spawnfile 0.1.24 → 0.1.27

package/dist/runtime/daimon/training/native/receipt/grok-clocked-pins.d.ts

@@ -0,0 +1,129 @@
+export declare const grokClockedWorkerConfigPins: readonly [{
+    readonly "grok-4.6": {
+        readonly low: "751f1dcd04983e5e5883df5a8fefa04f201e187e5ef1f344d3bf83f950830432";
+        readonly medium: "f1406f93a8091eb0c09e07321254a9c783a89b0bbf5548d9613d53a8d087a517";
+        readonly high: "203744f6f0dfc0bc80cfb896880497edfd9b3de4dcf33060e8ef4d2ef5f220a7";
+    };
+    readonly "grok-4.5": {
+        readonly low: "3c4f3515b21c1bffb3fb770e2ecb4b918b6c43d5e77c1fd47e1e6698d1fedee7";
+        readonly medium: "9117e12b2f3f6fa045799592969cbaae1c2f3b1ea79330badac8655b9b41dd7a";
+        readonly high: "907d8967960c342b442d6d256b2585f3c85bd846a78578f596f0b605403d6d34";
+    };
+    readonly "grok-build": {
+        readonly low: "a8c63ba910623a0686930c27db0733f4a2588c7fca9dd7da25c3f18027720ab5";
+        readonly medium: "6afcd2b90c0d19794f8c0d22147a0f011946a92e613f89dae98b0ca729313101";
+        readonly high: "6efddadc82c38020d3351829e54bb09fa456cd6d76ea1247902794d82a4a3ffa";
+    };
+}, {
+    readonly "grok-4.6": {
+        readonly low: "9a648763631d96a4cfac1c6e927b6670dd7674eb5a550a15bc1125713d58c5ce";
+        readonly medium: "d7b8cd3b9cd9d02610d7b5b0fd262b285307d688e0c4f01a8634ffde292a64a9";
+        readonly high: "da6c6cd82c8bcb650746abf895578bbdc76ced9a9a0ffef83c6b0e1112444f28";
+    };
+    readonly "grok-4.5": {
+        readonly low: "4cc2774a6f48abc9bcf386330427c77626b5f55f1a845aaa5f8658aa29ead6eb";
+        readonly medium: "0b90f5401f9dd788a4f18e6a0e96c15002fbd85ae95f42893cc54dd6eda2b3da";
+        readonly high: "29eee59f4df4dea611d62145e59e775b44950dbc68ff9548e119ac81d150b238";
+    };
+    readonly "grok-build": {
+        readonly low: "bceb42600257876eca5c9f902057d2b76249c824b05c8e282a421dabbbfd534b";
+        readonly medium: "3eb1f3b996cc452944839c5db295da476677f6b50fa6631388d3ade2706fb79b";
+        readonly high: "a0f5a7bcdf87e2a25b7cddde7e2e22ab077819eb037fd6079e5a4a2ed28a4a56";
+    };
+}, {
+    readonly "grok-4.6": {
+        readonly low: "3abba33c7664b3c4e4ca5582a2a7155fa5c995f452baf84eb111bbe1119f48bc";
+        readonly medium: "5bf0f18b2746ab4241216b2bc80ada3ef1010110710b3392dab885b82b0688f9";
+        readonly high: "a64c3fb448bf5307a72adf675396c87bca796a3d7ea75aed050202ebcb173367";
+    };
+    readonly "grok-4.5": {
+        readonly low: "06f052192b4c7c1d8ae204153c6be42704a15e2fe1bf60c08b5039ac23b3fafe";
+        readonly medium: "b808308d66faf34d278c44c5c4412b2f494424e76bef1d9b8dd5d0143fe276fb";
+        readonly high: "f9cdfa297ac4c909c1f556d6c67c815dc225ff4f67e4a7f0788236cac1f701b8";
+    };
+    readonly "grok-build": {
+        readonly low: "0e1eda926d41bec517f30abe1bf019e233b6ea967f4bc1177f6ce3a67ab6f325";
+        readonly medium: "edf9f7afd4404d9b7db84ed7f890ec39a5c23982adec904e7b48e5a20dd1f273";
+        readonly high: "2276e14a3152d5453f48491f17591f7eb7bd03d220adf81fa6715ca121c91cd9";
+    };
+}, {
+    readonly "grok-4.6": {
+        readonly low: "005fa436585cc34843104bacbc9ed9ad1056e24d22616b07da5e48a13a5aab36";
+        readonly medium: "e0cb186b021c630b12957f40657b069d7d8bb6e8f1aa275760c84205decd041c";
+        readonly high: "9897c21ec861376530b3fc53e44701f5ad40023a74c4916bed043959a5abb4ff";
+    };
+    readonly "grok-4.5": {
+        readonly low: "fc45a3c03055cd2e613c50d5cc4f083a01dbaaf5d78794f71fe8d309585d6c23";
+        readonly medium: "380d3c71f71eba63c26f2bcfb41ce8811472d2efd7dc227e43bd8cbf70796ce1";
+        readonly high: "b12b0df7eac944c6ca5a7669582c26625559f9b7b54820d13b50000110291076";
+    };
+    readonly "grok-build": {
+        readonly low: "6443fde406463506b271a3b067964579a605a411d40118bae26e45f5fb9f5f44";
+        readonly medium: "8ab7301f14ddd8a26e53702101efe87b67f1a118fdcd735132ba5a8c16740d62";
+        readonly high: "9a4321ebf77973e45014e0ba6691ae4731780abc3ad7d41ae3c41e339095b6b5";
+    };
+}, {
+    readonly "grok-4.6": {
