spawnfile 0.1.32 → 0.1.34

package/dist/compiler/training/broker/receipt.js

@@ -1,110 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-/** Filesystems that silently ignore `chown`/`chmod`, so a worker-uid probe over them proves nothing. */
-export const UNENFORCED_OWNERSHIP_FILESYSTEMS = ["virtiofs", "9p", "nfs", "nfs4", "cifs", "smb3", "vboxsf", "grpcfuse"];
-const isUnenforced = (fstype) => UNENFORCED_OWNERSHIP_FILESYSTEMS.includes(fstype) || fstype.startsWith("fuse");
-/**
- * The filesystem type backing `target`, from the longest mount point that is a
- * prefix of it. `/proc/self/mountinfo` octal-escapes space, tab, newline and
- * backslash in the mount point field, exactly as the durable-mount guard
- * already handles elsewhere in this compiler.
- */
-export const resolveBackingFilesystem = (target, mountinfo) => {
-    let best = "", fstype = "";
-    for (const line of mountinfo.split("\n")) {
-        const fields = line.split(" ");
-        const separator = fields.indexOf("-");
-        if (separator < 0 || fields.length < separator + 2)
-            continue;
-        const mountPoint = (fields[4] ?? "").replace(/\\(04[0011]|134)/gu, (match) => ({ "\\040": " ", "\\011": "\t", "\\012": "\n", "\\134": "\\" }[match] ?? match));
-        if (mountPoint !== "/" && target !== mountPoint && !target.startsWith(`${mountPoint}/`))
-            continue;
-        if (mountPoint.length >= best.length) {
-            best = mountPoint;
-            fstype = fields[separator + 1] ?? "";
-        }
-    }
-    return fstype;
-};
-/**
- * One denied canary per deny path, or a refusal naming the first path whose
- * denial this container cannot prove.
- *
- * Three cases, in decreasing strength:
- *
- *  - A **sealed** path (the datasets' root) must sit on a filesystem that
- *    enforces unix ownership and must be observed *unenterable* by the worker
- *    uid. `unenforcedBindPolicy` does not reach it: the sandbox profile alone
- *    is a boundary the worker can lift from inside a namespace of its own, and
- *    the held-out test set is the one thing that cannot rest on it.
- *  - Any other path on an ownership-enforcing filesystem — a host bind over
- *    ext4/xfs/btrfs/overlay included — gets a real worker-uid read probe. This
- *    is what makes the documented `refuse` default reachable: a host bind is
- *    only unprovable where the filesystem says so.
- *  - A path on a filesystem that ignores ownership (virtiofs and grpcfuse under
- *    Docker Desktop and Colima, 9p, nfs, cifs, fuse) cannot be probed at all.
- *    `refuse` — the default — fails the recycle and writes no receipt;
- *    `profile-only` accepts the attested deny entry as that path's only
- *    boundary and names every such path in the supervisor log.
- */
-export const resolveTrainingCanaries = async (options) => {
-    const canaries = [];
-    for (const target of options.denyPaths) {
-        const fstype = resolveBackingFilesystem(target, options.mountinfo);
-        const origin = `${options.hostBindPaths.includes(target) ? "a host bind mount on " : ""}${fstype || "an unknown filesystem"}`;
-        if (options.sealedPaths.includes(target)) {
-            if (isUnenforced(fstype)) {
-                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is backed by ${origin}, which ignores unix ownership, so the worker uid's denial cannot be proven; the sealed datasets must sit under a directory on an ownership-enforcing filesystem and no unenforcedBindPolicy waives this`);
-            }
-            if (!await options.probe(target, "enter")) {
-                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is still reachable by the worker uid`);
-            }
-        }
-        else if (isUnenforced(fstype)) {
-            if (options.unenforcedBindPolicy === "refuse") {
-                throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is backed by ${origin}, which ignores unix ownership; declare unenforcedBindPolicy "profile-only" to accept the bubblewrap deny list as its only boundary`);
-            }
-            options.log(`canary ${target} certified by the enforced sandbox profile only (${origin} ignores unix ownership)`);
-        }
-        else if (!await options.probe(target, "read")) {
-            throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is still readable by the worker uid`);
-        }
-        canaries.push({ path: target, method: "sandboxed-read", result: "denied" });
-    }
-    return canaries;
-};
-/** `noopolis.daimon.grok-slot-preflight.v2`, in the exact member order Daimon's strict schema accepts. */
-export const buildTrainingSlotReceipt = (input) => {
-    if (!/^[a-f0-9]{64}$/u.test(input.nonce))
-        throw new SpawnfileError("runtime_error", "Grok slot recycle nonce must be 32 random bytes in lowercase hex");
-    if (!Number.isSafeInteger(input.generation) || input.generation < 1)
-        throw new SpawnfileError("runtime_error", "Grok slot generation must be a positive integer");
-    if (input.canaries.length === 0)
-        throw new SpawnfileError("runtime_error", "Grok slot receipt requires at least one denied canary");
-    return {
-        version: DAIMON_GROK_ENGINE_BROKER.slotPreflightVersion,
-        slot: input.slot,
-        worker_uid: input.workerUid,
-        generation: input.generation,
-        nonce: input.nonce,
-        projection_sha256: input.projectionSha256,
-        sandbox_profile_sha256: input.sandboxProfileSha256,
-        seccomp_profile_sha256: input.seccompProfileSha256,
-        sandbox_runtime: "bubblewrap",
-        grok_executable_sha256: input.grokExecutableSha256,
-        canaries: [...input.canaries],
-        created_at: `${input.createdAt.toISOString().slice(0, 23)}Z`
-    };
-};
-/** sha256 of the pinned Grok executable the slot's workers exec, refused unless it is a manifest-pinned 1.0.34 build. */
-export const readGrokExecutableSha256 = (executable = DAIMON_GROK_ENGINE_BROKER.grokExecutablePath) => {
-    const digest = createHash("sha256").update(readFileSync(executable)).digest("hex");
-    const pinned = [DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.arm64.sha256, DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.x64.sha256];
-    if (!pinned.includes(digest)) {
-        throw new SpawnfileError("runtime_error", `${path.basename(executable)} is not the manifest-pinned Grok ${DAIMON_GROK_ENGINE_BROKER.grokCliVersion} build`);
-    }
-    return digest;
-};

