spawnfile 0.1.24 → 0.1.27

package/dist/runtime/pi/appTemplate.d.ts

@@ -3,7 +3,6 @@ export { renderPiApp } from "./appSource.js";
 export { resolveScriptedEngineCommandOption, resolveScriptedEngineStagedPath, SCRIPTED_ENGINE_STAGED_DIRECTORY } from "./appScriptedEngine.js";
 export { createPiAgentConfig, isPiEveryScheduleValue, renderPiModelsConfig, resolvePiEngine, resolvePiRawTrainingCapture, resolvePiThinkingFormat, resolvePiThinkingLevel, resolvePiTools } from "./appAgentConfig.js";
 export { PI_BUILTIN_TOOLS, PI_ENGINE_KINDS, PI_HARNESS_SYSTEM_PROMPT, PI_THINKING_FORMATS, PI_THINKING_LEVELS, type PiGeneratedAgent } from "./appTemplateTypes.js";
-export declare const DAIMON_PACKAGE_NAME = "@noopolis/daimon";
 export declare const DAIMON_PACKAGE_VERSION = "0.1.2";
 export declare const MNEME_PACKAGE_NAME = "@noopolis/mneme";
 export declare const MNEME_PACKAGE_VERSION = "0.1.1";
@@ -12,3 +11,4 @@ export declare const PI_AI_PACKAGE_NAME = "@earendil-works/pi-ai";
 export declare const PI_PACKAGE_VERSION = "0.79.10";
 export declare const renderPiPackageJson: () => string;
 export declare const renderPiAppConfig: (agents: PiGeneratedAgent[]) => string;
+export { DAIMON_PACKAGE_NAME } from '../daimon/packageName.js';

package/dist/runtime/pi/appTemplate.js

@@ -1,8 +1,8 @@
+import { DAIMON_PACKAGE_NAME } from '../daimon/packageName.js';
 export { renderPiApp } from "./appSource.js";
 export { resolveScriptedEngineCommandOption, resolveScriptedEngineStagedPath, SCRIPTED_ENGINE_STAGED_DIRECTORY } from "./appScriptedEngine.js";
 export { createPiAgentConfig, isPiEveryScheduleValue, renderPiModelsConfig, resolvePiEngine, resolvePiRawTrainingCapture, resolvePiThinkingFormat, resolvePiThinkingLevel, resolvePiTools } from "./appAgentConfig.js";
 export { PI_BUILTIN_TOOLS, PI_ENGINE_KINDS, PI_HARNESS_SYSTEM_PROMPT, PI_THINKING_FORMATS, PI_THINKING_LEVELS } from "./appTemplateTypes.js";
-export const DAIMON_PACKAGE_NAME = "@noopolis/daimon";
 export const DAIMON_PACKAGE_VERSION = "0.1.2";
 export const MNEME_PACKAGE_NAME = "@noopolis/mneme";
 export const MNEME_PACKAGE_VERSION = "0.1.1";
@@ -25,3 +25,4 @@ export const renderPiAppConfig = (agents) => serializeJson({
     agents,
     version: "spawnfile.pi-app.v1"
 });
+export { DAIMON_PACKAGE_NAME } from '../daimon/packageName.js';

package/dist/runtime/registry.d.ts

@@ -1,3 +1,4 @@
+import type { SubjectAdapterRegistration } from "../training/subjects/index.js";
 import type { DiagnosticReport } from "../report/index.js";
 import type { RuntimeLifecycleStatus } from "../shared/index.js";
 import type { RuntimeAdapter } from "./types.js";
@@ -25,6 +26,11 @@ export type RuntimeRegistryInstall = {
 };
 export type DaimonCapabilityReceipts = Partial<Record<"amd64" | "arm64", string>>;
 export interface RuntimeRegistryEntry {
+    training?: {
+        adapterId?: string;
+        engines?: readonly string[];
+        subject: () => Promise<SubjectAdapterRegistration>;
+    };
     defaultBranch: string;
     install?: RuntimeRegistryInstall;
     name: string;

package/dist/runtime/registry.js

@@ -1,3 +1,4 @@
+import { daimonTrainingDeclaration } from './daimon/engines.js';
 import { readFile } from "node:fs/promises";
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
@@ -74,6 +75,7 @@ export const parseRuntimeRegistry = (source) => {
         const parsed = runtimeRegistrySchema.parse(parseYaml(source));
         return Object.entries(parsed.runtimes)
             .map(([name, entry]) => ({
+            ...(name === 'daimon' ? { training: { ...daimonTrainingDeclaration, subject: async () => (await import('./daimon/training/index.js')).daimonTrainingSubject } } : {}),
             defaultBranch: entry.default_branch,
             install: entry.install?.kind === "container_image"
                 ? {

