssertions } from "./taskClock.js";
 import { renderTrainingSlotProvisioning } from "./provisioning.js";
+import { runTrainingRootScript } from "./rootScript.js";
 import { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveTrainingCanaries } from "./receipt.js";
 import { DAIMON_ORGANIZATION_UID, TRAINING_HOST_BIND_DENY_PATHS, TRAINING_SEALED_DENY_PATHS, trainingSlotPaths, trainingWipeTargets, trainingClearTargets, TRAINING_SUPERVISOR_LOG } from "./paths.js";
 const run = promisify(execFile);
@@ -38,13 +39,13 @@ export const createTrainingSlotRuntime = (options) => {
             // Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_DAC_OVERRIDE`, so it cannot delete
             // inside a directory it handed to the worker or the broker. Reclaim each tree first, then remove it.
             const script = renderTrainingSlotWipe(p.slot).join("\n");
-            await run(shell, ["--noprofile", "--norc", "-ceu", script], { maxBuffer: 1024 * 1024 }).catch((error) => {
+            await runTrainingRootScript(script, { shell, maxBuffer: 1024 * 1024 }).catch((error) => {
                 const detail = error;
                 throw new SpawnfileError("runtime_error", `Training slot wipe failed: ${(detail.stderr ?? "").slice(-1024).trim() || "no diagnostic"}`);
             });
         },
         provision: async () => {
-            const result = await run(shell, ["--noprofile", "--norc", "-ceu", script], { maxBuffer: 8 * 1024 * 1024 }).catch((error) => {
+            const result = await runTrainingRootScript(script, { shell, maxBuffer: 8 * 1024 * 1024 }).catch((error) => {
                 const detail = error;
                 throw new SpawnfileError("runtime_error", `Training slot provisioning failed: ${(detail.stderr ?? detail.stdout ?? "").slice(-2048).trim()}`);
             });
@@ -52,7 +53,7 @@ export const createTrainingSlotRuntime = (options) => {
                 log(`provisioning: ${result.stdout.trim().slice(-2048)}`);
         },
         canaries: async () => {
-            await run(shell, ["--noprofile", "--norc", "-ceu", renderTrainingTaskClockAssertions(options.registration).join("\n")]);
+            await runTrainingRootScript(renderTrainingTaskClockAssertions(options.registration).join("\n"), { shell });
             return resolveTrainingCanaries({
                 denyPaths: options.registration.denyPaths, probe, log, hostBindPaths: TRAINING_HOST_BIND_DENY_PATHS,
                 sealedPaths: TRAINING_SEALED_DENY_PATHS,

package/dist/compiler/training/index.d.ts

@@ -10,3 +10,6 @@ export * from "./execution.js";
 export * from "./moments.js";
 export * from "./compiledAgent.js";
 export { TRAINING_FAKETIME_LIBRARY_PATH } from "./container/contract.js";
+export * from "./subjectLease.js";
+export * from "./subjectDeclaration.js";
+export { recycleTrainingSlot, type RecycleTrainingSlotOptions, type TrainingSlotRecycleReceipt } from "./broker/recycleClient.js";

package/dist/compiler/training/index.js

@@ -8,3 +8,6 @@ export * from "./execution.js";
 export * from "./moments.js";
 export * from "./compiledAgent.js";
 export { TRAINING_FAKETIME_LIBRARY_PATH } from "./container/contract.js";
+export * from "./subjectLease.js";
+export * from "./subjectDeclaration.js";
+export { recycleTrainingSlot } from "./broker/recycleClient.js";

package/dist/compiler/training/preparation/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "spawnfile",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "spawnfile",
-      "version": "0.1.19",
+      "version": "0.1.20",
       "license": "MIT",
       "dependencies": {
         "@noopolis/stele": "0.0.2",

package/dist/compiler/training/preparation/broker.d.ts

@@ -1,3 +1,5 @@
+import { type DaimonAgentSkill } from "../../../runtime/daimon/grokWorkerSkills.js";
+import type { TrainingContext } from "../contract.js";
 import type { TrainingPreparationConfig } from "./contract.js";
 export interface PreparedTrainingBroker {
     declarationPath: string;
@@ -18,4 +20,11 @@ export interface PreparedTrainingBroker {
  * `docker create` — a dry run, a failed build — must still refuse the
  * developer's desktop Grok login rather than report it later.
  */
-export declare const prepareTrainingBroker: (broker: NonNullable<TrainingPreparationConfig["broker"]>, root: string, staging: string, write: boolean, slots?: number) => Promise<PreparedTrainingBroker>;
+/**
+ * The subject's declared skills, read from the context's pinned sources and
+ * refused if any byte changed since capture: exactly the `SKILL.md` files the
+ * compiler emits into its `.agents/skills`, in Daimon's engine-neutral form.
+ * `undefined` for none keeps a skill-less declaration byte-identical.
+ */
+export declare const trainingBrokerSkills: (context: Pick<TrainingContext, "skills">) => Promise<DaimonAgentSkill[] | undefined>;
+export declare const prepareTrainingBroker: (broker: NonNullable<TrainingPreparationConfig["broker"]>, root: string, staging: string, write: boolean, slots?: number, skills?: readonly DaimonAgentSkill[]) => Promise<PreparedTrainingBroker>;