package/dist/compiler/training/broker/recycleClient.d.ts

@@ -1,33 +0,0 @@
-import { type Socket } from "node:net";
-/** A reply is one short JSON line; anything longer is not this supervisor. */
-export declare const TRAINING_RECYCLE_MAX_REPLY_BYTES = 65536;
-/** Above the supervisor's 120 s drain deadline plus wipe, provision and canaries. */
-export declare const TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS = 180000;
-export interface RecycleTrainingSlotOptions {
-    slot: number;
-    /** This trial's 32-byte hex nonce; the published receipt must echo it. */
-    nonce: string;
-    signal?: AbortSignal;
-    /** Opens the supervisor connection; defaults to the container's fixed supervisor socket. */
-    connect?: () => Socket;
-    timeoutMs?: number;
-}
-export interface TrainingSlotRecycleReceipt {
-    slot: number;
-    generation: number;
-    nonce: string;
-    /** The receipt path the supervisor says it published; callers compare it to the slot descriptor. */
-    receipt: string;
-    durationMs: number;
-}
-/**
- * One `recycle` over the root slot supervisor socket (`spawnfile.training-slot-supervisor.v2`).
- *
- * The verb takes a slot and a nonce, never a path or a command: the container
- * replays its own audited provisioning and publishes the slot preflight receipt
- * echoing this nonce. The answer must bind this request exactly (protocol,
- * verb, slot, nonce, a generation of at least 1) or it is refused; a supervisor
- * refusal surfaces with its own reason. The reply is bounded, and the call is
- * bounded by `timeoutMs` and `signal`.
- */
-export declare const recycleTrainingSlot: (options: RecycleTrainingSlotOptions) => Promise<TrainingSlotRecycleReceipt>;

