spawnfile 0.1.25 → 0.1.28

package/README.md

@@ -95,7 +95,7 @@ Portability is capability-specific: the compiler reports each feature as **suppo
 | Explore complete projects | [Examples](examples/) |
 | Add an adapter or contribute | [Contributing](CONTRIBUTING.md) |
 | Integrate with deployment tooling | [Target and lifecycle contracts](specs/TARGETS.md) |
-| Plan isolated agent training | [Paideia training handoff](specs/TRAINING.md) |
+| Plan isolated agent training | [Agent training](specs/TRAINING.md) |
 | Find a detailed contract | [Specification index](specs/INDEX.md) |
 
 Spawnfile is part of [Noopolis](https://github.com/noopolis). [Moltnet](https://moltnet.dev) supplies messaging; [Daimon](https://github.com/noopolis/daimon-harness) runs individual agents; [Simfile](https://simfile.org) builds simulation worlds around organizations. You can use Spawnfile on its own.

package/dist/audit/readAudit.d.ts

@@ -13,9 +13,9 @@ export declare const auditReportSchema: z.ZodObject<{
         evidence: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         id: z.ZodString;
         severity: z.ZodEnum<{
-            critical: "critical";
-            high: "high";
             medium: "medium";
+            high: "high";
+            critical: "critical";
         }>;
         status: z.ZodEnum<{
             pass: "pass";

package/dist/auth/trainingAuth.js

@@ -10,7 +10,7 @@ const targets = {
 export const stageTrainingAuth = async (options) => {
     if (!Object.hasOwn(targets, options.provider))
         throw Error("Unsupported training auth provider");
-    const home = path.resolve(options.home), source = options.source ?? `/run/paideia-auth/${options.provider}`;
+    const home = path.resolve(options.home), source = options.source ?? `/run/spawnfile-training-auth/${options.provider}`;
     if (!path.isAbsolute(options.home) || await realpath(home) !== home || !(await lstat(home)).isDirectory())
         throw Error("Training home must be a canonical existing directory");
     if (!path.isAbsolute(source) || await realpath(source) !== path.resolve(source))

package/dist/cli/runCli.d.ts

@@ -4,7 +4,7 @@ import { devActivityProject, devApplyProject, devRestartProject, devStopProject,
 import { consumeImageUp } from "../distribution/index.js";
 import { createDockerProbeGateway, downDeployment, exportRunArtifacts, inspectDockerDeployment, listDeploymentRecords, listHomeDeploymentRecords } from "../deployment/index.js";
 import { listRuntimeAdapters } from "../runtime/index.js";
-import { delegatePaideiaTraining } from "./paideiaDelegation.js";
+import { runTraining } from "./trainingExecution.js";
 export interface CliStreams {
     stderr: (message: string) => void;
     stdout: (message: string) => void;
@@ -22,7 +22,7 @@ export interface CliHandlers {
     loadTrainingProject: typeof loadTrainingProject;
     resolveTrainingPlan: typeof resolveTrainingPlan;
     materializeTrainingMoment: typeof materializeTrainingMoment;
-    delegatePaideiaTraining: typeof delegatePaideiaTraining;
+    runTraining: typeof runTraining;
     buildCompilePlan: typeof buildCompilePlan;
     buildOrganizationView: typeof buildOrganizationView;
     buildProject: typeof buildProject;

package/dist/cli/runCli.js

@@ -23,7 +23,7 @@ import { registerProductionTargetCommands } from "./targetProductionCommands.js"
 import { registerViewCommand } from "./viewCommand.js";
 import { registerVolumeCommands } from "./volumeCommands.js";
 import { registerTrainCommand } from "./trainCommand.js";
-import { delegatePaideiaTraining } from "./paideiaDelegation.js";
+import { runTraining } from "./trainingExecution.js";
 const packageJsonPath = new URL("../../package.json", import.meta.url);
 const readPackageVersion = () => {
     const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
@@ -39,7 +39,7 @@ const createDefaultRenderEnvironment = () => ({
     stdoutIsTty: process.stdout.isTTY === true
 });
 const createDefaultHandlers = () => ({
-    createTrainingContext, createTrainingPlan, loadTrainingProject, resolveTrainingPlan, materializeTrainingMoment, lowerTrainingExecution, allocateTrainingOutputParent, delegatePaideiaTraining,
+    createTrainingContext, createTrainingPlan, loadTrainingProject, resolveTrainingPlan, materializeTrainingMoment, lowerTrainingExecution, allocateTrainingOutputParent, runTraining,
     buildCompilePlan, buildOrganizationView, buildProject, compileProject, publishProject,
     addAgentProject, addProjectModelFallback, addProjectSurface,
     addSubagentProject, addTeamProject, clearProjectModelFallbacks,