+        readonly low: "8aaa269214b8714f14b518fdd6318c4a9aa122e9834efda62118c5c280b90608";
+        readonly medium: "bfbbbb7dcc4570f19c801c46b7385488adde980e35220a7ec9f513fe248aacbb";
+        readonly high: "28eff95dc906938dd7b1dbfa591dd11f06b1e811c34ecf92e6b2312668e2b826";
+    };
+    readonly "grok-4.5": {
+        readonly low: "38a5c281e60a284494c07962da791c5ffaa4a2c866755aafcab9486a2c520f9d";
+        readonly medium: "8505a5aba87dbecd9e94316228a86847b40b9b99ebd4ecd8b7348579fb094064";
+        readonly high: "7a3f253587c3d3d6e8ef897907083b3485a64e9c49d20acec4d5b2ea9174b5db";
+    };
+    readonly "grok-build": {
+        readonly low: "f2cefbd48f7709841387ca83ee0dff06726ecb353ca158d5ee0ac9ae4807bb5e";
+        readonly medium: "11e25910196d697202279c2c523c43f7390274f2b20130f33924359fccacd0cc";
+        readonly high: "b00faee7b2b282157ec9a6efa61fe44bd01b59964d045fae6da3553e5bb905b0";
+    };
+}, {
+    readonly "grok-4.6": {
+        readonly low: "4003dd53f883eda76d2b2cef3a13cdb090232458ceb6feac8fca4df69e7b1436";
+        readonly medium: "6af81480a2407389c8a67f51c8e8eef75db7dd3ed253dee5bec3adedbf578d09";
+        readonly high: "8bae24c4deab8bcd0bdfd66eb942dc7712ad18b5e2878660571503ac83367f32";
+    };
+    readonly "grok-4.5": {
+        readonly low: "2cc31957ff602e0798eb4b9a28327a1786a9c37c12ef630705b2aa98add802da";
+        readonly medium: "79c1291ae0d2e92bf1322be62e8ec7ddd1f5d18cf754a4d5542188ba06b0b964";
+        readonly high: "d444ff62ec0385db25d53855f73f8b8835a7ece8cedd9e84fff4c6722c327164";
+    };
+    readonly "grok-build": {
+        readonly low: "7fd9df94045c8b06cfe445f525da81c12335d9a1975ee1669b96e37d1a177d47";
+        readonly medium: "9eb1da8e00ace0ec0d8013c757cebdf1839f5658f25fcabf4f13e69e70469f9c";
+        readonly high: "ff0410b3dba932c044e0a93886907809039b7954fa101c840032d5e10dd05200";
+    };
+}, {
+    readonly "grok-4.6": {
+        readonly low: "8d11c3ea89e617e3180709da71452e3893ab45bafe3964129e71958d8736751a";
+        readonly medium: "e811109be2c9248bf72ae89917eded4cff5c5e90ec42b1f4a1435ead547605a8";
+        readonly high: "576d75b8d1a72e954c8baa7313c21530fc236a1fe4c38f0ad989f977b87e2b4a";
+    };
+    readonly "grok-4.5": {
+        readonly low: "92046efbcf71a04019b8b50e74008dfa511272dede81dee85d71f3dd41724e52";
+        readonly medium: "71ed171e8d39749d2d374375e5a65b9e5e4f7685cd1f04f58e07b14dcc00a539";
+        readonly high: "8ec8b6d69defb418fa004c0b38096c987ebed94486aab145ea038fa0f3d5006d";
+    };
+    readonly "grok-build": {
+        readonly low: "a2f296b80252fefa5eda6d5232dca5b9aa1dbb5a59da781116df469ee66e7804";
+        readonly medium: "7223f7d43439f79ece6203d79c9bcebd2273de639192e531383dc87e01f54a63";
+        readonly high: "58c48d844e3c4456f332fbc0a383040e6842adbc94ddf29163dba1463c0276cc";
+    };
+}, {
+    readonly "grok-4.6": {
+        readonly low: "cb8baf51c1fe1dd833ffc7be66155dd1409f8d33a6919b9e38cac81f23b1709a";
+        readonly medium: "c832ca846869ad49f48dd83aea8215d921ba1eb2ecdc5a11f46817c25b4684e5";
+        readonly high: "85b55d35daffc43401d2b4434856ec6848e71120356cd296450c2bd3d65f4043";
+    };
+    readonly "grok-4.5": {
+        readonly low: "177c2957c3dfad8e6ff038c3cf1ea314eabe1e8c66586a171c2b45107ffe4b1b";
+        readonly medium: "04d7098cfcc5870ec753d952f91dfcf86e1dbaee7a582f5ff35447dfe643aeab";
+        readonly high: "45964c587f5fde70188943576723d01e89fdc6a735782cf67a04067b3b5eac6c";
+    };
+    readonly "grok-build": {
+        readonly low: "8a424a524737a194558c7abf62eebe1d75d734a33db525385f157ae6140b2cae";
+        readonly medium: "d5c3103b98c78b434561709a0abcf02cf9748a32119781fbbb4e90dd8b58d521";
+        readonly high: "074e9c5d797631f10630a1c44d7f02b8558c78b33bf8a6ade47165eab9ce73f7";
+    };
+}];

package/dist/runtime/daimon/training/native/receipt/grok-clocked-pins.js

@@ -0,0 +1,45 @@
+// Manifest v5 clocked worker config digests from Daimon public grokBrokerWorkerConfigSha256.
+// Slot index, then declared model and effort; parity is checked against the optional peer.