package/dist/compiler/training/broker/recycleClient.js

@@ -1,112 +0,0 @@
-import { createConnection } from "node:net";
-import { SpawnfileError } from "../../../shared/index.js";
-import { TRAINING_MAX_SLOTS, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
-import { TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
-/** A reply is one short JSON line; anything longer is not this supervisor. */
-export const TRAINING_RECYCLE_MAX_REPLY_BYTES = 65_536;
-/** Above the supervisor's 120 s drain deadline plus wipe, provision and canaries. */
-export const TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS = 180_000;
-const NONCE = /^[a-f0-9]{64}$/u;
-const REPLY_KEYS = ["durationMs", "generation", "nonce", "ok", "receipt", "slot", "v", "verb"];
-const refuse = (message) => new SpawnfileError("runtime_error", message);
-/** The supervisor's refusal text is diagnostic only; keep it one bounded printable line. */
-const refusalText = (value) => typeof value === "string" ? value.replace(/[^\x20-\x7e]/gu, "?").slice(0, 512) || "unknown" : "unknown";
-const bindReply = (answer, slot, nonce) => {
-    if (answer.ok !== true)
-        throw refuse(`Training slot ${slot} recycle refused: ${refusalText(answer.error)}`);
-    if (Object.keys(answer).sort().join(",") !== REPLY_KEYS.join(",") || answer.verb !== "recycle") {
-        throw refuse("Training slot recycle answer is not a recycle receipt");
-    }
-    if (answer.slot !== slot)
-        throw refuse(`Training slot recycle answer names slot ${String(answer.slot)}, not the leased slot ${slot}`);
-    if (answer.nonce !== nonce)
-        throw refuse("Training slot recycle answer does not echo this trial's nonce");
-    if (!Number.isSafeInteger(answer.generation) || answer.generation < 1) {
-        throw refuse("Training slot recycle answer carries no valid generation");
-    }
-    if (typeof answer.receipt !== "string" || answer.receipt.length === 0)
-        throw refuse("Training slot recycle answer names no receipt");
-    if (typeof answer.durationMs !== "number" || !Number.isFinite(answer.durationMs) || answer.durationMs < 0) {
-        throw refuse("Training slot recycle answer carries no valid duration");
-    }
-    return { slot, generation: answer.generation, nonce, receipt: answer.receipt, durationMs: answer.durationMs };
-};
-/**
- * One `recycle` over the root slot supervisor socket (`spawnfile.training-slot-supervisor.v2`).
- *
- * The verb takes a slot and a nonce, never a path or a command: the container
- * replays its own audited provisioning and publishes the slot preflight receipt
- * echoing this nonce. The answer must bind this request exactly (protocol,
- * verb, slot, nonce, a generation of at least 1) or it is refused; a supervisor
- * refusal surfaces with its own reason. The reply is bounded, and the call is
- * bounded by `timeoutMs` and `signal`.
- */
-export const recycleTrainingSlot = (options) => {
-    const { slot, nonce } = options;
-    if (!Number.isInteger(slot) || slot < 0 || slot >= TRAINING_MAX_SLOTS) {
-        return Promise.reject(new SpawnfileError("validation_error", `Training slot recycle requires a slot index from 0 to ${TRAINING_MAX_SLOTS - 1}`));
-    }
-    if (!NONCE.test(nonce))
-        return Promise.reject(new SpawnfileError("validation_error", "Training slot recycle requires a 32-byte hex nonce"));
-    try {
-        options.signal?.throwIfAborted();
-    }
-    catch (error) {
-        return Promise.reject(error);
-    }
-    return new Promise((resolve, reject) => {
-        const socket = (options.connect ?? (() => createConnection(TRAINING_SUPERVISOR_SOCKET)))();
-        let buffer = Buffer.alloc(0), settled = false;
-        const onAbort = () => finish(options.signal?.reason instanceof Error ? options.signal.reason : refuse("Training slot recycle was aborted"));
-        const timer = setTimeout(() => finish(refuse(`Training slot ${slot} recycle timed out before the supervisor answered`)), options.timeoutMs ?? TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS);
-        function finish(error, value) {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            options.signal?.removeEventListener("abort", onAbort);
-            socket.destroy();
-            if (error === undefined)
-                resolve(value);
-            else
-                reject(error);
-        }
-        options.signal?.addEventListener("abort", onAbort, { once: true });
-        socket.on("error", (error) => finish(refuse(`Training slot recycle could not reach the root supervisor: ${error.message}`)));
-        socket.on("close", () => finish(refuse("Training slot recycle connection closed before an answer")));
-        socket.on("connect", () => socket.write(`${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, verb: "recycle", slot, nonce })}\n`));
-        socket.on("data", (chunk) => {
-            buffer = Buffer.concat([buffer, chunk]);
-            const end = buffer.indexOf(0x0a);
-            if (end < 0 ? buffer.length > TRAINING_RECYCLE_MAX_REPLY_BYTES : end > TRAINING_RECYCLE_MAX_REPLY_BYTES) {
-                finish(refuse("Training slot recycle answer exceeded its bound"));
-                return;
-            }
-            if (end < 0)
-                return;
-            let answer;
-            try {
-                answer = JSON.parse(buffer.subarray(0, end).toString("utf8"));
-            }
-            catch {
-                finish(refuse("Training slot recycle answer is not JSON"));
-                return;
-            }
-            if (!answer || typeof answer !== "object" || Array.isArray(answer)) {
-                finish(refuse("Training slot recycle answer is not an object"));
-                return;
-            }
-            const record = answer;
-            if (record.v !== TRAINING_SUPERVISOR_PROTOCOL) {
-                finish(refuse("Training slot recycle answer names another protocol"));
-                return;
-            }
-            try {
-                finish(undefined, bindReply(record, slot, nonce));
-            }
-            catch (error) {
-                finish(error);
-            }
-        });
-    });
-};

