spawnfile 0.1.29 → 0.1.30

package/dist/auth/index.d.ts

@@ -13,3 +13,4 @@ export * from "./targetSecretSourceResolver.js";
 export { stageTrainingAuth } from "./trainingAuth.js";
 export type { TrainingAuthStageOptions, TrainingAuthProvider } from "./trainingAuth.js";
 export { writeBackTrainingGrokCredential } from "./trainingGrokWriteback.js";
+export { prepareTrainingCodexAuthority } from './trainingCodexAuthority.js';

package/dist/auth/index.js

@@ -12,3 +12,4 @@ export * from "./targetSecretSourceLifecycle.js";
 export * from "./targetSecretSourceResolver.js";
 export { stageTrainingAuth } from "./trainingAuth.js";
 export { writeBackTrainingGrokCredential } from "./trainingGrokWriteback.js";
+export { prepareTrainingCodexAuthority } from './trainingCodexAuthority.js';

package/dist/auth/trainingAuth.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { link, lstat, mkdir, open, realpath, unlink } from "node:fs/promises";
 import path from "node:path";
+import { verifyTrainingCodexBootstrap } from './trainingCodexAuthority.js';
 const targets = {
     codex: [".daimon-inbound", "codex-auth"],
     claude: [".claude", ".credentials.json"]
@@ -13,6 +14,8 @@ export const stageTrainingAuth = async (options) => {
     const home = path.resolve(options.home), source = options.source ?? `/run/spawnfile-training-auth/${options.provider}`;
     if (!path.isAbsolute(options.home) || await realpath(home) !== home || !(await lstat(home)).isDirectory())
         throw Error("Training home must be a canonical existing directory");
+    if (options.provider === 'codex')
+        return { version: 'spawnfile.training-auth-stage.v1', provider: 'codex', destination: await verifyTrainingCodexBootstrap(source) };
     if (!path.isAbsolute(source) || await realpath(source) !== path.resolve(source))
         throw Error("Training auth source must be a canonical regular leaf");
     const input = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);

package/dist/auth/trainingCodexAuthority.d.ts

@@ -0,0 +1,8 @@
+/** Stable host state for a declared subscription bootstrap, retained across runs.
+ * No credential bytes are copied here; the mounted Daimon authority owns them.
+ */
+export declare function prepareTrainingCodexAuthority(source: string, dockerContext: string): Promise<string>;
+/** Compatibility call for per-trial preparers: validate the one container ingress.
+ * It never creates a home-local snapshot or overwrites the rotating authority.
+ */
+export declare function verifyTrainingCodexBootstrap(source: string): Promise<string>;

package/dist/auth/trainingCodexAuthority.js

@@ -0,0 +1,40 @@
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { resolveSpawnfileHome } from './paths.js';
+import { DAIMON_CODEX_SUBSCRIPTION_REALM } from '../runtime/daimon/contractManifest.js';
+/** Stable host state for a declared subscription bootstrap, retained across runs.
+ * No credential bytes are copied here; the mounted Daimon authority owns them.
+ */
+export async function prepareTrainingCodexAuthority(source, dockerContext) {
+    const input = await lstat(source);
+    if (await realpath(source) !== path.resolve(source) || !input.isFile() || input.isSymbolicLink() || input.nlink !== 1
+        || input.uid !== process.getuid?.() || (input.mode & 0o777) !== 0o600 || input.size < 1
+        || input.size > DAIMON_CODEX_SUBSCRIPTION_REALM.maxCredentialBytes)
+        throw new Error('Unsafe training Codex bootstrap');
+    const identity = createHash('sha256').update(source).update('\0').update(dockerContext).digest('hex');
+    const root = path.join(resolveSpawnfileHome(), 'training', 'subscription-accounts', `codex-${identity}`);
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const entry = await lstat(root);
+    if (await realpath(root) !== root || !entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()
+        || (entry.mode & 0o777) !== 0o700)
+        throw new Error('Unsafe training Codex account state');
+    return root;
+}
+/** Compatibility call for per-trial preparers: validate the one container ingress.
+ * It never creates a home-local snapshot or overwrites the rotating authority.
+ */
+export async function verifyTrainingCodexBootstrap(source) {
+    const destination = DAIMON_CODEX_SUBSCRIPTION_REALM.bootstrapMountPath;
+    const [before, mounted] = await Promise.all([lstat(source), lstat(destination)]);
+    for (const entry of [before, mounted]) {
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1 || entry.uid !== process.getuid?.()
+            || (entry.mode & 0o777) !== 0o600 || entry.size < 1 || entry.size > DAIMON_CODEX_SUBSCRIPTION_REALM.maxCredentialBytes) {
+            throw new Error('Training Codex requires its container-owned shared bootstrap');
+        }
+    }
+    if (await realpath(source) !== path.resolve(source) || await realpath(destination) !== destination
+        || before.dev !== mounted.dev || before.ino !== mounted.ino)
+        throw new Error('Training Codex bootstrap differs from its declared ingress');
+    return destination;
+}

