spawnfile 0.1.25 → 0.1.27

package/dist/runtime/codex-exec/training/providers/codex-subscription/strict-schema.js

@@ -0,0 +1,219 @@
+import { Ajv } from 'ajv';
+import { isDeepStrictEqual } from 'node:util';
+import { InferenceFailure } from '../../../../../training/index.js';
+import { validateInferenceResponse } from '../../../../../training/index.js';
+// Wire schemas: graders/{labeling/planning,references/protocol,decomposition/transport},
+// inference/decision/teacher and evaluation/semantic/protocol, plus local references.
+const allowedKeywords = new Set([
+    'type', 'properties', 'required', 'additionalProperties', 'items',
+    'enum', 'const', 'description', '$schema', '$ref', 'definitions', '$defs',
+    'minimum', 'maximum', 'minLength', 'maxLength', 'minItems', 'maxItems', 'uniqueItems',
+]);
+// These authored bounds remain enforced on the completed response by the provider.
+const transportOmissions = new Set(['minimum', 'maximum', 'minLength', 'maxLength', '$schema']);
+const types = new Set(['object', 'array', 'string', 'number', 'integer', 'boolean', 'null']);
+function object(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function escapePointer(key) {
+    return key.replaceAll('~', '~0').replaceAll('/', '~1');
+}
+function refuse(keyword, pointer, reason = 'keyword is not allowlisted') {
+    throw new InferenceFailure('unsupported', `Codex strict schema refuses ${keyword} at ${pointer}: ${reason}`);
+}
+/** Admit only the authored dialect. Literal data and property names are not schemas. */
+function admit(schema) {
+    const locations = new Map();
+    inspect(schema, '#', locations);
+    for (const [pointer, node] of locations) {
+        const seen = new Set();
+        let target = node;
+        while (typeof target['$ref'] === 'string') {
+            const reference = target['$ref'];
+            if (seen.has(reference))
+                refuse('$ref', `${pointer}/$ref`, 'reference-only cycles are unsupported');
+            seen.add(reference);
+            const resolved = locations.get(reference);
+            if (!resolved)
+                refuse('$ref', `${pointer}/$ref`, 'target must be a supported schema location');
+            target = resolved;
+        }
+    }
+    return locations;
+}
+function inspect(schema, pointer, locations) {
+    if (!object(schema))
+        refuse('schema', pointer, 'expected a schema object');
+    locations.set(pointer, schema);
+    // Check keys before their values: no unknown construct can hide an unvisited schema.
+    for (const keyword of Object.keys(schema)) {
+        if (!allowedKeywords.has(keyword))
+            refuse(keyword, `${pointer}/${escapePointer(keyword)}`);
+    }
+    for (const [keyword, value] of Object.entries(schema)) {
+        const location = `${pointer}/${keyword}`;
+        switch (keyword) {
+            case 'definitions':
+            case '$defs':
+            case 'properties':
+                if (!object(value))
+                    refuse(keyword, location, 'expected a property map');
+                for (const [name, child] of Object.entries(value))
+                    inspect(child, `${location}/${escapePointer(name)}`, locations);
+                break;
+            case 'items':
+                if (!object(value))
+                    refuse(keyword, location, 'expected a single schema object; tuples are unsupported');
+                inspect(value, location, locations);
+                break;
+            case '$ref':
+                if (typeof value !== 'string' || (value !== '#' && !value.startsWith('#/')) ||
+                    value.includes('%') || /~(?![01])/u.test(value)) {
+                    refuse(keyword, location, 'expected an unscoped local JSON pointer without URI encoding');
+                }
+                if (Object.keys(schema).some(key => !['$ref', '$schema', 'description', 'definitions', '$defs'].includes(key))) {
+                    refuse(keyword, location, 'cannot preserve sibling validation constraints');
+                }
+                break;
+            case 'additionalProperties':
+                if (value !== false)
+                    refuse(keyword, location, 'free-form objects are unsupported; expected false');
+                break;
+            case 'type': {
+                const valid = (type) => typeof type === 'string' && types.has(type);
+                if (!valid(value) && !(Array.isArray(value) && value.length === 2 && value.includes('null') &&
+                    new Set(value).size === 2 && value.every(valid))) {
+                    refuse(keyword, location, 'expected a type or a nullable type pair');
+                }
+                break;
+            }
+            case 'required':
+                if (!Array.isArray(value) || value.some(name => typeof name !== 'string') || new Set(value).size !== value.length) {
+                    refuse(keyword, location, 'expected distinct property names');
+                }
+                break;
+            case 'description':
+                if (typeof value !== 'string')
+                    refuse(keyword, location, 'expected text');
+                break;
+            case '$schema':
+                if (value !== 'http://json-schema.org/draft-07/schema#')
+                    refuse(keyword, location, 'only draft-07 is supported');
+                break;
+            case 'enum':
+                if (!Array.isArray(value) || value.length === 0)
+                    refuse(keyword, location, 'expected nonempty literal choices');
+                break;
+            case 'minimum':
+            case 'maximum':
+                if (typeof value !== 'number' || !Number.isFinite(value))
+                    refuse(keyword, location, 'expected a finite number');
+                break;
+            case 'minLength':