package/dist/compiler/training/broker/registration.d.ts

@@ -1,46 +0,0 @@
-import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../../runtime/daimon/contractManifest.js";
-import { type DaimonAgentSkill } from "../../../runtime/daimon/grokWorkerSkills.js";
-import { type DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
-/**
- * The one training slot's deny list: Daimon's own protected set for a
- * single-agent organization (Grok bootstrap, realm, and the slot state root that
- * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
- * the evaluator roots, the caller's protected `/run/spawnfile-training` paths, the broker
- * control and registration roots, the grant home root, the inference ledger,
- * the per-slot ledger, turn store and supervisor socket directory.
- *
- * The same two refusals the production render enforces apply here: an entry
- * that equals or contains a Grok 1.0.34 base-profile grant makes Grok refuse
- * the profile outright, and masks cannot nest, so an entry covered by another
- * entry is a provisioning bug rather than something to silently drop.
- */
-export declare const resolveTrainingGrokDenyPaths: (added?: readonly string[] | undefined, slot?: number, slots?: number) => string[];
-export interface TrainingGrokSlotInput {
-    slot?: number;
-    slots?: number;
-    agentId: string;
-    model: DaimonGrokBrokerModel;
-    reasoningEffort: DaimonGrokBrokerReasoningEffort;
-    /** Deny entries this container adds beyond Daimon's own protected set; defaults to the fixed training set. */
-    denyPaths?: readonly string[];
-    /**
-     * The declaration's per-turn limits. The broker registration must declare
-     * them, because a wake may only LOWER a declared limit: a trial whose wake
-     * ceiling exceeds the manifest defaults is refused as `invalid_request`.
-     */
-    limits?: {
-        maxRequests: number;
-        maxTokens: number;
-        timeoutMs: number;
-    };
-    /** The declaration's skills; rendered into the slot's `$GROK_HOME/skills` and bound as `skillsSha256`. */
-    skills?: readonly DaimonAgentSkill[];
-}
-/**
- * The single brokered Grok registration a training container runs, at the
- * fixed container paths in `paths.ts`. Unlike production it points
- * `usageLedgerPath` at the per-slot ledger, because each trial's spend must be
- * separable and a recycle wipes it; the container-wide ledger and wake fuse do
- * not exist here.
- */
-export declare const resolveTrainingGrokRegistration: (input: TrainingGrokSlotInput) => DaimonGrokRegistration;

