spawnfile 0.1.25 → 0.1.27

package/dist/runtime/daimon/training/native/container/docker.js

@@ -0,0 +1,105 @@
+import { spawn } from 'node:child_process';
+import { posix } from 'node:path';
+import { nativeMounts } from './manifest.js';
+import { containerSecurityOptions } from './preflight.js';
+import { containerPaths } from '../receipt/index.js';
+export const ownerLabel = 'training.daimon-native.owner';
+export const trialLabel = 'training.daimon-native.trial';
+export function dockerCommand(command = 'docker') {
+    return async (args, options = {}) => new Promise((resolve, reject) => {
+        if (options.signal?.aborted) {
+            reject(new Error('Docker operation aborted'));
+            return;
+        }
+        const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        let failure;
+        let force;
+        const abort = (reason = 'Docker operation aborted') => {
+            failure ??= new Error(reason);
+            child.kill('SIGTERM');
+            force ??= setTimeout(() => child.kill('SIGKILL'), 1000);
+        };
+        const onAbort = () => abort();
+        const timer = setTimeout(() => abort('Docker operation deadline exceeded'), options.timeoutMs ?? 15_000);
+        options.signal?.addEventListener('abort', onAbort, { once: true });
+        child.stdout.on('data', bytes => { stdout += String(bytes); if (Buffer.byteLength(stdout) > 16_777_216)
+            abort('Docker output exceeded its bound'); });
+        child.stderr.on('data', bytes => { stderr += String(bytes); if (Buffer.byteLength(stderr) > 65536)
+            abort('Docker diagnostics exceeded their bound'); });
+        child.stdin.on('error', () => undefined);
+        child.once('error', error => { failure = error; });
+        child.once('close', code => {
+            clearTimeout(timer);
+            clearTimeout(force);
+            options.signal?.removeEventListener('abort', onAbort);
+            if (failure)
+                reject(failure);
+            else
+                resolve({ code: code ?? 1, stdout, stderr });
+        });
+        child.stdin.end(options.stdin);
+    });
+}
+export function createContainerArguments(launch, name, owner, trialId, timeoutMs, user = `${process.getuid?.() ?? 1000}:${process.getgid?.() ?? 1000}`) {
+    const security = containerSecurityOptions(launch);
+    const mounts = [...nativeMounts(launch),
+        { source: launch.config, target: containerPaths.config, readonly: true },
+        { source: launch.tokenFile, target: containerPaths.token, readonly: true },
+        { source: launch.controlRoot, target: containerPaths.control, readonly: false },
+        { source: launch.workerRoot, target: containerPaths.worker, readonly: true },
+        { source: launch.receiptFile, target: containerPaths.receipt, readonly: true },
+        ...(launch.bootstrap ? [{ source: launch.bootstrap.root, target: containerPaths.bootstrap, readonly: true }] : []),
+    ];
+    return ['create', '--name', name, '--label', `${ownerLabel}=${owner}`, '--label', `${trialLabel}=${trialId}`,
+        '--pull', 'never', '--init', '--read-only', '--user', user, '--cap-drop', 'ALL',
+        '--security-opt', 'no-new-privileges', ...security, '--pids-limit', '256',
+        '--tmpfs', '/tmp:rw,nosuid,nodev,size=268435456', '--tmpfs', '/run:rw,nosuid,nodev,size=16777216',
+        '--env-file', launch.envFile, '--workdir', '/opt/training',
+        ...mounts.flatMap(mount => ['--mount', `type=bind,source=${mount.source},target=${mount.target}${mount.readonly ? ',readonly' : ''}`]),
+        '--entrypoint', '/usr/local/bin/node', launch.image, '--experimental-strip-types',
+        launch.bootstrap ? posix.join(containerPaths.bootstrap, launch.bootstrap.entrypoint) : `${containerPaths.worker}/worker/cli.js`,
+        '--launch', containerPaths.receipt, '--config', containerPaths.config, '--config-sha256', launch.configSha256, '--control-root', containerPaths.control,
+        '--token-file', containerPaths.token, '--evidence', `${containerPaths.control}/evidence.json`, '--trial-id', trialId,
+        '--timeout-ms', String(timeoutMs), '--schedule-override', 'disabled'];
+}
+export async function inspectOwned(run, name, owner) {
+    const result = await run(['inspect', name, '--format', '{{json .}}']);
+    if (result.code !== 0) {
+        if (/No such (?:object|container)/iu.test(result.stderr))
+            return undefined;
+        throw new Error('Cannot inspect native container ownership');
+    }
+    const value = JSON.parse(result.stdout);
+    if (value.Config?.Labels?.[ownerLabel] !== owner || typeof value.State?.Running !== 'boolean') {
+        throw new Error('Native container ownership or state mismatch');
+    }
+    return value;
+}
+/**
+ * `node:http` rather than `fetch`: a working worker holds the socket open for as
+ * long as its turn takes, and undici's ambient 300-second header timeout would
+ * kill a healthy one well inside a legitimate deadline. Here the caller's own
+ * deadline is the only bound, as it already was for the surrounding exec.
+ */
+const httpScript = `import {readFile} from 'node:fs/promises';
+import {request} from 'node:http';
+const input=JSON.parse(await new Promise(resolve=>{let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',v=>s+=v);process.stdin.on('end',()=>resolve(s));}));
+const token=(await readFile(input.tokenFile,'utf8')).trim();
+const payload=input.body===undefined?undefined:JSON.stringify(input.body);
+const value=await new Promise((resolve,reject)=>{
+const call=request({host:'127.0.0.1',port:input.port,path:input.path,method:payload===undefined?'GET':'POST',signal:AbortSignal.timeout(input.timeoutMs),headers:{authorization:'Bearer '+token,...(payload===undefined?{}:{'content-type':'application/json'})}},response=>{
+let text='';response.setEncoding('utf8');response.on('data',chunk=>{text+=chunk});
+response.on('end',()=>{let parsed;try{parsed=JSON.parse(text)}catch(error){reject(error);return}
+if(response.statusCode<200||response.statusCode>299){reject(Error('Native HTTP '+response.statusCode+': '+JSON.stringify(parsed)));return}
+resolve(parsed)})});
+call.on('error',reject);if(payload!==undefined)call.write(payload);call.end()});
+process.stdout.write(JSON.stringify(value));`;
+export async function workerRequest(run, name, path, body, timeoutMs = 5000, signal, port = 19700, tokenFile = containerPaths.token) {
+    const result = await run(['exec', '-i', name, '/usr/local/bin/node', '--input-type=module', '-e', httpScript], { signal, timeoutMs: timeoutMs + 2000, stdin: JSON.stringify({ path, body, timeoutMs, port, tokenFile }) });
+    if (result.code !== 0)
+        throw new Error(`Native worker request failed: ${result.stderr.slice(-2000)}`);
+    return JSON.parse(result.stdout);
+}
+//# sourceMappingURL=docker.js.map