package/dist/cli/trainCommand.js

@@ -8,7 +8,6 @@ export const registerTrainCommand = (program, handlers, streams, packageVersion,
         .description("Plan, rewind, or train one canonical agent through its declared training inputs")
         .argument("[path]", "Canonical project directory or Spawnfile path", process.cwd())
         .option("--agent <id>", "Canonical agent id or unambiguous short name (inferred for one agent)")
-        .option("--paideia-command <executable>", "Installed Paideia executable; no shell or automatic install", "paideia")
         .option("--training-image <immutable-image>", "Pinned image containing the complete training environment")
         .option("--training-config <json>", "V2 image recipe and declared inputs, or advanced v1 local bindings")
         .option("--plan", "Print the resolved training authoring plan without executing training")
@@ -21,9 +20,9 @@ export const registerTrainCommand = (program, handlers, streams, packageVersion,
     for (const name of forwarded) {
         const flag = `--${name} <value>`;
         if (repeated.has(name))
-            command.option(flag, `Paideia ${name}; repeatable`, (value, previous) => [...previous, value], []);
+            command.option(flag, `Training ${name}; repeatable`, (value, previous) => [...previous, value], []);
         else
-            command.option(flag, name === "out" ? "Output directory for training or moment materialization" : `Paideia ${name}`);
+            command.option(flag, name === "out" ? "Output directory for training or moment materialization" : `Training ${name}`);
     }
     command.action(async (inputPath, options) => {
         if (typeof options.materialize === "string") {
@@ -104,11 +103,11 @@ export const registerTrainCommand = (program, handlers, streams, packageVersion,
         const context = await handlers.createTrainingContext(inputPath, { agent: plan.agent.id, packageVersion });
         if (lowered)
             await handlers.allocateTrainingOutputParent(lowered.execution.output);
-        setExitCode(await handlers.delegatePaideiaTraining({ context, args: lowered?.execution.args ?? args, execution: lowered?.execution,
+        setExitCode(await handlers.runTraining({ context, args: lowered?.execution.args ?? args, execution: lowered?.execution,
             repairMeasurements: options.repairMeasurements, repairWitness: options.repairWitness,
             trainingImage: lowered?.trainingImage ?? options.trainingImage,
             trainingConfig: lowered?.trainingConfig ?? options.trainingConfig,
-            command: options.paideiaCommand, dryRun: options.dryRun === true,
+            dryRun: options.dryRun === true,
             timeoutMs: timeout + 5000, streams, signal }));
     });
 };

package/dist/cli/{paideiaDelegation.d.ts → trainingExecution.d.ts}

@@ -1,9 +1,8 @@
 import { type TrainingContext, type TrainingExecution } from "../compiler/training/index.js";
 import type { CliStreams } from "./runCli.js";
-export interface DelegatePaideiaTrainingOptions {
+export interface RunTrainingOptions {
     context: TrainingContext;
     execution?: TrainingExecution;
-    command: string;
     args: readonly string[];
     dryRun: boolean;
     repairMeasurements?: string;
@@ -14,5 +13,5 @@ export interface DelegatePaideiaTrainingOptions {
     streams: CliStreams;
     signal?: AbortSignal;
 }
-/** Delegates through the public CLI, never importing Paideia or selecting a fallback adapter. */
-export declare const delegatePaideiaTraining: (options: DelegatePaideiaTrainingOptions) => Promise<number>;
+/** Owns image preparation/launch and invokes host estimates through the training composition. */
+export declare const runTraining: (options: RunTrainingOptions) => Promise<number>;