+export const grokClockedWorkerConfigPins = [
+    {
+        "grok-4.6": { "low": "751f1dcd04983e5e5883df5a8fefa04f201e187e5ef1f344d3bf83f950830432", "medium": "f1406f93a8091eb0c09e07321254a9c783a89b0bbf5548d9613d53a8d087a517", "high": "203744f6f0dfc0bc80cfb896880497edfd9b3de4dcf33060e8ef4d2ef5f220a7" },
+        "grok-4.5": { "low": "3c4f3515b21c1bffb3fb770e2ecb4b918b6c43d5e77c1fd47e1e6698d1fedee7", "medium": "9117e12b2f3f6fa045799592969cbaae1c2f3b1ea79330badac8655b9b41dd7a", "high": "907d8967960c342b442d6d256b2585f3c85bd846a78578f596f0b605403d6d34" },
+        "grok-build": { "low": "a8c63ba910623a0686930c27db0733f4a2588c7fca9dd7da25c3f18027720ab5", "medium": "6afcd2b90c0d19794f8c0d22147a0f011946a92e613f89dae98b0ca729313101", "high": "6efddadc82c38020d3351829e54bb09fa456cd6d76ea1247902794d82a4a3ffa" },
+    },
+    {
+        "grok-4.6": { "low": "9a648763631d96a4cfac1c6e927b6670dd7674eb5a550a15bc1125713d58c5ce", "medium": "d7b8cd3b9cd9d02610d7b5b0fd262b285307d688e0c4f01a8634ffde292a64a9", "high": "da6c6cd82c8bcb650746abf895578bbdc76ced9a9a0ffef83c6b0e1112444f28" },
+        "grok-4.5": { "low": "4cc2774a6f48abc9bcf386330427c77626b5f55f1a845aaa5f8658aa29ead6eb", "medium": "0b90f5401f9dd788a4f18e6a0e96c15002fbd85ae95f42893cc54dd6eda2b3da", "high": "29eee59f4df4dea611d62145e59e775b44950dbc68ff9548e119ac81d150b238" },
+        "grok-build": { "low": "bceb42600257876eca5c9f902057d2b76249c824b05c8e282a421dabbbfd534b", "medium": "3eb1f3b996cc452944839c5db295da476677f6b50fa6631388d3ade2706fb79b", "high": "a0f5a7bcdf87e2a25b7cddde7e2e22ab077819eb037fd6079e5a4a2ed28a4a56" },
+    },
+    {
+        "grok-4.6": { "low": "3abba33c7664b3c4e4ca5582a2a7155fa5c995f452baf84eb111bbe1119f48bc", "medium": "5bf0f18b2746ab4241216b2bc80ada3ef1010110710b3392dab885b82b0688f9", "high": "a64c3fb448bf5307a72adf675396c87bca796a3d7ea75aed050202ebcb173367" },
+        "grok-4.5": { "low": "06f052192b4c7c1d8ae204153c6be42704a15e2fe1bf60c08b5039ac23b3fafe", "medium": "b808308d66faf34d278c44c5c4412b2f494424e76bef1d9b8dd5d0143fe276fb", "high": "f9cdfa297ac4c909c1f556d6c67c815dc225ff4f67e4a7f0788236cac1f701b8" },
+        "grok-build": { "low": "0e1eda926d41bec517f30abe1bf019e233b6ea967f4bc1177f6ce3a67ab6f325", "medium": "edf9f7afd4404d9b7db84ed7f890ec39a5c23982adec904e7b48e5a20dd1f273", "high": "2276e14a3152d5453f48491f17591f7eb7bd03d220adf81fa6715ca121c91cd9" },
+    },
+    {
+        "grok-4.6": { "low": "005fa436585cc34843104bacbc9ed9ad1056e24d22616b07da5e48a13a5aab36", "medium": "e0cb186b021c630b12957f40657b069d7d8bb6e8f1aa275760c84205decd041c", "high": "9897c21ec861376530b3fc53e44701f5ad40023a74c4916bed043959a5abb4ff" },
+        "grok-4.5": { "low": "fc45a3c03055cd2e613c50d5cc4f083a01dbaaf5d78794f71fe8d309585d6c23", "medium": "380d3c71f71eba63c26f2bcfb41ce8811472d2efd7dc227e43bd8cbf70796ce1", "high": "b12b0df7eac944c6ca5a7669582c26625559f9b7b54820d13b50000110291076" },
+        "grok-build": { "low": "6443fde406463506b271a3b067964579a605a411d40118bae26e45f5fb9f5f44", "medium": "8ab7301f14ddd8a26e53702101efe87b67f1a118fdcd735132ba5a8c16740d62", "high": "9a4321ebf77973e45014e0ba6691ae4731780abc3ad7d41ae3c41e339095b6b5" },
+    },
+    {
+        "grok-4.6": { "low": "8aaa269214b8714f14b518fdd6318c4a9aa122e9834efda62118c5c280b90608", "medium": "bfbbbb7dcc4570f19c801c46b7385488adde980e35220a7ec9f513fe248aacbb", "high": "28eff95dc906938dd7b1dbfa591dd11f06b1e811c34ecf92e6b2312668e2b826" },
+        "grok-4.5": { "low": "38a5c281e60a284494c07962da791c5ffaa4a2c866755aafcab9486a2c520f9d", "medium": "8505a5aba87dbecd9e94316228a86847b40b9b99ebd4ecd8b7348579fb094064", "high": "7a3f253587c3d3d6e8ef897907083b3485a64e9c49d20acec4d5b2ea9174b5db" },
+        "grok-build": { "low": "f2cefbd48f7709841387ca83ee0dff06726ecb353ca158d5ee0ac9ae4807bb5e", "medium": "11e25910196d697202279c2c523c43f7390274f2b20130f33924359fccacd0cc", "high": "b00faee7b2b282157ec9a6efa61fe44bd01b59964d045fae6da3553e5bb905b0" },
+    },
+    {
+        "grok-4.6": { "low": "4003dd53f883eda76d2b2cef3a13cdb090232458ceb6feac8fca4df69e7b1436", "medium": "6af81480a2407389c8a67f51c8e8eef75db7dd3ed253dee5bec3adedbf578d09", "high": "8bae24c4deab8bcd0bdfd66eb942dc7712ad18b5e2878660571503ac83367f32" },
+        "grok-4.5": { "low": "2cc31957ff602e0798eb4b9a28327a1786a9c37c12ef630705b2aa98add802da", "medium": "79c1291ae0d2e92bf1322be62e8ec7ddd1f5d18cf754a4d5542188ba06b0b964", "high": "d444ff62ec0385db25d53855f73f8b8835a7ece8cedd9e84fff4c6722c327164" },
+        "grok-build": { "low": "7fd9df94045c8b06cfe445f525da81c12335d9a1975ee1669b96e37d1a177d47", "medium": "9eb1da8e00ace0ec0d8013c757cebdf1839f5658f25fcabf4f13e69e70469f9c", "high": "ff0410b3dba932c044e0a93886907809039b7954fa101c840032d5e10dd05200" },
+    },
+    {
+        "grok-4.6": { "low": "8d11c3ea89e617e3180709da71452e3893ab45bafe3964129e71958d8736751a", "medium": "e811109be2c9248bf72ae89917eded4cff5c5e90ec42b1f4a1435ead547605a8", "high": "576d75b8d1a72e954c8baa7313c21530fc236a1fe4c38f0ad989f977b87e2b4a" },
+        "grok-4.5": { "low": "92046efbcf71a04019b8b50e74008dfa511272dede81dee85d71f3dd41724e52", "medium": "71ed171e8d39749d2d374375e5a65b9e5e4f7685cd1f04f58e07b14dcc00a539", "high": "8ec8b6d69defb418fa004c0b38096c987ebed94486aab145ea038fa0f3d5006d" },
+        "grok-build": { "low": "a2f296b80252fefa5eda6d5232dca5b9aa1dbb5a59da781116df469ee66e7804", "medium": "7223f7d43439f79ece6203d79c9bcebd2273de639192e531383dc87e01f54a63", "high": "58c48d844e3c4456f332fbc0a383040e6842adbc94ddf29163dba1463c0276cc" },
+    },
+    {