+            case 'maxLength':
+            case 'minItems':
+            case 'maxItems':
+                if (typeof value !== 'number' || !Number.isInteger(value) || value < 0)
+                    refuse(keyword, location, 'expected a nonnegative integer');
+                break;
+            case 'uniqueItems':
+                if (typeof value !== 'boolean')
+                    refuse(keyword, location, 'expected a boolean');
+                break;
+        }
+    }
+}
+/** Translate admitted schema nodes only; do not forward arbitrary keywords. */
+export function codexStrictSchema(schema) {
+    admit(schema);
+    return transport(schema, new Set());
+}
+function transport(schema, nullableSlots) {
+    const references = [];
+    const result = translate(schema, nullableSlots, '#', references);
+    for (const node of references) {
+        // Optional slots wrap their original target in anyOf[0], including ancestors.
+        node['$ref'] = node['$ref'].split('/').map((part, index, parts) => nullableSlots.has(parts.slice(0, index + 1).join('/')) ? `${part}/anyOf/0` : part).join('/');
+    }
+    return result;
+}
+function translate(schema, nullableSlots, pointer, references, enclosingLiteral) {
+    const literal = enclosingLiteral ?? ['enum', 'const', 'uniqueItems'].find(key => Object.hasOwn(schema, key));
+    if (literal !== undefined && Object.hasOwn(schema, '$ref')) {
+        refuse(literal, pointer, 'cannot preserve literal constraints with references');
+    }
+    const result = Object.fromEntries(Object.entries(schema).filter(([key]) => !transportOmissions.has(key))
+        .map(([key, value]) => [key, structuredClone(value)]));
+    if (typeof schema['$ref'] === 'string')
+        references.push(result);
+    for (const keyword of ['properties', 'definitions', '$defs']) {
+        if (object(schema[keyword])) {
+            result[keyword] = Object.fromEntries(Object.entries(schema[keyword]).map(([name, child]) => [name, translate(child, nullableSlots, `${pointer}/${keyword}/${escapePointer(name)}`, references, literal)]));
+        }
+    }
+    if (object(schema['items']))
+        result['items'] = translate(schema['items'], nullableSlots, `${pointer}/items`, references, literal);
+    if (schema['type'] === 'object' || object(schema['properties']) || Object.hasOwn(schema, 'required') ||
+        Object.hasOwn(schema, 'additionalProperties') || Array.isArray(schema['type']) && schema['type'].includes('object')) {
+        const properties = (result['properties'] ?? {});
+        const required = (schema['required'] ?? []);
+        if (required.some(key => !Object.hasOwn(properties, key))) {
+            refuse('required', `${pointer}/required`, 'every required name must be declared in properties');
+        }
+        if (schema['additionalProperties'] !== false) {
+            refuse('additionalProperties', `${pointer}/additionalProperties`, 'free-form objects are unsupported; expected false');
+        }
+        for (const key of Object.keys(properties)) {
+            if (!required.includes(key)) {
+                properties[key] = { anyOf: [properties[key], { type: 'null' }] };
+                nullableSlots.add(`${pointer}/properties/${escapePointer(key)}`);
+            }
+        }
+        result['properties'] = properties;
+        result['required'] = Object.keys(properties);
+        result['additionalProperties'] = false;
+    }
+    // Literal equality and uniqueness must not intersect a changed subtree.
+    for (const keyword of ['enum', 'const', 'uniqueItems']) {
+        if (Object.hasOwn(schema, keyword) && !isDeepStrictEqual(result, schema)) {
+            refuse(keyword, `${pointer}/${keyword}`, 'cannot preserve literal constraints when translation changes their subtree');
+        }
+    }
+    return result;
+}
+/** Remove transport-added null placeholders only; preserve every originally valid null. */
+export function normalizeCodexResponse(text, schema, jsonFence = false) {
+    const locations = admit(schema);
+    // Check raw JSON first so duplicate keys and infinities cannot disappear.
+    validateInferenceResponse(text, {}, jsonFence);
+    const json = jsonFence ? /^```json\r?\n([\s\S]*?)\r?\n```$/u.exec(text.trim())?.[1] ?? text : text;
+    const nullableSlots = new Set();
+    transport(schema, nullableSlots);
+    const ajv = new Ajv({ strict: true, strictRequired: false }).addSchema(schema, 'original');
+    function visit(value, node, pointer) {
+        if (typeof node['$ref'] === 'string') {
+            const reference = node['$ref'];
+            return visit(value, locations.get(reference), reference);
+        }
+        if (Array.isArray(value) && object(node['items'])) {
+            return value.map(item => visit(item, node['items'], `${pointer}/items`));
+        }
+        if (object(value) && object(node['properties'])) {
+            for (const [key, child] of Object.entries(node['properties'])) {
+                if (!Object.hasOwn(value, key))
+                    continue;
+                const location = `${pointer}/properties/${escapePointer(key)}`;
+                // Encode each pointer segment so percent/hash property names stay literal.
+                const uri = location.split('/').map(encodeURIComponent).join('/').replace('%23', '#');
+                if (value[key] === null && nullableSlots.has(location) && !ajv.getSchema(`original${uri}`)(null))
+                    delete value[key];
+                else
+                    value[key] = visit(value[key], child, location);
+            }
+        }
+        return value;
+    }
+    const normalized = JSON.stringify(visit(JSON.parse(json), schema, '#'));
+    return normalized === JSON.stringify(JSON.parse(json)) ? text : normalized;
+}
+//# sourceMappingURL=strict-schema.js.map