package/dist/runtime/daimon/training/native/container/docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAA+C,MAAM,qBAAqB,CAAC;AASlG,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AACzD,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAEzD,MAAM,UAAU,aAAa,CAAC,OAAO,GAAG,QAAQ;IAC9C,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAA0B,CAAC;QAC/B,IAAI,KAAgD,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,0BAA0B,EAAQ,EAAE;YAC1D,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,KAAK,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACzG,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU;YAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtJ,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,KAAK;YAAE,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxJ,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAChG,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,CAAC,CAAC;;gBAAM,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA4B,EAAE,IAAY,EAAE,KAAa,EAAE,OAAe,EACjH,SAAiB,EAAE,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,EAAE;IACvF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAkB,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC;QACpD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QACxE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1E,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC/E,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5E,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9E,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnH,CAAC;IACF,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,UAAU,IAAI,OAAO,EAAE;QAC1G,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;QAC/E,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,KAAK;QACzE,SAAS,EAAE,qCAAqC,EAAE,SAAS,EAAE,oCAAoC;QACjG,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe;QAC1D,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,oBAAoB,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtI,cAAc,EAAE,qBAAqB,EAAE,MAAM,CAAC,KAAK,EAAE,4BAA4B;QACjF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,gBAAgB;QAC/H,UAAU,EAAE,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,cAAc,CAAC,OAAO;QACvJ,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,OAAO,gBAAgB,EAAE,YAAY,EAAE,OAAO;QACpH,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB,EAAE,IAAY,EAAE,KAAa;IAChF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAwB,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,GAAG;;;;;;;;;;;;6CAY0B,CAAC;AAE9C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,GAAkB,EAAE,IAAY,EAAE,IAAY,EAAE,IAAc,EACnG,SAAS,GAAG,IAAI,EAAE,MAAoB,EAAE,IAAI,GAAG,KAAK,EAAE,YAAoB,cAAc,CAAC,KAAK;IAC9F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,IAAI,EAAE,UAAU,CAAC,EAC3G,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9G,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAM,CAAC;AACxC,CAAC"}

package/dist/runtime/daimon/training/native/container/grok-slot.d.ts

@@ -0,0 +1,22 @@
+import { type GrokNativeLaunch } from '../receipt/index.js';
+/**
+ * What the container's own root said about this slot, read before any process starts.
+ *
+ * A Codex launch anchors every writable root and every control file inside the
+ * trial runtime home, a directory the evaluator created for this trial: a launch
+ * receipt can therefore never widen writability past the evaluator's own
+ * scratch. A Grok launch cannot use that anchor — the training container fixes
+ * its slot paths and the projection digest binds them — so the equivalent
+ * authority is this receipt. The root slot supervisor writes it after running a
+ * worker-uid denial canary over every path in the digest-bound projection, and
+ * it names the digest it certifies. Training is not that authority, so the file
+ * must be root-owned (or, outside a container, owned by this evaluator) and
+ * never group- or world-writable.
+ *
+ * Only the denial set is returned. Receipt freshness stays with the evaluator's
+ * slot freshness store, which is the single authority for nonce and generation;
+ * the projection v2 digest is checked here because it binds this denial set and
+ * the declared workerConfigVariant to this launch. The slot receipt remains v2
+ * for both worker variants; launch parsing refuses unclocked task-clock trials.
+ */
+export declare function readGrokSlotDenials(launch: GrokNativeLaunch): Promise<string[]>;