package/dist/runtime/trainingCli.d.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { type CliDependencies } from '../training/cli/index.js';
+export { main } from './trainingSubjects.js';
+/** Executable project integrations receive the same subject registry as host calls. */
+export declare function launch(argv?: string[], dependencies?: CliDependencies): Promise<void>;

package/dist/runtime/trainingCli.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { launch as launchTraining } from '../training/cli/index.js';
+import { trainingDependencies } from './trainingSubjects.js';
+export { main } from './trainingSubjects.js';
+/** Executable project integrations receive the same subject registry as host calls. */
+export async function launch(argv = process.argv.slice(2), dependencies = {}) {
+    await launchTraining(argv, await trainingDependencies(dependencies));
+}
+// Stdin and embedding hosts may set argv[1] to a label rather than an existing file.
+function isExecutableEntry() {
+    try {
+        return Boolean(process.argv[1] && pathToFileURL(realpathSync(resolve(process.argv[1]))).href === import.meta.url);
+    }
+    catch {
+        return false;
+    }
+}
+// Importing the host composition must not launch a second CLI or install signal handlers.
+if (isExecutableEntry())
+    await launch();

package/dist/runtime/trainingGraderProviders.d.ts

@@ -0,0 +1,4 @@
+import { type ProviderAvailabilityWindow } from '../training/contracts/index.js';
+export declare const defaultGrokWindow: ProviderAvailabilityWindow;
+export declare function grokWindowOpen(now: Date, window?: ProviderAvailabilityWindow): boolean;
+export declare function installBuiltinGraderProviders(): void;

package/dist/runtime/trainingGraderProviders.js

@@ -0,0 +1,55 @@
+import { createClaudeInference } from '../training/index.js';
+import { configureGraderProviders } from '../training/contracts/index.js';
+import { CONTAINED_TEACHER_POLICY, EMPTY_TOOLS_TEACHER_POLICY } from '../shared/trainingLegacy/index.js';
+import { createCodexInference } from './codex-exec/training/providers/codex-subscription/index.js';
+import { createGrokInference } from './daimon/training/providers/grok-subscription/index.js';
+export const defaultGrokWindow = { start: '20:30', end: '06:30', timeZone: 'Europe/Berlin' };
+export function grokWindowOpen(now, window = defaultGrokWindow) {
+    const minutes = (value) => {
+        if (!/^(?:[01]\d|2[0-3]):[0-5]\d$/.test(value))
+            throw new Error('Invalid Grok window time');
+        const [hours, mins] = value.split(':').map(Number);
+        return hours * 60 + mins;
+    };
+    const start = minutes(window.start), end = minutes(window.end);
+    if (window.timeZone !== undefined && window.timeZone !== 'Europe/Berlin')
+        throw new Error('Grok window timezone must be Europe/Berlin');
+    if (start === end)
+        throw new Error('Grok window must have distinct boundaries');
+    const parts = new Intl.DateTimeFormat('en-GB', { timeZone: window.timeZone ?? 'Europe/Berlin',
+        hour: '2-digit', minute: '2-digit', hourCycle: 'h23' }).formatToParts(now);
+    const current = Number(parts.find(p => p.type === 'hour').value) * 60 + Number(parts.find(p => p.type === 'minute').value);
+    const outer = current >= 20 * 60 + 30 || current < 6 * 60 + 30;
+    return outer && (start < end ? current >= start && current < end : current >= start || current < end);
+}
+function atomicConfig(teacher) {
+    if (teacher.effort !== undefined && !['low', 'medium', 'high', 'xhigh'].includes(teacher.effort))
+        throw new Error('Unsupported extractor effort');
+}
+const registry = {
+    providers: [
+        { id: 'claude', inferenceProviderId: 'claude-subscription', decisionTools: 'disabled', teacherPolicy: EMPTY_TOOLS_TEACHER_POLICY,
+            decompositionExtractor: true, atomicExtractor: false, validateAtomicConfig: atomicConfig,
+            create(teacher, timeoutMs) {
+                if (teacher.effort !== undefined)
+                    throw new Error('Claude teacher effort is unsupported');
+                return createClaudeInference({ timeoutMs });
+            } },
+        { id: 'codex', inferenceProviderId: 'codex-subscription', decisionTools: 'contained', teacherPolicy: CONTAINED_TEACHER_POLICY,
+            decompositionExtractor: true, atomicExtractor: true, validateAtomicConfig: atomicConfig,
+            create: (teacher, timeoutMs) => createCodexInference({ timeoutMs, reasoningEffort: teacher.effort }) },
+        { id: 'grok', inferenceProviderId: 'grok-subscription', decisionTools: 'disabled', teacherPolicy: EMPTY_TOOLS_TEACHER_POLICY,
+            decompositionExtractor: false, atomicExtractor: false, validateAtomicConfig: atomicConfig,
+            create(teacher, timeoutMs) {
+                const effort = teacher.effort;
+                if (effort !== undefined && !['low', 'medium', 'high', 'xhigh'].includes(effort))
+                    throw new Error('Unsupported Grok teacher effort');
+                return createGrokInference({ timeoutMs, reasoningEffort: effort });
+            } },
+    ],
+    council: { requiredProviders: ['codex', 'claude'], requiredMessage: 'Council requires independent codex and claude teachers',
+        defaultWindow: defaultGrokWindow, windowOpen: grokWindowOpen, limitedProvider: 'grok',
+        outsideWindow: window => `Outside Grok window ${window.start}-${window.end} ${window.timeZone ?? 'Europe/Berlin'}`,
+        closedWindow: phase => `Grok window closed before ${phase} call`, extractorMessage: 'Select one or two Codex/Claude extractors' },
+};
+export function installBuiltinGraderProviders() { configureGraderProviders(registry); }

