spawnfile 0.1.24 → 0.1.27

package/dist/runtime/daimon/training/native/transcript.js

@@ -0,0 +1,239 @@
+import { createHash } from 'node:crypto';
+import { lstat, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { redactNativeDiagnostic } from './child/index.js';
+import { readPrivateFile } from './receipt/index.js';
+/**
+ * Recovers what the engine was actually asked, and what it actually answered.
+ *
+ * Daimon reduces both to a digest and a character count before either leaves
+ * its runtime, which is enough to detect a change and not enough to diagnose
+ * one: a turn that files nothing looks identical to a turn that was never asked
+ * to. The Grok CLI writes its own transcript inside the Daimon-owned
+ * `$GROK_HOME`, the same runtime home this adapter already reads tool receipts
+ * and closed traces from, so the text is recoverable as observed evidence
+ * rather than reconstructed from the adapter's side of the wake.
+ *
+ * This capture is operator-only. Every trial observation persists at `raw`
+ * visibility, which no viewer, optimizer or evaluator projection can read, and
+ * it is published as a `diagnostic` so it never becomes `snapshot.output`, a
+ * captured tool call, or any judge's input. Nothing here changes what a trial
+ * evaluates.
+ */
+export const NATIVE_TRANSCRIPT_SCHEMA = 'spawnfile.training.daimon-native.transcript.v1';
+/** Sessions scanned under one engine home; an isolated trial closes exactly one execution. */
+const maximumSessions = 8;
+/** One session's transcript; larger than this is not a turn, it is a defect. */
+const maximumTranscriptBytes = 8 * 1024 * 1024;
+/** Published text bound. A transcript is for reading a turn, not for archiving a corpus. */
+const publishedChars = 32_768;
+/** `sessions/<percent-encoded-cwd>/<session-id>/chat_history.jsonl`. */
+const transcriptName = 'chat_history.jsonl';
+const sessionId = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const userQuery = /<user_query>\n?([\s\S]*?)\n?<\/user_query>/u;
+const digest = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+/**
+ * Publishes a transcript field, or refuses to.
+ *
+ * The digest and the character count are identities, never secrets, so they
+ * publish unconditionally — they are what Daimon's trace can be checked
+ * against. The text itself publishes only when the shared native redactor finds
+ * nothing credential-shaped left in it; otherwise the named detectors say why
+ * the bytes were withheld, which is the difference between "the reply could not
+ * be published" and "there was no reply".
+ */
+export function transcriptText(value) {
+    const truncated = value.length > publishedChars;
+    const candidate = truncated ? value.slice(0, publishedChars) : value;
+    // Declared secrets belong to the child lifecycle that owns the token and the
+    // process environment. With none to substitute, the detectors decide alone,
+    // which withholds more text than it would otherwise, never less.
+    const redacted = redactNativeDiagnostic(candidate, []);
+    return {
+        chars: value.length,
+        sha256: digest(value),
+        ...(redacted.clean ? { text: redacted.text } : {}),
+        truncated,
+        redaction: redacted.clean ? 'applied' : 'withheld',
+        ...(redacted.clean ? {} : { detectors: redacted.detectors }),
+    };
+}
+const asRecord = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+/** A CLI message body is a string, or the text parts of a content array. */
+function messageText(content) {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content))
+        return '';
+    return content
+        .map(part => {
+        const row = asRecord(part);
+        return row && row.type === 'text' && typeof row.text === 'string' ? row.text : '';
+    })
+        .filter(Boolean)
+        .join('\n');
+}
+/**
+ * The wake text and the final reply in one session transcript.
+ *
+ * The CLI prepends its own user rows (environment, skills, reminders) before the
+ * wake, and wraps the wake itself in `<user_query>`. The last wrapped row is
+ * therefore the delivered prompt; a transcript with no wrapper at all reports
+ * the last user row as `bare` rather than silently presenting a CLI preamble as
+ * the assignment.
+ */
+export function parseGrokTranscript(id, lines) {
+    const users = [];
+    let reply;
+    let rows = 0;
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const row = asRecord(value);
+        if (!row)
+            continue;
+        rows++;
+        if (row.type === 'user') {
+            const text = messageText(row.content);
+            if (text)
+                users.push(text);
+            continue;
+        }
+        if (row.type !== 'assistant')
+            continue;
+        // An assistant message that carries tool calls is work in progress, not the
+        // turn's answer. Treating one as the reply would report a turn that ended
+        // mid-tool-call as if it had answered.
+        const calls = Array.isArray(row.tool_calls) ? row.tool_calls.length : 0;
+        const text = messageText(row.content);
