spawnfile 0.1.24 → 0.1.27

package/dist/runtime/daimon/training/native/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../../../../src/runtime/daimon/training/native/admission.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAc,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI;IAC/H,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AACnF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAiB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5F,MAAM,OAAO,GAAG,CAAC,KAAc,EAAiB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE5H,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,KAAuB;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,wCAAwC,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;QAChH,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QACtF,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QACtF,OAAO,CAAC,WAAW,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,IAAI,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3F,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,kDAAkD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtH,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;QAC5F,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;QACxF,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;QACzG,YAAY,EAAE,OAAO,KAAK,sCAAsC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC;QACvG,YAAY,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,KAAK,CAAC,OAAO;QACtF,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAwC,CAAC;IAC/E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,sBAAsB,EAAE,CAAC;IACxG,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QACjH,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5H,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,kBAAkB,CAAC;YAClG,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG;YACnF,GAAG,CAAC,UAAU,KAAK,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAC3G,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,CAAC,OAAO;YAClF,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa;YACxG,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,UAAU,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,sBAAsB,EAAE,CAAC;QACjG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,OAAO;QACL,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAK,EAAE,CAAC,CAAC;QACvG,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC3G,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC3F,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACtC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACrF,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KACtG,CAAC;AACJ,CAAC"}

package/dist/runtime/daimon/training/native/child/arguments.d.ts

@@ -0,0 +1,16 @@
+import { type VerifiedNativeLaunch } from '../receipt/index.js';
+export declare function nativeChildArguments(launch: VerifiedNativeLaunch, trialId: string, timeoutMs: number): string[];
+/**
+ * Creates this trial's private artifact directory before the worker starts.
+ *
+ * A Codex control root is already per-trial, so it is returned untouched. A Grok
+ * slot control root is fixed by the container and shared across trials: the
+ * non-recursive `mkdir` below is what separates them, and it fails with EEXIST
+ * rather than colliding with, or silently overwriting, the previous trial's
+ * exclusive artifacts. Nothing outside this directory is Training's to clear, so
+ * the slot supervisor's recycle never has to wipe on Training's behalf.
+ */
+export declare function ensureNativeTrialArtifacts(launch: VerifiedNativeLaunch, trialId: string): Promise<string>;
+export declare function validateChildPaths(launch: VerifiedNativeLaunch): Promise<void>;
+/** Docker env-file semantics: literal values, no shell expansion or inherited host provider settings. */
+export declare function nativeChildEnvironment(launch: VerifiedNativeLaunch): Promise<NodeJS.ProcessEnv>;