package/dist/runtime/trainingProviders.d.ts

@@ -0,0 +1,4 @@
+import type { CliDependencies } from '../training/cli/index.js';
+import type { InferenceProviderRegistry } from '../training/contracts/index.js';
+/** Engine-owned descriptors extend the neutral built-ins at host composition. */
+export declare function createTrainingProviderRegistry(dependencies?: Pick<CliDependencies, 'grantAuthority' | 'subjects'>): InferenceProviderRegistry;

package/dist/runtime/trainingProviders.js

@@ -0,0 +1,89 @@
+import { INFERENCE_POLICY_VERSIONS } from '../training/contracts/index.js';
+import { defaultInferenceProviders, DatasetError, subjectHostInference, trainingEnvironment } from '../training/index.js';
+import { createCodexInference } from './codex-exec/training/providers/codex-subscription/index.js';
+import { createGrokInference } from './daimon/training/providers/grok-subscription/index.js';
+import { createGrokBrokerInference, GrokGrantPool } from './daimon/training/providers/grok-broker/index.js';
+import { grokBrokerControlSocketEnv, grokGrantHomeRootEnv, grokGrantModels, grokGrantReasoningEfforts } from './daimon/training/providers/grok-broker/grants.js';
+const modelFields = ['provider', 'model', 'endpoint', 'reasoning_effort', 'think', 'keep_alive_seconds', 'max_output_tokens', 'context_window'];
+function fail(path, message) { throw new DatasetError(path, message); }
+function oneOf(value, choices, path) {
+    if (!choices.includes(value))
+        fail(path, `expected one of ${choices.join(', ')}`);
+}
+function validate(model, path, reasoning) {
+    for (const field of Object.keys(model))
+        if (!modelFields.includes(field))
+            fail(`${path}.${field}`, 'unknown field');
+    if (typeof model.model !== 'string' || !model.model.length)
+        fail(`${path}.model`, 'expected a nonempty string');
+    if (reasoning === 'required') {
+        oneOf(model.model, grokGrantModels, `${path}.model`);
+        if (model.reasoning_effort === undefined)
+            fail(`${path}.reasoning_effort`, 'required for grok-broker');
+        oneOf(model.reasoning_effort, grokGrantReasoningEfforts, `${path}.reasoning_effort`);
+    }
+    else if (model.reasoning_effort !== undefined) {
+        if (reasoning === 'none')
+            fail(`${path}.reasoning_effort`, 'only supported for grok-subscription or grok-broker');
+        oneOf(model.reasoning_effort, ['low', 'medium', 'high', 'xhigh'], `${path}.reasoning_effort`);
+    }
+    for (const field of ['think', 'keep_alive_seconds', 'max_output_tokens', 'context_window', 'endpoint']) {
+        if (model[field] !== undefined)
+            fail(`${path}.${field}`, 'only supported for ollama');
+    }
+}
+/** Engine-owned descriptors extend the neutral built-ins at host composition. */
+export function createTrainingProviderRegistry(dependencies = {}) {
+    const codex = {
+        policyVersion: INFERENCE_POLICY_VERSIONS['codex-subscription'],
+        capabilities: { evaluatorPurposes: ['proposals', 'extraction'], evaluatorBudget: 'requests' },
+        validate: (model, path) => validate(model, path, 'none'),
+        create: (_model, context) => createCodexInference({ timeoutMs: context.timeoutMs }),
+    };
+    const grok = {
