spawnfile 0.1.25 → 0.1.28

package/dist/compiler/training/broker/paths.js

@@ -9,7 +9,7 @@ import { DAIMON_WORKER_ROOT } from "../../containerDaimonGrokWorkerRender.js";
  * They are deterministic because three parties must agree on them
  * without talking to each other: the root entrypoint that provisions them, the
  * root slot supervisor that wipes and re-provisions them on recycle, and
- * Paideia's native adapter, which writes them into `paideia.daimon-native.launch.v2`
+ * Spawnfile's native training adapter, which writes them into `spawnfile.training.daimon-native.launch.v2`
  * and has no way to ask the container what it chose. Daimon's projection never
  * resolves a path, so each one must also be canonical and never a symlink; the
  * provisioning program asserts that before a slot is used.
@@ -21,13 +21,13 @@ import { DAIMON_WORKER_ROOT } from "../../containerDaimonGrokWorkerRender.js";
  */
 export const TRAINING_RUN_ROOT = "/run/training/output";
 export const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
-export const TRAINING_PAIDEIA_ROOT = "/run/paideia";
-export const TRAINING_CONTEXT_FILE = `${TRAINING_PAIDEIA_ROOT}/context.json`;
+export const TRAINING_ROOT = "/run/spawnfile-training";
+export const TRAINING_CONTEXT_FILE = `${TRAINING_ROOT}/context.json`;
 /** Host-written, read-only `spawnfile.training-broker.v2` declaration the root entrypoint reads. */
-export const TRAINING_BROKER_DECLARATION_FILE = `${TRAINING_PAIDEIA_ROOT}/training-broker.json`;
+export const TRAINING_BROKER_DECLARATION_FILE = `${TRAINING_ROOT}/training-broker.json`;
 export const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
 export const TRAINING_INFERENCE_LEDGER = `${TRAINING_INFERENCE_DIRECTORY}/inference.jsonl`;
-/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Paideia reads it as `PAIDEIA_GROK_GRANT_HOME_ROOT`. */
+/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Training reads it as `SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT`. */
 export const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
 /**
  * Private temp for the broker and its relay (uid 2100, outside the organization
@@ -47,39 +47,39 @@ export const TRAINING_SUPERVISOR_SOCKET = `${TRAINING_SUPERVISOR_DIRECTORY}/cont
 export const TRAINING_SUPERVISOR_LOG = `${TRAINING_SUPERVISOR_DIRECTORY}/supervisor.log`;
 export const TRAINING_WORKER_ROOT = DAIMON_WORKER_ROOT;
 /**
- * Paideia's own fixed container paths (`containerPaths` in its native launch
+ * Training's own fixed container paths (`containerPaths` in its native launch
  * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
  * every `deny` target inside bubblewrap as the worker uid, and it cannot
- * create a file inside `/run/paideia`, which belongs to uid 2000 alone. The
- * single `/run/paideia` mask below covers all of them, which is also stronger
- * — a file Paideia adds later is covered without re-provisioning the slot.
+ * create a file inside `/run/spawnfile-training`, which belongs to uid 2000 alone. The
+ * single `/run/spawnfile-training` mask below covers all of them, which is also stronger
+ * — a file Training adds later is covered without re-provisioning the slot.
  */
 export const TRAINING_CALLER_PROTECTED_PATHS = [
-    `${TRAINING_PAIDEIA_ROOT}/config.json`,
-    `${TRAINING_PAIDEIA_ROOT}/control`,
-    `${TRAINING_PAIDEIA_ROOT}/launch.json`,
-    `${TRAINING_PAIDEIA_ROOT}/token`,
-    `${TRAINING_PAIDEIA_ROOT}/env`,
-    `${TRAINING_PAIDEIA_ROOT}/preparation.json`,
-    `${TRAINING_PAIDEIA_ROOT}/repair.json`
+    `${TRAINING_ROOT}/config.json`,
+    `${TRAINING_ROOT}/control`,
+    `${TRAINING_ROOT}/launch.json`,
+    `${TRAINING_ROOT}/token`,
+    `${TRAINING_ROOT}/env`,
+    `${TRAINING_ROOT}/preparation.json`,
+    `${TRAINING_ROOT}/repair.json`
 ];
 /**
- * `paideia.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
+ * `spawnfile.training.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
  *
  * This is not a summary of the five roles — it is the **whole** set of deny
  * entries this container adds beyond Daimon's own protected paths, because
- * Paideia's worker resolves the projection from exactly
+ * Training's worker resolves the projection from exactly
  * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
  * that carried only the five roles made Daimon hash a different deny list than
  * the one provisioning wrote, and a live run died on
  * `Grok broker projection digest differs from the launch receipt`.
  *
- * `role` is Paideia's closed five-value enum and may repeat; only `path` is
+ * `role` is Training's closed five-value enum and may repeat; only `path` is
  * unique. The four roles with a dedicated path keep it, and everything else is
  * tagged `context` — the caller-state role — since there is no other way to
  * carry a path through that contract.
  */
-export const TRAINING_SLOTS_FILE = `${TRAINING_PAIDEIA_ROOT}/slots.json`;
+export const TRAINING_SLOTS_FILE = `${TRAINING_ROOT}/slots.json`;
 export const TRAINING_SLOTS_VERSION = "spawnfile.training-slots.v1";
 export const TRAINING_DEFAULT_SLOTS = 4;
 export const TRAINING_MAX_SLOTS = 8;
@@ -127,7 +127,7 @@ export const trainingEvaluatorPaths = (slot, slots) => {
         { role: "sealed-inputs", path: TRAINING_SEALED_INPUTS_ROOT },
         { role: "judge-home", path: TRAINING_GRANT_HOME_ROOT },
         { role: "slot-ledger", path: own.usageDirectory },
-        ...[TRAINING_PAIDEIA_ROOT, TRAINING_BROKER_TMPDIR, TRAINING_INFERENCE_DIRECTORY,
+        ...[TRAINING_ROOT, TRAINING_BROKER_TMPDIR, TRAINING_INFERENCE_DIRECTORY,
             TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, TRAINING_SUPERVISOR_DIRECTORY,
             ...TRAINING_BROKER_SOCKET_PATHS,
             path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.registrationPath),
@@ -146,10 +146,10 @@ export const trainingSlotsDocument = (slots = TRAINING_DEFAULT_SLOTS) => ({
     schema: TRAINING_SLOTS_VERSION,
     slots: trainingSlotDescriptors(slots).map(p => ({
         index: p.slot, workerUid: p.workerUid,
-        // Paideia owns a runtime-neutral lease pool: its strict descriptor carries opaque named paths.
+        // Training owns a runtime-neutral lease pool: its strict descriptor carries opaque named paths.
         roots: {
             ...Object.fromEntries(Object.entries(p).filter((entry) => typeof entry[1] === "string")),
-            home: p.runtimeHome, control: p.state, context: TRAINING_PAIDEIA_ROOT,
+            home: p.runtimeHome, control: p.state, context: TRAINING_ROOT,
             ...Object.fromEntries(p.evaluatorPaths.map((entry, index) => [`evaluator:${entry.role}:${index}`, entry.path])),
             ...Object.fromEntries(p.containerPaths.map((entry, index) => [`container:${index}`, entry.path]))
         },