package/dist/cli/trainingExecution.js

@@ -0,0 +1,151 @@
+import { canonicalWireId } from '../shared/index.js';
+import { launchTrainingContainer } from "../compiler/training/container/index.js";
+import { runTrainingDocker } from "../compiler/training/container/process.js";
+import { prepareTraining } from "../compiler/training/preparation/index.js";
+import { readBoundedJson } from "../compiler/training/preparation/inputs.js";
+import { SpawnfileError } from "../shared/index.js";
+const failure = (message) => new SpawnfileError("runtime_error", message);
+const validCostReceipt = (line) => {
+    try {
+        const receipt = JSON.parse(line);
+        return typeof receipt === "object" && receipt !== null &&
+            "schema" in receipt && canonicalWireId(receipt.schema) === "spawnfile.training.training-cost-plan.v1" &&
+            "modelCallsMade" in receipt && receipt.modelCallsMade === 0;
+    }
+    catch {
+        return false;
+    }
+};
+/** Owns image preparation/launch and invokes host estimates through the training composition. */
+export const runTraining = async (options) => {
+    if (options.signal?.aborted)
+        return 130;
+    if (options.repairWitness && !options.repairMeasurements)
+        throw failure("--repair-witness requires --repair-measurements");
+    if (options.trainingConfig) {
+        const config = await readBoundedJson(options.trainingConfig);
+        // Image declarations go through preparation; lowered launch configurations go straight to Docker.
+        if (config.version === "spawnfile.training-container.v2" || (["spawnfile.training-container.v3", "spawnfile.training-container.v4"].includes(String(config.version)) && config.image !== undefined)) {
+            if (options.trainingImage && !options.execution)
+                throw failure("V2 owns its image declaration; --training-image is only for v1");
+            const prepared = await prepareTraining({ configPath: options.trainingConfig, context: options.context, args: options.args,
+                repairMeasurements: options.repairMeasurements, repairWitness: options.repairWitness,
+                execution: options.execution, outputOverride: options.execution?.output, imageOverride: options.execution ? options.trainingImage : undefined,
+                dryRun: options.dryRun, process: runTrainingDocker, timeoutMs: options.timeoutMs, signal: options.signal, streams: options.streams });
+            if (!("dryRun" in prepared))
+                return launchTrainingContainer({ ...prepared,
+                    timeoutMs: options.timeoutMs, signal: options.signal, streams: options.streams });
+            options.streams.stderr(`Training preparation plan ${prepared.digest}; no Docker, auth or filesystem mutations`);
+            options = { ...options, repairMeasurements: undefined, repairWitness: undefined };
+        }
+    }
+    if (options.repairMeasurements)
+        throw failure("Measurement repair requires the v2 preparation declaration");
+    if (!options.dryRun) {
+        if (!options.trainingImage || !options.trainingConfig)
+            throw failure("Actual training requires --training-image and --training-config; host execution is disabled");
+        return launchTrainingContainer({ image: options.trainingImage, configPath: options.trainingConfig,
+            context: options.context, args: options.args, execution: options.execution, timeoutMs: options.timeoutMs, streams: options.streams, signal: options.signal });
+    }
+    const controller = new AbortController();
+    const deadline = performance.now() + options.timeoutMs;
+    let active = true, lastLine = "";
+    const pending = { stdout: "", stderr: "" };
+    let stop;
+    const stopped = new Promise((resolve, reject) => {
+        stop = (code, error) => {
+            if (!active)
+                return;
+            active = false;
+            if (error)
+                reject(error);
+            else
+                resolve(code);
+            controller.abort(error);
+        };
+    });
+    const expire = () => stop(1, failure("Training exceeded its command deadline"));
+    const interrupt = () => stop(130);
+    const terminate = () => stop(143);
+    const timer = setTimeout(expire, options.timeoutMs);
+    process.once("SIGINT", interrupt);
+    process.once("SIGTERM", terminate);
+    options.signal?.addEventListener("abort", interrupt, { once: true });
+    const emit = (channel, raw) => {
+        if (performance.now() >= deadline)
+            expire();
+        if (!active)
+            return;
+        const line = raw.replace(/\r$/u, "");
+        if (!line.trim())
+            return;
+        if (channel === "stdout")
+            lastLine = line;
+        options.streams[channel](line);
+    };
+    const flush = () => {
+        for (const channel of ["stdout", "stderr"]) {
+            const text = pending[channel];
+            pending[channel] = "";
+            emit(channel, text);
+        }
+    };
+    const forward = (channel, text) => {
+        if (performance.now() >= deadline)
+            expire();
+        if (!active)
+            return;
+        const lines = (pending[channel] + text).split("\n");
+        pending[channel] = lines.pop();
+        for (const line of lines)
+            emit(channel, line);
+    };
+    try {
+        const invocation = async () => {
+            const { main: trainingMain } = await import("../runtime/trainingCli.js");
+            if (performance.now() >= deadline)
+                expire();
+            if (!active)
+                return stopped;
+            const args = options.args.includes("--dry-run") ? options.args : [...options.args, "--dry-run"];
+            return trainingMain(["train", ...args], {
+                cwd: process.cwd(), signal: controller.signal,
+                stdout: text => forward("stdout", text), stderr: text => forward("stderr", text)
+            }, { spawnfileContext: options.context });
+        };
+        if (options.signal?.aborted)
+            interrupt();
+        const code = await Promise.race([stopped, invocation()]);
+        // Synchronous core work can delay the timer; elapsed time still forbids success.
+        if (active && performance.now() >= deadline) {
+            expire();
+            return await stopped;
+        }
+        if (active)
+            flush();
+        if (active && performance.now() >= deadline)
+            expire();
+        if (!active)
+            return await stopped;
+        if (active && code === 0 && !validCostReceipt(lastLine)) {
+            throw failure("Training exited without the required final training receipt");
+        }
+        return code;
+    }
+    catch (error) {
+        if (active)
+            flush();
+        if (active && performance.now() >= deadline)
+            expire();
+        if (!active)
+            return await stopped;
+        throw error;
+    }
+    finally {
+        active = false;
+        clearTimeout(timer);
+        process.removeListener("SIGINT", interrupt);
+        process.removeListener("SIGTERM", terminate);
+        options.signal?.removeEventListener("abort", interrupt);
+    }
+};