package/dist/runtime/codex-exec/training/providers/codex-subscription/strict-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-schema.js","sourceRoot":"","sources":["../../../../../../src/runtime/codex-exec/training/providers/codex-subscription/strict-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAkB,MAAM,KAAK,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG7E,yFAAyF;AACzF,sFAAsF;AACtF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,OAAO;IACjE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO;IACzE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa;CACtF,CAAC,CAAC;AACH,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAChG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7F,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC;AACD,SAAS,MAAM,CAAC,OAAe,EAAE,OAAe,EAAE,MAAM,GAAG,4BAA4B;IACrF,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,+BAA+B,OAAO,OAAO,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;AAC/G,CAAC;AAED,wFAAwF;AACxF,SAAS,KAAK,CAAC,MAAc;IAC3B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,OAAO,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,OAAO,EAAE,uCAAuC,CAAC,CAAC;YACpG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,OAAO,EAAE,4CAA4C,CAAC,CAAC;YAC/F,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,SAAS,OAAO,CAAC,MAAe,EAAE,OAAe,EAAE,SAA8B;IAC/E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAC3E,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,qFAAqF;IACrF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;QACzC,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,aAAa,CAAC;YAAC,KAAK,OAAO,CAAC;YAAC,KAAK,YAAY;gBACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAC;gBACzE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,OAAO,CAAC,KAAK,EAAE,GAAG,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBACnH,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,yDAAyD,CAAC,CAAC;gBACzG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,8DAA8D,CAAC,CAAC;gBAC5F,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC/G,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,gDAAgD,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM;YACR,KAAK,sBAAsB;gBACzB,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,mDAAmD,CAAC,CAAC;gBACpG,MAAM;YACR,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACzF,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBACnD,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,yCAAyC,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,UAAU;gBACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBAClH,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,kCAAkC,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;gBAC1E,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,KAAK,KAAK,yCAAyC;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;gBACjH,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,mCAAmC,CAAC,CAAC;gBAChH,MAAM;YACR,KAAK,SAAS,CAAC;YAAC,KAAK,SAAS;gBAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAC;gBAChH,MAAM;YACR,KAAK,WAAW,CAAC;YAAC,KAAK,WAAW,CAAC;YAAC,KAAK,UAAU,CAAC;YAAC,KAAK,UAAU;gBAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,gCAAgC,CAAC,CAAC;gBACpI,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,OAAO,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;gBAChF,MAAM;QACV,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AACtC,CAAC;AACD,SAAS,SAAS,CAAC,MAAc,EAAE,aAA0B;IAC3D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,8EAA8E;QAC9E,IAAI,CAAC,MAAM,CAAC,GAAI,IAAI,CAAC,MAAM,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC5E,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,SAAS,CAAC,MAAc,EAAE,aAA0B,EAAE,OAAe,EAAE,UAAoB,EAAE,gBAAyB;IAC7H,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7G,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,qDAAqD,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAW,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAC7G,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChE,KAAK,MAAM,OAAO,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACzF,CAAC,IAAI,EAAE,SAAS,CAAC,KAAe,EAAE,aAAa,EAAE,GAAG,OAAO,IAAI,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,GAAG,OAAO,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAClI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;QAClG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtH,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAW,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAa,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,UAAU,EAAE,GAAG,OAAO,WAAW,EAAE,oDAAoD,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,MAAM,CAAC,sBAAsB,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,CAAC,sBAAsB,EAAE,GAAG,OAAO,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;QACzH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBACjE,aAAa,CAAC,GAAG,CAAC,GAAG,OAAO,eAAe,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;QAClC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,wEAAwE;IACxE,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,EAAE,4EAA4E,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAAc,EAAE,SAAS,GAAG,KAAK;IACpF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,0EAA0E;IAC1E,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,MAAmB,EAAE,UAAU,CAAC,CAAC;IACxG,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,OAAe;QAC1D,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAW,EAAE,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;oBAAE,SAAS;gBACzC,MAAM,QAAQ,GAAG,GAAG,OAAO,eAAe,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/D,2EAA2E;gBAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACtF,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,GAAG,EAAE,CAAE,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;;oBAChH,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAe,EAAE,QAAQ,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,OAAO,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7E,CAAC"}