package/dist/runtime/daimon/training/native/child/arguments.js

@@ -0,0 +1,69 @@
+import { normalizedTrainingEnvironment } from '../../../../../training/index.js';
+import { dirname, join } from 'node:path';
+import { chmod, lstat, mkdir, realpath } from 'node:fs/promises';
+import { nativeTrialArtifactsRoot, readPrivateFile } from '../receipt/index.js';
+export function nativeChildArguments(launch, trialId, timeoutMs) {
+    return ['--experimental-strip-types', launch.bootstrap ? join(launch.bootstrap.root, launch.bootstrap.entrypoint) : join(launch.workerRoot, 'worker/cli.js'),
+        '--launch', launch.receiptFile, '--config', launch.config, '--config-sha256', launch.configSha256,
+        '--control-root', launch.controlRoot, '--token-file', launch.tokenFile,
+        '--evidence', join(nativeTrialArtifactsRoot(launch, trialId), 'evidence.json'),
+        '--trial-id', trialId, '--timeout-ms', String(timeoutMs), '--schedule-override', 'disabled'];
+}
+/**
+ * Creates this trial's private artifact directory before the worker starts.
+ *
+ * A Codex control root is already per-trial, so it is returned untouched. A Grok
+ * slot control root is fixed by the container and shared across trials: the
+ * non-recursive `mkdir` below is what separates them, and it fails with EEXIST
+ * rather than colliding with, or silently overwriting, the previous trial's
+ * exclusive artifacts. Nothing outside this directory is Training's to clear, so
+ * the slot supervisor's recycle never has to wipe on Training's behalf.
+ */
+export async function ensureNativeTrialArtifacts(launch, trialId) {
+    const root = nativeTrialArtifactsRoot(launch, trialId);
+    if (root === launch.controlRoot)
+        return root;
+    const shared = dirname(root);
+    await mkdir(shared, { recursive: true, mode: 0o700 });
+    await chmod(shared, 0o700);
+    await mkdir(root, { mode: 0o700 });
+    await chmod(root, 0o700);
+    return root;
+}
+export async function validateChildPaths(launch) {
+    for (const projection of [launch.workspace, ...launch.projections]) {
+        if (projection.source !== projection.target)
+            throw new Error('Child execution requires actual source and target paths to match');
+    }
+    for (const credential of launch.credentials) {
+        const target = await lstat(credential.target);
+        if (!target.isFile() || target.isSymbolicLink() || target.nlink !== 1 || (target.mode & 0o777) !== 0o600 || await realpath(credential.target) !== credential.target) {
+            throw new Error('Caller-owned native credential ingress was not safely staged');
+        }
+        const directory = await lstat(dirname(credential.target));
+        if (!directory.isDirectory() || directory.isSymbolicLink() || (directory.mode & 0o777) !== 0o700)
+            throw new Error('Caller-owned native credential directory is unsafe');
+    }
+}
+/** Docker env-file semantics: literal values, no shell expansion or inherited host provider settings. */
+export async function nativeChildEnvironment(launch) {
+    const home = launch.projections.find(row => row.role === 'home');
+    if (!home || home.source !== home.target)
+        throw new Error('Native child HOME requires the verified materialized home projection');
+    const env = { HOME: home.target };
+    for (const key of ['PATH', 'LANG', 'LC_ALL', 'TZ'])
+        if (process.env[key] !== undefined)
+            env[key] = process.env[key];
+    const keys = new Set(['HOME']);
+    for (const line of (await readPrivateFile(launch.envFile, 65536)).split(/\r?\n/u)) {
+        if (!line.trim() || line.trimStart().startsWith('#'))
+            continue;
+        const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/u.exec(line);
+        if (!match || keys.has(match[1]))
+            throw new Error('Invalid explicit native child environment');
+        keys.add(match[1]);
+        env[match[1]] = match[2];
+    }
+    return normalizedTrainingEnvironment(env);
+}
+//# sourceMappingURL=arguments.js.map

package/dist/runtime/daimon/training/native/child/arguments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arguments.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/arguments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAA6B,MAAM,qBAAqB,CAAC;AAE3G,MAAM,UAAU,oBAAoB,CAAC,MAA4B,EAAE,OAAe,EAAE,SAAiB;IACnG,OAAO,CAAC,4BAA4B,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,eAAe,CAAC;QAC1J,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,YAAY;QACjG,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS;QACtE,YAAY,EAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC;QAC9E,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAA4B,EAAE,OAAe;IAC5F,MAAM,IAAI,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,MAAM,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAA4B;IACnE,KAAK,MAAM,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACnI,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,IAAI,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YACpK,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC1K,CAAC;AACH,CAAC;AACD,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAA4B;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAClI,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/D,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAClD,CAAC;IACD,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC"}

package/dist/runtime/daimon/training/native/child/deferred-trial.d.ts

@@ -0,0 +1,24 @@
+import { type TrialReport } from '../../../../../training/index.js';
+import type { SubjectTurnResult } from '../../../../../training/index.js';
+/** One required artifact the filing would produce, so the verdict is exactly the subject's. */
+export declare const filing: () => import("../../../../../training/index.js").ResolvedRecord;
+/**
+ * No sidecar artifact is registered for these trials, so a read is a defect rather
+ * than a missing file: the verdict has to be exactly the subject's own evidence.
+ */
+export declare const unregisteredSidecar: () => Promise<never>;
+/**
+ * The real child, the real loopback protocol and the real closure query: the only
+ * thing borrowed is the trial's own stimulus, because the worker owns the fresh
+ * workspace the launch receipt pins. Every continuation the budget admits defers,
+ * so the last one exhausts it — and by then the worker has stopped its own host.
+ *
+ * The caller owns the returned root: these trials write a real workspace and a real
+ * control root, and nothing here removes them.
+ */
+export declare function nativeDeferredTrial(mode: string, maxDeliveries?: number, supplied?: () => Promise<null>): Promise<{
+    report: TrialReport;
+    turn: SubjectTurnResult;
+    deliveries: number;
+    root: string;
+}>;