+        "grok-4.6": { "low": "cb8baf51c1fe1dd833ffc7be66155dd1409f8d33a6919b9e38cac81f23b1709a", "medium": "c832ca846869ad49f48dd83aea8215d921ba1eb2ecdc5a11f46817c25b4684e5", "high": "85b55d35daffc43401d2b4434856ec6848e71120356cd296450c2bd3d65f4043" },
+        "grok-4.5": { "low": "177c2957c3dfad8e6ff038c3cf1ea314eabe1e8c66586a171c2b45107ffe4b1b", "medium": "04d7098cfcc5870ec753d952f91dfcf86e1dbaee7a582f5ff35447dfe643aeab", "high": "45964c587f5fde70188943576723d01e89fdc6a735782cf67a04067b3b5eac6c" },
+        "grok-build": { "low": "8a424a524737a194558c7abf62eebe1d75d734a33db525385f157ae6140b2cae", "medium": "d5c3103b98c78b434561709a0abcf02cf9748a32119781fbbb4e90dd8b58d521", "high": "074e9c5d797631f10630a1c44d7f02b8558c78b33bf8a6ade47165eab9ce73f7" },
+    },
+];
+//# sourceMappingURL=grok-clocked-pins.js.map

package/dist/runtime/daimon/training/native/receipt/grok-clocked-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-clocked-pins.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/receipt/grok-clocked-pins.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;IACD;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;IACD;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;IACD;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;IACD;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;IACD;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;IACD;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;IACD;QACE,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,UAAU,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;QACjP,YAAY,EAAE,EAAC,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAC;KACpP;CACO,CAAC"}

package/dist/runtime/daimon/training/native/receipt/grok.d.ts

@@ -0,0 +1,246 @@
+import { z } from 'zod';
+import { type GrokNativeLaunch } from './schema.js';
+/** Independent manifest v5 worker pins; inference client configs have their own grant pins. */
+export declare const grokWorkerConfigPins: {
+    readonly unclocked: {
+        readonly 'grok-4.6': {
+            readonly low: "ab58499ac32678097c146479896f2b8a8e2b0e39aea22dc0a60b6227e370538e";
+            readonly medium: "df1a5cc84346e7f6bf6090492fbd19faaefb42953e3bb2e8c6cbc0572242403f";
+            readonly high: "65b0212564fb74042b1503d293fb8d3620276033264c0efade2a539ca09218e3";
+        };
+        readonly 'grok-4.5': {
+            readonly low: "8247127c3625ff7c5d8d527a53596b89ec6557a821ac46cfd00bd122b90daff6";
+            readonly medium: "59288cee61297bb8c002097061a48f77b09d310754187a253ee089f7172a9155";
+            readonly high: "c63c3387ce92d94ec3f690abfe98942afcd7c9e17ff84816bbe751f340ab251f";
+        };
+        readonly 'grok-build': {
+            readonly low: "fb343f2809903f26d21681470943235031f946e99085542fd89555eb7782cbb5";
+            readonly medium: "8a587ef75c90eab70d19b24583e60051d6fba9d90c558839fdbb15588b4cc656";
+            readonly high: "a23724e00d670caee185ba7690d2daa868173e53905cf446f5329666f01ab4e3";
+        };
+    };
+    readonly clocked: {
+        readonly "grok-4.6": {
+            readonly low: "751f1dcd04983e5e5883df5a8fefa04f201e187e5ef1f344d3bf83f950830432";
+            readonly medium: "f1406f93a8091eb0c09e07321254a9c783a89b0bbf5548d9613d53a8d087a517";
+            readonly high: "203744f6f0dfc0bc80cfb896880497edfd9b3de4dcf33060e8ef4d2ef5f220a7";
+        };
+        readonly "grok-4.5": {
+            readonly low: "3c4f3515b21c1bffb3fb770e2ecb4b918b6c43d5e77c1fd47e1e6698d1fedee7";
+            readonly medium: "9117e12b2f3f6fa045799592969cbaae1c2f3b1ea79330badac8655b9b41dd7a";
+            readonly high: "907d8967960c342b442d6d256b2585f3c85bd846a78578f596f0b605403d6d34";
+        };
+        readonly "grok-build": {
+            readonly low: "a8c63ba910623a0686930c27db0733f4a2588c7fca9dd7da25c3f18027720ab5";
+            readonly medium: "6afcd2b90c0d19794f8c0d22147a0f011946a92e613f89dae98b0ca729313101";
+            readonly high: "6efddadc82c38020d3351829e54bb09fa456cd6d76ea1247902794d82a4a3ffa";
+        };
+    };
+};
+export declare const grokTaskClockPin: {
+    readonly preloadPath: "/usr/local/lib/daimon/libfaketime.so.1";
+    readonly timestampFilePath: "/run/daimon-engine-broker/task-clock/slot-0/faketime";
+    readonly directoryPath: "/run/daimon-engine-broker/task-clock/slot-0";
+    readonly rootDirectoryPath: "/run/daimon-engine-broker/task-clock";
+    readonly directoryMode: 493;
+    readonly fileMode: 420;
+    readonly ownerUid: 2100;
+    readonly version: "noopolis.daimon.grok-broker-task-clock.v2";
+    readonly slotDirectoryPattern: "/run/daimon-engine-broker/task-clock/slot-{slot}";
+    readonly slotFilePattern: "/run/daimon-engine-broker/task-clock/slot-{slot}/faketime";
+    readonly workerView: "own-directory-visible-sibling-directories-denied";
+};
+/** Structural mirror of Daimon's public `noopolis.daimon.grok-broker-projection.v3`; Daimon stays the resolver. */
+export declare const grokBrokerProjectionSchema: z.ZodObject<{
+    version: z.ZodLiteral<"noopolis.daimon.grok-broker-projection.v3">;
+    agentId: z.ZodString;
+    workspacePath: z.ZodString;
+    runtimeHomePath: z.ZodString;
+    workerUid: z.ZodNumber;
+    slot: z.ZodNumber;
+    profilePath: z.ZodString;
+    profileSha256: z.ZodString;
+    denyPaths: z.ZodArray<z.ZodString>;
+    workerConfigSha256: z.ZodString;
+    systemPromptSha256: z.ZodString;
+    grokCliVersion: z.ZodString;
+    workerConfigVariant: z.ZodEnum<{
+        unclocked: "unclocked";
+        clocked: "clocked";
+    }>;
+    taskClock: z.ZodOptional<z.ZodObject<{
+        preloadPath: z.ZodLiteral<"/usr/local/lib/daimon/libfaketime.so.1">;
+        timestampFilePath: z.ZodString;