package/dist/runtime/daimon/training/native/container/grok-slot.js

@@ -0,0 +1,38 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { grokSlotPreflightSchema, readPrivateFile } from '../receipt/index.js';
+/**
+ * What the container's own root said about this slot, read before any process starts.
+ *
+ * A Codex launch anchors every writable root and every control file inside the
+ * trial runtime home, a directory the evaluator created for this trial: a launch
+ * receipt can therefore never widen writability past the evaluator's own
+ * scratch. A Grok launch cannot use that anchor — the training container fixes
+ * its slot paths and the projection digest binds them — so the equivalent
+ * authority is this receipt. The root slot supervisor writes it after running a
+ * worker-uid denial canary over every path in the digest-bound projection, and
+ * it names the digest it certifies. Training is not that authority, so the file
+ * must be root-owned (or, outside a container, owned by this evaluator) and
+ * never group- or world-writable.
+ *
+ * Only the denial set is returned. Receipt freshness stays with the evaluator's
+ * slot freshness store, which is the single authority for nonce and generation;
+ * the projection v2 digest is checked here because it binds this denial set and
+ * the declared workerConfigVariant to this launch. The slot receipt remains v2
+ * for both worker variants; launch parsing refuses unclocked task-clock trials.
+ */
+export async function readGrokSlotDenials(launch) {
+    const file = launch.broker.slotPreflightReceipt;
+    if (await realpath(file) !== file)
+        throw new Error('The Grok slot preflight receipt must be a canonical file');
+    const entry = await lstat(file);
+    const owner = process.getuid?.();
+    if ((entry.mode & 0o022) !== 0 || entry.uid !== 0 && entry.uid !== owner) {
+        throw new Error('The Grok slot preflight receipt must be written by the container root and stay unwritable to other users');
+    }
+    const receipt = grokSlotPreflightSchema.parse(JSON.parse(await readPrivateFile(file, 262_144)));
+    if (receipt.projection_sha256 !== launch.broker.projectionSha256) {
+        throw new Error('The Grok slot preflight receipt certifies a different projection than this launch declares');
+    }
+    return [...new Set(receipt.canaries.map(canary => canary.path))].sort();
+}
+//# sourceMappingURL=grok-slot.js.map

package/dist/runtime/daimon/training/native/container/grok-slot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-slot.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/grok-slot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAyB,MAAM,qBAAqB,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAwB;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAChD,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC/G,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC"}

package/dist/runtime/daimon/training/native/container/index.d.ts

@@ -0,0 +1,6 @@
+export { dockerCommand, createContainerArguments, inspectOwned, workerRequest, ownerLabel, trialLabel } from './docker.js';
+export type { DockerCommand, DockerResult, ContainerInspection } from './docker.js';
+export { startOwnedContainer } from './lifecycle.js';
+export { loadNativeLaunch, nativeMounts } from './manifest.js';
+export { containerSecurityOptions, grokContainerUnsupported, sandboxChecks, sandboxPreflightSchema } from './preflight.js';
+export { assertLeasedLaunch } from './slot.js';

package/dist/runtime/daimon/training/native/container/index.js

@@ -0,0 +1,6 @@
+export { dockerCommand, createContainerArguments, inspectOwned, workerRequest, ownerLabel, trialLabel } from './docker.js';
+export { startOwnedContainer } from './lifecycle.js';
+export { loadNativeLaunch, nativeMounts } from './manifest.js';
+export { containerSecurityOptions, grokContainerUnsupported, sandboxChecks, sandboxPreflightSchema } from './preflight.js';
+export { assertLeasedLaunch } from './slot.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/daimon/training/native/container/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3H,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC"}

package/dist/runtime/daimon/training/native/container/lifecycle.d.ts

@@ -0,0 +1,8 @@
+import type { StopReceipt } from '../../../../../training/index.js';
+import { type DockerCommand } from './docker.js';
+import type { VerifiedNativeLaunch } from '../receipt/index.js';
+export declare function startOwnedContainer(run: DockerCommand, launch: VerifiedNativeLaunch, trialId: string, timeoutMs: number, signal?: AbortSignal, startupMs?: number): Promise<{
+    name: string;
+    owner: `${string}-${string}-${string}-${string}-${string}`;
+    stop: (reason: string) => Promise<StopReceipt>;
+}>;