package/dist/runtime/daimon/training/native/child/deferred-trial.js

@@ -0,0 +1,63 @@
+import { createHash } from 'node:crypto';
+import { childFixture } from './fixture.js';
+import { parseDatasetYaml, resolveDataset } from '../../../../../training/index.js';
+import { createEvaluationRegistry } from '../../../../../training/index.js';
+import { runTrial } from '../../../../../training/index.js';
+import { createDaimonNativeAdapter } from '../index.js';
+/** One required artifact the filing would produce, so the verdict is exactly the subject's. */
+export const filing = () => resolveDataset(parseDatasetYaml(`schema: spawnfile.training.dataset.v1
+id: newsroom
+stages:
+  - id: accepted-article
+    checks:
+      - {id: filed, eval: tool-called, tool: mcp_newsroom_file_article}
+      - {id: body, eval: contains-any, input: 'artifact:accepted-article#/body', values: [Filed]}
+    score:
+      linear: {filed: 0.5, body: 0.5}
+    gate: {all: [{passed: filed}, {passed: body}]}
+records:
+  - id: record
+    group: unique
+    input: {prompt: file the assigned story}
+    outputs: {accepted-article: article.json}
+`)).records[0];
+/**
+ * No sidecar artifact is registered for these trials, so a read is a defect rather
+ * than a missing file: the verdict has to be exactly the subject's own evidence.
+ */
+export const unregisteredSidecar = async () => { throw new Error('unregistered sidecar'); };
+/**
+ * The real child, the real loopback protocol and the real closure query: the only
+ * thing borrowed is the trial's own stimulus, because the worker owns the fresh
+ * workspace the launch receipt pins. Every continuation the budget admits defers,
+ * so the last one exhausts it — and by then the worker has stopped its own host.
+ *
+ * The caller owns the returned root: these trials write a real workspace and a real
+ * control root, and nothing here removes them.
+ */
+export async function nativeDeferredTrial(mode, maxDeliveries = 1, supplied) {
+    const fixture = await childFixture(mode);
+    const text = 'Sourced research reply';
+    let asked = 0;
+    const sourced = async () => {
+        const id = `answer-${asked++}`;
+        return { id, text, source: { kind: 'transport', id, sha256: `sha256:${createHash('sha256').update(text).digest('hex')}` } };
+    };
+    const next = supplied ? async () => { asked++; return supplied(); } : sourced;
+    const native = createDaimonNativeAdapter({ timeoutMs: 20_000, execution: { kind: 'child-process', externalInputs: { maxDeliveries, next } } });
+    const session = await native.start(fixture.input);
+    let turn;
+    const adapter = { id: 'daimon-native-child', capabilities: native.capabilities,
+        async start() {
+            return { run: async (value, signal) => { turn = await session.run({ id: value.id, text: value.text }, signal); return turn; },
+                stop: reason => session.stop(reason) };
+        } };
+    const options = { id: fixture.input.trialId, phase: 'train', record: filing(), candidateId: 'candidate',
+        datasetDigest: 'dataset', planDigest: 'plan', adapter, model: fixture.input.model, root: fixture.root, timeoutMs: 20_000,
+        prepare: async () => ({ instructions: fixture.input.instructions }), registry: createEvaluationRegistry(),
+        evaluation: { judges: {}, embeddings: {}, readText: unregisteredSidecar },
+        persist: async () => undefined };
+    const report = await runTrial(options);
+    return { report, turn: turn, deliveries: asked, root: fixture.root };
+}
+//# sourceMappingURL=deferred-trial.js.map