+        reply = calls > 0 || !text.trim() ? undefined : text;
+    }
+    const wrapped = users.filter(text => userQuery.test(text));
+    const last = wrapped.at(-1);
+    const bare = users.at(-1);
+    const prompt = last !== undefined ? userQuery.exec(last)[1] : bare;
+    return {
+        sessionId: id,
+        rows,
+        ...(prompt === undefined ? {} : { prompt: transcriptText(prompt) }),
+        promptEnvelope: last !== undefined ? 'user_query' : bare === undefined ? 'absent' : 'bare',
+        ...(reply === undefined ? {} : { reply: transcriptText(reply) }),
+    };
+}
+async function entries(directory) {
+    try {
+        const info = await lstat(directory);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error('Native transcript directory must be real');
+        return await readdir(directory);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+/** Every `sessions/<cwd>/<session>/chat_history.jsonl` under one engine home, in stable order. */
+async function transcriptFiles(engineHome) {
+    const root = join(engineHome, 'sessions');
+    const found = [];
+    for (const workspace of (await entries(root)).sort()) {
+        const directory = join(root, workspace);
+        let info;
+        try {
+            info = await lstat(directory);
+        }
+        catch {
+            continue;
+        }
+        if (!info.isDirectory() || info.isSymbolicLink())
+            continue;
+        for (const session of (await entries(directory)).sort()) {
+            if (!sessionId.test(session))
+                continue;
+            const file = join(directory, session, transcriptName);
+            try {
+                const entry = await lstat(file);
+                if (!entry.isFile() || entry.isSymbolicLink())
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            if (found.length >= maximumSessions)
+                throw new Error('Native engine transcript count exceeds the isolated trial bound');
+            found.push({ id: session, file });
+        }
+    }
+    return found;
+}
+/**
+ * Which captured session is the turn Daimon closed.
+ *
+ * The digest is the only authority: one session whose prompt hashes to what the
+ * trace recorded IS that turn. Failing that, a single captured session in an
+ * isolated trial is it by construction. Anything else selects nothing rather
+ * than guessing, and every session still publishes.
+ */
+export function selectTranscriptSession(sessions, promptSha256) {
+    if (promptSha256 !== undefined) {
+        const matched = sessions.filter(session => session.prompt?.sha256 === promptSha256);
+        if (matched.length === 1)
+            return matched[0];
+    }
+    return sessions.length === 1 ? sessions[0] : undefined;
+}
+const traceNumber = (value) => Number.isSafeInteger(value) && Number(value) >= 0 ? Number(value) : undefined;
+const traceDigest = (value) => typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value) ? value : undefined;
+/** Daimon's `daimon.turn_trace.v1` reduction of the same turn, read structurally. */
+export function traceReduction(trace) {
+    if (!trace)
+        return undefined;
+    const prompt = asRecord(trace.prompt);
+    const reply = asRecord(trace.reply);
+    return {
+        turnId: trace.turn_id,
+        ...(traceDigest(prompt?.sha256) === undefined ? {} : { promptSha256: traceDigest(prompt?.sha256) }),
+        ...(traceNumber(prompt?.chars) === undefined ? {} : { promptChars: traceNumber(prompt?.chars) }),
+        ...(traceNumber(reply?.output_chars) === undefined ? {} : { replyChars: traceNumber(reply?.output_chars) }),
+    };
+}
+const compare = (observed, recorded) => observed === undefined || recorded === undefined ? 'unknown' : observed === recorded ? 'match' : 'differs';
+/**
+ * Reads the engine's own transcript out of the Daimon-owned engine home.
+ *
+ * Returns `undefined` when there is nothing to publish, so a Codex trial and a
+ * turn whose runtime home was already recycled both stay silent rather than
+ * publishing an empty capture that reads like evidence.
+ */
+export async function readNativeTranscript(runtimeHome, trace) {
+    const files = await transcriptFiles(join(runtimeHome, '.grok'));
+    if (!files.length)
+        return undefined;
+    const sessions = [];
+    for (const { id, file } of files) {
+        const source = await readPrivateFile(file, maximumTranscriptBytes);
+        sessions.push(parseGrokTranscript(id, source.split('\n')));
+    }
+    const reduction = traceReduction(trace);
+    const selected = selectTranscriptSession(sessions, reduction?.promptSha256);
+    return {
+        schema: NATIVE_TRANSCRIPT_SCHEMA,
+        engine: 'grok',
+        sessions,
+        ...(selected ? { selected: selected.sessionId } : {}),
+        ...(reduction ? { trace: reduction } : {}),
+        agreement: {
+            promptSha256: compare(selected?.prompt?.sha256, reduction?.promptSha256),
+            replyChars: compare(selected?.reply?.chars, reduction?.replyChars),
+        },
+    };
+}
+//# sourceMappingURL=transcript.js.map

