spawnfile 0.1.19 → 0.1.21

package/dist/runtime/daimon/grokSkillsSupport.js

@@ -0,0 +1,61 @@
+import { readFileSync } from "node:fs";
+import { parse as parseYaml } from "yaml";
+import { SpawnfileError } from "../../shared/index.js";
+import { daimonAgentSkillsFromResolved, parseDaimonAgentSkills } from "./grokWorkerSkills.js";
+/** The first Daimon whose broker accepts `skillsSha256` and renders `$GROK_HOME/skills` (noopolis/daimon-harness#55). */
+export const DAIMON_GROK_SKILLS_MIN_VERSION = "0.2.2";
+const runtimesYamlUrl = new URL("../../../runtimes.yaml", import.meta.url);
+let pinned;
+/**
+ * The Daimon package version of the runtime image `runtimes.yaml` pins, from
+ * its never-moved `<package version>-<short commit>` tag. Read synchronously
+ * because `preflightAgent` (`spawnfile validate`) is synchronous.
+ */
+export const pinnedDaimonRuntimeVersion = (source) => {
+    if (source === undefined && pinned !== undefined)
+        return pinned;
+    const document = parseYaml(source ?? readFileSync(runtimesYamlUrl, "utf8"));
+    const tag = document.runtimes?.daimon?.install?.tag;
+    const match = typeof tag === "string" ? /^(\d+\.\d+\.\d+)-[0-9a-f]{7,}$/u.exec(tag) : null;
+    if (!match)
+        throw new SpawnfileError("runtime_error", `runtimes.yaml pins no versioned Daimon runtime image tag: ${JSON.stringify(tag)}`);
+    if (source === undefined)
+        pinned = match[1];
+    return match[1];
+};
+const below = (version, minimum) => {
+    const left = version.split(".").map(Number), right = minimum.split(".").map(Number);
+    for (let index = 0; index < 3; index += 1)
+        if (left[index] !== right[index])
+            return left[index] < right[index];
+    return false;
+};
+/**
+ * Why a brokered Grok agent's declared skills cannot compile, or `undefined`.
+ *
+ * Two causes, both refused before anything is emitted: a skill Daimon's own
+ * parser would refuse (a name outside its component rule, a missing
+ * `SKILL.md`, a size past `AGENT_SKILLS_BOUNDS`), and a pinned runtime image
+ * older than 0.2.2, whose strict service parser rejects the `skillsSha256`
+ * key — so the broker, and every Grok agent of the organization, would fail
+ * to start.
+ */
+export const daimonGrokSkillsError = (node, engine, version = () => pinnedDaimonRuntimeVersion()) => {
+    if (engine !== "grok" || node.skills.length === 0)
+        return undefined;
+    try {
+        parseDaimonAgentSkills(daimonAgentSkillsFromResolved(node.skills));
+    }
+    catch (error) {
+        if (error instanceof SpawnfileError)
+            return `Daimon Grok agent ${node.name}: ${error.message}`;
+        throw error;
+    }
+    const pinnedVersion = version();
+    if (below(pinnedVersion, DAIMON_GROK_SKILLS_MIN_VERSION)) {
+        return `Daimon Grok agent ${node.name} declares skills (${node.skills.map((skill) => skill.name).sort().join(", ")}), but runtimes.yaml pins `
+            + `Daimon ${pinnedVersion}, whose engine broker rejects service.json skillsSha256 and would refuse to start every Grok agent of the `
+            + `organization. Re-pin the Daimon runtime image to ${DAIMON_GROK_SKILLS_MIN_VERSION} or later, or drop the skills from this agent.`;
+    }
+    return undefined;
+};