package/dist/compiler/containerDaimonGrokWorkerRender.d.ts

@@ -170,7 +170,7 @@ export declare const renderDaimonGrokServiceConfig: (registrations: readonly Dai
         };
         model: {
             id: "grok-4.6" | "grok-4.5" | "grok-build";
-            reasoningEffort: "high" | "medium" | "low";
+            reasoningEffort: "low" | "medium" | "high";
         };
     }[] | undefined;
     registrations: {
@@ -187,7 +187,7 @@ export declare const renderDaimonGrokServiceConfig: (registrations: readonly Dai
         } | undefined;
         model?: {
             id: "grok-4.6" | "grok-4.5" | "grok-build";
-            reasoningEffort: "high" | "medium" | "low";
+            reasoningEffort: "low" | "medium" | "high";
         } | undefined;
         agentId: string;
         slot: number;

package/dist/compiler/containerDaimonGrokWorkerRender.js

@@ -1,3 +1,4 @@
+import { daimonEngineHasBroker, getDaimonEngineDescriptor } from "../runtime/daimon/index.js";
 import path from "node:path";
 import { SpawnfileError } from "../shared/index.js";
 import { resolveDaimonGrokRegistrationLimits } from "../runtime/daimon/grokTurnLimits.js";
@@ -125,7 +126,7 @@ export const resolveDaimonGrokWorkerDenyPaths = (plans, plan, agentId, workerHom
     const daimonOwn = [
         DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath,
         DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath,
-        ...(agents.some(([, engine]) => engine === "agy") ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath, DAIMON_AGY_SUBSCRIPTION_REALM.durableMountPath] : []),
+        ...(agents.some(([, engine]) => getDaimonEngineDescriptor(engine)?.auth.staging === "secret-service") ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath, DAIMON_AGY_SUBSCRIPTION_REALM.durableMountPath] : []),
         daimonGrokAcceptanceStoreDenyPath(instanceRoot),
         ...peers.flatMap((slug) => [
             path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, slug),
@@ -181,7 +182,7 @@ export const resolveDaimonGrokRegistrations = (plans) => {
     const entries = plans
         .filter((plan) => plan.runtimeName === "daimon")
         .flatMap((plan) => Object.entries(plan.engineByNodeId ?? {})
-        .filter(([, engine]) => engine === "grok")
+        .filter(([, engine]) => daimonEngineHasBroker(engine))
         .map(([agentId]) => ({ agentId, plan })))
         .sort((left, right) => left.agentId.localeCompare(right.agentId));
     const homes = entries.map((_, slot) => path.posix.join(DAIMON_WORKER_ROOT, String(DAIMON_FIRST_WORKER_UID + slot)));

