spawnfile 0.1.24 → 0.1.27

package/dist/runtime/daimon/training/native/child/fixture.js

@@ -0,0 +1,157 @@
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+import { readFile, writeFile } from 'node:fs/promises';
+import { launchFixture } from '../test-fixtures.js';
+import { sha256 } from '../receipt/index.js';
+/**
+ * Real child/loopback protocol fixture only; it does not execute a model or prove
+ * sandboxing.
+ *
+ * `frames` names a file of terminal frames a REAL worker controller produced, one
+ * per wake. In that mode this fixture stops inventing evidence and replays them by
+ * wake id, which is the only way a test can put the worker's own poll and the
+ * parent's evidence reader on the same trial: the two halves live in different
+ * processes, and every fix that passed on one side alone went on to fail live.
+ */
+export async function childFixture(mode = 'complete', frames) {
+    const f = await launchFixture();
+    // TMPDIR may sit below an ESM package (as it does in CI). This worker is CommonJS.
+    f.launch.bootstrap.entrypoint = 'bootstrap.cjs';
+    const reservation = createServer();
+    await new Promise(resolve => reservation.listen(0, '127.0.0.1', resolve));
+    f.launch.host.port = reservation.address().port;
+    await new Promise(resolve => reservation.close(() => resolve()));
+    f.launch.workspace.target = f.launch.workspace.source;
+    for (const row of f.launch.projections)
+        row.target = row.source;
+    const config = JSON.parse(await readFile(f.launch.config, 'utf8'));
+    config.host.port = f.launch.host.port;
+    config.agents[0].workspacePath = f.launch.workspace.target;
+    config.agents[0].runtimeHomePath = f.launch.projections[0].target;
+    config.agents[0].instructions = f.input.instructions;
+    const bytes = JSON.stringify(config);
+    f.launch.configSha256 = sha256(bytes);
+    await writeFile(f.launch.config, bytes);
+    await f.save();
+    await writeFile(f.launch.envFile, `UNIT_CHILD_MODE=${mode}\nNATIVE_TRANSPORT_TOKEN=unit-transport-value\n${frames ? `UNIT_CHILD_FRAMES=${frames}\n` : ''}`);
+    await writeFile(join(f.launch.bootstrap.root, f.launch.bootstrap.entrypoint), worker);
+    return f;
+}
+const worker = `
+const fs=require('node:fs'),http=require('node:http'),crypto=require('node:crypto'),path=require('node:path');
+const args=Object.fromEntries(process.argv.slice(2).reduce((rows,v,i,all)=>i%2?rows:[...rows,[v.slice(2),all[i+1]]],[]));
+const launch=JSON.parse(fs.readFileSync(args.launch)),token=fs.readFileSync(args['token-file'],'utf8').trim(),trial=args['trial-id'],mode=process.env.UNIT_CHILD_MODE;
+fs.writeFileSync(path.join(launch.controlRoot,'child-env.json'),JSON.stringify({fresh:!process.env.UNIT_PARENT_SECRET,home:process.env.HOME,transport:process.env.NATIVE_TRANSPORT_TOKEN,pid:process.pid}));
+if(mode==='noisy'){console.log('Bootstrap progress');process.stderr.write('Unit diagnostic');}
+if(mode==='leak'){process.stderr.write('upstream refused: Bearer sk-unit-'+'A1b2C3d4'.repeat(6)+'\\n');process.stderr.write(JSON.stringify({schema:'spawnfile.training.daimon-native.start-failed.v1',error:'unit missing native library'})+'\\n');process.exit(1);}
+if(mode==='exit'){process.stderr.write(JSON.stringify({schema:'spawnfile.training.daimon-native.start-failed.v1',error:'unit missing native library'})+'\\n');process.exit(1);}if(mode==='overflow'){process.stdout.write('X'.repeat(1100000));setInterval(()=>{},1000);return;}
+let terminal;const replay=process.env.UNIT_CHILD_FRAMES?JSON.parse(fs.readFileSync(process.env.UNIT_CHILD_FRAMES,'utf8')):undefined;const health={version:'noopolis.daimon.organization-runtime-health.v1',state:'running',agents:[{agentId:mode==='bad-health'?'foreign':launch.agent.id}]};
+// The real worker stops its own Daimon host as soon as a delivery closes its execution and
+// stays deferred with no continuation left, so the caller's closure query lands on a stopped
+// runtime. Daimon seals the v2 activity projection at that stop and keeps answering it;
+// an 'unanswerable' mode reproduces the host that answers HTTP 503 native_host_unavailable there.
+let hostStopped=false,wakes=0,budget=0,stopOutcome,items=[],admitted=[],closed=[];
+// Daimon's real seal keeps one accepted-delivery record per wake of the trial, so a
+// continued trial's projection is never the single-item shape one wake produces.
+const activity=()=>({version:'noopolis.daimon.organization-runtime-activity.v2',
+state:hostStopped?'stopped':'running',items,
+// A host that stopped with work still admitted seals that honestly, and the caller
+// must refuse the closure rather than read the empty-list case into it.
+// Production admits an execution for as long as its wake runs and drops it when the
+// wake closes, which is the whole of the live quiescence answer: a worker still in a
+// turn reports it here, and a caller reading anything else is reading its own notes.
+executions:hostStopped&&mode.endsWith('-busy-seal')?[{agent_id:launch.agent.id,execution_id:'x'.repeat(64),state:'running',delivery_ids:[]}]