package/dist/runtime/container.js

@@ -1,3 +1,4 @@
+import { DAIMON_PACKAGE_NAME } from './daimon/packageName.js';
 import { createDaimonInstallCommands } from "./daimonInstall.js";
 import { SpawnfileError } from "../shared/index.js";
 import { NOOPOLIS_RUN_ID_ENV, resolveNoopolisRunId } from "./common.js";
@@ -12,7 +13,6 @@ const LEGACY_DAIMON_RUNTIME_IMAGE_ENV = "SPAWNFILE_DAIMON_RUNTIME_IMAGE";
 const LEGACY_DAIMON_RUNTIME_CAPABILITY_RECEIPT_ENV = "SPAWNFILE_DAIMON_RUNTIME_CAPABILITY_RECEIPT";
 const OPENCLAW_RUNTIME_IMAGE_ENV = "SPAWNFILE_OPENCLAW_RUNTIME_IMAGE";
 const PICOCLAW_RUNTIME_IMAGE_ENV = "SPAWNFILE_PICOCLAW_RUNTIME_IMAGE";
-const DAIMON_PACKAGE_NAME = "@noopolis/daimon";
 const PI_DAIMON_PACKAGE_VERSION = "0.1.2";
 const MNEME_PACKAGE_NAME = "@noopolis/mneme";
 const MNEME_PACKAGE_VERSION = "0.1.1";