package/dist/compiler/containerDaimonUidEntrypointRender.js

@@ -1,3 +1,4 @@
+import { DAIMON_SECRET_SERVICE_ENGINE_ID, getDaimonEngineDescriptor } from "../runtime/daimon/index.js";
 import path from "node:path";
 import { DAIMON_RUNTIME_ACCEPTANCE_STORE_MOUNT_ID, DAIMON_WAKE_FUSE_DIRECTORY } from "../runtime/daimon/config.js";
 import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../runtime/daimon/contractManifest.js";
@@ -72,8 +73,8 @@ const opaqueMountTargets = (runtimePlans) => [...new Set(runtimePlans
         ...(plan.opaqueMountTargets ?? []),
         ...(plan.resources ?? []).map((resource) => resource.linkPath),
         ...Object.entries(plan.engineByNodeId ?? {})
-            .filter(([, engine]) => engine === "codex")
-            .map(([nodeId, engine]) => path.posix.join(plan.instancePaths.instanceRoot ?? "", DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(nodeId), ".daimon-inbound", `${engine}-auth`))
+            .filter(([, engine]) => getDaimonEngineDescriptor(engine)?.auth.staging === "portable-file")
+            .map(([nodeId, engine]) => path.posix.join(plan.instancePaths.instanceRoot ?? "", DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(nodeId), getDaimonEngineDescriptor(engine).credentialMaterial.sourceRelativePath))
     ])
         .filter((target) => target.startsWith("/")))].sort();
 export const resolveDaimonUidEntrypointStateRoots = (runtimePlans) => [
@@ -210,7 +211,7 @@ export const renderDaimonUidEntrypoint = (runtimePlans, persistentMountPaths = [
         'gid="$uid"',
         `runtime_command=(${quote("/opt/spawnfile/entrypoint.sh")} --spawnfile-runtime-identity "$uid" "$gid")`,
         'if [ "$#" -gt 0 ]; then',
-        `  if [ "$#" -ne 5 ] || [ "$1" != auth ] || [ "$2" != agy ] || [ "$3" != login ] || [ "$4" != --config ] || [ "$5" != ${quote(daimonConfigPath ?? "")} ]; then echo "Unsupported Daimon container command" >&2; exit 1; fi`,
+        `  if [ "$#" -ne 5 ] || [ "$1" != auth ] || [ "$2" != ${DAIMON_SECRET_SERVICE_ENGINE_ID} ] || [ "$3" != login ] || [ "$4" != --config ] || [ "$5" != ${quote(daimonConfigPath ?? "")} ]; then echo "Unsupported Daimon container command" >&2; exit 1; fi`,
         `  runtime_command=(bash ${quote(daimonStartPath)} "$@")`,
         "fi",
         // Fail closed BEFORE the ownership guard touches anything: an unbacked

package/dist/compiler/containerPackageOverrides.d.ts

@@ -1,7 +1,7 @@
 import type { RuntimeContainerPackageOverrides } from "../runtime/index.js";
 /**
  * Compile-time-only request map: runtime install npm package name (e.g.
- * "@noopolis/daimon") to the absolute local package directory that should
+ * "Daimon") to the absolute local package directory that should
  * be packed and installed into the generated container instead of the
  * pinned registry version. Only opt-in local/E2E compiles set this (see
  * src/e2e/AGENTS.md); a standard compile passes no overrides and the

package/dist/compiler/training/broker/declaration.d.ts

@@ -22,9 +22,9 @@ export declare const trainingBrokerDeclarationSchema: z.ZodObject<{
         "grok-build": "grok-build";
     }>;
     reasoningEffort: z.ZodEnum<{
-        high: "high";
-        medium: "medium";
         low: "low";
+        medium: "medium";
+        high: "high";
     }>;
     architecture: z.ZodEnum<{
         arm64: "arm64";