+        directoryPath: z.ZodString;
+        directoryMode: z.ZodLiteral<493>;
+        fileMode: z.ZodLiteral<420>;
+        ownerUid: z.ZodLiteral<2100>;
+        version: z.ZodLiteral<"noopolis.daimon.grok-broker-task-clock.v2">;
+        rootDirectoryPath: z.ZodLiteral<"/run/daimon-engine-broker/task-clock">;
+        slotDirectoryPattern: z.ZodLiteral<"/run/daimon-engine-broker/task-clock/slot-{slot}">;
+        slotFilePattern: z.ZodLiteral<"/run/daimon-engine-broker/task-clock/slot-{slot}/faketime">;
+        workerView: z.ZodLiteral<"own-directory-visible-sibling-directories-denied">;
+    }, z.core.$strict>>;
+    grokExecutableSha256: z.ZodString;
+    nativeAbiVersion: z.ZodNumber;
+    model: z.ZodEnum<{
+        "grok-4.6": "grok-4.6";
+        "grok-4.5": "grok-4.5";
+        "grok-build": "grok-build";
+    }>;
+    reasoningEffort: z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>;
+    limits: z.ZodObject<{
+        maxRequests: z.ZodNumber;
+        maxTokens: z.ZodNumber;
+        timeoutMs: z.ZodNumber;
+    }, z.core.$strict>;
+    usageLedgerPath: z.ZodString;
+    seccompProfileSha256: z.ZodString;
+    attestation: z.ZodObject<{
+        platform: z.ZodLiteral<"linux/landlock">;
+        enforced: z.ZodLiteral<true>;
+        restrictNetwork: z.ZodLiteral<true>;
+        profileName: z.ZodString;
+        sandboxRuntime: z.ZodLiteral<"bubblewrap">;
+        eventsPath: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type GrokBrokerProjection = z.infer<typeof grokBrokerProjectionSchema>;
+/**
+ * Mirror of `noopolis.daimon.grok-slot-preflight.v2` at Daimon's strictness (first worker uid,
+ * exact RFC3339 instant, unique canaries). The worker still verifies with Daimon's own verifier first.
+ */
+export declare const grokSlotPreflightSchema: z.ZodObject<{
+    version: z.ZodLiteral<"noopolis.daimon.grok-slot-preflight.v2">;
+    slot: z.ZodNumber;
+    worker_uid: z.ZodNumber;
+    generation: z.ZodNumber;
+    nonce: z.ZodString;
+    projection_sha256: z.ZodString;
+    sandbox_profile_sha256: z.ZodString;
+    seccomp_profile_sha256: z.ZodString;
+    sandbox_runtime: z.ZodLiteral<"bubblewrap">;
+    grok_executable_sha256: z.ZodString;
+    canaries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        method: z.ZodLiteral<"sandboxed-read">;
+        result: z.ZodLiteral<"denied">;
+    }, z.core.$strict>>;
+    created_at: z.ZodString;
+}, z.core.$strict>;
+export type GrokSlotPreflight = z.infer<typeof grokSlotPreflightSchema>;
+export declare const grokBrokerReceiptSchema = "spawnfile.training.daimon-native.grok-broker-projection.v1";
+declare const receiptSchema: z.ZodObject<{
+    schema: z.ZodPreprocess<z.ZodLiteral<"spawnfile.training.daimon-native.grok-broker-projection.v1">>;
+    trialId: z.ZodString;
+    configSha256: z.ZodString;
+    projectionSha256: z.ZodString;
+    projection: z.ZodObject<{
+        version: z.ZodLiteral<"noopolis.daimon.grok-broker-projection.v3">;
+        agentId: z.ZodString;
+        workspacePath: z.ZodString;
+        runtimeHomePath: z.ZodString;
+        workerUid: z.ZodNumber;
+        slot: z.ZodNumber;
+        profilePath: z.ZodString;
+        profileSha256: z.ZodString;
+        denyPaths: z.ZodArray<z.ZodString>;
+        workerConfigSha256: z.ZodString;
+        systemPromptSha256: z.ZodString;
+        grokCliVersion: z.ZodString;
+        workerConfigVariant: z.ZodEnum<{
+            unclocked: "unclocked";
+            clocked: "clocked";
+        }>;
+        taskClock: z.ZodOptional<z.ZodObject<{
+            preloadPath: z.ZodLiteral<"/usr/local/lib/daimon/libfaketime.so.1">;
+            timestampFilePath: z.ZodString;
+            directoryPath: z.ZodString;
+            directoryMode: z.ZodLiteral<493>;
+            fileMode: z.ZodLiteral<420>;
+            ownerUid: z.ZodLiteral<2100>;
+            version: z.ZodLiteral<"noopolis.daimon.grok-broker-task-clock.v2">;
+            rootDirectoryPath: z.ZodLiteral<"/run/daimon-engine-broker/task-clock">;
+            slotDirectoryPattern: z.ZodLiteral<"/run/daimon-engine-broker/task-clock/slot-{slot}">;
+            slotFilePattern: z.ZodLiteral<"/run/daimon-engine-broker/task-clock/slot-{slot}/faketime">;
+            workerView: z.ZodLiteral<"own-directory-visible-sibling-directories-denied">;
+        }, z.core.$strict>>;
+        grokExecutableSha256: z.ZodString;
+        nativeAbiVersion: z.ZodNumber;
+        model: z.ZodEnum<{
+            "grok-4.6": "grok-4.6";
+            "grok-4.5": "grok-4.5";
+            "grok-build": "grok-build";
+        }>;
+        reasoningEffort: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>;
+        limits: z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            maxTokens: z.ZodNumber;
+            timeoutMs: z.ZodNumber;
+        }, z.core.$strict>;
+        usageLedgerPath: z.ZodString;
+        seccompProfileSha256: z.ZodString;
+        attestation: z.ZodObject<{
+            platform: z.ZodLiteral<"linux/landlock">;
+            enforced: z.ZodLiteral<true>;
+            restrictNetwork: z.ZodLiteral<true>;
+            profileName: z.ZodString;
+            sandboxRuntime: z.ZodLiteral<"bubblewrap">;
+            eventsPath: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    slotPreflight: z.ZodObject<{
+        version: z.ZodLiteral<"noopolis.daimon.grok-slot-preflight.v2">;
+        slot: z.ZodNumber;
+        worker_uid: z.ZodNumber;
+        generation: z.ZodNumber;
+        nonce: z.ZodString;
+        projection_sha256: z.ZodString;