package/dist/compiler/training/broker/projection.d.ts

@@ -2,7 +2,7 @@ import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from
 import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
 import type { TrainingBrokerDeclaration } from "./declaration.js";
 /**
- * The slice of Daimon's public `@noopolis/daimon/runtime` export the slot
+ * The slice of Daimon's public `Daimon/runtime` export the slot
  * supervisor needs. Daimon stays the resolver: the slot preflight receipt binds
  * `projection_sha256`, and a second implementation of that digest would fork
  * the contract the moment either side changed a member.
@@ -27,10 +27,10 @@ export declare const loadDaimonProjectionModule: (load?: () => Promise<unknown>)
  * resolved from.
  *
  * It is a projection *input*, never a runtime config Daimon hosts: the trial's
- * real config is Paideia's. Only `agents[].id`, `workspacePath`,
+ * real config is Training's. Only `agents[].id`, `workspacePath`,
  * `runtimeHomePath`, the engine's declared model and effort, and the *absence*
  * of peers reach `resolveOrganizationGrokBrokerProjection`, so this minimal
- * config and Paideia's fuller one compute the same projection digest. A peer
+ * config and Training's fuller one compute the same projection digest. A peer
  * agent would change Daimon's protected set and the digest with it, which is
  * why each slot resolves its own one-agent projection with explicit sibling deny paths.
  */
@@ -53,7 +53,7 @@ export declare const resolveTrainingGrokProjection: (declaration: TrainingBroker
 /**
  * One slot's registration and projection, exactly as the root entrypoint binds
  * them into that slot's preflight receipt. The entrypoint and the public lease
- * both call this, so the digest a lease hands Paideia cannot drift from the
+ * both call this, so the digest a lease hands Training cannot drift from the
  * one the supervisor certified.
  */
 export declare const resolveTrainingSlotProjection: (declaration: TrainingBrokerDeclaration, slot: number, daimon: DaimonProjectionModule) => Promise<TrainingGrokProjection & {