package/dist/runtime/daimon/training/native/container/lifecycle.js

@@ -0,0 +1,110 @@
+import { canonicalWireId } from '../../../../../training/index.js';
+import { randomUUID } from 'node:crypto';
+import { verifyNativeSandbox } from './preflight.js';
+import { createContainerArguments, inspectOwned, workerRequest } from './docker.js';
+export async function startOwnedContainer(run, launch, trialId, timeoutMs, signal, startupMs = 60_000) {
+    const owner = randomUUID();
+    const name = `training-${owner}`;
+    let created = false;
+    let stopping;
+    const stop = (reason) => {
+        stopping ??= (async () => {
+            let native;
+            try {
+                if (!created)
+                    return receipt('acknowledged', 'confirmed', reason, 'No native container was created');
+                let state = await inspectOwned(run, name, owner);
+                if (!state)
+                    return receipt('acknowledged', 'confirmed', reason, 'Owned native container is absent');
+                if (state.State.Running) {
+                    try {
+                        native = await workerRequest(run, name, '/trial/stop', {}, 6000, undefined, launch.host.port);
+                    }
+                    catch { /* outer containment remains authoritative */ }
+                    await run(['stop', '--time', '2', name], { timeoutMs: 5000 }).catch(() => undefined);
+                    state = await inspectOwned(run, name, owner);
+                    if (state?.State.Running) {
+                        await run(['kill', name], { timeoutMs: 5000 });
+                        const deadline = Date.now() + 3000;
+                        do {
+                            state = await inspectOwned(run, name, owner);
+                            if (!state?.State.Running)
+                                break;
+                            await new Promise(resolve => setTimeout(resolve, 100));
+                        } while (Date.now() < deadline);
+                    }
+                }
+                if (state?.State.Running)
+                    throw new Error('Owned container still reports running after termination');
+                const removed = await run(['rm', name], { timeoutMs: 5000 });
+                if (removed.code !== 0 && await inspectOwned(run, name, owner))
+                    throw new Error('Owned stopped container could not be removed');
+                if (await inspectOwned(run, name, owner))
+                    throw new Error('Owned container remained after removal');
+                return receipt('acknowledged', 'confirmed', reason, `Owned container stopped and removed; native stop ${native?.state ?? 'unavailable'}`);
+            }
+            catch (error) {
+                return receipt('unknown', 'unknown', reason, `Container shutdown unconfirmed: ${String(error)}`);
+            }
+        })();
+        return stopping;
+    };
+    try {
+        const context = await run(['context', 'inspect', '--format', '{{json .Endpoints.docker.Host}}'], { signal });
+        if (context.code !== 0 || !String(JSON.parse(context.stdout)).startsWith('unix://') ||
+            process.env.DOCKER_HOST && !process.env.DOCKER_HOST.startsWith('unix://'))
+            throw new Error('Native trials require a local Docker socket context');
+        created = true;
+        const create = await run(createContainerArguments(launch, name, owner, trialId, timeoutMs), { signal, timeoutMs: 30_000 });
+        if (create.code !== 0 || !/^[a-f0-9]{64}$/u.test(create.stdout.trim()))
+            throw new Error(`Native container creation failed: ${create.stderr.slice(-1000)}`);
+        await inspectOwned(run, name, owner);
+        const started = await run(['start', name], { signal });
+        if (started.code !== 0)
+            throw new Error(`Native container start failed: ${started.stderr.slice(-1000)}`);
+        const deadline = Date.now() + startupMs;
+        let lastError = '';
+        while (Date.now() < deadline) {
+            if (signal?.aborted)
+                throw new Error('Native startup aborted');
+            const state = await inspectOwned(run, name, owner);
+            if (!state?.State.Running) {
+                const logs = await run(['logs', '--tail', '20', name]);
+                throw new Error(`Native container exited before readiness: ${logs.stderr.slice(-2000)}${logs.stdout.slice(-2000)}`);
+            }
+            let healthy = false;
+            try {
+                const health = await workerRequest(run, name, '/trial/health', undefined, 1000, signal, launch.host.port);
+                const logs = await run(['logs', '--tail', '100', name], { signal });
+                const ready = logs.stdout.split('\n').filter(Boolean).flatMap(line => { try {
+                    return [JSON.parse(line)];
+                }
+                catch {
+                    return [];
+                } })
+                    .find(row => canonicalWireId(row.schema) === 'spawnfile.training.daimon-native.ready.v1' && row.trialId === trialId && row.configSha256 === launch.configSha256);
+                healthy = !!ready && health.version === 'noopolis.daimon.organization-runtime-health.v1' && health.state === 'running' &&
+                    health.agents.length === 1 && health.agents[0]?.agentId === launch.agent.id;
+            }
+            catch (error) {
+                lastError = String(error);
+            }
+            if (healthy) {
+                await verifyNativeSandbox(run, name, launch, trialId, signal);
+                return { name, owner, stop };
+            }
+            await new Promise(resolve => setTimeout(resolve, 200));
+        }
+        throw new Error(`Native startup deadline exceeded: ${lastError}`);
+    }
+    catch (error) {
+        const outcome = await stop('Native startup failed');
+        if (outcome.quiescence !== 'confirmed')
+            throw new Error(`${String(error)}; ${outcome.detail}`, { cause: error });
+        throw error;
+    }
+}
+function receipt(state, quiescence, reason, detail) {
+    return { state, scope: 'native-handle', quiescence, remoteWork: 'unknown', reason, detail };
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/runtime/daimon/training/native/container/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,aAAa,EAAsB,MAAM,aAAa,CAAC;AAIxG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAkB,EAAE,MAA4B,EAAE,OAAe,EAAE,SAAiB,EAC5H,MAAoB,EAAE,SAAS,GAAG,MAAM;IACxC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAA0C,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAwB,EAAE;QACpD,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,MAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,iCAAiC,CAAC,CAAC;gBACrG,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,KAAK;oBAAE,OAAO,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,kCAAkC,CAAC,CAAC;gBACpG,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC;wBAAC,MAAM,GAAG,MAAM,aAAa,CAAqB,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;oBAClL,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACrF,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC7C,IAAI,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;wBACzB,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;wBACnC,GAAG,CAAC;4BACF,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;4BAC7C,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO;gCAAE,MAAM;4BACjC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;wBACzD,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;oBAClC,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,EAAE,KAAK,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBACrG,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAChI,IAAI,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACpG,OAAO,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,oDAAoD,MAAM,EAAE,KAAK,IAAI,aAAa,EAAE,CAAC,CAAC;YAC5I,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACvH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,iCAAiC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtJ,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3H,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3J,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAoE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7K,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACpE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,EAAE,CAAC;gBAAC,CAAC,CAAC,CAAC,CAAC;qBAC1J,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,2CAA2C,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnK,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,gDAAgD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;oBAClH,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAC9C,IAAI,OAAO,EAAE,CAAC;gBAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAC7G,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjH,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA2B,EAAE,UAAqC,EAAE,MAAc,EAAE,MAAc;IACjH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC9F,CAAC"}