+// A projection carrying an execution that is not this agent's cannot be counted at
+// all, and a count nobody can account for is the one answer closure must refuse.
+:mode==='foreign-execution'?[{agent_id:'another-agent',execution_id:'y'.repeat(64),state:'running',delivery_ids:[]}]
+:admitted.length?admitted:terminal?.activity?.executions??[]});
+// The worker settles its stop exactly once and every later /trial/stop replays that
+// same value, including an internal stop that did not acknowledge: control.ts races
+// host.stop() against a 5s deadline and memoizes whatever it got.
+const settleStop=()=>{hostStopped=true;stopOutcome=stopOutcome??(mode==='bad-stop'||mode.endsWith('-stop-unknown')
+?{schema:'spawnfile.training.daimon-native.stop.v1',state:'unknown',quiescence:'unknown',error:'unit native shutdown deadline exceeded'}
+:{schema:'spawnfile.training.daimon-native.stop.v1',state:'acknowledged',quiescence:'unknown',containmentVerification:'parent-container-owner'});return stopOutcome;};
+const server=http.createServer(async(req,res)=>{if(req.headers.authorization!=='Bearer '+token){res.writeHead(401);res.end();return;}
+if(req.url==='/v2/activity'&&hostStopped&&mode.endsWith('-unanswerable')){res.writeHead(503,{'content-type':'application/json'});res.end(JSON.stringify({error:'native_host_unavailable'}));return;}
+res.writeHead(200,{'content-type':'application/json'});
+if(req.url==='/trial/health'){res.end(JSON.stringify(health));return;}
+if(req.url==='/v2/activity'){res.end(JSON.stringify(activity()));return;}
+if(req.url==='/trial/stop'){res.end(JSON.stringify(settleStop()));return;}
+// An admitted execution names the deliveries it covers, because that projection is
+// the runtime's own binding of a delivery to an execution and the only thing that
+// answers for a wake whose receipt has already dropped its execution id.
+if(req.url==='/trial/run'){const running={agent_id:launch.agent.id,execution_id:crypto.randomUUID(),state:'running',delivery_ids:[]};admitted=[...admitted,running];
+if(mode==='stall')return;if(mode==='die-mid-turn'){process.stderr.write('worker: stream bound crossed, terminating\\n');server.closeAllConnections();process.exit(1);}let text='';for await(const chunk of req)text+=chunk;const input=JSON.parse(text),id=crypto.randomUUID(),at=new Date().toISOString();
+// The runtime's own binding of this delivery to the execution running it: the
+// projection names the delivery ids an admitted execution covers.
+running.delivery_ids=[trial+':'+input.wakeId];
+admitted=admitted.filter(row=>row!==running);
+// A real worker's own frames, replayed verbatim: this fixture authors nothing in
+// this mode, so what the reader parses is exactly what the worker published.
+if(replay){terminal=replay.find(row=>row.wakeId===input.wakeId);if(!terminal){res.end('{}');return;}items=[...items,{...terminal.receipt,active:false}];res.end(JSON.stringify(terminal));return;}
+if(!wakes++)budget=input.controls?.maxExternalDeliveries??0;
+const receipt={version:'noopolis.daimon.wake-receipt-status.v2',acceptance_id:crypto.randomUUID(),agent_id:launch.agent.id,delivery_id:trial+':'+input.wakeId,request_digest:'a'.repeat(64),state:'completed',accepted_at:at,updated_at:at,execution_id:id};
+items=[...items,{...receipt,active:false,queue_position:wakes}];
+const closedTrace={schema:'daimon.turn_trace.v1',agent_id:launch.agent.id,turn_id:id,started_at:at,completed_at:at,status:'completed',tools:[]};
+closed=[...closed,closedTrace];
+// Every wake of a continued trial closes an execution of its own, and a worker that
+// does not strip its own history publishes all of them on the frame. The frame still
+// names the one THIS wake closed; the '-history' modes are that shape, with the two
+// ways it can go wrong beside it: an earlier trace that is not this agent's work at
+// all, and two traces answering to the one execution the frame names.
+const history=mode.includes('-history')?closed.map(row=>({...row})):[closedTrace];
+// Both faults are injected only once the trial HAS history, so neither can be
+// mistaken for the arity: the first wake of each mode publishes a clean single trace.
+if(history.length>1&&mode.endsWith('-foreign'))history[0]={...history[0],agent_id:'another-agent'};
+if(history.length>1&&mode.endsWith('-ambiguous'))history.push({...closedTrace});
+terminal={schema:'spawnfile.training.daimon-native.trial.v1',trialId:trial,wakeId:input.wakeId,agentId:launch.agent.id,model:launch.agent.model,configSha256:launch.configSha256,status:'completed',startedAt:at,completedAt:at,executionId:id,receipt,activity:{version:'noopolis.daimon.organization-runtime-activity.v2',items:[{...receipt,active:false}],executions:[]},native:{traces:history,usage:[{v:'noopolis.daimon.turn-usage.v1',agent:launch.agent.id,wake:id,engine:'codex',input:100,output:20,cache_read:40,total:120,complete:true}],toolReceipts:[],modelContexts:[{model:launch.agent.model}]},coverage:[{channel:'usage',completeness:'complete',ordering:'source'}]};