package/dist/compiler/training/broker/projection.js

@@ -1,10 +1,12 @@
+import { DAIMON_BROKER_ENGINE_ID } from "../../../runtime/daimon/index.js";
+import { DAIMON_PACKAGE_NAME } from '../../../runtime/daimon/packageName.js';
 import { SpawnfileError } from "../../../shared/index.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { trainingSlotPaths } from "./paths.js";
 import { resolveTrainingGrokRegistration } from "./registration.js";
 /** Indirect specifier: Daimon is an in-image runtime peer of the training container, never a Spawnfile source dependency. */
 const loadRuntime = async () => {
-    const packageName = "@noopolis/daimon/runtime";
+    const packageName = `${DAIMON_PACKAGE_NAME}/runtime`;
     return import(packageName);
 };
 export const loadDaimonProjectionModule = async (load = loadRuntime) => {
@@ -13,7 +15,7 @@ export const loadDaimonProjectionModule = async (load = loadRuntime) => {
         daimon = await load();
     }
     catch {
-        throw new SpawnfileError("runtime_error", "The training image must install @noopolis/daimon with its public /runtime export");
+        throw new SpawnfileError("runtime_error", `The training image must install ${DAIMON_PACKAGE_NAME} with its public /runtime export`);
     }
     if (typeof daimon.resolveOrganizationGrokBrokerProjection !== "function" || typeof daimon.grokBrokerProjectionSha256 !== "function"
         || daimon.GROK_ENGINE_BROKER?.projectionVersion !== DAIMON_GROK_ENGINE_BROKER.projectionVersion
@@ -29,10 +31,10 @@ export const loadDaimonProjectionModule = async (load = loadRuntime) => {
  * resolved from.
  *
  * It is a projection *input*, never a runtime config Daimon hosts: the trial's
- * real config is Paideia's. Only `agents[].id`, `workspacePath`,
+ * real config is Training's. Only `agents[].id`, `workspacePath`,
  * `runtimeHomePath`, the engine's declared model and effort, and the *absence*
  * of peers reach `resolveOrganizationGrokBrokerProjection`, so this minimal
- * config and Paideia's fuller one compute the same projection digest. A peer
+ * config and Training's fuller one compute the same projection digest. A peer
  * agent would change Daimon's protected set and the digest with it, which is
  * why each slot resolves its own one-agent projection with explicit sibling deny paths.
  */
@@ -45,7 +47,7 @@ export const trainingOrganizationRuntimeConfig = (declaration, slot = 0) => ({
             instructions: "training subject",
             workspacePath: trainingSlotPaths(slot).workspace,
             runtimeHomePath: trainingSlotPaths(slot).runtimeHome,
-            engine: { kind: "grok", model: declaration.model, reasoningEffort: declaration.reasoningEffort }
+            engine: { kind: DAIMON_BROKER_ENGINE_ID, model: declaration.model, reasoningEffort: declaration.reasoningEffort }
         }]
 });
 /**
@@ -77,7 +79,7 @@ export const resolveTrainingGrokProjection = async (declaration, registration, d
     // A Daimon older than 0.2.2 ignores `skills`, and a drifted mirror would provision a tree the broker
     // refuses every turn: either way the projection must carry exactly the provisioned skills digest.
     if (projection.skillsSha256 !== registration.skills?.sha256) {
-        throw new SpawnfileError("runtime_error", "Daimon's Grok broker projection skills digest differs from the provisioned skills; the training image needs @noopolis/daimon >= 0.2.2");
+        throw new SpawnfileError("runtime_error", `Daimon's Grok broker projection skills digest differs from the provisioned skills; the training image needs ${DAIMON_PACKAGE_NAME} >= 0.2.2`);
     }
     const clock = DAIMON_GROK_ENGINE_BROKER.worker.taskClock;
     const expectedClock = { ...clock, directoryPath: clock.slotDirectoryPattern.replace("{slot}", String(registration.slot)),
@@ -98,7 +100,7 @@ export const resolveTrainingGrokProjection = async (declaration, registration, d
 /**
  * One slot's registration and projection, exactly as the root entrypoint binds
  * them into that slot's preflight receipt. The entrypoint and the public lease
- * both call this, so the digest a lease hands Paideia cannot drift from the
+ * both call this, so the digest a lease hands Training cannot drift from the
  * one the supervisor certified.
  */
 export const resolveTrainingSlotProjection = async (declaration, slot, daimon) => {

package/dist/compiler/training/broker/provisioning.d.ts

@@ -4,7 +4,7 @@ import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRend
  *
  * The two ledger directories are setgid to the organization group on purpose:
  * the broker writes its rows `0640` owned by the broker group, so without
- * `2100:2000 2750` uid 2000 — Paideia, DSPy and every judge — cannot read a
+ * `2100:2000 2750` uid 2000 — Training, DSPy and every judge — cannot read a
  * single subject usage row or inference row it paid for.
  */
 export declare const trainingSlotDirectories: (slot?: number) => readonly {