package/dist/runtime/daimon/training/native/transcript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript.js","sourceRoot":"","sources":["../../../../../src/runtime/daimon/training/native/transcript.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAyB,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gDAAgD,CAAC;AAEzF,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,gFAAgF;AAChF,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,4FAA4F;AAC5F,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,wEAAwE;AACxE,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAC5C,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAoChE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjG;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,cAAc,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,6EAA6E;IAC7E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,SAAS;QACT,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAClD,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAuC,EAAE,CACvE,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE7G,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,OAAO;SACX,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAU,EAAE,KAAwB;IACtE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAyB,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,EAAE,CAAC;QACP,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACvC,4EAA4E;QAC5E,0EAA0E;QAC1E,uCAAuC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,KAAK,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,OAAO;QACL,SAAS,EAAE,EAAE;QACb,IAAI;QACJ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,cAAc,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QAC1F,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,SAAiB;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9G,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,eAAe,CAAC,UAAkB;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,SAAS;QAC3D,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;oBAAE,SAAS;YAC1D,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,IAAI,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACxH,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAA4C,EAClF,YAAqB;IACrB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAc,EAAsB,EAAE,CACzD,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAsB,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAEjF,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,OAAO;QACrB,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAE,EAAE,CAAC;QACpG,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAE,EAAE,CAAC;QACjG,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,KAAK,EAAE,YAAY,CAAE,EAAE,CAAC;KAC7G,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,CAAI,QAAuB,EAAE,QAAuB,EAAmC,EAAE,CACvG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAE7G;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,KAAmB;IACjF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,MAAM;QACd,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,SAAS,EAAE;YACT,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC;YACxE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC;SACnE;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime/daimon/training/native/transport/delivery.d.ts

@@ -0,0 +1,27 @@
+import type { VerifiedNativeLaunch } from '../receipt/index.js';
+import { type TransportDeliverySource, type TerminalEvidence } from '../worker/index.js';
+import type { NativeWorkerRequest } from './types.js';
+/** The provider reserves a source first; publication happens only after the worker arms it. */
+export interface PreparedTransportDelivery {
+    source: TransportDeliverySource;
+    publish(signal: AbortSignal): Promise<void>;
+}
+export interface NativeTransportDelivery {
+    prepare(context: {
+        trialId: string;
+        turnId: string;
+        text: string;
+        launch: VerifiedNativeLaunch;
+        executionId: string;
+    }, signal: AbortSignal): Promise<PreparedTransportDelivery>;
+}
+export declare function verifyPreparedTransport(value: PreparedTransportDelivery, exact?: boolean): void;
+/** Provider callbacks may not extend the trial's real deadline or outlive cancellation. */
+export declare function boundedTransportCall<T>(callback: (signal: AbortSignal) => Promise<T>, deadline: number, signal: AbortSignal): Promise<T>;
+/** A transport receipt binds to its actual delivery, never a synthetic trial/wake key. */
+export declare function transportTerminalBinding(value: TerminalEvidence, source: TransportDeliverySource | undefined): 'bound' | 'incomplete' | 'conflict';
+/** Start observation, prove the matching run is armed, then let the provider publish. */
+export declare function requestTransportDelivery(request: NativeWorkerRequest, body: {
+    wakeId: string;
+    source: TransportDeliverySource;
+}, delivery: PreparedTransportDelivery, deadline: number, signal: AbortSignal): Promise<TerminalEvidence>;