+        sandbox_profile_sha256: z.ZodString;
+        seccomp_profile_sha256: z.ZodString;
+        sandbox_runtime: z.ZodLiteral<"bubblewrap">;
+        grok_executable_sha256: z.ZodString;
+        canaries: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            method: z.ZodLiteral<"sandboxed-read">;
+            result: z.ZodLiteral<"denied">;
+        }, z.core.$strict>>;
+        created_at: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type GrokBrokerReceipt = z.infer<typeof receiptSchema>;
+/** Daimon's canonical JSON (UTF-16 key sort, plain JSON data only); its digest is what a slot receipt binds. */
+export declare function canonicalJson(value: unknown): string;
+export declare const grokProjectionSha256: (projection: GrokBrokerProjection) => string;
+/**
+ * The two digest-bound writable roots a Grok launch runs the subject in.
+ *
+ * The trial runner protects its own layout without knowing the engine, so it
+ * also names the runtime home — which for a Grok slot is the subject's own home
+ * and one of the roots the projection binds as `workspacePath`/`runtimeHomePath`.
+ * A caller cannot both hand the subject a root and demand the subject be denied
+ * it, so these exact roots are exempt from the caller's protected set. Nothing
+ * else is: a protected path *inside* one of them is still refused, because the
+ * exemption matches the root itself, never a descendant.
+ */
+export declare function grokSubjectRoots(launch: GrokNativeLaunch): string[];
+/** Every evaluator root a Grok launch declares, plus its control root (Daimon's acceptance store). */
+export declare function requiredGrokEvaluatorPaths(launch: GrokNativeLaunch): string[];
+export declare function bindGrokBrokerProjection(projection: unknown, slotPreflight: unknown, trialId: string, configSha256: string): GrokBrokerReceipt;
+/**
+ * Re-binds a persisted Grok projection receipt without loading Daimon: the
+ * projection must be this launch's slot, its canonical digest must equal the
+ * launch and the slot receipt, the receipt must deny exactly the projected
+ * paths, and every evaluator path (plus `extraRequired`) must be one of those
+ * denied canaries. Launch control files must sit inside a denied root.
+ */
+export declare function parseGrokBrokerReceipt(value: unknown, launch: GrokNativeLaunch, trialId: string, extraRequired?: readonly string[]): GrokBrokerReceipt;
+export {};

package/dist/runtime/daimon/training/native/receipt/grok.js

@@ -0,0 +1,195 @@
+import { compatibleWireLiteral } from '../../../../../training/index.js';
+import { grokClockedWorkerConfigPins } from './grok-clocked-pins.js';
+import { createHash } from 'node:crypto';
+import { posix } from 'node:path';
+import { z } from 'zod';
+import { grokModels, grokReasoningEfforts } from './schema.js';
+const sha = z.string().regex(/^[a-f0-9]{64}$/u);
+const canonical = z.string().max(4096).refine(value => posix.isAbsolute(value) && posix.normalize(value) === value &&
+    value !== '/' && !value.endsWith('/') && !value.includes('\0'), 'canonical absolute path');
+const count = z.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+/** Independent manifest v5 worker pins; inference client configs have their own grant pins. */
+export const grokWorkerConfigPins = {
+    unclocked: {
+        'grok-4.6': { low: 'ab58499ac32678097c146479896f2b8a8e2b0e39aea22dc0a60b6227e370538e', medium: 'df1a5cc84346e7f6bf6090492fbd19faaefb42953e3bb2e8c6cbc0572242403f', high: '65b0212564fb74042b1503d293fb8d3620276033264c0efade2a539ca09218e3' },
+        'grok-4.5': { low: '8247127c3625ff7c5d8d527a53596b89ec6557a821ac46cfd00bd122b90daff6', medium: '59288cee61297bb8c002097061a48f77b09d310754187a253ee089f7172a9155', high: 'c63c3387ce92d94ec3f690abfe98942afcd7c9e17ff84816bbe751f340ab251f' },
+        'grok-build': { low: 'fb343f2809903f26d21681470943235031f946e99085542fd89555eb7782cbb5', medium: '8a587ef75c90eab70d19b24583e60051d6fba9d90c558839fdbb15588b4cc656', high: 'a23724e00d670caee185ba7690d2daa868173e53905cf446f5329666f01ab4e3' },
+    },
+    clocked: grokClockedWorkerConfigPins[0],
+};
+export const grokTaskClockPin = {
+    "preloadPath": "/usr/local/lib/daimon/libfaketime.so.1",
+    "timestampFilePath": "/run/daimon-engine-broker/task-clock/slot-0/faketime",
+    "directoryPath": "/run/daimon-engine-broker/task-clock/slot-0",
+    "rootDirectoryPath": "/run/daimon-engine-broker/task-clock",
+    "directoryMode": 493,
+    "fileMode": 420,
+    "ownerUid": 2100,
+    "version": "noopolis.daimon.grok-broker-task-clock.v2",
+    "slotDirectoryPattern": "/run/daimon-engine-broker/task-clock/slot-{slot}",
+    "slotFilePattern": "/run/daimon-engine-broker/task-clock/slot-{slot}/faketime",
+    "workerView": "own-directory-visible-sibling-directories-denied"
+};
+/** Structural mirror of Daimon's public `noopolis.daimon.grok-broker-projection.v3`; Daimon stays the resolver. */
+export const grokBrokerProjectionSchema = z.strictObject({
+    version: z.literal('noopolis.daimon.grok-broker-projection.v3'), agentId: z.string().min(1).max(128),
+    workspacePath: canonical, runtimeHomePath: canonical, workerUid: count, slot: count, profilePath: canonical, profileSha256: sha,
+    denyPaths: z.array(canonical).min(1).max(256), workerConfigSha256: sha, systemPromptSha256: sha, grokCliVersion: z.string().min(1).max(64),
+    workerConfigVariant: z.enum(['unclocked', 'clocked']),
+    taskClock: z.strictObject({ preloadPath: z.literal(grokTaskClockPin.preloadPath), timestampFilePath: canonical,
+        directoryPath: canonical, directoryMode: z.literal(grokTaskClockPin.directoryMode),