package/dist/runtime/daimon/grokWorkerConfigBytes.d.ts

@@ -41,3 +41,129 @@ export declare const DAIMON_GROK_WORKER_PROFILE_SAMPLES: readonly [{
     readonly bytes: "[profiles.daimon-strict]\nextends = \"strict\"\nrestrict_network = true\ndeny = [\"/run/daimon-engine-broker\", \"/var/lib/daimon-workers/2201\", \"/var/lib/spawnfile/daimon/usage\"]\n";
     readonly denyPaths: readonly ["/var/lib/spawnfile/daimon/usage", "/run/daimon-engine-broker", "/run/daimon-engine-broker", "/var/lib/daimon-workers/2201"];
 }];
+/** Daimon `grokWorkerSkillsSha256` / `renderGrokWorkerSkillsTree` samples; the Spawnfile mirror must reproduce them exactly. */
+export declare const DAIMON_GROK_WORKER_SKILLS_SAMPLES: readonly [{
+    readonly sha256: "74a407e0569e692f5f354dd8613d2b6411493440cadd9ad197fcad31a63b6b34";
+    readonly skills: readonly [];
+    readonly tree: readonly [];
+}, {
+    readonly sha256: "48f444624ff818f29446cbbdb2a3057f93fbf760b6c8fefb5d0914d50fa80f62";
+    readonly skills: readonly [{
+        readonly name: "review";
+        readonly files: readonly [{
+            readonly path: "SKILL.md";
+            readonly content: "---\nname: review\ndescription: Review a diff.\n---\n\nRead the diff first.\n";
+        }];
+    }];
+    readonly tree: readonly [{
+        readonly path: "skills";
+        readonly kind: "directory";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 365;
+    }, {
+        readonly path: "skills/review";
+        readonly kind: "directory";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 365;
+    }, {
+        readonly path: "skills/review/SKILL.md";
+        readonly kind: "file";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 292;
+        readonly content: "---\nname: review\ndescription: Review a diff.\n---\n\nRead the diff first.\n";
+    }];
+}, {
+    readonly sha256: "0fd754e7ce8db521c404752446fa224b0e1389c21dbbc0985835e1734480a978";
+    readonly skills: readonly [{
+        readonly name: "zeta_notes";
+        readonly files: readonly [{
+            readonly path: "SKILL.md";
+            readonly content: "# Zeta été 🚀\n";
+        }, {
+            readonly path: "references/deep/guide.md";
+            readonly content: "nested\n";
+        }, {
+            readonly path: "references/a.md";
+            readonly content: "";
+        }];
+    }, {
+        readonly name: "alpha-1";
+        readonly files: readonly [{
+            readonly path: "SKILL.md";
+            readonly content: "alpha\r\n";
+        }];
+    }];
+    readonly tree: readonly [{
+        readonly path: "skills";
+        readonly kind: "directory";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 365;
+    }, {
+        readonly path: "skills/alpha-1";
+        readonly kind: "directory";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 365;
+    }, {
+        readonly path: "skills/alpha-1/SKILL.md";
+        readonly kind: "file";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 292;
+        readonly content: "alpha\r\n";
+    }, {
+        readonly path: "skills/zeta_notes";
+        readonly kind: "directory";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 365;
+    }, {
+        readonly path: "skills/zeta_notes/SKILL.md";
+        readonly kind: "file";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 292;
+        readonly content: "# Zeta été 🚀\n";
+    }, {
+        readonly path: "skills/zeta_notes/references";
+        readonly kind: "directory";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 365;
+    }, {
+        readonly path: "skills/zeta_notes/references/a.md";
+        readonly kind: "file";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 292;
+        readonly content: "";
+    }, {
+        readonly path: "skills/zeta_notes/references/deep";
+        readonly kind: "directory";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 365;
+    }, {
+        readonly path: "skills/zeta_notes/references/deep/guide.md";
+        readonly kind: "file";
+        readonly uid: 0;
+        readonly gid: 0;
+        readonly mode: 292;
+        readonly content: "nested\n";
+    }];
+}];
+/** Daimon's skills parser limits and name/path component rule; the Spawnfile mirror must use exactly these. */
+export declare const DAIMON_AGENT_SKILLS_RULES: {
+    readonly bounds: {
+        readonly skills: 64;
+        readonly filesPerSkill: 64;
+        readonly fileBytes: 262144;
+        readonly totalBytes: 4194304;
+        readonly depth: 8;
+    };
+    readonly componentPattern: "^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$";
+};