package/dist/runtime/daimon/training/native/container/manifest.d.ts

@@ -0,0 +1,17 @@
+import type { SubjectStart } from '../../../../../training/index.js';
+import { type NativeLaunch, type VerifiedNativeLaunch, type NativeMount } from '../receipt/index.js';
+export declare function nativeMounts(launch: NativeLaunch): NativeMount[];
+/**
+ * Only fresh subtrees explicitly projected by trusted preparation enter the subject.
+ *
+ * Codex anchors every writable root, control file and control root inside the
+ * trial runtime home the evaluator created for this trial, so a launch receipt
+ * can never widen writability past that scratch. A brokered Grok launch runs in
+ * a training container whose slot paths are fixed and bound by
+ * `projection_sha256`, so the same guarantee is taken from the container
+ * contract instead: the two writable roots are exactly the trial workspace and
+ * the trial runtime home the evaluator itself named (and the projection digest
+ * binds both), the control root and every control input sit inside a root
+ * attested, worker-denied slot root, and no writable root touches one.
+ */
+export declare function loadNativeLaunch(input: SubjectStart, child?: boolean): Promise<VerifiedNativeLaunch>;

package/dist/runtime/daimon/training/native/container/manifest.js

@@ -0,0 +1,144 @@
+import { assertLeasedLaunch } from './slot.js';
+import { lstat, realpath, readdir } from 'node:fs/promises';
+import { basename, dirname, join, posix, resolve } from 'node:path';
+import { grokContainerUnsupported } from './preflight.js';
+import { readGrokSlotDenials } from './grok-slot.js';
+import { containerPaths, grokSubjectRoots, isGrokLaunch, nativeTrialArtifactsRoot, parseNativeLaunch, readPrivateFile, sha256, within } from '../receipt/index.js';
+export function nativeMounts(launch) {
+    return [{ ...launch.workspace, readonly: false },
+        ...launch.projections.map(({ source, target }) => ({ source, target, readonly: false })),
+        ...launch.credentials.map(row => ({ ...row, readonly: true }))];
+}
+/**
+ * Only fresh subtrees explicitly projected by trusted preparation enter the subject.
+ *
+ * Codex anchors every writable root, control file and control root inside the
+ * trial runtime home the evaluator created for this trial, so a launch receipt
+ * can never widen writability past that scratch. A brokered Grok launch runs in
+ * a training container whose slot paths are fixed and bound by
+ * `projection_sha256`, so the same guarantee is taken from the container
+ * contract instead: the two writable roots are exactly the trial workspace and
+ * the trial runtime home the evaluator itself named (and the projection digest
+ * binds both), the control root and every control input sit inside a root
+ * attested, worker-denied slot root, and no writable root touches one.
+ */
+export async function loadNativeLaunch(input, child = false) {
+    const runtime = await realpath(input.runtimeHomePath);
+    // The resolved trial runtime home, not the caller's spelling of it: preparation may reach a fixed slot
+    // root through a symlink, and the worker refuses any control file whose own path traverses one. This
+    // cannot redirect the receipt — the value comes from the evaluator's `runtimeHomePath`, never from the
+    // launch, and every check below still pins that resolved root (for Grok, to the digest-bound slot home).
+    const receiptFile = join(runtime, 'native-launch.json');
+    const launch = parseNativeLaunch(JSON.parse(await readPrivateFile(receiptFile, 65536)));
+    if (input.slot)
+        assertLeasedLaunch(launch, input.slot);
+    if (launch.agent.engine === 'grok' && !child)
+        throw new Error(grokContainerUnsupported);
+    const workspace = await realpath(input.workspacePath);
+    if (input.model !== launch.agent.model)
+        throw new Error('Subject model differs from the prepared native model');
+    if (input.tools?.length)
+        throw new Error('Fixture functions cannot replace native runtime tools');
+    if (await realpath(launch.workspace.source) !== workspace)
+        throw new Error('Native workspace must be the materialized trial workspace');
+    const instructions = await readPrivateFile(join(workspace, launch.instructions.relativePath));
+    if (instructions !== input.instructions || sha256(instructions) !== launch.instructions.sha256) {
+        throw new Error('Materialized native instruction bytes differ from the declared candidate');
+    }
+    if (sha256(await readPrivateFile(launch.config)) !== launch.configSha256)
+        throw new Error('Native launch config digest mismatch');
+    const slotDenied = isGrokLaunch(launch) ? await readGrokSlotDenials(launch) : undefined;
+    const deniedRoot = (path) => !!slotDenied?.some(root => within(root, path));
+    const touchesDenied = (path) => !!slotDenied?.some(root => within(root, path) || within(path, root));
+    const control = await realpath(launch.controlRoot);
+    if (slotDenied) {
+        const entry = await lstat(control);
+        // The receipt is the container root's own statement; a control root it does not deny to the worker uid is refused.
+        if (control !== launch.controlRoot || !entry.isDirectory() || (entry.mode & 0o077) !== 0 ||
+            !slotDenied.includes(control) || within(workspace, control)) {
+            throw new Error('Native Grok control must be a private slot directory the verified slot receipt denies to the worker');
+        }
+        // The slot control root is shared across trials and already holds Daimon's own store, so freshness is per trial.
+        if (await lstat(nativeTrialArtifactsRoot(launch, input.trialId)).then(() => true, () => false)) {
+            throw new Error('Native Grok control already holds fresh trial data for this trial identity');
+        }
+        if ((await lstat(receiptFile)).mode & 0o077)
+            throw new Error('The Grok native launch receipt must stay private inside the slot runtime home');
+    }
+    else if (!within(runtime, control) || control === runtime || within(workspace, control) || (await readdir(control)).length) {
+        throw new Error('Native control must be a fresh empty directory within the trial runtime');
+    }
+    for (const file of [launch.config, launch.tokenFile, launch.envFile]) {
+        const path = await realpath(file);
+        const anchored = slotDenied ? deniedRoot(path) : within(runtime, path);
+        if (path !== file || !anchored || within(workspace, path))
+            throw new Error('Native control inputs must be private trial files');
+        await readPrivateFile(path);
+    }
+    if (touchesDenied(workspace))
+        throw new Error('The Grok slot workspace cannot be, contain or sit inside a denied slot root');
+    const protectedRoots = await Promise.all((input.protectedPaths ?? []).map(path => realpath(path)));
+    // The engine-neutral trial runner protects its own runtime home; for a Grok slot that root is the subject's home.