+        policyVersion: INFERENCE_POLICY_VERSIONS['grok-subscription'], capabilities: {},
+        incompatibleWith: ['grok-broker'], incompatibilityReason: 'grok-broker routes cannot fall back to a desktop grok-subscription login',
+        validate: (model, path) => validate(model, path, 'optional'),
+        normalizeIdentity: model => ({ ...model, reasoning_effort: model.reasoning_effort ?? 'medium' }),
+        create: (model, context) => createGrokInference({ timeoutMs: context.timeoutMs, reasoningEffort: model.reasoning_effort }),
+    };
+    const broker = {
+        policyVersion: INFERENCE_POLICY_VERSIONS['grok-broker'],
+        capabilities: { purposeScoped: true, brokerAdmission: true }, incompatibleWith: ['grok-subscription'],
+        incompatibilityReason: 'grok-broker routes cannot fall back to a desktop grok-subscription login',
+        validate: (model, path) => validate(model, path, 'required'),
+        create(model, context) {
+            const key = 'daimon.grok-broker.grants';
+            let pool = context.resources.get(key);
+            if (!pool) {
+                const socket = trainingEnvironment(grokBrokerControlSocketEnv);
+                pool = new GrokGrantPool({ id: socket ?? 'unconfigured',
+                    authority: async () => (await (dependencies.grantAuthority?.() ?? subjectHostInference(dependencies.subjects).grantAuthority(socket))) });
+                context.resources.set(key, pool);
+                const retained = pool;
+                context.onClose(() => retained.close());
+            }
+            return createGrokBrokerInference({ pool, homeRoot: trainingEnvironment(grokGrantHomeRootEnv) || undefined,
+                purpose: context.purpose, timeoutMs: context.timeoutMs, reasoningEffort: model.reasoning_effort });
+        },
+    };
+    return { ...defaultInferenceProviders, brokerAdmissionLabel: 'grok-broker',
+        // Registration order preserves the historical authored-provider diagnostic.
+        providers: { 'claude-subscription': { ...defaultInferenceProviders.providers['claude-subscription'], validate: (model, path) => validate(model, path, 'none') },
+            'codex-subscription': codex, 'grok-subscription': grok, 'grok-broker': broker, ollama: {
+                ...defaultInferenceProviders.providers.ollama,
+                validate(model, path) {
+                    // Preserve the historical host-composed configuration diagnostic outside the neutral core.
+                    if (model.reasoning_effort !== undefined) {
+                        // Common authored shape errors precede provider-control diagnostics.
+                        for (const field of Object.keys(model))
+                            if (!modelFields.includes(field))
+                                fail(`${path}.${field}`, 'unknown field');
+                        if (typeof model.model !== 'string' || !model.model.length)
+                            fail(`${path}.model`, 'expected a nonempty string');
+                        fail(`${path}.reasoning_effort`, 'only supported for grok-subscription or grok-broker');
+                    }
+                    defaultInferenceProviders.providers.ollama.validate(model, path);
+                },
+            } } };
+}