+// Daimon CLEARS the receipt's execution id when the subject defers the delivery,
+// so a deferred wake's frame names an execution its own receipt no longer does.
+// A fixture that kept it made every reader test bind through a field production
+// never supplies on this path.
+if((mode.startsWith('blocked')||mode==='undisposed')&&(input.wakeId==='task'||mode.startsWith('blocked-always'))){terminal.status='failed';terminal.blocked='awaiting-external-input';receipt.state='accepted';receipt.deferred=true;delete receipt.execution_id;
+if(wakes>budget)settleStop();
+terminal.error='Native execution completed; delivery blocked awaiting external input';
+// Production derives \`blocked\` from the deferred marker, so a delivery without one
+// never carries it; control.ts reports the disposition it actually found and stops
+// the host on its own failure path. A fixture pairing the two is a shape nothing emits.
+// A reclaimed-undisposed delivery keeps its execution id; only a deferral clears it.
+if(mode==='blocked-no-deferred'||mode==='undisposed'){delete receipt.deferred;delete terminal.blocked;receipt.execution_id=id;receipt.code='active_wake_aborted';
+terminal.error='Native execution completed; delivery reclaimed undisposed (active_wake_aborted)';settleStop();}
+if(mode==='blocked-failed-trace')terminal.native.traces[0].status='failed';
+if(mode==='blocked-active')terminal.activity.executions=[{agent_id:launch.agent.id,turn_id:id}];
+if(mode==='blocked-wrong-execution')terminal.executionId='foreign';
+// The same observed shape — a deferred delivery over a closed trace, on a frame that
+// names an execution nothing answers to — placed on the wakes a continued trial adds.
+// '-unbound-continuation' binds the assignment and loses only its continuations, which
+// is the trial that had an admissible frame and published none; '-unbound' loses every
+// wake, so nothing in it may be selected however many frames it published.
+if(mode==='blocked-always-unbound'||mode.startsWith('blocked-always-unbound-continuation')&&input.wakeId!=='task')terminal.executionId='foreign';
+if(mode==='blocked-always-failed-continuation-foreign'&&input.wakeId!=='task')terminal.native.traces[0].status='failed';
+if(mode.endsWith('-continuation-foreign')&&input.wakeId!=='task')terminal.native.traces.push({...closedTrace,turn_id:'foreign-execution',agent_id:'another-agent'});}
+// A closed execution the broker sealed on the subject's own declared timeout: the
+// worker labels the frame only when that execution's own usage row says so;
+// '-unbacked' is a label that row does not support.
+if(mode.startsWith('limit')){terminal.status='failed';receipt.state='failed';closedTrace.status='failed';closedTrace.error={message:'engine broker turn failed (limit_exceeded; limit=timeout)',stage:'engine_prompt'};
+terminal.native.usage[0].complete=false;terminal.native.usage[0].limit_reason=mode.startsWith('limit-unlabelled')||mode==='limit-unbacked'?'none':'timeout';terminal.coverage=[{channel:'usage',completeness:'partial',ordering:'source'}];
+terminal.error='Native execution failed: Grok broker turn limit_exceeded (limit_reason timeout)';if(!mode.startsWith('limit-unlabelled'))terminal.limit='timeout';
+// A timeout counts only once the trace spans the configured wake ceiling (20s here);
+// '-idle' is Daimon's idle watchdog sealing the same reason after a short stall.
+closedTrace.started_at=new Date(Date.parse(at)-(mode==='limit-idle'?1000:20000)).toISOString();
+// Daimon's retry shape: the failed execution ran again under a fresh id, and after that
+// failed too the receipt is accepted, deferred and no longer names an execution.
+if(mode==='limit-retried'){const first={...closedTrace,turn_id:crypto.randomUUID()};terminal.native.traces=[first,closedTrace];
+terminal.native.usage=[{...terminal.native.usage[0],wake:first.turn_id},terminal.native.usage[0]];receipt.state='accepted';receipt.deferred=true;delete receipt.execution_id;
+terminal.activity.items=[{...receipt,active:false}];}
+settleStop();}
+if(mode==='bad-terminal')terminal.trialId='foreign';
+// A frame whose receipt answers for another trial's delivery, with every other
+// identity on the frame itself matching: the delivery is the only thing that says so.
+if(mode==='foreign-delivery')receipt.delivery_id='other-trial:'+input.wakeId;
+res.end(JSON.stringify(terminal));return;}
+res.end('{}');});
+const engine=launch.agent.engine==='grok'?{engine:'grok',reasoningEffort:mode==='bad-effort'?'high':launch.agent.reasoningEffort}:{};
+server.listen(launch.host.port,'127.0.0.1',()=>console.log(JSON.stringify({schema:'spawnfile.training.daimon-native.ready.v1',trialId:mode==='bad-ready'?'foreign':trial,configSha256:launch.configSha256,agentId:launch.agent.id,model:mode==='bad-model'?'grok-4.5':launch.agent.model,port:launch.host.port,...engine})));
+process.on('SIGTERM',()=>{if(mode==='ignore-term')return;server.closeAllConnections();server.close(()=>process.exit(0));});
+`;
+//# sourceMappingURL=fixture.js.map