package/dist/runtime/daimon/training/native/child/deferred-trial.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deferred-trial.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/deferred-trial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAuC,MAAM,kCAAkC,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAGxD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;;;CAe3D,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;AAEhB;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAoB,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5G;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,aAAa,GAAG,CAAC,EACvE,QAA8B;IAC9B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,wBAAwB,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QAAG,MAAM,EAAE,GAAG,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;IAAC,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,MAAM,MAAM,GAAG,yBAAyB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/I,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,IAAmC,CAAC;IACxC,MAAM,OAAO,GAAmB,EAAE,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY;QAC5F,KAAK,CAAC,KAAK;YACT,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;gBAC3H,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,CAAC,EAAE,CAAC;IACN,MAAM,OAAO,GAAiB,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW;QACnH,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM;QACzH,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,wBAAwB,EAAE;QACzG,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,mBAAmB,EAAE;QACzE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC"}

package/dist/runtime/daimon/training/native/child/diagnostics.d.ts

@@ -0,0 +1,58 @@
+import type { SubjectStartupCapture, SubjectStartupDiagnostic } from '../../../../../training/index.js';
+export declare const redactedMarker = "[redacted]";
+export declare const redactedPathMarker = "[redacted-path]";
+export declare const withholdDetectors: readonly ["declared-secret", "bearer", "pem", "opaque-run"];
+export type WithholdDetector = typeof withholdDetectors[number];
+/**
+ * Removes every value this adapter knows to be secret, then refuses to call the
+ * result clean if anything credential-shaped is left.
+ *
+ * Substitution covers the control token, the declared environment values and the
+ * credential file paths. The assignment scrub covers a secret nobody declared: a
+ * line that echoes `SOMETHING=value` publishes the name and drops the value. What
+ * substitution cannot reach is an undeclared credential printed on its own — a
+ * bearer header, a PEM block, a long opaque token — so its presence makes the
+ * text unpublishable rather than published in the hope that it is harmless.
+ */
+export declare function redactNativeDiagnostic(text: string, secrets: readonly string[]): {
+    text: string;
+    clean: boolean;
+    detectors: readonly WithholdDetector[];
+};
+/**
+ * Carries the publishable record, and the unredacted capture, out of startup.
+ *
+ * The caller persists the record durably and writes the capture to the
+ * operator's own run output as an operator-only file. The capture never reaches
+ * the event stream, a report or a viewer projection.
+ */
+export declare class NativeStartupFailure extends Error {
+    readonly diagnostic: SubjectStartupDiagnostic;
+    readonly capture: SubjectStartupCapture;
+    constructor(message: string, diagnostic: SubjectStartupDiagnostic, capture: SubjectStartupCapture);
+}
+/** Protected process output, never a public observation or a model/judge input. */
+export declare function childDiagnostics(root: string, trialId: string, configSha256: string, secrets?: readonly string[]): Promise<{
+    file: string;
+    append(chunk: Buffer, stdout: boolean): void;
+    save(exitCode: number | null, exitSignal: NodeJS.Signals | null): Promise<void>;
+    /**
+     * The durable half of the protected file above.
+     *
+     * The full capture stays in the control root, which on a training slot is
+     * tmpfs that dies with the container; this redacted record is what an
+     * operator can still read afterwards, and it always names the failure class
+     * even when the bytes themselves have to be withheld.
+     */
+    /**
+     * The publishable record on its own, for a worker that died *after*
+     * readiness. Startup already published one; a mid-turn death published
+     * nothing at all, so the one account of why the worker stopped answering
+     * lived only in the protected file on the slot's tmpfs and died with the
+     * container. Same redaction, same withholding rules, no capture: this
+     * travels in the durable event stream, which outlives the container, and an
+     * unredacted capture has no business there.
+     */
+    record(caught: unknown): SubjectStartupDiagnostic;
+    startupFailure(caught: unknown): NativeStartupFailure;
+}>;