package/dist/compiler/containerDaimonGrokWorkerRender.js

@@ -124,6 +124,10 @@ export const resolveDaimonGrokWorkerDenyPaths = (plans, plan, agentId, workerHom
     const ownRuntimeHome = path.posix.join(instanceRoot, DAIMON_RUNTIME_HOMES_DIRECTORY, nodeSlug(agentId));
     const peers = agents.filter(([id]) => id !== agentId).map(([id]) => nodeSlug(id));
     const daimonOwn = [
+        ...[...new Set(agents.map(([, engine]) => engine))].flatMap((engine) => {
+            const auth = getDaimonEngineDescriptor(engine)?.auth;
+            return auth?.staging === "portable-realm" ? [auth.realm.bootstrapMountPath, auth.realm.durableMountPath] : [];
+        }),
         DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath,
         DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath,
         ...(agents.some(([, engine]) => getDaimonEngineDescriptor(engine)?.auth.staging === "secret-service") ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath, DAIMON_AGY_SUBSCRIPTION_REALM.durableMountPath] : []),

package/dist/compiler/training/container/launch.js

@@ -21,6 +21,8 @@ import { parseTrainingMappedPreparation } from "../preparation/contract.js";
 import { persistTrainingGrokCredential } from "./grokWriteback.js";
 import { nativeTrainingSlotsDocument } from "./nativeSlots.js";
 import { createTrainingOutputVolume, trainingOutputVolumeEnabled } from "./outputVolume.js";
+import { prepareTrainingCodexAuthority } from '../../../auth/index.js';
+import { DAIMON_CODEX_SUBSCRIPTION_REALM } from '../../../runtime/daimon/contractManifest.js';
 // The image bakes /run/training/inputs as 0:2000 0750 for brokered worker isolation; the
 // non-brokered host-uid evaluator joins that group so it can still traverse its own inputs.
 export const TRAINING_INPUTS_GID = 2_000;
@@ -137,6 +139,11 @@ export const launchTrainingContainer = async (options) => {
             ...options.repairPath ? [`type=bind,src=${options.repairPath},dst=/run/spawnfile-training/repair.json,readonly`] : [],
             ...prepared.config.auth.map((entry) => `type=bind,src=${entry.source},dst=/run/spawnfile-training-auth/${entry.provider},readonly`)];
         const broker = prepared.config.broker;
+        const codex = prepared.config.auth.find(entry => entry.provider === 'codex');
+        if (codex && !broker) {
+            const account = await prepareTrainingCodexAuthority(codex.source, prepared.config.dockerContext);
+            mounts.push(`type=bind,src=${account},dst=${DAIMON_CODEX_SUBSCRIPTION_REALM.durableMountPath}`, `type=bind,src=${codex.source},dst=${DAIMON_CODEX_SUBSCRIPTION_REALM.bootstrapMountPath},readonly`);
+        }
         if (broker) {
             mounts.push(trainingRunRequestMount(prepared.config.output.source, prepared.args));
             const slotsFile = path.join(privateRoot, "slots.json");