+    const subjectRoots = isGrokLaunch(launch) ? grokSubjectRoots(launch) : [];
+    const home = launch.projections.find(row => row.role === 'home');
+    const targets = new Set();
+    const writableSources = [];
+    for (const mount of nativeMounts(launch)) {
+        const source = await realpath(mount.source);
+        const stat = await lstat(source);
+        if (source !== resolve(mount.source) || !stat.isFile() && !stat.isDirectory())
+            throw new Error('Native bind source must be a real file or directory');
+        if (targets.has(mount.target))
+            throw new Error('Duplicate native bind target');
+        targets.add(mount.target);
+        if (['/', '/var', '/var/run', '/run', '/proc', '/sys', '/dev', '/etc', '/usr', '/opt', '/home', '/tmp'].includes(mount.target) ||
+            mount.target.includes('docker.sock') || source.includes('docker.sock'))
+            throw new Error('Forbidden native bind target');
+        if (Object.values(containerPaths).some(target => within(mount.target, target) || within(target, mount.target))) {
+            throw new Error('Native bind overlaps worker-owned control paths');
+        }
+        if (mount.readonly) {
+            // Only Codex has a portable ingress credential; Grok launches carry none (schema) and use the broker realm.
+            if (launch.agent.engine !== 'codex' || mount.target !== posix.join(home.target, '.daimon-inbound', 'codex-auth') || !stat.isFile() || (stat.mode & 0o077) !== 0 || stat.nlink !== 1) {
+                throw new Error('Credential mount must be one private read-only native ingress file');
+            }
+            const exposedSources = [launch.workspace.source, ...launch.projections.map(row => row.source), launch.workerRoot,
+                ...(launch.bootstrap ? [launch.bootstrap.root] : [])];
+            if (exposedSources.some(root => within(root, source)))
+                throw new Error('Credential source cannot also be exposed through another native mount');
+            continue;
+        }
+        if (writableSources.some(root => within(root, source) || within(source, root))) {
+            throw new Error('Writable native projections cannot overlap or alias the engine credential home');
+        }
+        writableSources.push(source);
+        if (source !== workspace) {
+            if (slotDenied) {
+                // Closed set: the schema admits one projection, and it must be the trial runtime home the evaluator named,
+                // which the slot projection binds as `runtimeHomePath`. Nothing the launch chose on its own is writable.
+                if (source !== runtime || touchesDenied(source)) {
+                    throw new Error('Native Grok projection must be exactly the slot runtime home and outside every denied slot root');
+                }
+            }
+            else {
+                const childData = child && basename(workspace) === 'workspace' && launch.projections.some(row => row.source === source && ['home', 'memory', 'state'].includes(row.role) && source === join(dirname(workspace), row.role));
+                if ((!within(runtime, source) && !childData) || source === runtime || within(source, control) || within(control, source) ||
+                    [launch.config, launch.tokenFile, launch.envFile].some(path => within(source, path))) {
+                    throw new Error('Native projection must be fresh trial data and exclude controls');
+                }
+            }
+            if (mount.target !== home.target && (within(home.target, mount.target) || within(mount.target, home.target))) {
+                throw new Error('Native projections cannot alias into the engine home');
+            }
+        }
+        if (protectedRoots.some(root => within(source, root) && !subjectRoots.includes(root)))
+            throw new Error('Native bind contains evaluator-owned files');
+    }
+    for (const source of [launch.workerRoot, ...(launch.bootstrap ? [launch.bootstrap.root] : [])]) {
+        if (await realpath(source) !== source || !(await lstat(source)).isDirectory() || source === '/' ||
+            protectedRoots.some(root => within(source, root) || within(root, source)))
+            throw new Error('Invalid immutable native code mount');
+    }
+    return { ...launch, receiptFile };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/runtime/daimon/training/native/container/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EACnE,MAAM,qBAAqB,CAAC;AAE9F,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC9C,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAmB,EAAE,KAAK,GAAG,KAAK;IACvE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtD,uGAAuG;IACvG,qGAAqG;IACrG,uGAAuG;IACvG,yGAAyG;IACzG,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI;QAAE,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAChH,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAClG,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACxI,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9F,IAAI,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAClI,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7F,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACtH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,mHAAmH;QACnH,IAAI,OAAO,KAAK,MAAM,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YACpF,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;QACzH,CAAC;QACD,iHAAiH;QACjH,IAAI,MAAM,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAChJ,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7H,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAChI,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAC7H,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,kHAAkH;IAClH,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtJ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1H,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC5H,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,4GAA4G;YAC5G,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBACpL,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU;gBAC9G,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAChJ,SAAS;QACX,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;QACD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,UAAU,EAAE,CAAC;gBACf,2GAA2G;gBAC3G,yGAAyG;gBACzG,IAAI,MAAM,KAAK,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;gBACrH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,KAAK,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9F,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5H,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;oBACpH,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;oBACzF,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC7G,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACvJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/F,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,KAAK,GAAG;YAC3F,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxI,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC"}