package/dist/runtime/daimon/training/native/child/diagnostics.js

@@ -0,0 +1,215 @@
+import { canonicalWireId } from '../../../../../training/index.js';
+import { lstat, realpath, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const limit = 65_536;
+/** Published tails are for identifying a defect class, not for reading a transcript. */
+const published = 4_096;
+/**
+ * Below this length a value cannot carry credential entropy, and substituting it
+ * would corrupt unrelated text while proving nothing. Such values are not
+ * redaction targets; the assignment scrub below still keeps them from being
+ * published as a named environment value.
+ */
+const shortestRedactableSecret = 8;
+/** Environment values are never published verbatim, including ones this adapter was never told were secret. */
+const assignment = /(^|[\s"'([{,;])([A-Za-z_][A-Za-z0-9_]{1,63})=(\S+)/gu;
+/** Paths whose name says credential: published as a class, never as a location. */
+const credentialPath = /(?:^|(?<=\s))\S*\/\S*(?:auth\.json|\.pem|\.key|token)\S*/giu;
+/** Undeclared credential-shaped material: what substitution cannot remove because nobody declared it. */
+const credentialShaped = [/bearer\s+\S+/iu, /-----BEGIN [A-Z ]*(?:PRIVATE KEY|CERTIFICATE)/u];
+const opaqueRun = /[A-Za-z0-9_-]{40,}/gu;
+export const redactedMarker = '[redacted]';
+export const redactedPathMarker = '[redacted-path]';
+const truncate = (text) => text.length > published ? `${text.slice(0, published)}…` : text;
+/** Longest message published from a frame; a frame is an identity and a sentence, not a transcript. */
+const framedMessage = 512;
+const maximumFrames = 8;
+export const withholdDetectors = ['declared-secret', 'bearer', 'pem', 'opaque-run'];
+/**
+ * Which detector refuses this text, named rather than counted.
+ *
+ * Knowing that a bearer header fired tells an operator "the runtime threw with a
+ * capability token in the message"; knowing that a long opaque run fired tells
+ * them "something printed a blob". Without the name, a withheld stream is
+ * indistinguishable from a crash with no output at all.
+ */
+function withholdingDetectors(text, survivingSecret) {
+    const detectors = [];
+    if (survivingSecret)
+        detectors.push('declared-secret');
+    if (credentialShaped[0].test(text))
+        detectors.push('bearer');
+    if (credentialShaped[1].test(text))
+        detectors.push('pem');
+    if ([...text.matchAll(opaqueRun)].some(match => !/^[0-9a-f]+$/u.test(match[0])))
+        detectors.push('opaque-run');
+    return detectors;
+}
+/**
+ * Removes every value this adapter knows to be secret, then refuses to call the
+ * result clean if anything credential-shaped is left.
+ *
+ * Substitution covers the control token, the declared environment values and the
+ * credential file paths. The assignment scrub covers a secret nobody declared: a
+ * line that echoes `SOMETHING=value` publishes the name and drops the value. What
+ * substitution cannot reach is an undeclared credential printed on its own — a
+ * bearer header, a PEM block, a long opaque token — so its presence makes the
+ * text unpublishable rather than published in the hope that it is harmless.
+ */
+export function redactNativeDiagnostic(text, secrets) {
+    const substitutable = [...new Set(secrets.filter(secret => secret.length >= shortestRedactableSecret))];
+    let value = text;
+    for (const secret of substitutable.sort((left, right) => right.length - left.length))
+        value = value.split(secret).join(redactedMarker);
+    value = value.replace(assignment, (_match, lead, key) => `${lead}${key}=${redactedMarker}`);
+    value = value.replace(credentialPath, redactedPathMarker);
+    const detectors = withholdingDetectors(value, substitutable.some(secret => value.includes(secret)));
+    return { text: value, clean: !detectors.length, detectors };
+}
+/** Every `{"schema":…}` line the runtime printed, with the field it states its failure in. */
+function readFrames(stream, text, secrets) {
+    const frames = [];
+    for (const line of text.split(/\r?\n/u)) {
+        if (frames.length >= maximumFrames || !line.trim().startsWith('{'))
+            continue;
+        let row;
+        try {
+            row = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!row || typeof row !== 'object' || typeof row.schema !== 'string' || !row.schema)