package/dist/compiler/training/broker/declaration.js

@@ -1,3 +1,4 @@
+import { DAIMON_BROKER_ENGINE_ID } from "../../../runtime/daimon/index.js";
 import path from "node:path";
 import { z } from "zod";
 import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
@@ -17,7 +18,7 @@ export const trainingBrokerDeclarationSchema = z.strictObject({
     version: z.literal("spawnfile.training-broker.v2"),
     maxRunRequests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).default(1000),
     slots: z.number().int().min(1).max(8).default(4),
-    engine: z.literal("grok"),
+    engine: z.literal(DAIMON_BROKER_ENGINE_ID),
     agentId: z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u),
     model: z.enum(DAIMON_GROK_BROKER_MODELS),
     reasoningEffort: z.enum(DAIMON_GROK_BROKER_REASONING_EFFORTS),
@@ -29,7 +30,7 @@ export const trainingBrokerDeclarationSchema = z.strictObject({
     }),
     /** The read-only bootstrap credential leaf, already refused if it is the desktop `~/.grok/auth.json`. */
     bootstrap: canonical,
-    /** The uid the trained evaluator (Paideia, DSPy, judges) runs as; the only uid the slot supervisor serves. */
+    /** The uid the trained evaluator (Training, DSPy, judges) runs as; the only uid the slot supervisor serves. */
     organizationUid: z.literal(DAIMON_GROK_ENGINE_BROKER.identities.organizationUid),
     seccompProfileSha256: z.string().regex(/^[a-f0-9]{64}$/u),
     /**

package/dist/compiler/training/broker/entrypoint.d.ts

@@ -1,6 +1,6 @@
 import { type DaimonProjectionModule } from "./projection.js";
-export declare const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "PAIDEIA_GROK_BROKER_CONTROL_SOCKET";
-export declare const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "PAIDEIA_GROK_GRANT_HOME_ROOT";
+export declare const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "SPAWNFILE_TRAINING_GROK_BROKER_CONTROL_SOCKET";
+export declare const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT";
 export declare const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
 /**
  * The desktop Grok login, in every spelling a caller might reach it by.
@@ -26,7 +26,7 @@ export interface TrainingEntrypointOptions {
  * production capability set, start the launcher (root) and the broker and
  * relay (2100) and prove each one's post-drop identity, publish the slot
  * supervisor socket, and only then drop to uid 2000 with an empty capability
- * bounding set to run `train`. Paideia, DSPy and the judges are that uid; the
+ * bounding set to run `train`. The training core, DSPy and the judges are that uid; the
  * model's own tools are the worker uid the launcher alone can reach.
  */
 export declare const runTrainingBrokerEntrypoint: (options: TrainingEntrypointOptions) => Promise<number>;