package/dist/compiler/training/execution.d.ts

@@ -63,7 +63,7 @@ export declare const trainingExecutionSchema: z.ZodObject<{
                     path: z.ZodString;
                     examples: z.ZodArray<z.ZodObject<{
                         id: z.ZodString;
-                        at: z.ZodISODateTime;
+                        at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                         wake: z.ZodObject<{
                             surface: z.ZodLiteral<"moltnet">;
                             room: z.ZodString;
@@ -86,7 +86,7 @@ export declare const trainingExecutionSchema: z.ZodObject<{
                     path: z.ZodString;
                     examples: z.ZodArray<z.ZodObject<{
                         id: z.ZodString;
-                        at: z.ZodISODateTime;
+                        at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                         wake: z.ZodObject<{
                             surface: z.ZodLiteral<"moltnet">;
                             room: z.ZodString;
@@ -109,7 +109,7 @@ export declare const trainingExecutionSchema: z.ZodObject<{
                     path: z.ZodString;
                     examples: z.ZodArray<z.ZodObject<{
                         id: z.ZodString;
-                        at: z.ZodISODateTime;
+                        at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                         wake: z.ZodObject<{
                             surface: z.ZodLiteral<"moltnet">;
                             room: z.ZodString;

package/dist/compiler/training/plan/contract.d.ts

@@ -5,7 +5,7 @@ export declare const trainingPlanDatasetSchema: z.ZodObject<{
     path: z.ZodString;
     examples: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
-        at: z.ZodISODateTime;
+        at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
         wake: z.ZodObject<{
             surface: z.ZodLiteral<"moltnet">;
             room: z.ZodString;
@@ -90,7 +90,7 @@ export declare const trainingPlanSchema: z.ZodObject<{
                 path: z.ZodString;
                 examples: z.ZodArray<z.ZodObject<{
                     id: z.ZodString;
-                    at: z.ZodISODateTime;
+                    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                     wake: z.ZodObject<{
                         surface: z.ZodLiteral<"moltnet">;
                         room: z.ZodString;
@@ -113,7 +113,7 @@ export declare const trainingPlanSchema: z.ZodObject<{
                 path: z.ZodString;
                 examples: z.ZodArray<z.ZodObject<{
                     id: z.ZodString;
-                    at: z.ZodISODateTime;
+                    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                     wake: z.ZodObject<{
                         surface: z.ZodLiteral<"moltnet">;
                         room: z.ZodString;
@@ -136,7 +136,7 @@ export declare const trainingPlanSchema: z.ZodObject<{
                 path: z.ZodString;
                 examples: z.ZodArray<z.ZodObject<{
                     id: z.ZodString;
-                    at: z.ZodISODateTime;
+                    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                     wake: z.ZodObject<{
                         surface: z.ZodLiteral<"moltnet">;
                         room: z.ZodString;
@@ -218,7 +218,7 @@ export declare const trainingPlanJsonSchema: z.core.ZodStandardJSONSchemaPayload
                 path: z.ZodString;
                 examples: z.ZodArray<z.ZodObject<{
                     id: z.ZodString;
-                    at: z.ZodISODateTime;
+                    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                     wake: z.ZodObject<{
                         surface: z.ZodLiteral<"moltnet">;
                         room: z.ZodString;
@@ -241,7 +241,7 @@ export declare const trainingPlanJsonSchema: z.core.ZodStandardJSONSchemaPayload
                 path: z.ZodString;
                 examples: z.ZodArray<z.ZodObject<{
                     id: z.ZodString;
-                    at: z.ZodISODateTime;
+                    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                     wake: z.ZodObject<{
                         surface: z.ZodLiteral<"moltnet">;
                         room: z.ZodString;
@@ -264,7 +264,7 @@ export declare const trainingPlanJsonSchema: z.core.ZodStandardJSONSchemaPayload
                 path: z.ZodString;
                 examples: z.ZodArray<z.ZodObject<{
                     id: z.ZodString;
-                    at: z.ZodISODateTime;
+                    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                     wake: z.ZodObject<{
                         surface: z.ZodLiteral<"moltnet">;
                         room: z.ZodString;