package/dist/compiler/training/broker/provisioning.js

@@ -5,7 +5,7 @@ import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_TURN_USAGE_LEDGER } from "../../
 import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
 import { renderDaimonBrokerProvisioningProgram, renderDaimonWorkspaceResourceSecurity } from "../../containerDaimonBrokerRender.js";
 import { renderDaimonGrokHostPreflight, renderDaimonGrokWorkerProvisioning } from "../../containerDaimonGrokWorkerProvisioning.js";
-import { trainingSlotPaths, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_INFERENCE_LEDGER, TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_PAIDEIA_ROOT, TRAINING_SEALED_INPUTS_IDENTITY, TRAINING_SEALED_INPUTS_ROOT, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_BROKER_TMPDIR, TRAINING_WORKER_ROOT, } from "./paths.js";
+import { trainingSlotPaths, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_INFERENCE_LEDGER, TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_ROOT, TRAINING_SEALED_INPUTS_IDENTITY, TRAINING_SEALED_INPUTS_ROOT, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_BROKER_TMPDIR, TRAINING_WORKER_ROOT, } from "./paths.js";
 import { trainingNamespaceDenialMechanism } from "./seccompRoutes.js";
 const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
 /**
@@ -26,14 +26,14 @@ const PROVISION_DIRECTORY_HELPER = [
  *
  * The two ledger directories are setgid to the organization group on purpose:
  * the broker writes its rows `0640` owned by the broker group, so without
- * `2100:2000 2750` uid 2000 — Paideia, DSPy and every judge — cannot read a
+ * `2100:2000 2750` uid 2000 — Training, DSPy and every judge — cannot read a
  * single subject usage row or inference row it paid for.
  */
 export const trainingSlotDirectories = (slot = 0) => [
     // `/run/training` itself is deliberately absent: it is a mount-point parent on the read-only
     // image root, and every writable child below it is its own tmpfs or bind.
     { path: trainingSlotPaths(slot).root, mode: "0711", uid: 0, gid: 0 },
-    { path: TRAINING_PAIDEIA_ROOT, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
+    { path: TRAINING_ROOT, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
     { path: "/home/training", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
     { path: "/work", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
     { path: trainingSlotPaths(slot).workspace, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: trainingSlotPaths(slot).workerUid },

package/dist/compiler/training/broker/registration.d.ts

@@ -5,7 +5,7 @@ import { type DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRend
  * The one training slot's deny list: Daimon's own protected set for a
  * single-agent organization (Grok bootstrap, realm, and the slot state root that
  * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
- * the evaluator roots, the caller's protected `/run/paideia` paths, the broker
+ * the evaluator roots, the caller's protected `/run/spawnfile-training` paths, the broker
  * control and registration roots, the grant home root, the inference ledger,
  * the per-slot ledger, turn store and supervisor socket directory.
  *

package/dist/compiler/training/broker/registration.js

@@ -13,7 +13,7 @@ const within = (candidate, root) => candidate === root || candidate.startsWith(`
  * The one training slot's deny list: Daimon's own protected set for a
  * single-agent organization (Grok bootstrap, realm, and the slot state root that
  * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
- * the evaluator roots, the caller's protected `/run/paideia` paths, the broker
+ * the evaluator roots, the caller's protected `/run/spawnfile-training` paths, the broker
  * control and registration roots, the grant home root, the inference ledger,
  * the per-slot ledger, turn store and supervisor socket directory.
  *

package/dist/compiler/training/broker/supervisor.d.ts

@@ -56,7 +56,7 @@ export declare const startTrainingSlot: (runtime: TrainingSlotRuntime, nonce: st
 }>;
 export interface TrainingSlotSupervisorOptions {
     runtimes: readonly TrainingSlotRuntime[];
-    /** Only this uid may recycle. Paideia, DSPy and the judges all run as it; every worker uid is refused. */
+    /** Only this uid may recycle. Training, DSPy and the judges all run as it; every worker uid is refused. */
     organizationUid?: number;
     drainTimeoutMs?: number;
     now?: () => number;

package/dist/compiler/training/container/contract.js

@@ -1,3 +1,4 @@
+import { DAIMON_BROKER_ENGINE_ID } from "../../../runtime/daimon/index.js";
 import path from "node:path";
 import { z } from "zod";
 import { trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema } from "./evaluators.js";
@@ -7,7 +8,7 @@ const hostPath = z.string().min(1).refine((value) => path.isAbsolute(value) && !
 const inputPath = z.string().regex(/^\/run\/training\/inputs\/[A-Za-z0-9._/-]+$/u).refine((value) => path.posix.normalize(value) === value && !value.endsWith("/"));
 export const trainingImageSchema = z.string().regex(/^(?:sha256:[a-f0-9]{64}|[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[a-f0-9]{64})$/u);
 const brokerLaunchSchema = z.object({
-    engine: z.literal("grok"),
+    engine: z.literal(DAIMON_BROKER_ENGINE_ID),
     /** The named Docker volume holding the training Grok realm: `auth.json` and the broker credential journal, nothing else. */
     realmVolume: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
     /** Host leaf of the dedicated training Grok login. Never the desktop `~/.grok/auth.json`. */