package/dist/runtime/trainingSubjects.d.ts

@@ -0,0 +1,129 @@
+import { type RuntimeRegistryEntry } from './registry.js';
+import type { SubjectAdapterRegistry } from '../training/subjects/index.js';
+import type { CliDependencies } from '../training/cli/index.js';
+import { main as trainingMain } from '../training/cli/index.js';
+import { prepareNative as prepareCoreNative } from '../training/cli/native.js';
+/** codex-exec is a standalone subject, never a compiled Spawnfile runtime. */
+export declare function createTrainingSubjects(entries?: readonly RuntimeRegistryEntry[]): Promise<SubjectAdapterRegistry>;
+export declare function trainingDependencies(dependencies?: CliDependencies): Promise<CliDependencies>;
+/** Shared host/container composition of the runtime-neutral training CLI. */
+export declare function main(...[argv, io, dependencies]: Parameters<typeof trainingMain>): Promise<number>;
+export declare function prepareNative(...[args, io, dependencies, ...rest]: Parameters<typeof prepareCoreNative>): Promise<{
+    adapter: import("../training/index.js").SubjectAdapter;
+    inference: import("../training/index.js").InferenceProvider | undefined;
+    prepareEnvironment: ((paths: Parameters<import("../training/index.js").TrialOptions["prepare"]>[0], signal: AbortSignal, context: import("../training/index.js").NativePreparationContext) => Promise<Omit<Awaited<ReturnType<import("../training/index.js").TrialOptions["prepare"]>>, "instructions">>) | undefined;
+    cacheRoots: string[];
+    subjectRoot: string | undefined;
+    closeInference: () => Promise<void>;
+    registry: Readonly<Record<string, import("../training/index.js").RegisteredEvaluator>>;
+    evaluation: {
+        judges: Record<string, import("../training/index.js").JudgeRoute>;
+        graders: Record<string, import("../training/graders/atomic/types.js").AtomicRuntime | import("../training/graders/index.js").GradingRuntime>;
+        embeddings: {};
+        readText: (path: string) => Promise<string>;
+    };
+    context: undefined;
+    readiness: undefined;
+    runtime: string;
+    model: string;
+    sourceRoot: string;
+    out: string;
+    candidate: import("../training/index.js").CandidateManifest;
+    judges: Record<string, string>;
+    datasets: import("../training/cli/datasets.js").CliDatasets;
+    citationRepairs: Record<string, 0 | 1>;
+    maxTrials: number;
+    resources: {
+        [k: string]: string;
+    };
+} | {
+    adapter: import("../training/index.js").SubjectAdapter;
+    inference: import("../training/index.js").InferenceProvider | undefined;
+    prepareEnvironment: ((paths: Parameters<import("../training/index.js").TrialOptions["prepare"]>[0], signal: AbortSignal, context: import("../training/index.js").NativePreparationContext) => Promise<Omit<Awaited<ReturnType<import("../training/index.js").TrialOptions["prepare"]>>, "instructions">>) | undefined;
+    cacheRoots: string[];
+    subjectRoot: string | undefined;
+    closeInference: () => Promise<void>;
+    registry: Readonly<Record<string, import("../training/index.js").RegisteredEvaluator>>;
+    evaluation: {
+        judges: Record<string, import("../training/index.js").JudgeRoute>;
+        graders: Record<string, import("../training/graders/atomic/types.js").AtomicRuntime | import("../training/graders/index.js").GradingRuntime>;
+        embeddings: {};
+        readText: (path: string) => Promise<string>;
+    };
+    runtime: string;
+    model: string;
+    candidate: import("../training/index.js").CandidateManifest;
+    judges: Record<string, string>;
+    citationRepairs: Record<string, 0 | 1>;
+    sourceRoot: string;
+    out: string;
+    resources: {
+        [k: string]: string;
+    };
+    datasets: import("../training/cli/datasets.js").CliDatasets;
+    maxTrials: number;
+    context: {
+        version: "spawnfile.training-context.v1";
+        producer: {
+            package: "spawnfile";
+            version: string;
+        };
+        project: {
+            root: string;
+            manifest: string;
+            sourceDigest: string;
+        };
+        agent: {
+            id: string;
+            name: string;
+            source: string;
+            runtime: string;
+            engine: string | null;
+            model: {
+                provider: string;
+                name: string;
+                authMethod: string;
+            } | null;
+        };
+        sources: {
+            sourcePath: string;
+            destinationPath: string;
+            sha256: string;
+        }[];
+        documents: {
+            sourcePath: string;
+            destinationPath: string;
+            sha256: string;
+            role: string;
+        }[];
+        skills: {
+            sourcePath: string;
+            destinationPath: string;
+            sha256: string;
+            name: string;
+            ref: string;
+            requiresMcp: string[];
+        }[];
+        resources: {
+            id: string;
+            kind: "volume" | "git" | "bundle";
+            mount: string;
+            mode: "readonly" | "mutable";
+            sharing: "per_agent" | "team";
+            definitionDigest: string;
+            pin: string | null;
+        }[];
+        requirements: {
+            nativeCompilation: true;
+            isolatedPreparation: true;
+        };
+    };
+    readiness: {
+        runnable: boolean;
+        integration: {
+            id: string;
+            version: string;
+        } | null;
+        reason: string;
+    };
+}>;