package/dist/runtime/daimon/training/native/child/fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/fixture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAI,GAAG,UAAU,EAAE,MAAe;IACnE,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;IAChC,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,SAAU,CAAC,UAAU,GAAG,eAAe,CAAC;IACjD,MAAM,WAAW,GAAG,YAAY,EAAE,CAAC;IAAC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAI,WAAW,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACtE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IAClG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;IAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,IAAI,kDAAkD,MAAM,CAAC,CAAC,CAAC,qBAAqB,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5J,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoHd,CAAC"}

package/dist/runtime/daimon/training/native/child/grok.d.ts

@@ -0,0 +1,14 @@
+import type { GrokSlotFreshnessStore } from '../../services/index.js';
+import { type GrokNativeLaunch, type VerifiedNativeLaunch } from '../receipt/index.js';
+/**
+ * Grok slot isolation is proven by the root slot supervisor's receipt, which
+ * the worker already verified with Daimon's verifier. The parent re-binds it
+ * without Daimon and adds the caller's protected paths: each one, every launch
+ * evaluator root and the control root must be an exact denied canary. The two
+ * digest-bound subject roots are the one exemption, for the reason
+ * `grokSubjectRoots` states; a protected path inside them is still required. No local
+ * `codex sandbox` process runs and no model is called. The receipt must carry
+ * this trial's recycle nonce and a generation above the last one the
+ * evaluator's persisted freshness state accepted; acceptance advances that state.
+ */
+export declare function verifyChildGrokSlot(launch: VerifiedNativeLaunch & GrokNativeLaunch, trialId: string, protectedPaths: readonly string[], slots: GrokSlotFreshnessStore | undefined): Promise<void>;