package/dist/compiler/training/container/evaluators.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
-export declare const TRAINING_EVALUATOR_ROUTES_FILE = "/run/paideia/evaluator-routes.json";
-export declare const TRAINING_TYPESAFE_SECRET_FILE = "/run/paideia/secrets/typesafe";
-export declare const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/paideia/secret-ingress/typesafe";
+export declare const TRAINING_EVALUATOR_ROUTES_FILE = "/run/spawnfile-training/evaluator-routes.json";
+export declare const TRAINING_TYPESAFE_SECRET_FILE = "/run/spawnfile-training/secrets/typesafe";
+export declare const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/spawnfile-training/secret-ingress/typesafe";
 export declare const trainingEvaluatorRouteSchema: z.ZodObject<{
     purpose: z.ZodEnum<{
         decisions: "decisions";

package/dist/compiler/training/container/evaluators.js

@@ -1,9 +1,9 @@
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
-export const TRAINING_EVALUATOR_ROUTES_FILE = "/run/paideia/evaluator-routes.json";
-export const TRAINING_TYPESAFE_SECRET_FILE = "/run/paideia/secrets/typesafe";
-export const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/paideia/secret-ingress/typesafe";
+export const TRAINING_EVALUATOR_ROUTES_FILE = "/run/spawnfile-training/evaluator-routes.json";
+export const TRAINING_TYPESAFE_SECRET_FILE = "/run/spawnfile-training/secrets/typesafe";
+export const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/spawnfile-training/secret-ingress/typesafe";
 export const trainingEvaluatorRouteSchema = z.object({
     purpose: z.enum(["extraction", "proposals", "decisions"]),
     provider: z.enum(["codex-subscription", "typesafe"]),
@@ -32,10 +32,10 @@ export const prepareTrainingEvaluators = async (root, config, mappedArgs) => {
             throw Error("Evaluator receipts require one mapped training --out directory");
         }
         const source = path.join(root, "evaluator-routes.json");
-        await writeFile(source, JSON.stringify({ version: "paideia.evaluator-routes.v1", routes: config.evaluatorRoutes,
+        await writeFile(source, JSON.stringify({ version: "spawnfile.training.evaluator-routes.v1", routes: config.evaluatorRoutes,
             receiptPath: path.posix.join(output, "evaluator-requests.jsonl") }), { mode: 0o444, flag: "wx" });
         mounts.push(`type=bind,src=${source},dst=${TRAINING_EVALUATOR_ROUTES_FILE},readonly`);
-        env.push(`PAIDEIA_EVALUATOR_ROUTES_FILE=${TRAINING_EVALUATOR_ROUTES_FILE}`);
+        env.push(`SPAWNFILE_TRAINING_EVALUATOR_ROUTES_FILE=${TRAINING_EVALUATOR_ROUTES_FILE}`);
     }
     for (const secret of config.evaluatorSecrets ?? []) {
         // The host-uid v1 launcher cannot stage a root-owned copy; bind the canonical leaf at the consumer path.
@@ -44,7 +44,7 @@ export const prepareTrainingEvaluators = async (root, config, mappedArgs) => {
         }
         else
             mounts.push(`type=bind,src=${secret.source},dst=${TRAINING_TYPESAFE_SECRET_INGRESS},readonly`);
-        env.push(`PAIDEIA_TYPESAFE_SECRET_FILE=${TRAINING_TYPESAFE_SECRET_FILE}`);
+        env.push(`SPAWNFILE_TRAINING_TYPESAFE_SECRET_FILE=${TRAINING_TYPESAFE_SECRET_FILE}`);
     }
     return { mounts, env };
 };