package/dist/compiler/training/preparation/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "spawnfile",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "spawnfile",
-      "version": "0.1.29",
+      "version": "0.1.30",
       "license": "MIT",
       "dependencies": {
         "@huggingface/jinja": "0.5.10",
@@ -16,9 +16,9 @@
         "commander": "^14.0.1",
         "mdast-util-from-markdown": "2.0.3",
         "mdast-util-to-string": "4.0.0",
-        "undici": "7.29.1",
+        "undici": "7.30.1",
         "yaml": "^2.8.1",
-        "zod": "^4.1.12"
+        "zod": "^4.6.7"
       },
       "bin": {
         "spawnfile": "dist/cli/index.js"
@@ -5055,9 +5055,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
-      "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
+      "version": "7.30.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
+      "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"
@@ -5461,9 +5461,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"

package/dist/compiler/training/repair/contract.d.ts

@@ -254,7 +254,7 @@ export declare const witnessSchema: z.ZodObject<{
                         path: z.ZodString;
                         examples: z.ZodArray<z.ZodObject<{
                             id: z.ZodString;
-                            at: z.ZodISODateTime;
+                            at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                             wake: z.ZodObject<{
                                 surface: z.ZodLiteral<"moltnet">;
                                 room: z.ZodString;
@@ -277,7 +277,7 @@ export declare const witnessSchema: z.ZodObject<{
                         path: z.ZodString;
                         examples: z.ZodArray<z.ZodObject<{
                             id: z.ZodString;
-                            at: z.ZodISODateTime;
+                            at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                             wake: z.ZodObject<{
                                 surface: z.ZodLiteral<"moltnet">;
                                 room: z.ZodString;
@@ -300,7 +300,7 @@ export declare const witnessSchema: z.ZodObject<{
                         path: z.ZodString;
                         examples: z.ZodArray<z.ZodObject<{
                             id: z.ZodString;
-                            at: z.ZodISODateTime;
+                            at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                             wake: z.ZodObject<{
                                 surface: z.ZodLiteral<"moltnet">;
                                 room: z.ZodString;
@@ -636,7 +636,7 @@ export declare const witnessEnvelopeSchema: z.ZodObject<{
                             path: z.ZodString;
                             examples: z.ZodArray<z.ZodObject<{
                                 id: z.ZodString;
-                                at: z.ZodISODateTime;
+                                at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                                 wake: z.ZodObject<{
                                     surface: z.ZodLiteral<"moltnet">;
                                     room: z.ZodString;
@@ -659,7 +659,7 @@ export declare const witnessEnvelopeSchema: z.ZodObject<{
                             path: z.ZodString;
                             examples: z.ZodArray<z.ZodObject<{
                                 id: z.ZodString;
-                                at: z.ZodISODateTime;
+                                at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                                 wake: z.ZodObject<{
                                     surface: z.ZodLiteral<"moltnet">;
                                     room: z.ZodString;
@@ -682,7 +682,7 @@ export declare const witnessEnvelopeSchema: z.ZodObject<{
                             path: z.ZodString;
                             examples: z.ZodArray<z.ZodObject<{
                                 id: z.ZodString;
-                                at: z.ZodISODateTime;
+                                at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
                                 wake: z.ZodObject<{
                                     surface: z.ZodLiteral<"moltnet">;
                                     room: z.ZodString;
@@ -771,7 +771,7 @@ export declare const witnessEnvelopeSchema: z.ZodObject<{
     digest: z.ZodString;
 }, z.core.$strict>;
 export declare const repairReceiptSchema: z.ZodObject<{
-    version: z.ZodPreprocess<z.ZodLiteral<"spawnfile.training.measurement-repair.v1">>;
+    version: z.ZodPreprocess<z.ZodLiteral<"spawnfile.training.measurement-repair.v1">, unknown>;
     parent: z.ZodObject<{
         root: z.ZodLiteral<"/run/training/inputs/repair-parent">;
         imageId: z.ZodString;
@@ -800,7 +800,7 @@ export declare const repairReceiptSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const repairEnvelopeSchema: z.ZodObject<{
     receipt: z.ZodObject<{
-        version: z.ZodPreprocess<z.ZodLiteral<"spawnfile.training.measurement-repair.v1">>;
+        version: z.ZodPreprocess<z.ZodLiteral<"spawnfile.training.measurement-repair.v1">, unknown>;
         parent: z.ZodObject<{
             root: z.ZodLiteral<"/run/training/inputs/repair-parent">;
             imageId: z.ZodString;