package/dist/runtime/daimon/grokWorkerConfigBytes.js

@@ -51,3 +51,160 @@ export const DAIMON_GROK_WORKER_PROFILE_SAMPLES = [
         ]
     }
 ];
+/** Daimon `grokWorkerSkillsSha256` / `renderGrokWorkerSkillsTree` samples; the Spawnfile mirror must reproduce them exactly. */
+export const DAIMON_GROK_WORKER_SKILLS_SAMPLES = [
+    {
+        "sha256": "74a407e0569e692f5f354dd8613d2b6411493440cadd9ad197fcad31a63b6b34",
+        "skills": [],
+        "tree": []
+    },
+    {
+        "sha256": "48f444624ff818f29446cbbdb2a3057f93fbf760b6c8fefb5d0914d50fa80f62",
+        "skills": [
+            {
+                "name": "review",
+                "files": [
+                    {
+                        "path": "SKILL.md",
+                        "content": "---\nname: review\ndescription: Review a diff.\n---\n\nRead the diff first.\n"
+                    }
+                ]
+            }
+        ],
+        "tree": [
+            {
+                "path": "skills",
+                "kind": "directory",
+                "uid": 0,
+                "gid": 0,
+                "mode": 365
+            },
+            {
+                "path": "skills/review",
+                "kind": "directory",
+                "uid": 0,
+                "gid": 0,
+                "mode": 365
+            },
+            {
+                "path": "skills/review/SKILL.md",
+                "kind": "file",
+                "uid": 0,
+                "gid": 0,
+                "mode": 292,
+                "content": "---\nname: review\ndescription: Review a diff.\n---\n\nRead the diff first.\n"
+            }
+        ]
+    },
+    {
+        "sha256": "0fd754e7ce8db521c404752446fa224b0e1389c21dbbc0985835e1734480a978",
+        "skills": [
+            {
+                "name": "zeta_notes",
+                "files": [
+                    {
+                        "path": "SKILL.md",
+                        "content": "# Zeta été 🚀\n"
+                    },
+                    {
+                        "path": "references/deep/guide.md",
+                        "content": "nested\n"
+                    },
+                    {
+                        "path": "references/a.md",
+                        "content": ""
+                    }
+                ]
+            },
+            {
+                "name": "alpha-1",
+                "files": [
+                    {
+                        "path": "SKILL.md",
+                        "content": "alpha\r\n"
+                    }
+                ]
+            }
+        ],
+        "tree": [
+            {
+                "path": "skills",
+                "kind": "directory",
+                "uid": 0,
+                "gid": 0,
+                "mode": 365
+            },
+            {
+                "path": "skills/alpha-1",
+                "kind": "directory",
+                "uid": 0,
+                "gid": 0,
+                "mode": 365
+            },
+            {
+                "path": "skills/alpha-1/SKILL.md",
+                "kind": "file",
+                "uid": 0,
+                "gid": 0,
+                "mode": 292,
+                "content": "alpha\r\n"
+            },
+            {
+                "path": "skills/zeta_notes",
+                "kind": "directory",
+                "uid": 0,
+                "gid": 0,
+                "mode": 365
+            },
+            {
+                "path": "skills/zeta_notes/SKILL.md",
+                "kind": "file",
+                "uid": 0,
+                "gid": 0,
+                "mode": 292,
+                "content": "# Zeta été 🚀\n"
+            },
+            {
+                "path": "skills/zeta_notes/references",
+                "kind": "directory",
+                "uid": 0,
+                "gid": 0,
+                "mode": 365
+            },
+            {
+                "path": "skills/zeta_notes/references/a.md",
+                "kind": "file",
+                "uid": 0,
+                "gid": 0,
+                "mode": 292,
+                "content": ""
+            },
+            {
+                "path": "skills/zeta_notes/references/deep",
+                "kind": "directory",
+                "uid": 0,
+                "gid": 0,
+                "mode": 365
+            },
+            {
+                "path": "skills/zeta_notes/references/deep/guide.md",
+                "kind": "file",
+                "uid": 0,
+                "gid": 0,
+                "mode": 292,
+                "content": "nested\n"
+            }
+        ]
+    }
+];
+/** Daimon's skills parser limits and name/path component rule; the Spawnfile mirror must use exactly these. */
+export const DAIMON_AGENT_SKILLS_RULES = {
+    "bounds": {
+        "skills": 64,
+        "filesPerSkill": 64,
+        "fileBytes": 262144,
+        "totalBytes": 4194304,
+        "depth": 8
+    },
+    "componentPattern": "^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$"
+};