package/dist/runtime/daimon/training/native/container/native-preflight.d.ts

@@ -0,0 +1,8 @@
+import { type VerifiedNativeLaunch } from '../receipt/index.js';
+import type { DockerCommand } from './docker.js';
+/** Exact owner-projected policy; fresh config home because sandbox lacks exec's isolation flags. */
+export declare const nativePolicyProbeScript = "\nimport {execFile} from 'node:child_process';\nimport {promisify} from 'node:util';\nimport {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';\nimport {join} from 'node:path';\nconst input=JSON.parse(await new Promise(resolve=>{let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',v=>s+=v);process.stdin.on('end',()=>resolve(s));}));\nconst projection=input.projection;\nconst scratch=await mkdtemp(join(projection.workspacePath,'.spawnfile-training-native-policy-'));\ntry {\n  const home=join(scratch,'home'), code=join(home,'.codex'), source=join(scratch,'input'), output=join(scratch,'complete');\n  await mkdir(code,{recursive:true,mode:448});\n  await writeFile(source,'NATIVE_WORKSPACE_READ',{mode:384});\n  const command='const fs=require(\"node:fs\");if(process.cwd()!=='+JSON.stringify(projection.workspacePath)+'||fs.readFileSync('+JSON.stringify(source)+',\"utf8\")!==\"NATIVE_WORKSPACE_READ\")throw Error(\"Native workspace read failed\");fs.writeFileSync('+JSON.stringify(output)+',\"NATIVE_POLICY_EXECUTED\");';\n  await promisify(execFile)(projection.executablePath,[...projection.sandboxArgs,'--','/usr/local/bin/node','-e',command],{\n    cwd:projection.workspacePath,env:{PATH:process.env.PATH,HOME:home,CODEX_HOME:code,TMPDIR:'/tmp',LANG:'C.UTF-8'},timeout:12000,maxBuffer:65536});\n  if(await readFile(output,'utf8')!=='NATIVE_POLICY_EXECUTED')throw Error('Native sandbox command did not complete');\n  process.stdout.write(JSON.stringify({schema:'spawnfile.training.daimon-native.policy-preflight.v1',projectionSha256:input.projectionSha256,modelCallsMade:0,workspaceReadWrite:true}));\n} finally {await rm(scratch,{recursive:true,force:true});}\n";
+export declare function verifyPreparedNativeSandbox(run: DockerCommand, name: string, launch: VerifiedNativeLaunch, trialId: string, signal?: AbortSignal): Promise<{
+    projectionSha256: string;
+    workspaceReadWrite: true;
+}>;