package/dist/runtime/containerPackageOverrides.d.ts

@@ -1,6 +1,6 @@
 /**
  * Contract for overriding one runtime install npm package (e.g.
- * `@noopolis/daimon`) with a locally packed tarball instead of the pinned
+ * `Daimon`) with a locally packed tarball instead of the pinned
  * registry version, inside a generated container build.
  *
  * This is opt-in and compile-time only: `createRuntimeInstallRecipe`
@@ -22,7 +22,7 @@ export interface RuntimeContainerPackageOverride {
      * "noopolis-daimon-0.1.2.tgz" — whatever npm itself names it. */
     filename: string;
 }
-/** Keyed by npm package name, e.g. "@noopolis/daimon". */
+/** Keyed by npm package name, e.g. "Daimon". */
 export type RuntimeContainerPackageOverrides = Record<string, RuntimeContainerPackageOverride>;
 /** The single Dockerfile COPY line that stages the packed vendor tarballs
  * into the image; emitted at most once per runtime install recipe, only

package/dist/runtime/containerPackageOverrides.js

@@ -1,6 +1,6 @@
 /**
  * Contract for overriding one runtime install npm package (e.g.
- * `@noopolis/daimon`) with a locally packed tarball instead of the pinned
+ * `Daimon`) with a locally packed tarball instead of the pinned
  * registry version, inside a generated container build.
  *
  * This is opt-in and compile-time only: `createRuntimeInstallRecipe`

package/dist/runtime/daimon/adapter.js

@@ -3,6 +3,7 @@ import { CLI_ENGINE_SKILL_BASE_DIRECTORIES, createAgentCapabilities, createDiagn
 import { parseEveryScheduleMs } from "../scheduleUtils.js";
 import { daimonGrokSkillsError } from "./grokSkillsSupport.js";
 import { assertDaimonAgentOptions, assertDaimonInstructionBounds, createDaimonContainerTargets, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, DAIMON_CONFIG_FILE, DAIMON_CONTROL_PORT, DAIMON_ENGINES, resolveDaimonEngine } from "./config.js";
+import { DAIMON_ENGINE_DESCRIPTORS, DAIMON_BROKER_ENGINE_ID, getDaimonEngineDescriptor } from "./engines.js";
 import { resolveDaimonGrokModel } from "./grokModel.js";
 import { prepareDaimonRuntimeAuth } from "./runAuth.js";
 import { hasDaimonScheduleAuthority } from "./scheduleAuthority.js";
@@ -19,9 +20,7 @@ const assertDaimonSurfaces = (surfaces) => {
     }
 };
 const assertDaimonModel = (target) => {
-    if (target.provider === "openai" && target.auth.method === "codex" && !target.endpoint)
-        return;
-    if (target.provider === "xai" && target.auth.method === "grok" && !target.endpoint)
+    if (!target.endpoint && Object.values(DAIMON_ENGINE_DESCRIPTORS).some(({ auth }) => auth.provider === target.provider && auth.method === target.auth.method))
         return;
     throw new SpawnfileError("validation_error", "Daimon organization runtime v1 accepts only the optional OpenAI Codex subscription intent or a brokered xAI Grok declaration; AGY engine auth stays Daimon-owned");
 };
@@ -73,7 +72,7 @@ const daimonCodexPolicyError = (node) => {
     if (node.runtime.options.codex_policy !== "workspace-no-network") {
         return "Daimon runtime option codex_policy must be workspace-no-network";
     }
-    if (resolveDaimonEngine(node) !== "codex") {
+    if (!getDaimonEngineDescriptor(resolveDaimonEngine(node))?.sandbox.policy) {
         return "Daimon runtime option codex_policy=workspace-no-network is only supported for Codex agents";
     }
     if (node.execution?.sandbox?.mode !== "workspace") {
@@ -102,14 +101,15 @@ const unsupportedAgentFeatures = (node) => {
             throw new SpawnfileError("validation_error", `Daimon stdio MCP server ${server.name} requires an absolute command`);
     }
     const engine = resolveDaimonEngine(node);
-    if (engine === "agy" && node.execution?.model) {
+    const descriptor = getDaimonEngineDescriptor(engine);
+    if (!descriptor.modelSelection.configurable && node.execution?.model) {
         throw new SpawnfileError("validation_error", "Daimon AGY agents must omit Spawnfile execution.model; their subscription auth and model selection are Daimon-owned");
     }
-    if (engine === "codex" && node.execution?.model?.primary.auth?.method === "grok") {
+    if (descriptor.auth.staging === "portable-file" && node.execution?.model?.primary.auth?.method === getDaimonEngineDescriptor(DAIMON_BROKER_ENGINE_ID)?.auth.method) {
         throw new SpawnfileError("validation_error", `Daimon Codex agent ${node.name} cannot declare Grok model auth`);
     }
-    if (engine === "grok")
-        resolveDaimonGrokModel(node);
+    if (descriptor.broker)
+        resolveDaimonGrokModel(node, descriptor);
 };
 const scheduleCapabilityFor = async (node) => {
     if (!node.schedule)
@@ -235,7 +235,7 @@ export const daimonAdapter = {
         if (options.codex_policy !== undefined && options.codex_policy !== "workspace-no-network") {
             diagnostics.push(createDiagnostic("error", "Daimon runtime option codex_policy must be workspace-no-network"));
         }
-        if (options.codex_policy === "workspace-no-network" && options.engine !== undefined && options.engine !== "codex") {
+        if (options.codex_policy === "workspace-no-network" && options.engine !== undefined && !(typeof options.engine === "string" && getDaimonEngineDescriptor(options.engine)?.sandbox.policy)) {
             diagnostics.push(createDiagnostic("error", "Daimon runtime option codex_policy=workspace-no-network is only supported for Codex agents"));
         }
         try {