package/dist/compiler/training/rewind/contract.d.ts

@@ -44,8 +44,8 @@ export declare const materializedInputSchema: z.ZodObject<{
         agentSlug: z.ZodOptional<z.ZodString>;
         snapshot: z.ZodOptional<z.ZodString>;
         cursor: z.ZodOptional<z.ZodString>;
-        switchingAt: z.ZodOptional<z.ZodISODateTime>;
-        landedAt: z.ZodOptional<z.ZodISODateTime>;
+        switchingAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
+        landedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
         prepared: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>;
     path: z.ZodNullable<z.ZodString>;
@@ -70,8 +70,8 @@ export declare const materializedMomentSchema: z.ZodObject<{
         }>;
         dataset: z.ZodString;
     }, z.core.$strict>;
-    at: z.ZodISODateTime;
-    effectiveAt: z.ZodISODateTime;
+    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
+    effectiveAt: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     inputs: z.ZodArray<z.ZodObject<{
         section: z.ZodEnum<{
             networks: "networks";
@@ -108,8 +108,8 @@ export declare const materializedMomentSchema: z.ZodObject<{
             agentSlug: z.ZodOptional<z.ZodString>;
             snapshot: z.ZodOptional<z.ZodString>;
             cursor: z.ZodOptional<z.ZodString>;
-            switchingAt: z.ZodOptional<z.ZodISODateTime>;
-            landedAt: z.ZodOptional<z.ZodISODateTime>;
+            switchingAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
+            landedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
             prepared: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>;
         path: z.ZodNullable<z.ZodString>;
@@ -120,7 +120,7 @@ export declare const materializedMomentSchema: z.ZodObject<{
     record: z.ZodObject<{
         matched: z.ZodBoolean;
         attempts: z.ZodOptional<z.ZodNumber>;
-        selectedStartedAt: z.ZodOptional<z.ZodISODateTime>;
+        selectedStartedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
         executionId: z.ZodOptional<z.ZodString>;
         selection: z.ZodOptional<z.ZodLiteral<"earliest-startedAt">>;
     }, z.core.$strict>;
@@ -158,7 +158,7 @@ export declare const leakFindingSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const leakCheckSchema: z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.leak-check.v1">;
-    at: z.ZodISODateTime;
+    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     ok: z.ZodBoolean;
     checked: z.ZodObject<{
         files: z.ZodNumber;
@@ -199,7 +199,7 @@ export type LeakCheck = z.infer<typeof leakCheckSchema>;
 export type LeakFinding = z.infer<typeof leakFindingSchema>;
 export declare const taskClockSchema: z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.task-clock.v1">;
-    origin: z.ZodISODateTime;
+    origin: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
 }, z.core.$strict>;
 export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.materialized-moment.v1">;
@@ -217,8 +217,8 @@ export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaP
         }>;
         dataset: z.ZodString;
     }, z.core.$strict>;
-    at: z.ZodISODateTime;
-    effectiveAt: z.ZodISODateTime;
+    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
+    effectiveAt: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     inputs: z.ZodArray<z.ZodObject<{
         section: z.ZodEnum<{
             networks: "networks";
@@ -255,8 +255,8 @@ export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaP
             agentSlug: z.ZodOptional<z.ZodString>;
             snapshot: z.ZodOptional<z.ZodString>;
             cursor: z.ZodOptional<z.ZodString>;
-            switchingAt: z.ZodOptional<z.ZodISODateTime>;
-            landedAt: z.ZodOptional<z.ZodISODateTime>;
+            switchingAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
+            landedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
             prepared: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>;
         path: z.ZodNullable<z.ZodString>;
@@ -267,7 +267,7 @@ export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaP
     record: z.ZodObject<{
         matched: z.ZodBoolean;
         attempts: z.ZodOptional<z.ZodNumber>;
-        selectedStartedAt: z.ZodOptional<z.ZodISODateTime>;
+        selectedStartedAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
         executionId: z.ZodOptional<z.ZodString>;
         selection: z.ZodOptional<z.ZodLiteral<"earliest-startedAt">>;
     }, z.core.$strict>;
@@ -278,7 +278,7 @@ export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaP
 }, z.core.$strict>>;
 export declare const leakCheckJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.leak-check.v1">;
-    at: z.ZodISODateTime;
+    at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     ok: z.ZodBoolean;
     checked: z.ZodObject<{
         files: z.ZodNumber;
@@ -317,5 +317,5 @@ export declare const leakCheckJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.
 }, z.core.$strict>>;
 export declare const taskClockJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.task-clock.v1">;
-    origin: z.ZodISODateTime;
+    origin: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
 }, z.core.$strict>>;