package/dist/compiler/training/container/launch.js

@@ -1,3 +1,4 @@
+import { getRegisteredRuntime } from '../../../runtime/registry.js';
 import { randomUUID } from "node:crypto";
 import { chmod, mkdtemp, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -64,6 +65,13 @@ export const launchTrainingContainer = async (options) => {
             throw Error("Repair receipt path must be canonical");
         const raw = JSON.parse(await readFile(options.repairPath, "utf8"));
         const envelope = repairEnvelopeSchema.parse(raw);
+        if (["native", "trials", "optimizer"].some(name => name in envelope.receipt.compatibility.components)) {
+            throw Error("Repair receipt references external training components; re-prepare with Spawnfile before repairing measurements");
+        }
+        const registered = await getRegisteredRuntime(options.context.agent.runtime);
+        if (!registered?.training?.adapterId || envelope.receipt.current.adapterId !== registered.training.adapterId) {
+            throw Error("Repair receipt adapter is not registered for the selected runtime");
+        }
         if (hashJson(raw.receipt) !== envelope.digest || envelope.receipt.current.imageId !== image ||
             !prepared.config.inputs.some(input => input.destination === envelope.receipt.parent.root))
             throw Error("Repair receipt launch identity mismatch");
@@ -103,7 +111,7 @@ export const launchTrainingContainer = async (options) => {
         if (execution) {
             const capability = await call(["image", "inspect", expectedImage, "--format", `{{json (index .Config.Labels "${TRAINING_EXECUTION_CAPABILITY_LABEL}")}}`]);
             if (capability.code !== 0 || capability.stdout.trim() !== JSON.stringify(TRAINING_EXECUTION_VERSION)) {
-                throw Error(`Authored training requires an image implementing --spawnfile-execution ${TRAINING_EXECUTION_FILE} and labelled ${TRAINING_EXECUTION_CAPABILITY_LABEL}=${TRAINING_EXECUTION_VERSION}; legacy Paideia datasets are incompatible`);
+                throw Error(`Authored training requires an image implementing --spawnfile-execution ${TRAINING_EXECUTION_FILE} and labelled ${TRAINING_EXECUTION_CAPABILITY_LABEL}=${TRAINING_EXECUTION_VERSION}; legacy Training datasets are incompatible`);
             }
         }
         privateRoot = await realpath(await mkdtemp(path.join(path.dirname(prepared.config.output.source), ".spawnfile-training-container-")));
@@ -122,11 +130,11 @@ export const launchTrainingContainer = async (options) => {
         }
         const mounts = [...evaluators.mounts, ...prepared.config.inputs.map((entry) => `type=bind,src=${entry.source},dst=${entry.destination},readonly`),
             outputVolume?.mount ?? `type=bind,src=${prepared.config.output.source},dst=/run/training/output`,
-            `type=bind,src=${contextFile},dst=/run/paideia/context.json,readonly`,
+            `type=bind,src=${contextFile},dst=/run/spawnfile-training/context.json,readonly`,
             ...execution ? [`type=bind,src=${executionFile},dst=${TRAINING_EXECUTION_FILE},readonly`] : [],
-            ...options.preparationPath ? [`type=bind,src=${options.preparationPath},dst=/run/paideia/preparation.json,readonly`] : [],
-            ...options.repairPath ? [`type=bind,src=${options.repairPath},dst=/run/paideia/repair.json,readonly`] : [],
-            ...prepared.config.auth.map((entry) => `type=bind,src=${entry.source},dst=/run/paideia-auth/${entry.provider},readonly`)];
+            ...options.preparationPath ? [`type=bind,src=${options.preparationPath},dst=/run/spawnfile-training/preparation.json,readonly`] : [],
+            ...options.repairPath ? [`type=bind,src=${options.repairPath},dst=/run/spawnfile-training/repair.json,readonly`] : [],
+            ...prepared.config.auth.map((entry) => `type=bind,src=${entry.source},dst=/run/spawnfile-training-auth/${entry.provider},readonly`)];
         const broker = prepared.config.broker;
         if (broker) {
             mounts.push(trainingRunRequestMount(prepared.config.output.source, prepared.args));
@@ -151,11 +159,11 @@ export const launchTrainingContainer = async (options) => {
         const args = ["create", "--name", name, "--label", `com.spawnfile.training.owner=${name}`,
             "--init", "--read-only", ...privilege,
             "--env", "HOME=/home/training", "--workdir", "/work", "--entrypoint", broker ? TRAINING_BROKER_ENTRYPOINT : "/opt/training/bin/train",
-            ...(broker ? ["--env", "PAIDEIA_MODEL_REQUEST_CAP=broker"] : []),
+            ...(broker ? ["--env", "SPAWNFILE_TRAINING_MODEL_REQUEST_CAP=broker"] : []),
             ...evaluators.env.flatMap(value => ["--env", value]),
             ...[...mounts, ...(broker ? trainingBrokerMounts(broker) : [])].flatMap((mount) => ["--mount", mount]),
             ...(prepared.viewerPort === undefined ? [] : ["--publish", `127.0.0.1:${prepared.viewerPort}:${prepared.viewerPort}`]), expectedImage,
-            "train", "--spawnfile-context", "/run/paideia/context.json",
+            "train", "--spawnfile-context", "/run/spawnfile-training/context.json",
             ...(execution ? ["--spawnfile-execution", TRAINING_EXECUTION_FILE] : []), ...prepared.args];
         creationAttempted = true;
         const created = await call(args);