package/dist/runtime/daimon/training/native/transport/delivery.js

@@ -0,0 +1,98 @@
+import { setTimeout as pause } from 'node:timers/promises';
+import { matchTransportSource, parseTransportSource } from '../worker/index.js';
+export function verifyPreparedTransport(value, exact = false) {
+    if (!value || Object.keys(value).sort().join(',') !== 'publish,source' || typeof value.publish !== 'function') {
+        throw new Error('Invalid prepared transport delivery');
+    }
+    const source = parseTransportSource(value.source);
+    if (exact && !('deliveryId' in source))
+        throw new Error('Transport continuation requires an exact delivery ID');
+}
+/** Provider callbacks may not extend the trial's real deadline or outlive cancellation. */
+export async function boundedTransportCall(callback, deadline, signal) {
+    if (signal.aborted)
+        throw new Error('Transport delivery cancelled');
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+        throw new Error('Native trial deadline exceeded awaiting transport delivery');
+    const controller = new AbortController();
+    let timer;
+    let abort;
+    const interrupted = new Promise((_resolve, reject) => {
+        abort = () => { controller.abort(); reject(new Error('Transport delivery cancelled')); };
+        signal.addEventListener('abort', abort, { once: true });
+        timer = setTimeout(() => { controller.abort(); reject(new Error('Native trial deadline exceeded awaiting transport delivery')); }, remaining);
+    });
+    try {
+        const value = await Promise.race([callback(controller.signal), interrupted]);
+        if (signal.aborted)
+            throw new Error('Transport delivery cancelled');
+        if (Date.now() >= deadline)
+            throw new Error('Native trial deadline exceeded awaiting transport delivery');
+        return value;
+    }
+    finally {
+        clearTimeout(timer);
+        signal.removeEventListener('abort', abort);
+        controller.abort();
+    }
+}
+function sameSource(left, right) {
+    return !!left && left.kind === right.kind && ('deliveryId' in left
+        ? 'deliveryId' in right && left.deliveryId === right.deliveryId
+        : 'deliveryIdPrefix' in right && left.deliveryIdPrefix === right.deliveryIdPrefix);
+}
+/** A transport receipt binds to its actual delivery, never a synthetic trial/wake key. */
+export function transportTerminalBinding(value, source) {
+    const transport = value.transport;
+    const incomplete = () => value.status === 'failed' && !value.blocked ? 'incomplete' : 'conflict';
+    if (!source || !transport || !sameSource(transport.source, source))
+        return 'conflict';
+    if (transport.deliveryId === undefined)
+        return value.receipt || value.executionId || transport.acceptanceId || transport.batch ? 'conflict' : incomplete();
+    if (!matchTransportSource(source, transport.deliveryId) || value.receipt &&
+        (value.receipt.delivery_id !== transport.deliveryId || value.receipt.agent_id !== value.agentId ||
+            transport.acceptanceId !== undefined && value.receipt.acceptance_id !== transport.acceptanceId ||
+            value.executionId !== undefined && value.receipt.execution_id !== undefined && value.receipt.execution_id !== value.executionId))
+        return 'conflict';
+    if (transport.batch && (!transport.batch.deliveryIds.includes(transport.deliveryId) ||
+        value.executionId !== undefined && transport.batch.executionId !== value.executionId))
+        return 'conflict';
+    return value.receipt && transport.acceptanceId && value.executionId && transport.batch ? 'bound' : incomplete();
+}
+/** Start observation, prove the matching run is armed, then let the provider publish. */
+export async function requestTransportDelivery(request, body, delivery, deadline, signal) {
+    if (Date.now() >= deadline)
+        throw new Error('Native trial deadline exceeded awaiting transport delivery');
+    // Publication keeps the work deadline. Terminal transport gets shutdown/report
+    // grace, while the worker's completion evidence still has to predate the deadline.
+    return boundedTransportCall(async (bound) => {
+        let settled = false;
+        const terminal = request('/trial/run', body, Math.max(1, deadline - Date.now()) + 8000, bound)
+            .finally(() => { settled = true; });
+        let publishing = false;
+        const publish = boundedTransportCall(async (publication) => {
+            for (;;) {
+                const status = await request('/trial/run', undefined, Math.max(1, deadline - Date.now()), publication);
+                if (settled)
+                    return;
+                if (['waiting', 'observing'].includes(status.state) && status.wakeId === body.wakeId && status.source && sameSource(status.source, body.source))
+                    break;
+                await pause(20, undefined, { signal: publication });
+            }
+            publication.throwIfAborted();
+            publishing = true;
+            await delivery.publish(publication);
+        }, deadline, bound);
+        // A rejected run never publishes; a provider failure aborts the owned request.
+        await Promise.race([publish, terminal]);
+        if (publishing)
+            await publish;
+        const evidence = await terminal;
+        if (evidence.status === 'completed' && !(Date.parse(evidence.completedAt) < deadline)) {
+            throw new Error('Native trial deadline exceeded in terminal completion evidence');
+        }
+        return evidence;
+    }, deadline + 8000, signal);
+}
+//# sourceMappingURL=delivery.js.map