+        fileMode: z.literal(grokTaskClockPin.fileMode), ownerUid: z.literal(grokTaskClockPin.ownerUid), version: z.literal(grokTaskClockPin.version), rootDirectoryPath: z.literal(grokTaskClockPin.rootDirectoryPath),
+        slotDirectoryPattern: z.literal(grokTaskClockPin.slotDirectoryPattern), slotFilePattern: z.literal(grokTaskClockPin.slotFilePattern),
+        workerView: z.literal(grokTaskClockPin.workerView) }).optional(),
+    grokExecutableSha256: sha, nativeAbiVersion: count, model: z.enum(grokModels), reasoningEffort: z.enum(grokReasoningEfforts),
+    limits: z.strictObject({ maxRequests: count, maxTokens: count, timeoutMs: count }), usageLedgerPath: canonical, seccompProfileSha256: sha,
+    attestation: z.strictObject({ platform: z.literal('linux/landlock'), enforced: z.literal(true), restrictNetwork: z.literal(true),
+        profileName: z.string().min(1).max(128), sandboxRuntime: z.literal('bubblewrap'), eventsPath: canonical }),
+}).refine(projection => (projection.workerConfigVariant === 'clocked') === (projection.taskClock !== undefined), { message: 'Grok taskClock must match workerConfigVariant', path: ['taskClock'] })
+    .refine(projection => !projection.taskClock || (projection.taskClock.directoryPath === grokTaskClockPin.slotDirectoryPattern.replace('{slot}', String(projection.slot))
+    && projection.taskClock.timestampFilePath === grokTaskClockPin.slotFilePattern.replace('{slot}', String(projection.slot))), { message: 'Grok taskClock must belong to its slot', path: ['taskClock'] })
+    .refine(projection => projection.workerConfigSha256 === (projection.workerConfigVariant === 'clocked'
+    ? grokClockedWorkerConfigPins[projection.slot]?.[projection.model][projection.reasoningEffort]
+    : grokWorkerConfigPins.unclocked[projection.model][projection.reasoningEffort]), { message: 'Grok worker config digest differs from the pinned variant/model/effort', path: ['workerConfigSha256'] });
+const nonce = z.string().regex(/^[a-f0-9]{64}$/u);
+/**
+ * Mirror of `noopolis.daimon.grok-slot-preflight.v2` at Daimon's strictness (first worker uid,
+ * exact RFC3339 instant, unique canaries). The worker still verifies with Daimon's own verifier first.
+ */
+export const grokSlotPreflightSchema = z.strictObject({
+    version: z.literal('noopolis.daimon.grok-slot-preflight.v2'), slot: count, worker_uid: z.number().int().min(2200).max(4_294_967_294),
+    generation: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER), nonce,
+    projection_sha256: sha, sandbox_profile_sha256: sha, seccomp_profile_sha256: sha, sandbox_runtime: z.literal('bubblewrap'), grok_executable_sha256: sha,
+    canaries: z.array(z.strictObject({ path: canonical, method: z.literal('sandboxed-read'), result: z.literal('denied') })).min(1).max(256),
+    created_at: z.string().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u)
+        .refine(value => !Number.isNaN(Date.parse(value)) && new Date(value).toISOString() === value, 'exact RFC3339 timestamp'),
+}).superRefine((receipt, context) => {
+    const paths = receipt.canaries.map(canary => canary.path);
+    if (new Set(paths).size !== paths.length)
+        context.addIssue({ code: 'custom', path: ['canaries'], message: 'duplicate canary path' });
+});
+export const grokBrokerReceiptSchema = 'spawnfile.training.daimon-native.grok-broker-projection.v1';
+const receiptSchema = z.strictObject({ schema: compatibleWireLiteral(grokBrokerReceiptSchema), trialId: z.string().min(1), configSha256: sha,
+    projectionSha256: sha, projection: grokBrokerProjectionSchema, slotPreflight: grokSlotPreflightSchema });
+const scalars = (value) => {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                throw new Error('Canonical JSON rejects unpaired surrogates');
+            index++;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff)
+            throw new Error('Canonical JSON rejects unpaired surrogates');
+    }
+    return JSON.stringify(value);
+};
+/** Daimon's canonical JSON (UTF-16 key sort, plain JSON data only); its digest is what a slot receipt binds. */
+export function canonicalJson(value) {
+    if (value === null || typeof value === 'boolean')
+        return JSON.stringify(value);
+    if (typeof value === 'string')
+        return scalars(value);
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value) || Object.is(value, -0))
+            throw new Error('Canonical JSON rejects non-finite numbers');
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index++)
+            if (!Object.hasOwn(value, index))
+                throw new Error('Canonical JSON rejects sparse arrays');
+        return `[${value.map(canonicalJson).join(',')}]`;
+    }
+    if (typeof value !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+        throw new Error('Canonical JSON requires plain data');
+    const keys = Reflect.ownKeys(value);
+    if (keys.some(key => typeof key !== 'string'))
+        throw new Error('Canonical JSON rejects symbol keys');
+    return `{${keys.sort().map(key => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor.enumerable || !('value' in descriptor))
+            throw new Error('Canonical JSON requires data properties');
+        return `${scalars(key)}:${canonicalJson(descriptor.value)}`;
+    }).join(',')}}`;
+}
+export const grokProjectionSha256 = (projection) => createHash('sha256').update(canonicalJson(projection)).digest('hex');
+const within = (root, path) => path === root || path.startsWith(`${root}/`);
+/**
+ * The two digest-bound writable roots a Grok launch runs the subject in.