package/dist/compiler/training/rewind/memorySchemas.d.ts

@@ -14,7 +14,7 @@ export declare const memoryEventSchema: z.ZodObject<{
         "memory.promoted": "memory.promoted";
         "memory.consolidated": "memory.consolidated";
     }>;
-    createdAt: z.ZodISODateTime;
+    createdAt: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     principal: z.ZodObject<{
         agentId: z.ZodString;
         scope: z.ZodEnum<{

package/dist/compiler/training/rewind/snapshotManifest.d.ts

@@ -5,7 +5,7 @@ export declare const snapshotManifestSchema: z.ZodObject<{
     version: z.ZodLiteral<"noopolis.daimon.wake-moment.v1">;
     id: z.ZodString;
     snapshot: z.ZodString;
-    started_at: z.ZodISODateTime;
+    started_at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     sourcePath: z.ZodString;
     entries: z.ZodRecord<z.ZodString, z.ZodObject<{
         type: z.ZodEnum<{

package/dist/compiler/training/subjectLease.d.ts

@@ -55,7 +55,7 @@ export interface TrainingSubjectLease {
         target: string;
     };
     projections: {
-        role: "home" | "memory" | "transport";
+        role: "home" | "memory" | "transport" | "subscription";
         source: string;
         target: string;
     }[];