package/dist/runtime/trainingSubjects.js

@@ -0,0 +1,32 @@
+import { installBuiltinGraderProviders } from './trainingGraderProviders.js';
+import { createTrainingProviderRegistry } from './trainingProviders.js';
+import { createExperimentSlotFreshness } from './daimon/training/services/index.js';
+import { loadRuntimeRegistry } from './registry.js';
+import { createCodexAdapter } from './codex-exec/training/index.js';
+import { main as trainingMain } from '../training/cli/index.js';
+import { prepareNative as prepareCoreNative } from '../training/cli/native.js';
+/** codex-exec is a standalone subject, never a compiled Spawnfile runtime. */
+export async function createTrainingSubjects(entries) {
+    const registered = entries ?? await loadRuntimeRegistry();
+    const subjects = await Promise.all(registered.flatMap(entry => entry.training
+        ? [entry.training.subject().then(subject => [entry.name, subject])] : []));
+    return Object.freeze({
+        ...Object.fromEntries(subjects),
+        codex: { create: createCodexAdapter },
+    });
+}
+export async function trainingDependencies(dependencies = {}) {
+    installBuiltinGraderProviders();
+    const subjects = dependencies.subjects ?? await createTrainingSubjects();
+    return { ...dependencies, subjects,
+        inferenceProviders: dependencies.inferenceProviders ?? createTrainingProviderRegistry({ ...dependencies, subjects }),
+        createTrialServices: dependencies.createTrialServices ?? (stateRoot => ({ grokSlots: createExperimentSlotFreshness(stateRoot) })),
+    };
+}
+/** Shared host/container composition of the runtime-neutral training CLI. */
+export async function main(...[argv, io, dependencies]) {
+    return trainingMain(argv, io, await trainingDependencies(dependencies));
+}
+export async function prepareNative(...[args, io, dependencies, ...rest]) {
+    return prepareCoreNative(args, io, await trainingDependencies(dependencies), ...rest);
+}

package/dist/shared/daimonCodexDocker.js

@@ -1,3 +1,4 @@
+import { daimonEngineHasBroker, getDaimonEngineDescriptor } from "../runtime/daimon/index.js";
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -23,20 +24,17 @@ const DAIMON_CONFIG_VERSIONS = [
     "noopolis.daimon.organization-runtime.v1",
     "noopolis.daimon.organization-runtime.v2"
 ];
-const DAIMON_CODEX_STRICT_SANDBOX = {
-    mode: "workspace-write",
-    networkAccess: false,
-    webSearch: "disabled"
-};
 const isRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value);
-const hasExactCodexStrictSandbox = (engine) => {
+const hasExactCodexStrictSandbox = (engine, policy) => {
     const sandbox = engine.codexSandbox;
     if (sandbox === undefined)
         return false;
     if (!isRecord(sandbox)) {
         throw new SpawnfileError("validation_error", "Daimon Codex sandbox policy has an invalid shape");
     }
-    const expected = DAIMON_CODEX_STRICT_SANDBOX;
+    if (!policy)
+        throw new SpawnfileError("runtime_error", "Daimon native sandbox descriptor has no strict policy");
+    const expected = policy;
     const keys = Object.keys(sandbox).sort();
     const expectedKeys = Object.keys(expected).sort();
     if (keys.length !== expectedKeys.length ||
@@ -65,12 +63,13 @@ export const resolveDaimonEngineDockerInterop = (source) => {
             throw new SpawnfileError("validation_error", "Daimon generated organization config has an invalid agent engine");
         }
         const kind = agent.engine.kind;
-        if (kind !== "agy" && kind !== "codex" && kind !== "grok") {
+        if (typeof kind !== "string" || !getDaimonEngineDescriptor(kind)) {
             throw new SpawnfileError("validation_error", "Daimon generated organization config has an unsupported agent engine");
         }
-        if (kind === "codex" && hasExactCodexStrictSandbox(agent.engine))
+        const descriptor = getDaimonEngineDescriptor(kind);
+        if (descriptor.sandbox.policy && hasExactCodexStrictSandbox(agent.engine, descriptor.sandbox.policy))
             interop.codex = true;
-        if (kind === "grok")
+        if (daimonEngineHasBroker(kind))
             interop.grok = true;
     }
     return interop;

package/dist/shared/errors.js

@@ -16,3 +16,4 @@ const USAGE_ERROR_CODES = new Set(["validation_error", "invalid_manifest"]);
  * into a process exit code, so every path agrees (see specs/SPEC.md §9.1).
  */
 export const errorExitCode = (error) => isSpawnfileError(error) && USAGE_ERROR_CODES.has(error.code) ? 2 : 1;
+//# sourceMappingURL=errors.js.map

package/dist/shared/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/shared/errors.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvB,IAAI,CAAqB;IAEzC,YAAmB,IAAwB,EAAE,OAAe,EAAE,OAAsB;QAClF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAA2B,EAAE,CAC1E,KAAK,YAAY,cAAc,CAAC;AAElC,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAqB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEhG;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAS,EAAE,CACrD,gBAAgB,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/shared/index.d.ts