package/dist/runtime/daimon/config.d.ts

@@ -19,7 +19,8 @@ export declare const DAIMON_WAKE_FUSE_DIRECTORY = "/var/lib/spawnfile/daimon/wak
 export declare const DAIMON_WAKE_FUSE_DIRECTORY_ENV = "DAIMON_WAKE_FUSE_DIRECTORY";
 export declare const DAIMON_WAKE_FUSE_MOUNT_ID = "daimon-wake-fuse";
 export declare const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
-export declare const DAIMON_ENGINES: readonly ["agy", "codex", "grok"];
+import { DAIMON_ENGINES } from "./engines.js";
+export { DAIMON_ENGINES } from "./engines.js";
 type DaimonEngine = typeof DAIMON_ENGINES[number];
 /** The per-agent option checks `createDaimonContainerTargets` applies, for preflight. */
 export declare const assertDaimonAgentOptions: (agentId: string, node: ResolvedAgentNode) => void;

package/dist/runtime/daimon/config.js

@@ -4,14 +4,15 @@ import { daimonGrokSkillsError } from "./grokSkillsSupport.js";
 import { daimonAgentSkillsFromResolved } from "./grokWorkerSkills.js";
 import { parseEveryScheduleMs } from "../scheduleUtils.js";
 import { SpawnfileError } from "../../shared/index.js";
-import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_ENGINE_CREDENTIALS, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "./contractManifest.js";
+import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_GROK_SUBSCRIPTION_REALM, DAIMON_GROK_TURN_USAGE_LEDGER } from "./contractManifest.js";
 import { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory } from "./memory.js";
 import { assertDaimonScheduleAuthority } from "./scheduleAuthority.js";
 import { assertDaimonAttentionAuthority, resolveDaimonAttention } from "./attention.js";
 import { resolveDaimonGrokTurnLimits } from "./grokTurnLimits.js";
 import { resolveDaimonGrokModel } from "./grokModel.js";
 import { assertDaimonRecordingIsolation, daimonRecordingMountId, resolveDaimonAgentRecording } from "./recording.js";
-export const DAIMON_CODEX_WORKSPACE_NO_NETWORK_POLICY = { mode: "workspace-write", networkAccess: false, webSearch: "disabled" };
+import { DAIMON_PINNED_PORTABLE_DESCRIPTOR } from "./engineDescriptorSchema.js";
+export const DAIMON_CODEX_WORKSPACE_NO_NETWORK_POLICY = DAIMON_PINNED_PORTABLE_DESCRIPTOR.sandbox.policy;
 // Re-exported so every existing importer of these names keeps working; the
 // definitions themselves now live in `./memory.js`.
 export { DAIMON_INSTANCE_STATE_ROOT, daimonMemoryCapabilityFor, daimonMemorySelectionWarning, daimonMemoryVectorRecallWarning, resolveDaimonAgentMemory };
@@ -30,7 +31,8 @@ export const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
 const DAIMON_MAX_CONFIG_BYTES = 1_048_576;
 const DAIMON_MAX_INSTRUCTION_BYTES = 16_384;
 const DAIMON_MAX_INSTRUCTION_CODEPOINTS = 16_384;
-export const DAIMON_ENGINES = ["agy", "codex", "grok"];
+import { DAIMON_ENGINES, DAIMON_DEFAULT_ENGINE, getDaimonEngineDescriptor, daimonEngineHasBroker } from "./engines.js";
+export { DAIMON_ENGINES } from "./engines.js";
 const normalizeSchedule = (node) => {
     const schedule = node.schedule;
     if (!schedule || schedule.kind === "disabled")
@@ -62,7 +64,7 @@ const assertPublicInstructionBounds = (agentId, instructions) => {
     }
 };
 const assertTurnLimitsEngine = (agentId, engine, turnLimits) => {
-    if (engine !== "grok" && turnLimits !== undefined) {
+    if (!daimonEngineHasBroker(engine) && turnLimits !== undefined) {