+ *
+ * The trial runner protects its own layout without knowing the engine, so it
+ * also names the runtime home — which for a Grok slot is the subject's own home
+ * and one of the roots the projection binds as `workspacePath`/`runtimeHomePath`.
+ * A caller cannot both hand the subject a root and demand the subject be denied
+ * it, so these exact roots are exempt from the caller's protected set. Nothing
+ * else is: a protected path *inside* one of them is still refused, because the
+ * exemption matches the root itself, never a descendant.
+ */
+export function grokSubjectRoots(launch) {
+    const home = launch.projections.find(row => row.role === 'home');
+    return [...new Set([launch.workspace.source, launch.workspace.target, home.source, home.target])];
+}
+/** Every evaluator root a Grok launch declares, plus its control root (Daimon's acceptance store). */
+export function requiredGrokEvaluatorPaths(launch) {
+    return [...new Set([...launch.broker.evaluatorPaths.map(row => row.path), launch.controlRoot])].sort();
+}
+export function bindGrokBrokerProjection(projection, slotPreflight, trialId, configSha256) {
+    const parsed = grokBrokerProjectionSchema.parse(projection);
+    return receiptSchema.parse({ schema: grokBrokerReceiptSchema, trialId, configSha256, projectionSha256: grokProjectionSha256(parsed), projection: parsed, slotPreflight });
+}
+/**
+ * Re-binds a persisted Grok projection receipt without loading Daimon: the
+ * projection must be this launch's slot, its canonical digest must equal the
+ * launch and the slot receipt, the receipt must deny exactly the projected
+ * paths, and every evaluator path (plus `extraRequired`) must be one of those
+ * denied canaries. Launch control files must sit inside a denied root.
+ */
+export function parseGrokBrokerReceipt(value, launch, trialId, extraRequired = []) {
+    const receipt = receiptSchema.parse(value);
+    const { projection, slotPreflight: slot } = receipt;
+    const { broker } = launch;
+    const home = launch.projections.find(row => row.role === 'home').target;
+    const digest = grokProjectionSha256(projection);
+    const mismatch = (member) => { throw new Error(`Grok broker projection is not bound to this trial and launch: ${member}`); };
+    if (receipt.trialId !== trialId || receipt.configSha256 !== launch.configSha256)
+        mismatch('trial');
+    if (projection.agentId !== launch.agent.id || projection.workspacePath !== launch.workspace.target || projection.runtimeHomePath !== home)
+        mismatch('agent');
+    if (projection.model !== launch.agent.model || projection.reasoningEffort !== launch.agent.reasoningEffort)
+        mismatch('model');
+    if (projection.version !== broker.projectionVersion || projection.workerConfigVariant !== broker.workerConfigVariant)
+        mismatch('workerConfigVariant');
+    if (launch.taskClock && projection.workerConfigVariant !== 'clocked')
+        throw new Error('Grok taskClock requires workerConfigVariant: clocked');
+    if (projection.slot !== broker.slot || projection.workerUid !== broker.workerUid || projection.usageLedgerPath !== broker.usageLedgerPath ||
+        projection.seccompProfileSha256 !== broker.seccompProfileSha256 || canonicalJson(projection.limits) !== canonicalJson(broker.limits))
+        mismatch('slot');
+    if (receipt.projectionSha256 !== digest || digest !== broker.projectionSha256 || slot.projection_sha256 !== digest)
+        mismatch('projection_sha256');
+    // Freshness: this recycle's nonce, never a generation below the evaluator's persisted floor.
+    if (slot.nonce !== broker.expectedNonce)
+        throw new Error('Grok slot preflight receipt is stale: nonce');
+    if (slot.generation < broker.minGeneration)
+        throw new Error('Grok slot preflight receipt is stale: generation');
+    if (slot.slot !== projection.slot || slot.worker_uid !== projection.workerUid || slot.sandbox_profile_sha256 !== projection.profileSha256 ||
+        slot.grok_executable_sha256 !== projection.grokExecutableSha256 || slot.seccomp_profile_sha256 !== projection.seccompProfileSha256)
+        mismatch('slot_preflight');
+    const denied = slot.canaries.map(canary => canary.path).sort();
+    if (canonicalJson(denied) !== canonicalJson([...projection.denyPaths].sort()))
+        mismatch('canaries');
+    for (const path of [...requiredGrokEvaluatorPaths(launch), ...extraRequired]) {
+        // A mask on an ancestor denies everything beneath it (the lifted-mask policy the supervisor
+        // applies), so an exact canary or any denied ancestor satisfies the requirement.
+        const covered = denied.some(root => path === root || path.startsWith(root === '/' ? '/' : `${root}/`));
+        if (!covered)
+            throw new Error(`Grok slot preflight omits a denied canary for evaluator path ${path}`);
+    }
+    for (const file of [launch.config, launch.tokenFile, launch.envFile]) {
+        if (!denied.some(root => within(root, file)))
+            throw new Error(`Grok slot preflight does not deny launch control file ${file}`);
+    }
+    return receipt;
+}
+//# sourceMappingURL=grok.js.map