package/dist/compiler/training/container/security.js

@@ -3,7 +3,7 @@ import { DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, materializeDaimonGrokSeccompProfil
 import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
 import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
 import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
-import { TRAINING_BROKER_TMPDIR, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_PAIDEIA_ROOT, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_WORKER_ROOT } from "../broker/paths.js";
+import { TRAINING_BROKER_TMPDIR, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_ROOT, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_WORKER_ROOT } from "../broker/paths.js";
 export const TRAINING_BROKER_ENTRYPOINT = "/opt/training/bin/train-broker";
 /** Same output directory is the same resumable run; different outputs never share a counter. */
 export const trainingRunRequestMount = (outputSource, args) => {
@@ -28,7 +28,7 @@ export const trainingBrokerTmpfsTargets = (slots = 4) => [
     { path: "/var/tmp", size: "256m", mode: "1777" },
     { path: "/work", size: "4g", mode: "0755" },
     { path: "/home/training", size: "1g", mode: "0755" },
-    { path: TRAINING_PAIDEIA_ROOT, size: "64m", mode: "0755" },
+    { path: TRAINING_ROOT, size: "64m", mode: "0755" },
     ...trainingSlotDescriptors(slots).map(p => ({ path: p.root, size: "4g", mode: "0711" })),
     { path: TRAINING_TURN_STORE_ROOT, size: "256m", mode: "0700" },
     { path: TRAINING_GRANT_HOME_ROOT, size: "64m", mode: "0755" },
@@ -64,5 +64,5 @@ export const trainingBrokerSecurityArgs = async (seccompProfileDirectory) => [
 export const trainingBrokerMounts = (broker) => [
     `type=volume,src=${broker.realmVolume},dst=${DAIMON_GROK_ENGINE_BROKER.credentialHomePath}`,
     `type=bind,src=${broker.bootstrap},dst=/var/lib/spawnfile/daimon/grok-bootstrap-auth,readonly`,
-    `type=bind,src=${broker.declaration},dst=${TRAINING_PAIDEIA_ROOT}/training-broker.json,readonly`
+    `type=bind,src=${broker.declaration},dst=${TRAINING_ROOT}/training-broker.json,readonly`
 ];

package/dist/compiler/training/container/subjectIsolation.js

@@ -1,3 +1,4 @@
+import { getDaimonEngineDescriptor } from "../../../runtime/daimon/index.js";
 import { resolveDaimonEngine } from "../../../runtime/daimon/config.js";
 import { resolveTrainingContextGraph } from "../context.js";
 import { trainingContextSchema } from "../contract.js";
@@ -8,7 +9,7 @@ export const assertTrainingSubjectIsolation = async (config, context) => {
     const parsed = trainingContextSchema.parse(context);
     const { selected } = await resolveTrainingContextGraph(parsed.project.manifest, parsed.agent.id);
     const agent = selected.value;
-    if (agent.runtime.name !== "daimon" || resolveDaimonEngine(agent) !== "codex" ||
+    if (agent.runtime.name !== "daimon" || getDaimonEngineDescriptor(resolveDaimonEngine(agent))?.training.subject.isolation !== "native-sandbox" ||
         agent.runtime.options.codex_policy !== "workspace-no-network" || agent.execution?.sandbox?.mode !== "workspace") {
         throw Error("codex-native-sandbox subject isolation requires the selected training agent to use runtime daimon, engine codex, and strict codex_policy: workspace-no-network (execution.sandbox.mode: workspace)");
     }

package/dist/compiler/training/execution.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { type TrainingPlan } from "./plan/contract.js";
 import type { LoadedTrainingProject } from "./plan/types.js";
-export declare const TRAINING_EXECUTION_FILE = "/run/paideia/execution.json";
+export declare const TRAINING_EXECUTION_FILE = "/run/spawnfile-training/execution.json";
 export { TRAINING_EXECUTION_CAPABILITY_LABEL, TRAINING_EXECUTION_VERSION } from "./contract.js";
 export declare const trainingExecutionSchema: z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.training-execution.v1">;
@@ -74,9 +74,9 @@ export declare const trainingExecutionSchema: z.ZodObject<{
                             id: z.ZodString;
                             declaredBy: z.ZodString;
                             section: z.ZodEnum<{
+                                networks: "networks";
                                 memory: "memory";
                                 resources: "resources";
-                                networks: "networks";
                             }>;
                         }, z.core.$strict>>;
                     }, z.core.$strict>>;
@@ -97,9 +97,9 @@ export declare const trainingExecutionSchema: z.ZodObject<{
                             id: z.ZodString;
                             declaredBy: z.ZodString;
                             section: z.ZodEnum<{
+                                networks: "networks";
                                 memory: "memory";
                                 resources: "resources";
-                                networks: "networks";
                             }>;
                         }, z.core.$strict>>;
                     }, z.core.$strict>>;
@@ -120,9 +120,9 @@ export declare const trainingExecutionSchema: z.ZodObject<{
                             id: z.ZodString;
                             declaredBy: z.ZodString;
                             section: z.ZodEnum<{
+                                networks: "networks";
                                 memory: "memory";
                                 resources: "resources";
-                                networks: "networks";
                             }>;
                         }, z.core.$strict>>;
                     }, z.core.$strict>>;
@@ -218,7 +218,7 @@ export declare const lowerTrainingExecution: (options: LowerTrainingExecutionOpt
                             overrides: {
                                 id: string;
                                 declaredBy: string;
-                                section: "memory" | "resources" | "networks";
+                                section: "networks" | "memory" | "resources";
                             }[];
                         }[];
                     };
@@ -237,7 +237,7 @@ export declare const lowerTrainingExecution: (options: LowerTrainingExecutionOpt
                             overrides: {
                                 id: string;
                                 declaredBy: string;
-                                section: "memory" | "resources" | "networks";
+                                section: "networks" | "memory" | "resources";
                             }[];
                         }[];
                     } | null;
@@ -256,7 +256,7 @@ export declare const lowerTrainingExecution: (options: LowerTrainingExecutionOpt
                             overrides: {
                                 id: string;
                                 declaredBy: string;
-                                section: "memory" | "resources" | "networks";
+                                section: "networks" | "memory" | "resources";
                             }[];
                         }[];
                     };
@@ -335,8 +335,6 @@ export declare const lowerTrainingExecution: (options: LowerTrainingExecutionOpt
                 nativeImage: string;
                 pythonImage: string;
                 platform: "linux/amd64" | "linux/arm64";
-                paideia: string;
-                bridge: string;
                 claude: string;
                 integration: {
                     source: string;
@@ -396,7 +394,7 @@ export declare const lowerTrainingExecution: (options: LowerTrainingExecutionOpt
             engine: "grok";
             agentId: string;
             model: "grok-4.6" | "grok-4.5" | "grok-build";
-            reasoningEffort: "high" | "medium" | "low";
+            reasoningEffort: "low" | "medium" | "high";
             architecture: "arm64" | "x64";
             limits: {
                 maxRequests: number;