+            continue;
+        const stated = [row.error, row.reason, row.message].find(value => typeof value === 'string' && value);
+        if (stated === undefined) {
+            frames.push({ stream, schema: row.schema });
+            continue;
+        }
+        // The schema is an identity, never a secret, so it publishes even when the message it carries cannot.
+        const message = redactNativeDiagnostic(String(stated).slice(0, framedMessage), secrets);
+        frames.push({ stream, schema: row.schema, ...(message.clean ? { message: message.text } : { withheldBy: message.detectors }) });
+    }
+    return frames.length ? frames : undefined;
+}
+const lineCount = (text) => text ? text.split(/\r?\n/u).length : 0;
+/** The worker's own stated failure is the best reason; a frame from any layer beats an exit status. */
+function classify(frames, exitCode, exitSignal, fallback) {
+    const stated = frames?.filter(frame => frame.message !== undefined) ?? [];
+    const worker = stated.find(frame => canonicalWireId(frame.schema) === 'spawnfile.training.daimon-native.start-failed.v1');
+    // Any layer's own account — the worker's, or a caller bootstrap's — outranks an exit code.
+    const frame = worker ?? stated.at(-1);
+    if (frame)
+        return `${frame.schema}: ${frame.message}`;
+    if (exitSignal)
+        return `Native worker terminated by signal ${exitSignal}: ${fallback}`;
+    if (exitCode !== null && exitCode !== 0)
+        return `Native worker exited with code ${exitCode}: ${fallback}`;
+    return fallback;
+}
+/**
+ * Carries the publishable record, and the unredacted capture, out of startup.
+ *
+ * The caller persists the record durably and writes the capture to the
+ * operator's own run output as an operator-only file. The capture never reaches
+ * the event stream, a report or a viewer projection.
+ */
+export class NativeStartupFailure extends Error {
+    diagnostic;
+    capture;
+    constructor(message, diagnostic, capture) {
+        super(message);
+        this.diagnostic = diagnostic;
+        this.capture = capture;
+        this.name = 'NativeStartupFailure';
+    }
+}
+/** Protected process output, never a public observation or a model/judge input. */
+export async function childDiagnostics(root, trialId, configSha256, secrets = []) {
+    const directory = await lstat(root);
+    if (!directory.isDirectory() || directory.isSymbolicLink() || await realpath(root) !== root || (directory.mode & 0o777) !== 0o700) {
+        throw new Error('Native diagnostics require the protected canonical control directory');
+    }
+    const file = join(root, 'child-diagnostics.json');
+    const streams = { stdout: { bytes: Buffer.alloc(0), truncated: false }, stderr: { bytes: Buffer.alloc(0), truncated: false } };
+    let saved;
+    let status = { exitCode: null, exitSignal: null };
+    return {
+        file,
+        append(chunk, stdout) {
+            if (saved)
+                return;
+            const stream = stdout ? streams.stdout : streams.stderr;
+            const remaining = limit - stream.bytes.length;
+            stream.truncated ||= chunk.length > remaining;
+            if (remaining > 0)
+                stream.bytes = Buffer.concat([stream.bytes, chunk.subarray(0, remaining)]);
+        },
+        save(exitCode, exitSignal) {
+            status = { exitCode, exitSignal };
+            return saved ??= writeFile(file, JSON.stringify({ schema: 'spawnfile.training.daimon-native.child-diagnostics.v1', trialId, configSha256,
+                exitCode, exitSignal, limitBytesPerStream: limit,
+                stdout: streams.stdout.bytes.toString('utf8'), stderr: streams.stderr.bytes.toString('utf8'),
+                truncated: { stdout: streams.stdout.truncated, stderr: streams.stderr.truncated },
+            }) + '\n', { flag: 'wx', mode: 0o600 });
+        },
+        /**
+         * The durable half of the protected file above.
+         *
+         * The full capture stays in the control root, which on a training slot is
+         * tmpfs that dies with the container; this redacted record is what an
+         * operator can still read afterwards, and it always names the failure class
+         * even when the bytes themselves have to be withheld.
+         */
+        /**
+         * The publishable record on its own, for a worker that died *after*