         throw new SpawnfileError("validation_error", `Daimon runtime option turn_limits is only supported on a brokered Grok agent: ${agentId}`);
     }
 };
@@ -81,7 +83,7 @@ export const assertDaimonAgentOptions = (agentId, node) => {
 /** The instruction-size check compile applies in `createDaimonContainerTargets`, for preflight. */
 export const assertDaimonInstructionBounds = (agentId, node) => assertPublicInstructionBounds(agentId, formatInstructions(node));
 export const resolveDaimonEngine = (node) => {
-    const engine = node.runtime.options.engine ?? "codex";
+    const engine = node.runtime.options.engine ?? DAIMON_DEFAULT_ENGINE;
     if (typeof engine === "string" && DAIMON_ENGINES.includes(engine)) {
         return engine;
     }
@@ -89,14 +91,15 @@ export const resolveDaimonEngine = (node) => {
 };
 const resolveDaimonEngineConfig = (node) => {
     const kind = resolveDaimonEngine(node);
-    if (kind === "grok") {
-        const declared = resolveDaimonGrokModel(node);
+    const descriptor = getDaimonEngineDescriptor(kind);
+    if (descriptor.broker) {
+        const declared = resolveDaimonGrokModel(node, descriptor);
         return { kind, model: declared.model, reasoningEffort: declared.reasoningEffort };
     }
-    const model = kind === "codex" ? node.execution?.model?.primary?.name : undefined;
-    const reasoningEffort = kind === "codex" ? node.execution?.model?.primary?.reasoning_effort : undefined;
-    const codexSandbox = kind === "codex" && node.runtime.options.codex_policy === "workspace-no-network"
-        ? DAIMON_CODEX_WORKSPACE_NO_NETWORK_POLICY
+    const model = descriptor.modelSelection.configurable ? node.execution?.model?.primary?.name : undefined;
+    const reasoningEffort = descriptor.modelSelection.configurable ? node.execution?.model?.primary?.reasoning_effort : undefined;
+    const codexSandbox = descriptor.sandbox.policy && node.runtime.options.codex_policy === "workspace-no-network"
+        ? descriptor.sandbox.policy
         : undefined;
     return {
         kind,
@@ -112,9 +115,8 @@ const renderStartScript = (agents) => {
     const acceptanceStorePath = `<instance-root>/${DAIMON_RUNTIME_ACCEPTANCE_STORE_DIRECTORY}`;
     const readinessReceiptPath = `${acceptanceStorePath}/runtime-readiness.json`;
     const setup = agents.flatMap((agent) => {
-        const credential = agent.engine.kind === "codex"
-            ? DAIMON_ENGINE_CREDENTIALS.codex
-            : undefined;
+        const material = getDaimonEngineDescriptor(agent.engine.kind)?.credentialMaterial;
+        const credential = material?.sourceRelativePath ? material : undefined;
         const inbound = path.posix.join(agent.runtimeHomePath, ".daimon-inbound");
         return [
             // The workspace mode is owned by the uid entrypoint, which grants a grok worker
@@ -124,7 +126,7 @@ const renderStartScript = (agents) => {
             // A Grok agent's runtime home is traversable by its worker's group (the
             // broker provisioning grants `0710` so the worker can read its setgid
             // `tool-output/` spills); restating 0700 here would revoke that.
-            agent.engine.kind === "grok"
+            daimonEngineHasBroker(agent.engine.kind)
                 ? `[ -d ${JSON.stringify(agent.runtimeHomePath)} ] || install -d -m 700 ${JSON.stringify(agent.runtimeHomePath)}`
                 : `install -d -m 700 ${[
                     agent.runtimeHomePath,