package/dist/compiler/training/broker/entrypoint.js

@@ -1,3 +1,4 @@
+import { normalizedTrainingEnvironment } from "../../../shared/index.js";
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
@@ -15,8 +16,8 @@ import { loadDaimonProjectionModule, resolveTrainingSlotProjection } from "./pro
 import { createTrainingSlotRuntime } from "./runtime.js";
 import { createTrainingSlotSupervisor, serveTrainingSlotSupervisor, startTrainingSlot } from "./supervisor.js";
 import { trainingSlotDescriptors, assertTrainingSlotsDocument, TRAINING_SLOTS_FILE, DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
-export const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "PAIDEIA_GROK_BROKER_CONTROL_SOCKET";
-export const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "PAIDEIA_GROK_GRANT_HOME_ROOT";
+export const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "SPAWNFILE_TRAINING_GROK_BROKER_CONTROL_SOCKET";
+export const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT";
 export const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
 /**
  * The desktop Grok login, in every spelling a caller might reach it by.
@@ -30,7 +31,7 @@ export const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
 export const desktopGrokAuthPaths = (home = os.homedir()) => [path.resolve(home, ".grok/auth.json"), path.resolve(home, ".grok", "auth.json")];
 export const assertNotDesktopGrokAuth = (source, home = os.homedir()) => {
     if (desktopGrokAuthPaths(home).includes(path.resolve(source))) {
-        throw new SpawnfileError("validation_error", "Training refuses the desktop ~/.grok/auth.json as its Grok bootstrap; import a dedicated login with `spawnfile auth import grok --profile paideia-training --from <dir>`");
+        throw new SpawnfileError("validation_error", "Training refuses the desktop ~/.grok/auth.json as its Grok bootstrap; import a dedicated login with `spawnfile auth import grok --profile spawnfile-training --from <dir>`");
     }
     return source;
 };
@@ -52,7 +53,7 @@ const DAIMON_GROK_SUBSCRIPTION_MAX_BYTES = 64 * 1024;
  * production capability set, start the launcher (root) and the broker and
  * relay (2100) and prove each one's post-drop identity, publish the slot
  * supervisor socket, and only then drop to uid 2000 with an empty capability
- * bounding set to run `train`. Paideia, DSPy and the judges are that uid; the
+ * bounding set to run `train`. The training core, DSPy and the judges are that uid; the
  * model's own tools are the worker uid the launcher alone can reach.
  */
 export const runTrainingBrokerEntrypoint = async (options) => {
@@ -106,10 +107,10 @@ const runTrainingChild = (argv, declaration, log) => new Promise((resolve) => {
     const child = spawn(command[0], command.slice(1), {
         stdio: ["ignore", "inherit", "inherit"],
         env: {
-            ...process.env,
+            ...normalizedTrainingEnvironment(),
             [TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV]: DAIMON_GROK_ENGINE_BROKER.controlSocketPath,
             [TRAINING_GROK_GRANT_HOME_ROOT_ENV]: TRAINING_GRANT_HOME_ROOT,
-            PAIDEIA_TRAINING_SLOTS_FILE: TRAINING_SLOTS_FILE,
+            SPAWNFILE_TRAINING_SLOTS_FILE: TRAINING_SLOTS_FILE,
             HOME: "/home/training"
         }
     });

package/dist/compiler/training/broker/evaluatorSecrets.js

@@ -1,3 +1,4 @@
+import { trainingEnvironment } from "../../../shared/index.js";
 import { constants } from "node:fs";
 import { chmod, chown, lstat, mkdir, open } from "node:fs/promises";
 import path from "node:path";
@@ -5,9 +6,10 @@ import { TRAINING_TYPESAFE_SECRET_FILE, TRAINING_TYPESAFE_SECRET_INGRESS } from
 import { DAIMON_ORGANIZATION_UID } from "./paths.js";
 /** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
 export const stageTrainingEvaluatorSecret = async (env = process.env) => {
-    if (env.PAIDEIA_TYPESAFE_SECRET_FILE === undefined)
+    const secretFile = trainingEnvironment("SPAWNFILE_TRAINING_TYPESAFE_SECRET_FILE", env);
+    if (secretFile === undefined)
         return;
-    if (process.getuid?.() !== 0 || env.PAIDEIA_TYPESAFE_SECRET_FILE !== TRAINING_TYPESAFE_SECRET_FILE) {
+    if (process.getuid?.() !== 0 || secretFile !== TRAINING_TYPESAFE_SECRET_FILE) {
         throw Error("Invalid evaluator secret staging declaration");
     }
     try {