@@ -5,3 +5,4 @@ export * from "./redaction.js";
 export * from "./types.js";
 export * from "./volumeNames.js";
 export * from "./daimonCodexDocker.js";
+export * from './trainingLegacy/index.js';

package/dist/shared/index.js

@@ -5,3 +5,4 @@ export * from "./redaction.js";
 export * from "./types.js";
 export * from "./volumeNames.js";
 export * from "./daimonCodexDocker.js";
+export * from './trainingLegacy/index.js';

package/dist/shared/trainingLegacy/index.d.ts

@@ -0,0 +1,5 @@
+export * from './trainingLegacyWire.js';
+export * from './trainingLegacyEnvironment.js';
+export * from './trainingLegacyFiles.js';
+export * from './trainingLegacyHashDomains.js';
+export * from './trainingLegacyGraderProviders.js';

package/dist/shared/trainingLegacy/index.js

@@ -0,0 +1,6 @@
+export * from './trainingLegacyWire.js';
+export * from './trainingLegacyEnvironment.js';
+export * from './trainingLegacyFiles.js';
+export * from './trainingLegacyHashDomains.js';
+export * from './trainingLegacyGraderProviders.js';
+//# sourceMappingURL=index.js.map

package/dist/shared/trainingLegacy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/trainingLegacy/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,oCAAoC,CAAC"}

package/dist/shared/trainingLegacy/trainingLegacyEnvironment.d.ts

@@ -0,0 +1,6 @@
+/** An explicitly empty current value also overrides the legacy value. */
+export declare function trainingEnvironment(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+/** Child processes receive current names only, with current values taking precedence. */
+export declare function normalizedTrainingEnvironment(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Historical credential exclusion retained byte-for-byte for subscription isolation. */
+export declare const LEGACY_SUBSCRIPTION_SECRET_ENVIRONMENT: RegExp;

package/dist/shared/trainingLegacy/trainingLegacyEnvironment.js

@@ -0,0 +1,40 @@
+/** Read legacy deployment inputs without emitting their names into child environments. */
+const legacyPrefix = 'PAIDEIA_';
+const trainingPrefix = 'SPAWNFILE_TRAINING_';
+let warned = false;
+function warn() {
+    if (warned)
+        return;
+    warned = true;
+    process.stderr.write('Deprecated legacy training environment variables; use SPAWNFILE_TRAINING_* names.\n');
+}
+function currentName(legacy) {
+    return legacy === `${legacyPrefix}TRAINING_SLOTS_FILE` ? `${trainingPrefix}SLOTS_FILE`
+        : `${trainingPrefix}${legacy.slice(legacyPrefix.length)}`;
+}
+/** An explicitly empty current value also overrides the legacy value. */
+export function trainingEnvironment(name, env = process.env) {
+    const legacy = name === `${trainingPrefix}SLOTS_FILE` ? `${legacyPrefix}TRAINING_SLOTS_FILE`
+        : `${legacyPrefix}${name.slice(trainingPrefix.length)}`;
+    if (env[legacy] !== undefined)
+        warn();
+    return env[name] ?? env[legacy];
+}
+/** Child processes receive current names only, with current values taking precedence. */
+export function normalizedTrainingEnvironment(env = process.env) {
+    const normalized = { ...env };
+    for (const [name, value] of Object.entries(env)) {
+        if (!name.startsWith(legacyPrefix))
+            continue;
+        delete normalized[name];
+        if (value === undefined)
+            continue;
+        warn();
+        const current = currentName(name);
+        normalized[current] ??= value;
+    }
+    return normalized;
+}
+/** Historical credential exclusion retained byte-for-byte for subscription isolation. */
+export const LEGACY_SUBSCRIPTION_SECRET_ENVIRONMENT = /^(ANTHROPIC_(API_KEY|AUTH_TOKEN|BASE_URL|CUSTOM_HEADERS|PROFILE|FEDERATION_.*|ORGANIZATION_ID|IDENTITY_TOKEN_FILE)|CLAUDE_CODE_(OAUTH_TOKEN.*|USE_.*|API_KEY_HELPER.*)|TYPESAFE_API_KEY|OPENAI_API_KEY|CODEX_API_KEY)$/u;
+//# sourceMappingURL=trainingLegacyEnvironment.js.map