package/dist/runtime/daimon/training/native/child/grok.js

@@ -0,0 +1,47 @@
+import { lstat, realpath, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { grokSubjectRoots, nativeTrialArtifactsRoot, parseGrokBrokerReceipt, readPrivateFile, requiredGrokEvaluatorPaths } from '../receipt/index.js';
+/**
+ * Grok slot isolation is proven by the root slot supervisor's receipt, which
+ * the worker already verified with Daimon's verifier. The parent re-binds it
+ * without Daimon and adds the caller's protected paths: each one, every launch
+ * evaluator root and the control root must be an exact denied canary. The two
+ * digest-bound subject roots are the one exemption, for the reason
+ * `grokSubjectRoots` states; a protected path inside them is still required. No local
+ * `codex sandbox` process runs and no model is called. The receipt must carry
+ * this trial's recycle nonce and a generation above the last one the
+ * evaluator's persisted freshness state accepted; acceptance advances that state.
+ */
+export async function verifyChildGrokSlot(launch, trialId, protectedPaths, slots) {
+    try {
+        if (!slots)
+            throw new Error('Grok child execution requires the evaluator slot freshness store');
+        // Exempt the digest-bound subject roots BEFORE validating shapes: the evaluator reaches its own
+        // trial workspace and runtime home through symlinks into the slot, and a symlink is neither a
+        // file nor a directory to `lstat`. Everything the receipt must deny is still validated below.
+        const subject = grokSubjectRoots(launch);
+        // Match subject roots by resolved target, not by spelling: the evaluator's own trial workspace and
+        // runtime home are symlinks into the slot, while the launch names the slot paths the digest binds.
+        const resolved = new Set(await Promise.all(subject.map(async (root) => realpath(root).catch(() => root))));
+        const exempt = await Promise.all(protectedPaths.map(async (path) => subject.includes(path) || resolved.has(await realpath(path).catch(() => path))));
+        const required = protectedPaths.filter((_, index) => !exempt[index]);
+        for (const path of required) {
+            const entry = await lstat(path);
+            if (!entry.isDirectory() && !entry.isFile())
+                throw new Error(`Unsupported protected native path: ${path}`);
+        }
+        const artifacts = nativeTrialArtifactsRoot(launch, trialId);
+        const receipt = parseGrokBrokerReceipt(JSON.parse(await readPrivateFile(join(artifacts, 'sandbox-projection.json'), 1_048_576)), launch, trialId, required);
+        await slots.accept(receipt.projection.slot, receipt.slotPreflight);
+        await writeFile(join(artifacts, 'child-sandbox-preflight.json'), JSON.stringify({ schema: 'spawnfile.training.daimon-native.child-grok-slot-preflight.v1',
+            trialId, configSha256: launch.configSha256, projectionSha256: receipt.projectionSha256, slot: receipt.projection.slot,
+            workerUid: receipt.projection.workerUid, slotPreflightCreatedAt: receipt.slotPreflight.created_at, slotGeneration: receipt.slotPreflight.generation, modelCallsMade: 0, localSandboxProbe: false,
+            evaluatorPathsDenied: [...new Set([...requiredGrokEvaluatorPaths(launch), ...required])].sort() }), { flag: 'wx', mode: 0o600 });
+    }
+    catch (error) {
+        // Name the underlying refusal: a wrapped cause is invisible in the published failure record.
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Grok broker slot preflight failed before cognition: ${reason}`, { cause: error });
+    }
+}
+//# sourceMappingURL=grok.js.map