package/dist/runtime/daimon/grokWorkerSkills.d.ts

@@ -0,0 +1,61 @@
+import type { ResolvedSkill } from "../../compiler/types.js";
+/**
+ * Mirror of Daimon's `grokWorkerSkills.ts` (`@noopolis/daimon/runtime` 0.2.2):
+ * the engine-neutral skills input, its `noopolis.daimon.grok-worker-skills.v1`
+ * digest and the `$GROK_HOME/skills` tree root provisioning writes. Pinned to
+ * Daimon's own output by `DAIMON_GROK_WORKER_SKILLS_SAMPLES`
+ * (`scripts/vendor-daimon-grok-contract.ts`), exactly as the sandbox profile
+ * mirror is: production renders `service.json` at compile time and never
+ * loads Daimon, while the broker re-hashes the provisioned tree before every
+ * turn, so one byte of drift here refuses every Grok turn rather than
+ * degrading quietly. Training additionally cross-checks this digest against
+ * Daimon's projection (`training/broker/projection.ts`).
+ */
+export declare const DAIMON_GROK_WORKER_SKILLS_LAYOUT: {
+    readonly relativePath: "skills";
+    readonly uid: 0;
+    readonly gid: 0;
+    readonly directoryMode: 365;
+    readonly fileMode: 292;
+    readonly digestVersion: "noopolis.daimon.grok-worker-skills.v1";
+};
+export declare const DAIMON_AGENT_SKILLS_BOUNDS: {
+    readonly skills: 64;
+    readonly filesPerSkill: 64;
+    readonly fileBytes: 262144;
+    readonly totalBytes: 4194304;
+    readonly depth: 8;
+};
+export interface DaimonAgentSkillFile {
+    path: string;
+    content: string;
+}
+export interface DaimonAgentSkill {
+    name: string;
+    files: DaimonAgentSkillFile[];
+}
+export interface DaimonGrokWorkerSkillsEntry {
+    path: string;
+    kind: "directory" | "file";
+    uid: number;
+    gid: number;
+    mode: number;
+    content?: string;
+}
+/** What a registration carries when its agent declares skills; absent otherwise. */
+export interface DaimonGrokWorkerSkills {
+    sha256: string;
+    tree: DaimonGrokWorkerSkillsEntry[];
+}
+/** Daimon's skill name and path component rule (vendored as `DAIMON_AGENT_SKILLS_RULES.componentPattern`). */
+export declare const DAIMON_AGENT_SKILL_COMPONENT: RegExp;
+/** Daimon's `parseAgentSkills`: the same refusals, sorted by name and path so equal sets digest equally. */
+export declare const parseDaimonAgentSkills: (skills: readonly DaimonAgentSkill[]) => DaimonAgentSkill[];
+/** Daimon's `grokWorkerSkillsSha256`: sha256 over the canonical (key-sorted) description of the tree. */
+export declare const daimonGrokWorkerSkillsSha256: (skills: readonly DaimonAgentSkill[]) => string;
+/** Daimon's `renderGrokWorkerSkillsTree`: every entry under `$GROK_HOME`, parents before children; none for no skills. */
+export declare const renderDaimonGrokWorkerSkillsTree: (skills: readonly DaimonAgentSkill[]) => DaimonGrokWorkerSkillsEntry[];
+/** Spawnfile's declared skills are one `SKILL.md` each, emitted verbatim into `<workspace>/.agents/skills/<name>/`. */
+export declare const daimonAgentSkillsFromResolved: (skills: readonly Pick<ResolvedSkill, "name" | "content">[]) => DaimonAgentSkill[];
+/** The registration's skills member: `undefined` for none, so a skill-less registration stays byte-identical. */
+export declare const resolveDaimonGrokWorkerSkills: (skills: readonly DaimonAgentSkill[] | undefined) => DaimonGrokWorkerSkills | undefined;