package/dist/compiler/training/execution.js

@@ -8,7 +8,7 @@ import { trainingPlanSchema, trainingPlanOptimizerSchema } from "./plan/contract
 import { trainingPreparationSchema } from "./preparation/contract.js";
 import { readBoundedJson } from "./preparation/inputs.js";
 import { trainingContainerConfigSchema, trainingImageSchema } from "./container/contract.js";
-export const TRAINING_EXECUTION_FILE = "/run/paideia/execution.json";
+export const TRAINING_EXECUTION_FILE = "/run/spawnfile-training/execution.json";
 export { TRAINING_EXECUTION_CAPABILITY_LABEL, TRAINING_EXECUTION_VERSION } from "./contract.js";
 export const trainingExecutionSchema = z.object({
     version: z.literal("spawnfile.training-execution.v1"),

package/dist/compiler/training/index.d.ts

@@ -3,7 +3,8 @@ export * from "./context.js";
 export * from "./plan/index.js";
 export * from "./rewind/index.js";
 export type { ResolvedTraining, ResolvedTrainingGrader } from "./resolution.js";
-export { parseTrainingMappedPreparation } from "./preparation/contract.js";
+export { parseTrainingMappedPreparation, trainingPreparationSchema } from "./preparation/contract.js";
+export { prepareTrainingEvaluators } from "./container/evaluators.js";
 export type { TrainingMappedPreparation } from "./preparation/contract.js";
 export { TRAINING_SLOTS_FILE, TRAINING_SLOTS_VERSION, trainingSlotPaths, trainingSlotDescriptors, trainingSlotsDocument, type TrainingSlotsDocument, type TrainingSlotPaths, type TrainingSlotDescriptor } from "./broker/paths.js";
 export * from "./execution.js";

package/dist/compiler/training/index.js

@@ -2,7 +2,8 @@ export * from "./contract.js";
 export * from "./context.js";
 export * from "./plan/index.js";
 export * from "./rewind/index.js";
-export { parseTrainingMappedPreparation } from "./preparation/contract.js";
+export { parseTrainingMappedPreparation, trainingPreparationSchema } from "./preparation/contract.js";
+export { prepareTrainingEvaluators } from "./container/evaluators.js";
 export { TRAINING_SLOTS_FILE, TRAINING_SLOTS_VERSION, trainingSlotPaths, trainingSlotDescriptors, trainingSlotsDocument } from "./broker/paths.js";
 export * from "./execution.js";
 export * from "./moments.js";

package/dist/compiler/training/moments.js

@@ -67,8 +67,8 @@ export const lowerTrainingMoments = async (options) => {
     const datasets = {};
     for (const role of roles)
         if (declared.has(role)) {
-            datasets[role] = path.join(out, `${role}.paideia.json`);
-            await save(datasets[role], { schema: "paideia.dataset.v1", id: `${plan.agent.id}:${role}`, subject: plan.agent.name,
+            datasets[role] = path.join(out, `${role}.spawnfile-training.json`);
+            await save(datasets[role], { schema: "spawnfile.training.dataset.v1", id: `${plan.agent.id}:${role}`, subject: plan.agent.name,
                 setup: { profile: plan.preparation?.hook ?? "spawnfile/rewind" }, records: records[role] });
         }
     const report = { version: "spawnfile.training-moment-lowering.v1", agent: plan.agent.id, entries };