package/dist/runtime/daimon/training/native/transport/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/transport/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuD,MAAM,oBAAoB,CAAC;AAarI,MAAM,UAAU,uBAAuB,CAAC,KAAgC,EAAE,KAAK,GAAG,KAAK;IACrF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,gBAAgB,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9G,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,KAAK,IAAI,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAClH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAI,QAA6C,EAAE,QAAgB,EAAE,MAAmB;IAChI,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,IAAI,KAAkB,CAAC;IACvB,MAAM,WAAW,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC1D,KAAK,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC1G,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACpG,CAAC;AAED,SAAS,UAAU,CAAC,IAAyC,EAAE,KAA8B;IAC3F,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI;QAChE,CAAC,CAAC,YAAY,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAC/D,CAAC,CAAC,kBAAkB,IAAI,KAAK,IAAI,IAAI,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACvF,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,KAAuB,EAAE,MAA2C;IAC3G,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAqB,CAAC,CAAC,CAAC,UAAmB,CAAC;IACnH,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IACtF,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC3J,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,OAAO;QACpE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;YAC7F,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,YAAY;YAC9F,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,UAAU,CAAC;IAC1J,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC;QAC/E,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7G,OAAO,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAClH,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAA4B,EAAE,IAAyD,EACpI,QAAmC,EAAE,QAAgB,EAAE,MAAmB;IAC1E,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC1G,+EAA+E;IAC/E,mFAAmF;IACnF,OAAO,oBAAoB,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAmB,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC;aAC7G,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;YACvD,SAAS,CAAC;gBACR,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;gBAC5E,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;oBAAE,MAAM;gBACvJ,MAAM,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC;YAClB,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpB,+EAA+E;QAC/E,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxC,IAAI,UAAU;YAAE,MAAM,OAAO,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC;QAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9B,CAAC"}

package/dist/runtime/daimon/training/native/transport/http.d.ts

@@ -0,0 +1,3 @@
+import type { NativeWorkerRequest } from './types.js';
+/** Fixed caller-authorized endpoint. No ambient credentials, URL credentials or redirects. */
+export declare function createNativeHttpClient(endpoint: string, token: string, delivery?: 'direct' | 'transport'): NativeWorkerRequest;