package/dist/runtime/daimon/training/native/child/grok.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/grok.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,eAAe,EAAE,0BAA0B,EACpE,MAAM,qBAAqB,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA+C,EAAE,OAAe,EAAE,cAAiC,EAC3I,KAAyC;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAChG,gGAAgG;QAChG,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzC,mGAAmG;QACnG,mGAAmG;QACnG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,EAAE,SAAS,CAAC,CAAC,EAC7H,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,+DAA+D;YACvJ,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YACrH,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,EAAE,iBAAiB,EAAE,KAAK;YAChM,oBAAoB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,0BAA0B,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC"}

package/dist/runtime/daimon/training/native/child/index.d.ts

@@ -0,0 +1,7 @@
+export { startOwnedChild, bindTerminalEvidence } from './lifecycle.js';
+export { nativeChildArguments } from './arguments.js';
+export type { NativeChildExecution } from './types.js';
+export { createGrokSlotFreshnessStore } from '../../services/index.js';
+export type { GrokSlotFreshness, GrokSlotFreshnessOptions, GrokSlotFreshnessStore } from '../../services/index.js';
+export { redactNativeDiagnostic, redactedMarker, redactedPathMarker, withholdDetectors } from './diagnostics.js';
+export type { WithholdDetector } from './diagnostics.js';

package/dist/runtime/daimon/training/native/child/index.js

@@ -0,0 +1,5 @@
+export { startOwnedChild, bindTerminalEvidence } from './lifecycle.js';
+export { nativeChildArguments } from './arguments.js';
+export { createGrokSlotFreshnessStore } from '../../services/index.js';
+export { redactNativeDiagnostic, redactedMarker, redactedPathMarker, withholdDetectors } from './diagnostics.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/daimon/training/native/child/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/runtime/daimon/training/native/child/lifecycle.d.ts

@@ -0,0 +1,40 @@
+import type { TerminalEvidenceMissing } from '../../../../../training/index.js';
+import { type VerifiedNativeLaunch } from '../receipt/index.js';
+import { type TerminalEvidence } from '../worker/index.js';
+import { type NativeExecutionHandle } from '../transport/index.js';
+import { type TransportDeliverySource } from '../worker/index.js';
+import type { NativeChildExecution } from './types.js';
+/** One fresh worker process in the caller's existing container; no Docker or remote proof. */
+export declare function startOwnedChild(execution: NativeChildExecution, launch: VerifiedNativeLaunch, trialId: string, timeoutMs: number, signal?: AbortSignal, startupMs?: number, protectedPaths?: readonly string[]): Promise<NativeExecutionHandle>;
+/** One delivery's place in the ledger: which wake it was, and why its frame cannot be scored. */
+interface WakeEvidence {
+    wakeId: string;
+    source?: TransportDeliverySource;
+    unevidenced?: TerminalEvidenceMissing;
+}
+/**
+ * Whether ONE wake's frame can be scored from — never whether something is still
+ * spending, and never a verdict about the trial around it.
+ *
+ * A frame from another trial, agent, wake or config is not this trial's evidence,
+ * and that check lives here rather than in the closure predicate. The receipt has
+ * to name this trial's own delivery too: the frame's identity and the delivery the
+ * runtime answered for are one delivery, or the frame is accounting for somebody
+ * else's wake. Those are attribution failures, so they `seal` the whole trial:
+ * nothing this runtime published can be scored past one.
+ *
+ * A trial whose subject deferred runs its continuations as further wakes, and each
+ * one closes an execution of its own. The trace that answers for THIS frame is the
+ * one the frame names; the rest are this same trial's earlier, already-closed
+ * wakes, and counting them was refusing a healthy run for the arity of its own
+ * history. Nothing is admitted by position: an unnamed execution resolves to no
+ * trace at all, and that is this wake's own fault rather than the trial's.
+ *
+ * An identity conflict still throws, because it must fail the turn rather than
+ * pass as verified work; it only records what it was first. Two traces answering
+ * to the named execution is its own word: the frame is not unbound, it is
+ * unreadable, and that distinction is what sends the next look at it upstream
+ * instead of here.
+ */
+export declare function bindTerminalEvidence(wake: WakeEvidence, value: TerminalEvidence, launch: VerifiedNativeLaunch, trialId: string, seal: (fault: TerminalEvidenceMissing) => void, wakeTimeoutMs?: number): void;
+export {};