package/dist/runtime/daimon/grokWorkerSkills.js

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import { SpawnfileError } from "../../shared/index.js";
+/**
+ * Mirror of Daimon's `grokWorkerSkills.ts` (`@noopolis/daimon/runtime` 0.2.2):
+ * the engine-neutral skills input, its `noopolis.daimon.grok-worker-skills.v1`
+ * digest and the `$GROK_HOME/skills` tree root provisioning writes. Pinned to
+ * Daimon's own output by `DAIMON_GROK_WORKER_SKILLS_SAMPLES`
+ * (`scripts/vendor-daimon-grok-contract.ts`), exactly as the sandbox profile
+ * mirror is: production renders `service.json` at compile time and never
+ * loads Daimon, while the broker re-hashes the provisioned tree before every
+ * turn, so one byte of drift here refuses every Grok turn rather than
+ * degrading quietly. Training additionally cross-checks this digest against
+ * Daimon's projection (`training/broker/projection.ts`).
+ */
+export const DAIMON_GROK_WORKER_SKILLS_LAYOUT = {
+    relativePath: "skills", uid: 0, gid: 0, directoryMode: 0o555, fileMode: 0o444,
+    digestVersion: "noopolis.daimon.grok-worker-skills.v1"
+};
+export const DAIMON_AGENT_SKILLS_BOUNDS = { skills: 64, filesPerSkill: 64, fileBytes: 262_144, totalBytes: 4_194_304, depth: 8 };
+/** Daimon's skill name and path component rule (vendored as `DAIMON_AGENT_SKILLS_RULES.componentPattern`). */
+export const DAIMON_AGENT_SKILL_COMPONENT = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/u;
+const COMPONENT = DAIMON_AGENT_SKILL_COMPONENT;
+const LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/u;
+const invalid = (detail) => { throw new SpawnfileError("compile_error", `Invalid Daimon agent skills: ${detail}`); };
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const byteLength = (content) => Buffer.byteLength(content, "utf8");
+/** Daimon's `parseAgentSkills`: the same refusals, sorted by name and path so equal sets digest equally. */
+export const parseDaimonAgentSkills = (skills) => {
+    if (skills.length > DAIMON_AGENT_SKILLS_BOUNDS.skills)
+        invalid("too many skills");
+    let total = 0;
+    const names = new Set();
+    const parsed = skills.map((skill) => {
+        if (!COMPONENT.test(skill.name))
+            invalid(`skill name ${JSON.stringify(skill.name)}`);
+        if (names.has(skill.name))
+            invalid(`duplicate skill ${skill.name}`);
+        names.add(skill.name);
+        if (skill.files.length === 0 || skill.files.length > DAIMON_AGENT_SKILLS_BOUNDS.filesPerSkill)
+            invalid(`files of ${skill.name}`);
+        const paths = new Set();
+        for (const file of skill.files) {
+            const parts = file.path.split("/");
+            if (parts.length > DAIMON_AGENT_SKILLS_BOUNDS.depth || parts.some((part) => !COMPONENT.test(part)))
+                invalid(`path ${JSON.stringify(`${skill.name}/${file.path}`)}`);
+            const bytes = byteLength(file.content);
+            if (bytes > DAIMON_AGENT_SKILLS_BOUNDS.fileBytes)
+                invalid(`size of ${skill.name}/${file.path}`);
+            total += bytes;
+            if (paths.has(file.path))
+                invalid(`duplicate path ${skill.name}/${file.path}`);
+            paths.add(file.path);
+            if (LONE_SURROGATE.test(file.content))
+                invalid(`content of ${skill.name}/${file.path} is not Unicode text`);
+        }
+        for (const candidate of paths)
+            if ([...paths].some((other) => other.startsWith(`${candidate}/`)))
+                invalid(`path collision ${skill.name}/${candidate}`);
+        if (!paths.has("SKILL.md"))
+            invalid(`${skill.name} has no SKILL.md`);
+        return { name: skill.name, files: skill.files.map((file) => ({ path: file.path, content: file.content })).sort((a, b) => compare(a.path, b.path)) };
+    });
+    if (total > DAIMON_AGENT_SKILLS_BOUNDS.totalBytes)
+        invalid("total size");
+    return parsed.sort((a, b) => compare(a.name, b.name));
+};
+/** Daimon's `grokWorkerSkillsSha256`: sha256 over the canonical (key-sorted) description of the tree. */
+export const daimonGrokWorkerSkillsSha256 = (skills) => {
+    // Keys are written in canonical (sorted) order, so plain JSON.stringify is Daimon's canonicalJson here.
+    const description = {
+        skills: parseDaimonAgentSkills(skills).map((skill) => ({
+            files: skill.files.map((file) => ({ bytes: byteLength(file.content), path: file.path, sha256: createHash("sha256").update(file.content, "utf8").digest("hex") })),
+            name: skill.name
+        })),
+        version: DAIMON_GROK_WORKER_SKILLS_LAYOUT.digestVersion
+    };
+    return createHash("sha256").update(JSON.stringify(description)).digest("hex");
+};
+/** Daimon's `renderGrokWorkerSkillsTree`: every entry under `$GROK_HOME`, parents before children; none for no skills. */
+export const renderDaimonGrokWorkerSkillsTree = (skills) => {
+    const parsed = parseDaimonAgentSkills(skills);
+    if (parsed.length === 0)
+        return [];
+    const { relativePath, uid, gid, directoryMode, fileMode } = DAIMON_GROK_WORKER_SKILLS_LAYOUT;
+    const directory = (entry) => ({ path: entry, kind: "directory", uid, gid, mode: directoryMode });
+    const entries = [directory(relativePath)];
+    const seen = new Set([relativePath]);
+    for (const skill of parsed) {
+        for (const file of skill.files) {
+            const parts = [relativePath, skill.name, ...file.path.split("/")];
+            for (let depth = 2; depth < parts.length; depth += 1) {
+                const relative = parts.slice(0, depth).join("/");
+                if (!seen.has(relative)) {
+                    seen.add(relative);
+                    entries.push(directory(relative));
+                }
+            }
+            entries.push({ path: parts.join("/"), kind: "file", uid, gid, mode: fileMode, content: file.content });
+        }
+    }
+    return entries;
+};
+/** Spawnfile's declared skills are one `SKILL.md` each, emitted verbatim into `<workspace>/.agents/skills/<name>/`. */
+export const daimonAgentSkillsFromResolved = (skills) => skills.map((skill) => ({ name: skill.name, files: [{ path: "SKILL.md", content: skill.content }] }));
+/** The registration's skills member: `undefined` for none, so a skill-less registration stays byte-identical. */
+export const resolveDaimonGrokWorkerSkills = (skills) => skills === undefined || skills.length === 0 ? undefined
+    : { sha256: daimonGrokWorkerSkillsSha256(skills), tree: renderDaimonGrokWorkerSkillsTree(skills) };