+         * readiness. Startup already published one; a mid-turn death published
+         * nothing at all, so the one account of why the worker stopped answering
+         * lived only in the protected file on the slot's tmpfs and died with the
+         * container. Same redaction, same withholding rules, no capture: this
+         * travels in the durable event stream, which outlives the container, and an
+         * unredacted capture has no business there.
+         */
+        record(caught) {
+            return build(caught);
+        },
+        startupFailure(caught) {
+            const diagnostic = build(caught);
+            const raw = { stdout: streams.stdout.bytes.toString('utf8'), stderr: streams.stderr.bytes.toString('utf8') };
+            const capture = { basename: 'OPERATOR-ONLY.native-startup-capture.json',
+                content: `${JSON.stringify({ schema: 'spawnfile.training.daimon-native.operator-capture.v1', trialId, configSha256,
+                    exitCode: status.exitCode, exitSignal: status.exitSignal, protectedArtifact: file,
+                    limitBytesPerStream: limit, stdout: raw.stdout, stderr: raw.stderr,
+                    truncated: { stdout: streams.stdout.truncated, stderr: streams.stderr.truncated } }, null, 2)}\n` };
+            return new NativeStartupFailure(`Native worker failed before readiness: ${diagnostic.reason}`, diagnostic, capture);
+        },
+    };
+    function build(caught) {
+        const fallback = caught instanceof Error ? caught.message : String(caught);
+        const raw = { stdout: streams.stdout.bytes.toString('utf8'), stderr: streams.stderr.bytes.toString('utf8') };
+        const out = redactNativeDiagnostic(raw.stdout, secrets);
+        const err = redactNativeDiagnostic(raw.stderr, secrets);
+        // Frames publish per field, so one unpublishable message never costs the whole account of the failure.
+        const frames = [...readFrames('stdout', raw.stdout, secrets) ?? [], ...readFrames('stderr', raw.stderr, secrets) ?? []];
+        const reason = redactNativeDiagnostic(classify(frames, status.exitCode, status.exitSignal, fallback), secrets);
+        const clean = out.clean && err.clean;
+        const withheld = [['stdout', raw.stdout, out], ['stderr', raw.stderr, err]]
+            .filter(([, , result]) => !result.clean)
+            .map(([stream, text, result]) => ({ stream, bytes: Buffer.byteLength(text), lines: lineCount(text),
+            frame: frames.find(row => row.stream === stream)?.schema ?? null, detectors: result.detectors }));
+        const diagnostic = {
+            schema: 'spawnfile.training.daimon-native.startup-diagnostic.v1', trialId,
+            // A withheld stream still leaves the class identified, so the reason is kept whenever it is itself clean.
+            reason: reason.clean ? truncate(reason.text) : 'Native worker failed before readiness; its stated reason could not be published safely',
+            exitCode: status.exitCode, exitSignal: status.exitSignal,
+            redaction: clean ? 'applied' : 'withheld',
+            ...(clean ? { streams: { stdout: truncate(out.text), stderr: truncate(err.text),
+                    truncated: { stdout: streams.stdout.truncated || out.text.length > published, stderr: streams.stderr.truncated || err.text.length > published } } } : {}),
+            ...(frames.length ? { frames } : {}),
+            ...(withheld.length ? { withheld } : {}),
+            protectedArtifact: file,
+        };
+        return diagnostic;
+    }
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/runtime/daimon/training/native/child/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,KAAK,GAAG,MAAM,CAAC;AACrB,wFAAwF;AACxF,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,+GAA+G;AAC/G,MAAM,UAAU,GAAG,sDAAsD,CAAC;AAC1E,mFAAmF;AACnF,MAAM,cAAc,GAAG,6DAA6D,CAAC;AACrF,yGAAyG;AACzG,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;AAC9F,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAE3G,uGAAuG;AACvG,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAU,CAAC;AAG7F;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,eAAwB;IAClE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,eAAe;QAAE,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvD,IAAI,gBAAgB,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,gBAAgB,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,OAA0B;IAC7E,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACxG,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;IAC5G,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,MAA2B,EAAE,IAAY,EAAE,OAA0B;IACvF,MAAM,MAAM,GAAoD,EAAE,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7E,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAC/F,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC;QACtG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpF,sGAAsG;QACtG,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnF,uGAAuG;AACvG,SAAS,QAAQ,CAAC,MAA0C,EAAE,QAAuB,EAAE,UAAyB,EAAE,QAAgB;IAChI,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,kDAAkD,CAAC,CAAC;IAC1H,2FAA2F;IAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAQ,EAAE,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,sCAAsC,UAAU,KAAK,QAAQ,EAAE,CAAC;IACvF,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,kCAAkC,QAAQ,KAAK,QAAQ,EAAE,CAAC;IAC1G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACP;IAA+C;IAArF,YAAY,OAAe,EAAW,UAAoC,EAAW,OAA8B;QACjH,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,eAAU,GAAV,UAAU,CAA0B;QAAW,YAAO,GAAP,OAAO,CAAuB;QAEjH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,YAAoB,EAAE,UAA6B,EAAE;IACzH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAClI,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/H,IAAI,KAAgC,CAAC;IACrC,IAAI,MAAM,GAAmE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAClH,OAAO;QACL,IAAI;QACJ,MAAM,CAAC,KAAa,EAAE,MAAe;YACnC,IAAI,KAAK;gBAAE,OAAO;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACxD,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAC9C,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YAC9C,IAAI,SAAS,GAAG,CAAC;gBAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAuB,EAAE,UAAiC;YAC7D,MAAM,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,uDAAuD,EAAE,OAAO,EAAE,YAAY;gBACtI,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK;gBAChD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC5F,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE;aAClF,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD;;;;;;;WAOG;QACH;;;;;;;;WAQG;QACH,MAAM,CAAC,MAAe;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,cAAc,CAAC,MAAe;YAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7G,MAAM,OAAO,GAA0B,EAAE,QAAQ,EAAE,2CAA2C;gBAC5F,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD,EAAE,OAAO,EAAE,YAAY;oBAChH,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI;oBACjF,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACxG,OAAO,IAAI,oBAAoB,CAAC,0CAA0C,UAAU,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACtH,CAAC;KACF,CAAC;IACF,SAAS,KAAK,CAAC,MAAe;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7G,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,uGAAuG;QACvG,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;QACrC,MAAM,QAAQ,GAAI,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAW;aACnF,MAAM,CAAC,CAAC,CAAC,EAAE,AAAD,EAAG,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;YAChG,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,UAAU,GAA6B;YAC3C,MAAM,EAAE,wDAAwD,EAAE,OAAO;YACzE,0GAA0G;YAC1G,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wFAAwF;YACvI,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;YACxD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC7E,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3J,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,iBAAiB,EAAE,IAAI;SACxB,CAAC;QACF,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/runtime/daimon/training/native/child/fixture.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Real child/loopback protocol fixture only; it does not execute a model or prove
+ * sandboxing.
+ *
+ * `frames` names a file of terminal frames a REAL worker controller produced, one
+ * per wake. In that mode this fixture stops inventing evidence and replays them by
+ * wake id, which is the only way a test can put the worker's own poll and the
+ * parent's evidence reader on the same trial: the two halves live in different
+ * processes, and every fix that passed on one side alone went on to fail live.
+ */
+export declare function childFixture(mode?: string, frames?: string): Promise<{
+    root: string;
+    input: import("../../../../../training/index.js").SubjectStart;
+    launch: import("../receipt/schema.js").VerifiedNativeLaunch;
+    save(): Promise<void>;
+}>;