package/dist/runtime/daimon/training/native/transport/http.js

@@ -0,0 +1,81 @@
+import { fetch, getGlobalDispatcher } from 'undici';
+const responseLimit = 16_777_216;
+/**
+ * A worker holding a socket open is working, not broken: the request's own
+ * deadline is the only authority on how long that may last. undici's ambient
+ * header and body timeouts (300 seconds by default) are shorter than a
+ * legitimate trial turn and would tear down a healthy worker as a transport
+ * failure, so every request carries its own, derived from that deadline and
+ * deliberately later than it. An over-deadline worker then expires through the
+ * abort signal and is reported as cancelled or expired, while a dead socket
+ * still surfaces as a transport failure. undici's timers are accurate to within
+ * 500ms, well inside this grace.
+ */
+const dispatcherGraceMs = 30_000;
+/** Fixed caller-authorized endpoint. No ambient credentials, URL credentials or redirects. */
+export function createNativeHttpClient(endpoint, token, delivery = 'direct') {
+    const url = new URL(endpoint);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/') {
+        throw new Error('Native worker endpoint must be an HTTP origin without credentials, path or query');
+    }
+    if (!/^[\x21-\x7e]{16,4096}$/u.test(token))
+        throw new Error('Native worker authentication token is invalid');
+    return async (path, body, timeoutMs = 5000, signal) => {
+        if (!['/trial/health', '/trial/run', '/trial/stop', '/v2/activity'].includes(path) ||
+            (['/trial/health', '/v2/activity'].includes(path) ? body !== undefined
+                : body === undefined && !(path === '/trial/run' && delivery === 'transport')))
+            throw new Error('Unsupported native worker request');
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 86_408_000)
+            throw new Error('Invalid native worker request deadline');
+        const payload = body === undefined ? undefined : JSON.stringify(body);
+        if (payload !== undefined && Buffer.byteLength(payload) > 32768)
+            throw new Error('Native worker request exceeds its byte bound');
+        const deadline = AbortSignal.timeout(timeoutMs);
+        const combined = signal ? AbortSignal.any([signal, deadline]) : deadline;
+        combined.throwIfAborted();
+        // Composing the process dispatcher binds both timeouts per request without owning a connection pool to close or leak.
+        const bound = timeoutMs + dispatcherGraceMs;
+        const dispatcher = getGlobalDispatcher().compose(dispatch => (options, handler) => dispatch({ ...options, headersTimeout: bound, bodyTimeout: bound }, handler));
+        let response;
+        try {
+            response = await fetch(new URL(path, url), { method: payload === undefined ? 'GET' : 'POST', redirect: 'error',
+                headers: { authorization: `Bearer ${token}`, ...(payload === undefined ? {} : { 'content-type': 'application/json' }) },
+                body: payload, signal: combined, dispatcher });
+        }
+        catch {
+            throw new Error(combined.aborted ? 'Native worker request cancelled or expired' : 'Native worker transport failed');
+        }
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`Native worker HTTP status ${response.status}`);
+        }
+        if (response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase() !== 'application/json' || !response.body) {
+            await response.body?.cancel();
+            throw new Error('Native worker response is not JSON');
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let bytes = 0;
+        try {
+            for (;;) {
+                const next = await reader.read();
+                if (next.done)
+                    break;
+                bytes += next.value.length;
+                if (bytes > responseLimit)
+                    throw new Error('Native worker response exceeds its byte bound');
+                chunks.push(next.value);
+            }
+            combined.throwIfAborted();
+            return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+        }
+        catch {
+            await reader.cancel().catch(() => undefined);
+            throw new Error(combined.aborted ? 'Native worker response cancelled or expired' : 'Native worker response is malformed or exceeds its bound');
+        }
+        finally {
+            reader.releaseLock();
+        }
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/runtime/daimon/training/native/transport/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/transport/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAGpD,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmC,QAAQ;IACjH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAClI,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC7G,OAAO,KAAK,EAAK,IAAY,EAAE,IAAc,EAAE,SAAS,GAAG,IAAI,EAAE,MAAoB,EAAc,EAAE;QACnG,IAAI,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC9E,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpE,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,KAAK,WAAW,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC1I,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC3I,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjI,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC1B,sHAAsH;QACtH,MAAM,KAAK,GAAG,SAAS,GAAG,iBAAiB,CAAC;QAC5C,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAChF,QAAQ,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAChF,IAAI,QAA2C,CAAC;QAChD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO;gBAC5G,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;gBACvH,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAAC,CAAC;QAChI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC;QACrH,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,kBAAkB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACrB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,KAAK,GAAG,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC5F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YACD,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAM,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,0DAA0D,CAAC,CAAC;QACjJ,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC"}

package/dist/runtime/daimon/training/native/transport/index.d.ts

@@ -0,0 +1,4 @@
+export { createNativeHttpClient } from './http.js';
+export type { NativeExecutionHandle, NativeWorkerPath, NativeWorkerRequest } from './types.js';
+export { boundedTransportCall, requestTransportDelivery, transportTerminalBinding, verifyPreparedTransport } from './delivery.js';
+export type { NativeTransportDelivery, PreparedTransportDelivery } from './delivery.js';