package/dist/runtime/types.d.ts

@@ -64,6 +64,14 @@ export interface ContainerTarget {
         maxTokens?: number;
         timeoutMs?: number;
     }>;
+    /** Daimon only: each brokered Grok agent's declared skills (absent for none), rendered into its worker `$GROK_HOME/skills`. */
+    grokSkillsByNodeId?: Record<string, {
+        name: string;
+        files: {
+            path: string;
+            content: string;
+        }[];
+    }[]>;
     files: EmittedFile[];
     id: string;
     opaqueMountTargets?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spawnfile",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Canonical source compiler for autonomous agents and teams.",
   "license": "MIT",
   "type": "module",

package/runtimes.yaml

@@ -13,16 +13,16 @@
 runtimes:
   daimon:
     remote: git@github.com:noopolis/daimon-harness.git
-    ref: 14d0298c00861f949bb6993d1af9751cde53319f
+    ref: cbe75eb1fd5fed63782e54c4df72603e33e67d3e
     default_branch: main
     install:
       kind: container_image
       image: noopolis/spawnfile-runtime-daimon
-      tag: 0.2.1-14d0298
-      digest: sha256:2de3bd522ce88202b3295efa4f19c72c350e5e18c25ccba55e5acf3395e8569c
+      tag: 0.2.3-cbe75eb
+      digest: sha256:2b656c1c638b91b61deafc61786db6931501399da81fc88df7b93f12ed93eb55
       capability_receipts:
-        amd64: sha256:26fe7ff328bb45fb6643b0792ab38b2658d5fcc3d2d8bd67d9848ea2987c04cc
-        arm64: sha256:347da7c613ad3430e018de829587a6d686c498c6168ef4be6b8dd501fdb07ebb
+        amd64: sha256:c3c79482e692370900f9225e8d2b720b1619e4c40d36493ece2c331b0a3661ef
+        arm64: sha256:53ca61a1011b73ed2fb985c9c460cf2fc0e51f12016ba8add07969ac7b3412be
       contract_manifest_sha256: sha256:e39551277c6727c8807b1247e759f57addcee3f17f1405ebc927179647d64de6
     status: active