package/dist/compiler/training/subjectLease.js

@@ -3,7 +3,7 @@ import { DAIMON_PACKAGE_NAME } from '../../runtime/daimon/packageName.js';
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { SpawnfileError } from "../../shared/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../runtime/daimon/contractManifest.js";
+import { DAIMON_CODEX_SUBSCRIPTION_REALM, DAIMON_GROK_ENGINE_BROKER } from "../../runtime/daimon/contractManifest.js";
 import { parseTrainingBrokerDeclaration } from "./broker/declaration.js";
 import { TRAINING_BROKER_DECLARATION_FILE, TRAINING_ROOT, TRAINING_SLOTS_FILE, trainingSlotDescriptors } from "./broker/paths.js";
 import { loadDaimonProjectionModule, resolveTrainingSlotProjection } from "./broker/projection.js";
@@ -107,7 +107,7 @@ const loadDaimonRuntime = async () => {
     return import(packageName);
 };
 /** The Codex credential leaf Daimon reads, from its public export, refused unless it equals the vendored manifest. */
-const codexCredentialRelativePath = async (load = loadDaimonRuntime) => {
+const codexSubscriptionRealm = async (load = loadDaimonRuntime) => {
     let daimon;
     try {
         daimon = await load();
@@ -115,11 +115,10 @@ const codexCredentialRelativePath = async (load = loadDaimonRuntime) => {
     catch {
         return refused(`The training image must install ${DAIMON_PACKAGE_NAME} with its public /runtime export`);
     }
-    const relative = daimon?.ENGINE_CREDENTIAL_MATERIAL?.[DAIMON_PORTABLE_ENGINE_ID]?.sourceRelativePath;
-    if (typeof relative !== "string" || relative !== getDaimonEngineDescriptor(DAIMON_PORTABLE_ENGINE_ID).credentialMaterial.sourceRelativePath) {
-        return refused("The installed Daimon Codex credential material differs from this compiler's vendored manifest");
+    if (!daimon?.CODEX_SUBSCRIPTION_REALM || Object.entries(DAIMON_CODEX_SUBSCRIPTION_REALM).some(([key, value]) => daimon.CODEX_SUBSCRIPTION_REALM[key] !== value)) {
+        return refused("The installed Daimon Codex subscription realm differs from this compiler's vendored manifest");
     }
-    return relative;
+    return DAIMON_CODEX_SUBSCRIPTION_REALM;
 };
 /** Ports from the leased slot's own `slots.json` block (offsets 0=Moltnet, 1=worker control, 2=bridge), refused outside it. */
 const leasedSlotPorts = async (slot, file) => {
@@ -152,7 +151,7 @@ const leaseCodexSubject = async (options) => {
     const workspace = canonical("workspace", options.trialRoots.workspace);
     const runtimeHome = canonical("runtime home", options.trialRoots.runtimeHome);
     const ports = await leasedSlotPorts(options.slot, options.slotsFile ?? TRAINING_SLOTS_FILE);
-    const relative = await codexCredentialRelativePath(options.loadDaimon);
+    const realm = await codexSubscriptionRealm(options.loadDaimon);
     options.signal.throwIfAborted();
     // Codex's writable data sits beside the workspace, disjoint from the evaluator runtime and its controls.
     const parent = path.posix.dirname(workspace);
@@ -168,10 +167,11 @@ const leaseCodexSubject = async (options) => {
         agent: { id: options.agentId, engine: DAIMON_PORTABLE_ENGINE_ID, model: options.model },
         workspace: { source: workspace, target: workspace },
         projections: [{ role: "home", source: home, target: home }, { role: "memory", source: memory, target: memory },
-            { role: "transport", source: transport, target: transport }],
-        // The read-only container leaf is the sole ingress; the child stages it into exactly this target
-        // (`stageTrainingAuth` from `spawnfile/auth`), never overwriting a renewed credential.
-        credentials: [{ source: TRAINING_CODEX_CREDENTIAL_INGRESS, target: path.posix.join(home, relative) }],
+            { role: "transport", source: transport, target: transport },
+            { role: "subscription", source: realm.durableMountPath, target: realm.durableMountPath }],
+        // The container owns one persistent authority for every trial. The runtime
+        // stages credentials during each serialized host lifecycle and promotes refreshes.
+        credentials: [{ source: TRAINING_CODEX_CREDENTIAL_INGRESS, target: realm.bootstrapMountPath }],
         roots,
         ports,
         env: {}

package/dist/deployment/organizationReady.d.ts

@@ -46,7 +46,7 @@ export declare const organizationReadinessSchema: z.ZodPreprocess<z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.organization-ready.v1">;
     world_binding_digest: z.ZodNullable<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>>;
+}, z.core.$strict>, unknown>;
 export declare const createOrganizationReadinessPending: (evidence: OrganizationReadinessEvidence, record: ReconcileOrganizationReadinessInput["record"]) => OrganizationReadiness;
 export declare const parseOrganizationReadiness: (value: unknown) => OrganizationReadiness;
 export declare const reconcileOrganizationReadiness: (input: ReconcileOrganizationReadinessInput) => OrganizationReadiness;