package/dist/compiler/training/broker/paths.d.ts

@@ -5,7 +5,7 @@ import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/dai
  * They are deterministic because three parties must agree on them
  * without talking to each other: the root entrypoint that provisions them, the
  * root slot supervisor that wipes and re-provisions them on recycle, and
- * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
+ * Spawnfile's native training adapter, which writes them into `spawnfile.training.daimon-native.launch.v2`
  * and has no way to ask the container what it chose. Daimon's projection never
  * resolves a path, so each one must also be canonical and never a symlink; the
  * provisioning program asserts that before a slot is used.
@@ -17,13 +17,13 @@ import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/dai
  */
 export declare const TRAINING_RUN_ROOT = "/run/training/output";
 export declare const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
-export declare const TRAINING_PAIDEIA_ROOT = "/run/paideia";
-export declare const TRAINING_CONTEXT_FILE = "/run/paideia/context.json";
+export declare const TRAINING_ROOT = "/run/spawnfile-training";
+export declare const TRAINING_CONTEXT_FILE = "/run/spawnfile-training/context.json";
 /** Host-written, read-only `spawnfile.training-broker.v2` declaration the root entrypoint reads. */
-export declare const TRAINING_BROKER_DECLARATION_FILE = "/run/paideia/training-broker.json";
+export declare const TRAINING_BROKER_DECLARATION_FILE = "/run/spawnfile-training/training-broker.json";
 export declare const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
 export declare const TRAINING_INFERENCE_LEDGER = "/run/training/inference/inference.jsonl";
-/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
+/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Training reads it as `SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT`. */
 export declare const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
 /**
  * Private temp for the broker and its relay (uid 2100, outside the organization
@@ -43,31 +43,31 @@ export declare const TRAINING_SUPERVISOR_SOCKET = "/run/training/supervisor/cont
 export declare const TRAINING_SUPERVISOR_LOG = "/run/training/supervisor/supervisor.log";
 export declare const TRAINING_WORKER_ROOT = "/var/lib/daimon-workers";
 /**
- * Paideia's own fixed container paths (`containerPaths` in its native launch
+ * Training's own fixed container paths (`containerPaths` in its native launch
  * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
  * every `deny` target inside bubblewrap as the worker uid, and it cannot
- * create a file inside `/run/paideia`, which belongs to uid 2000 alone. The
- * single `/run/paideia` mask below covers all of them, which is also stronger
- * — a file Paideia adds later is covered without re-provisioning the slot.
+ * create a file inside `/run/spawnfile-training`, which belongs to uid 2000 alone. The
+ * single `/run/spawnfile-training` mask below covers all of them, which is also stronger
+ * — a file Training adds later is covered without re-provisioning the slot.
  */
-export declare const TRAINING_CALLER_PROTECTED_PATHS: readonly ["/run/paideia/config.json", "/run/paideia/control", "/run/paideia/launch.json", "/run/paideia/token", "/run/paideia/env", "/run/paideia/preparation.json", "/run/paideia/repair.json"];
+export declare const TRAINING_CALLER_PROTECTED_PATHS: readonly ["/run/spawnfile-training/config.json", "/run/spawnfile-training/control", "/run/spawnfile-training/launch.json", "/run/spawnfile-training/token", "/run/spawnfile-training/env", "/run/spawnfile-training/preparation.json", "/run/spawnfile-training/repair.json"];
 /**
- * `paideia.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
+ * `spawnfile.training.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
  *
  * This is not a summary of the five roles — it is the **whole** set of deny
  * entries this container adds beyond Daimon's own protected paths, because
- * Paideia's worker resolves the projection from exactly
+ * Training's worker resolves the projection from exactly
  * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
  * that carried only the five roles made Daimon hash a different deny list than
  * the one provisioning wrote, and a live run died on
  * `Grok broker projection digest differs from the launch receipt`.
  *
- * `role` is Paideia's closed five-value enum and may repeat; only `path` is
+ * `role` is Training's closed five-value enum and may repeat; only `path` is
  * unique. The four roles with a dedicated path keep it, and everything else is
  * tagged `context` — the caller-state role — since there is no other way to
  * carry a path through that contract.
  */
-export declare const TRAINING_SLOTS_FILE = "/run/paideia/slots.json";
+export declare const TRAINING_SLOTS_FILE = "/run/spawnfile-training/slots.json";
 export declare const TRAINING_SLOTS_VERSION: "spawnfile.training-slots.v1";
 export declare const TRAINING_DEFAULT_SLOTS = 4;
 export declare const TRAINING_MAX_SLOTS = 8;
@@ -115,7 +115,7 @@ export declare const trainingEvaluatorPaths: (slot: number, slots: number) => Tr
 export declare const trainingSlotDescriptors: (slots?: number) => {
     evaluatorPaths: TrainingEvaluatorPath[];
     containerPaths: {
-        path: "/run/paideia/config.json" | "/run/paideia/control" | "/run/paideia/launch.json" | "/run/paideia/token" | "/run/paideia/env" | "/run/paideia/preparation.json" | "/run/paideia/repair.json";
+        path: "/run/spawnfile-training/config.json" | "/run/spawnfile-training/control" | "/run/spawnfile-training/launch.json" | "/run/spawnfile-training/token" | "/run/spawnfile-training/env" | "/run/spawnfile-training/preparation.json" | "/run/spawnfile-training/repair.json";
     }[];
     controlRoot: string;
     slot: number;