package/dist/runtime/daimon/training/native/container/native-preflight.js

@@ -0,0 +1,40 @@
+import { canonicalWireId } from '../../../../../training/index.js';
+import { join } from 'node:path';
+import { parseNativeSandboxReceipt, readPrivateFile } from '../receipt/index.js';
+/** Exact owner-projected policy; fresh config home because sandbox lacks exec's isolation flags. */
+export const nativePolicyProbeScript = `
+import {execFile} from 'node:child_process';
+import {promisify} from 'node:util';
+import {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';
+import {join} from 'node:path';
+const input=JSON.parse(await new Promise(resolve=>{let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',v=>s+=v);process.stdin.on('end',()=>resolve(s));}));
+const projection=input.projection;
+const scratch=await mkdtemp(join(projection.workspacePath,'.spawnfile-training-native-policy-'));
+try {
+  const home=join(scratch,'home'), code=join(home,'.codex'), source=join(scratch,'input'), output=join(scratch,'complete');
+  await mkdir(code,{recursive:true,mode:448});
+  await writeFile(source,'NATIVE_WORKSPACE_READ',{mode:384});
+  const command='const fs=require("node:fs");if(process.cwd()!=='+JSON.stringify(projection.workspacePath)+'||fs.readFileSync('+JSON.stringify(source)+',"utf8")!=="NATIVE_WORKSPACE_READ")throw Error("Native workspace read failed");fs.writeFileSync('+JSON.stringify(output)+',"NATIVE_POLICY_EXECUTED");';
+  await promisify(execFile)(projection.executablePath,[...projection.sandboxArgs,'--','/usr/local/bin/node','-e',command],{
+    cwd:projection.workspacePath,env:{PATH:process.env.PATH,HOME:home,CODEX_HOME:code,TMPDIR:'/tmp',LANG:'C.UTF-8'},timeout:12000,maxBuffer:65536});
+  if(await readFile(output,'utf8')!=='NATIVE_POLICY_EXECUTED')throw Error('Native sandbox command did not complete');
+  process.stdout.write(JSON.stringify({schema:'spawnfile.training.daimon-native.policy-preflight.v1',projectionSha256:input.projectionSha256,modelCallsMade:0,workspaceReadWrite:true}));
+} finally {await rm(scratch,{recursive:true,force:true});}
+`;
+export async function verifyPreparedNativeSandbox(run, name, launch, trialId, signal) {
+    const home = launch.projections.find(projection => projection.role === 'home');
+    const receipt = parseNativeSandboxReceipt(JSON.parse(await readPrivateFile(join(launch.controlRoot, 'sandbox-projection.json'), 262144)), {
+        trialId, configSha256: launch.configSha256, agentId: launch.agent.id, workspacePath: launch.workspace.target, runtimeHomePath: home.target,
+    });
+    const result = await run(['exec', '-i', name, '/usr/local/bin/node', '--input-type=module', '-e', nativePolicyProbeScript], {
+        signal, timeoutMs: 15_000, stdin: JSON.stringify({ path: 'native-policy-preflight', projectionSha256: receipt.projectionSha256, projection: receipt.projection }),
+    });
+    if (result.code !== 0)
+        throw new Error(`Exact native sandbox policy failed before cognition: ${result.stderr.slice(-3000)}`);
+    const proof = JSON.parse(result.stdout);
+    if (canonicalWireId(proof.schema) !== 'spawnfile.training.daimon-native.policy-preflight.v1' || proof.projectionSha256 !== receipt.projectionSha256 ||
+        proof.modelCallsMade !== 0 || proof.workspaceReadWrite !== true)
+        throw new Error('Exact native sandbox probe omitted bound workspace execution evidence');
+    return { projectionSha256: receipt.projectionSha256, workspaceReadWrite: true };
+}
+//# sourceMappingURL=native-preflight.js.map

package/dist/runtime/daimon/training/native/container/native-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-preflight.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/native-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAA6B,MAAM,qBAAqB,CAAC;AAG5G,oGAAoG;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;CAkBtC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAkB,EAAE,IAAY,EAAE,MAA4B,EAC9G,OAAe,EAAE,MAAoB;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAChF,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;QACxI,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM;KAC3I,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,IAAI,EAAE,uBAAuB,CAAC,EAAE;QAC1H,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAClK,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7H,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAC;IACnE,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,sDAAsD,IAAI,KAAK,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB;QACjJ,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC5J,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AAClF,CAAC"}

package/dist/runtime/daimon/training/native/container/preflight.d.ts

@@ -0,0 +1,15 @@
+import type { VerifiedNativeLaunch } from '../receipt/index.js';
+import type { DockerCommand } from './docker.js';
+/** Same namespace compatibility policy as Spawnfile's strict native Codex launch. */
+export declare const codexSandboxContainerSecurity: readonly ["--security-opt", "seccomp=unconfined", "--security-opt", "apparmor=unconfined"];
+/** Separate-container Grok needs a broker, realm and root slot supervisor this adapter does not own. */
+export declare const grokContainerUnsupported = "Separate-container Grok native trials are unsupported: run Grok through child-process execution in the broker-capable training container";
+/** Codex's bubblewrap needs unconfined outer profiles; no other engine inherits them. */
+export declare function containerSecurityOptions(launch: VerifiedNativeLaunch): readonly string[];
+export declare const sandboxPreflightSchema = "spawnfile.training.daimon-native.sandbox-preflight.v1";
+export declare const sandboxChecks: readonly ["namespace", "workspaceRead", "workspaceWrite", "runDenied", "authDenied", "ingressDenied", "networkDenied"];
+/** Shared verbatim by the emitted command and transition tests. A timeout proves nothing. */
+export declare const sandboxNetworkProbeScript = "\nlet settled=false;\nconst socket=net.connect({host:'127.0.0.1',port});\nconst fail=message=>{if(settled)return;settled=true;socket.destroy();process.stderr.write(message);process.exitCode=1;};\nsocket.once('connect',()=>fail('Sandbox network reachable'));\nsocket.once('error',()=>{if(settled)return;settled=true;socket.destroy();fs.writeFileSync('complete','SANDBOX_CHECKS_PASSED');});\nsocket.setTimeout(750,()=>fail('Sandbox network probe timed out'));";
+/** Runs only local sandbox commands with non-secret canaries and a fresh Codex home. */
+export declare const sandboxPreflightScript: string;
+export declare function verifyNativeSandbox(run: DockerCommand, name: string, launch: VerifiedNativeLaunch, trialId: string, signal?: AbortSignal): Promise<void>;