@@ -205,10 +207,10 @@ export const createDaimonContainerTargets = async (inputs) => {
     for (const agent of configAgents)
         assertTurnLimitsEngine(agent.id, agent.engine.kind, turnLimitsById.get(agent.id));
     const grokTurnLimitsByNodeId = Object.fromEntries(configAgents
-        .filter((agent) => agent.engine.kind === "grok" && turnLimitsById.get(agent.id) !== undefined)
+        .filter((agent) => daimonEngineHasBroker(agent.engine.kind) && turnLimitsById.get(agent.id) !== undefined)
         .map((agent) => [agent.id, turnLimitsById.get(agent.id)]));
     const grokModelByNodeId = Object.fromEntries(configAgents
-        .filter((agent) => agent.engine.kind === "grok" && agent.engine.model !== undefined && agent.engine.reasoningEffort !== undefined)
+        .filter((agent) => daimonEngineHasBroker(agent.engine.kind) && agent.engine.model !== undefined && agent.engine.reasoningEffort !== undefined)
         .map((agent) => [agent.id, { model: agent.engine.model, reasoningEffort: agent.engine.reasoningEffort }]));
     // The compiled `.agents/skills` tree, in Daimon's engine-neutral form: root provisioning renders it into the worker's `$GROK_HOME/skills`.
     for (const input of agents) {
@@ -217,23 +219,21 @@ export const createDaimonContainerTargets = async (inputs) => {
             throw new SpawnfileError("validation_error", refused);
     }
     const grokSkillsByNodeId = Object.fromEntries(agents
-        .filter((input) => engineByNodeId[input.id] === "grok" && input.value.skills.length > 0)
+        .filter((input) => daimonEngineHasBroker(engineByNodeId[input.id]) && input.value.skills.length > 0)
         .map((input) => [input.id, daimonAgentSkillsFromResolved(input.value.skills)]));
-    const hasAgy = configAgents.some((agent) => agent.engine.kind === "agy");
-    const hasGrok = configAgents.some((agent) => agent.engine.kind === "grok");
+    const hasAgy = configAgents.some((agent) => getDaimonEngineDescriptor(agent.engine.kind)?.auth.staging === "secret-service");
+    const hasGrok = configAgents.some((agent) => daimonEngineHasBroker(agent.engine.kind));
     const agyRuntimeHomeMounts = configAgents
-        .filter((agent) => agent.engine.kind === "agy")
+        .filter((agent) => getDaimonEngineDescriptor(agent.engine.kind)?.auth.staging === "secret-service")
         .map((agent) => ({
         id: `daimon-agy-runtime-home-${path.posix.basename(agent.runtimeHomePath)}`,
         mountPath: agent.runtimeHomePath,
         reason: `Daimon AGY subscription runtime home for ${agent.id}`
     }));
     const portableEngineHomeMounts = configAgents
-        .filter((agent) => agent.engine.kind !== "agy")
+        .filter((agent) => getDaimonEngineDescriptor(agent.engine.kind)?.capabilities.portableCredential === true)
         .map((agent) => {
-        const destinationRelativePath = agent.engine.kind === "grok"
-            ? DAIMON_GROK_SUBSCRIPTION_REALM.agentCredentialRelativePath
-            : DAIMON_ENGINE_CREDENTIALS.codex.destinationRelativePath;
+        const destinationRelativePath = getDaimonEngineDescriptor(agent.engine.kind).credentialMaterial.destinationRelativePath;
         return {
             id: `daimon-engine-home-${agent.engine.kind}-${path.posix.basename(agent.runtimeHomePath)}`,
             mountPath: path.posix.join(agent.runtimeHomePath, path.posix.dirname(destinationRelativePath)),