package/dist/runtime/daimon/training/native/transport/index.js

@@ -0,0 +1,3 @@
+export { createNativeHttpClient } from './http.js';
+export { boundedTransportCall, requestTransportDelivery, transportTerminalBinding, verifyPreparedTransport } from './delivery.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/daimon/training/native/transport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/transport/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC"}

package/dist/runtime/daimon/training/native/transport/types.d.ts

@@ -0,0 +1,15 @@
+import type { StopReceipt, SubjectStartupDiagnostic } from '../../../../../training/index.js';
+export type NativeWorkerPath = '/trial/health' | '/trial/run' | '/trial/stop' | '/v2/activity';
+export type NativeWorkerRequest = <T>(path: NativeWorkerPath, body?: unknown, timeoutMs?: number, signal?: AbortSignal) => Promise<T>;
+export interface NativeExecutionHandle {
+    name: string;
+    request: NativeWorkerRequest;
+    stop(reason: string): Promise<StopReceipt>;
+    /**
+     * The redacted account of a worker that stopped answering, available once
+     * `stop` has settled and only when the closure was not confirmed. A confirmed
+     * closure needs no explanation; an unconfirmed one is the case where nothing
+     * else says why. Absent for transports that own no child process.
+     */
+    diagnostic?(): SubjectStartupDiagnostic | undefined;
+}

package/dist/runtime/daimon/training/native/transport/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/runtime/daimon/training/native/transport/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/transport/types.ts"],"names":[],"mappings":""}

package/dist/runtime/daimon/training/native/worker/cli.d.ts

@@ -0,0 +1 @@
+export declare function nativeWorkerMain(args: string[]): Promise<number>;

package/dist/runtime/daimon/training/native/worker/cli.js

@@ -0,0 +1,17 @@
+import { pathToFileURL } from 'node:url';
+import { runDaimonNativeWorker } from './worker.js';
+export async function nativeWorkerMain(args) {
+    try {
+        await runDaimonNativeWorker(args);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`${JSON.stringify({ schema: 'spawnfile.training.daimon-native.start-failed.v1',
+            error: error instanceof Error ? error.message : 'Native startup failed' })}\n`);
+        return 1;
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    void nativeWorkerMain(process.argv.slice(2)).then(code => { process.exitCode = code; });
+}
+//# sourceMappingURL=cli.js.map

package/dist/runtime/daimon/training/native/worker/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/worker/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,IAAI,CAAC;QAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACpD,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,kDAAkD;YACjG,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,KAAK,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/runtime/daimon/training/native/worker/control.d.ts

@@ -0,0 +1,20 @@
+export { describeNativeFailure, admittedExecutions, validateNativeFrame, executionClosed, claimedExecution, disposedWakeExecution, AMBIGUOUS_NATIVE_EXECUTION, AMBIGUOUS_WAKE_EXECUTION } from './evidence/index.js';
+import { type DeliveryControls } from './deliveries.js';
+import { type NativeLaunch, type NativeTaskClockEvidence } from '../receipt/index.js';
+import { createTransportDelivery, type TransportDeliverySource } from './wake-delivery/index.js';
+import type { NativeConfig, NativeHost, TerminalEvidence, WorkerOptions } from './types.js';
+export interface NativeStopEvidence {
+    schema: 'spawnfile.training.daimon-native.stop.v1';
+    state: 'acknowledged' | 'unknown';
+    quiescence: 'unknown';
+    containmentVerification: 'parent-container-owner';
+    native?: unknown;
+    error?: string;
+}
+export interface WorkerController {
+    host: NativeHost;
+    transport?: ReturnType<typeof createTransportDelivery>;
+    run(wakeId: string, text: string, controls?: DeliveryControls, source?: TransportDeliverySource): Promise<TerminalEvidence>;
+    stop(): Promise<NativeStopEvidence>;
+}
+export declare function createWorkerController(host: NativeHost, config: NativeConfig, options: WorkerOptions, token: string, launch?: NativeLaunch, taskClock?: NativeTaskClockEvidence): WorkerController;