package/dist/shared/trainingLegacy/trainingLegacyEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trainingLegacyEnvironment.js","sourceRoot":"","sources":["../../../src/shared/trainingLegacy/trainingLegacyEnvironment.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAC7C,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,SAAS,IAAI;IACX,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,KAAK,GAAG,YAAY,qBAAqB,CAAC,CAAC,CAAC,GAAG,cAAc,YAAY;QACpF,CAAC,CAAC,GAAG,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpF,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,cAAc,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,qBAAqB;QAC1F,CAAC,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,IAAI,EAAE,CAAC;IACtC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,6BAA6B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChF,MAAM,UAAU,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAClC,UAAU,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,sCAAsC,GAAG,yNAAyN,CAAC"}

package/dist/shared/trainingLegacy/trainingLegacyFiles.d.ts

@@ -0,0 +1,4 @@
+/** Explicit legacy file selections keep their original bytes and source identity. */
+export declare function checkTrainingFilename(path: string): void;
+/** Bound and freeze the exact file bytes; legacy selections retain their source digest. */
+export declare function readTrainingBytes(path: string, maximum: number): Buffer;

package/dist/shared/trainingLegacy/trainingLegacyFiles.js

@@ -0,0 +1,34 @@
+import { constants, closeSync, existsSync, fstatSync, openSync, readFileSync } from 'node:fs';
+/** Explicit legacy file selections keep their original bytes and source identity. */
+export function checkTrainingFilename(path) {
+    const legacy = /\.paideia(?=\.(?:ya?ml|json)$)/u;
+    const current = /\.spawnfile-training(?=\.(?:ya?ml|json)$)/u;
+    const oldName = legacy.test(path);
+    if (!oldName && !current.test(path))
+        return;
+    const counterpart = oldName ? path.replace(legacy, '.spawnfile-training') : path.replace(current, '.paideia');
+    if (existsSync(path) && existsSync(counterpart)) {
+        throw new Error('Both legacy and current training files exist; remove or rename one before continuing');
+    }
+    if (oldName && existsSync(path)) {
+        process.stderr.write('Deprecated legacy training filename; use .spawnfile-training.yaml (or matching JSON suffix).\n');
+    }
+}
+/** Bound and freeze the exact file bytes; legacy selections retain their source digest. */
+export function readTrainingBytes(path, maximum) {
+    checkTrainingFilename(path);
+    const file = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = fstatSync(file);
+        if (!stat.isFile() || stat.size > maximum)
+            throw new Error('CLI input must be a bounded regular text file');
+        const bytes = readFileSync(file);
+        if (bytes.length > maximum)
+            throw new Error('CLI input grew beyond its byte bound');
+        return bytes;
+    }
+    finally {
+        closeSync(file);
+    }
+}
+//# sourceMappingURL=trainingLegacyFiles.js.map

package/dist/shared/trainingLegacy/trainingLegacyFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trainingLegacyFiles.js","sourceRoot":"","sources":["../../../src/shared/trainingLegacy/trainingLegacyFiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE9F,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,MAAM,GAAG,iCAAiC,CAAC;IACjD,MAAM,OAAO,GAAG,4CAA4C,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9G,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACzH,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IAC7D,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC5G,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;AAChC,CAAC"}

package/dist/shared/trainingLegacy/trainingLegacyGraderProviders.d.ts

@@ -0,0 +1,5 @@
+/** Frozen authored keys and identities retained by neutral grader schemas. */
+export declare const COUNCIL_WINDOW_CONFIG_KEY = "grok_window";
+export declare const COUNCIL_WINDOW_OPTION_KEY = "grokWindow";
+export declare const CONTAINED_TEACHER_POLICY = "subscription-codex-containment-one-schema-repair.v1";
+export declare const EMPTY_TOOLS_TEACHER_POLICY = "subscription-empty-tools-one-schema-repair.v1";

package/dist/shared/trainingLegacy/trainingLegacyGraderProviders.js

@@ -0,0 +1,6 @@
+/** Frozen authored keys and identities retained by neutral grader schemas. */
+export const COUNCIL_WINDOW_CONFIG_KEY = 'grok_window';
+export const COUNCIL_WINDOW_OPTION_KEY = 'grokWindow';
+export const CONTAINED_TEACHER_POLICY = 'subscription-codex-containment-one-schema-repair.v1';
+export const EMPTY_TOOLS_TEACHER_POLICY = 'subscription-empty-tools-one-schema-repair.v1';
+//# sourceMappingURL=trainingLegacyGraderProviders.js.map

package/dist/shared/trainingLegacy/trainingLegacyGraderProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trainingLegacyGraderProviders.js","sourceRoot":"","sources":["../../../src/shared/trainingLegacy/trainingLegacyGraderProviders.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,qDAAqD,CAAC;AAC9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,+CAA+C,CAAC"}