package/dist/deployment/record.d.ts

@@ -12,7 +12,7 @@ declare const recordSourceSchema: z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strict>]>;
 export type DeploymentRecordSource = z.infer<typeof recordSourceSchema>;
 export declare const deploymentRecordSchema: z.ZodObject<{
-    activated_at: z.ZodOptional<z.ZodISODateTime>;
+    activated_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
     activation_exact: z.ZodOptional<z.ZodBoolean>;
     activation_note: z.ZodOptional<z.ZodString>;
     recording: z.ZodOptional<z.ZodObject<{
@@ -48,12 +48,12 @@ export declare const deploymentRecordSchema: z.ZodObject<{
         version: z.ZodLiteral<"spawnfile.deploy-resources.v1">;
         deployment: z.ZodString;
         deployment_id: z.ZodString;
-        activated_at: z.ZodISODateTime;
+        activated_at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
         activation_exact: z.ZodBoolean;
         activation_note: z.ZodOptional<z.ZodString>;
-        rolled_back_at: z.ZodOptional<z.ZodISODateTime>;
+        rolled_back_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
         exact: z.ZodOptional<z.ZodLiteral<false>>;
-        deployed_at: z.ZodISODateTime;
+        deployed_at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
         report_sha256: z.ZodString;
         resources: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             id: z.ZodString;
@@ -167,7 +167,7 @@ export declare const deploymentRecordSchema: z.ZodObject<{
         version: z.ZodLiteral<"spawnfile.organization-ready.v1">;
         world_binding_digest: z.ZodNullable<z.ZodString>;
         reason: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>>;
+    }, z.core.$strict>, unknown>>;
 }, z.core.$strict>;
 export type DeploymentRecord = Omit<z.infer<typeof deploymentRecordSchema>, "organization_handoff" | "organization_handoff_handle" | "organization_ready"> & {
     organization_handoff?: OrganizationHandoff;

package/dist/deployment/record.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { ensureDirectory, readUtf8File } from "../filesystem/index.js";
 import { deployResourcesSchema } from "./resourceLog.js";
 import { publishDeploymentRecord } from "./recordPublication.js";
-import { SpawnfileError } from "../shared/index.js";
+import { compatibleIsoDateTimeSchema, SpawnfileError } from "../shared/index.js";
 import { recordingReportSchema } from "../report/index.js";
 import { parseOrganizationHandoff } from "./organizationHandoffTypes.js";
 import { parseOpaqueTargetHandle } from "../target/index.js";
@@ -82,7 +82,7 @@ const deploymentRecordV1Schema = z.object({
     version: z.literal("spawnfile.deployment.v1")
 }).strict();
 export const deploymentRecordSchema = z.object({
-    activated_at: z.iso.datetime({ offset: true }).optional(),
+    activated_at: compatibleIsoDateTimeSchema({ offset: true }).optional(),
     activation_exact: z.boolean().optional(),
     activation_note: z.string().min(1).optional(),
     recording: recordingReportSchema.optional(),

package/dist/deployment/resourceLog.d.ts

@@ -6,12 +6,12 @@ export declare const deployResourcesSchema: z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.deploy-resources.v1">;
     deployment: z.ZodString;
     deployment_id: z.ZodString;
-    activated_at: z.ZodISODateTime;
+    activated_at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     activation_exact: z.ZodBoolean;
     activation_note: z.ZodOptional<z.ZodString>;
-    rolled_back_at: z.ZodOptional<z.ZodISODateTime>;
+    rolled_back_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>>;
     exact: z.ZodOptional<z.ZodLiteral<false>>;
-    deployed_at: z.ZodISODateTime;
+    deployed_at: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
     report_sha256: z.ZodString;
     resources: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         id: z.ZodString;

package/dist/deployment/resourceLog.js

@@ -1,3 +1,4 @@
+import { compatibleIsoDateTimeSchema } from '../shared/index.js';
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { z } from "zod";
@@ -15,9 +16,9 @@ const resourceSchema = z.discriminatedUnion("kind", [
 export const deployResourcesSchema = z.object({
     version: z.literal(DEPLOY_RESOURCES_VERSION), deployment: text,
     deployment_id: text,
-    activated_at: z.iso.datetime({ offset: true }), activation_exact: z.boolean(), activation_note: text.optional(),
-    rolled_back_at: z.iso.datetime({ offset: true }).optional(), exact: z.literal(false).optional(),
-    deployed_at: z.iso.datetime({ offset: true }), report_sha256: digest,
+    activated_at: compatibleIsoDateTimeSchema({ offset: true }), activation_exact: z.boolean(), activation_note: text.optional(),
+    rolled_back_at: compatibleIsoDateTimeSchema({ offset: true }).optional(), exact: z.literal(false).optional(),
+    deployed_at: compatibleIsoDateTimeSchema({ offset: true }), report_sha256: digest,
     resources: z.array(resourceSchema),
     recording_agents: z.array(recordingAgentSchema).optional()
 }).strict().refine((value) => !value.rolled_back_at || (value.exact === false && !value.activation_exact