package/dist/compiler/training/broker/registration.js

@@ -1,113 +0,0 @@
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
-import { resolveDaimonGrokWorkerSkills } from "../../../runtime/daimon/grokWorkerSkills.js";
-import { DAIMON_GROK_BASE_PROFILE_GRANTS, assertCanonicalRegisteredPath } from "../../containerDaimonGrokWorkerRender.js";
-import { trainingSlotPaths, trainingEvaluatorPaths, TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, TRAINING_DEFERRED_DENY_PATHS } from "./paths.js";
-const fail = (message) => {
-    throw new SpawnfileError("compile_error", message);
-};
-const within = (candidate, root) => candidate === root || candidate.startsWith(`${root}/`);
-/**
- * The one training slot's deny list: Daimon's own protected set for a
- * single-agent organization (Grok bootstrap, realm, and the slot state root that
- * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
- * the evaluator roots, the caller's protected `/run/spawnfile-training` paths, the broker
- * control and registration roots, the grant home root, the inference ledger,
- * the per-slot ledger, turn store and supervisor socket directory.
- *
- * The same two refusals the production render enforces apply here: an entry
- * that equals or contains a Grok 1.0.34 base-profile grant makes Grok refuse
- * the profile outright, and masks cannot nest, so an entry covered by another
- * entry is a provisioning bug rather than something to silently drop.
- */
-export const resolveTrainingGrokDenyPaths = (added = undefined, slot = 0, slots = 1) => {
-    const p = trainingSlotPaths(slot);
-    const required = trainingEvaluatorPaths(slot, slots).map(entry => entry.path);
-    // The wake-acceptance store is masked through `p.state`, never directly: Grok 1.0.34
-    // materializes every deny target inside bubblewrap AS THE WORKER UID, and the store's parent is
-    // `2000:2000 0700`, so the store itself is unplaceable and would make Grok refuse the whole profile
-    // (`.runtime/grok-deny-placement/EVIDENCE.md`). The state root covers it and nothing else lives there.
-    const daimonOwn = [TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, p.state];
-    const grokHome = path.posix.join(p.workerHome, DAIMON_GROK_WORKER_HOME_DIRECTORY);
-    const grants = [
-        ...DAIMON_GROK_BASE_PROFILE_GRANTS, p.workspace, grokHome,
-        path.posix.join(grokHome, "sessions"), path.posix.join(p.workerHome, "tmp")
-    ];
-    const candidates = [...new Set([...daimonOwn, ...required, ...(added ?? [])])].sort();
-    for (const entry of candidates) {
-        assertCanonicalRegisteredPath("deny path", entry);
-        const grant = grants.find((candidate) => within(candidate, entry));
-        if (grant)
-            fail(`Training Grok deny path ${entry} equals or contains the base profile grant ${grant}; Grok refuses such a profile`);
-        if (within(p.workspace, entry) || within(p.workerHome, entry) || within(p.runtimeHome, entry)) {
-            fail(`Training Grok deny path ${entry} would hide the subject's own workspace, home, or runtime home`);
-        }
-        if ([p.clockFile, DAIMON_GROK_ENGINE_BROKER.worker.taskClock.preloadPath,
-            "/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1", "/usr/lib/aarch64-linux-gnu/faketime/libfaketime.so.1"].some(file => within(file, entry))) {
-            fail(`Training Grok deny path ${entry} would hide the subject's task clock`);
-        }
-        const ancestor = candidates.find((other) => other !== entry && within(entry, other));
-        if (ancestor)
-            fail(`Training Grok deny path ${ancestor} would cover ${entry}; masks cannot nest`);
-    }
-    return candidates;
-};
-/**
- * The single brokered Grok registration a training container runs, at the
- * fixed container paths in `paths.ts`. Unlike production it points
- * `usageLedgerPath` at the per-slot ledger, because each trial's spend must be
- * separable and a recycle wipes it; the container-wide ledger and wake fuse do
- * not exist here.
- */
-export const resolveTrainingGrokRegistration = (input) => {
-    const p = trainingSlotPaths(input.slot ?? 0);
-    if (!input.agentId.trim())
-        fail("Training Grok slot requires an agent id");
-    if (!DAIMON_GROK_BROKER_MODELS.includes(input.model)
-        || !DAIMON_GROK_BROKER_REASONING_EFFORTS.includes(input.reasoningEffort)) {
-        fail(`Training Grok slot has no declared broker model and reasoning effort: ${input.agentId}`);
-    }
-    const home = assertCanonicalRegisteredPath("home", p.workerHome);
-    const grokHome = path.posix.join(home, DAIMON_GROK_WORKER_HOME_DIRECTORY);
-    const config = resolveDaimonGrokClockedWorkerConfig(input.model, input.reasoningEffort, p.slot);
-    const denyPaths = resolveTrainingGrokDenyPaths(input.denyPaths, p.slot, input.slots ?? 1);
-    const profile = renderDaimonGrokWorkerSandboxProfile(denyPaths);
-    const eventsPath = path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath);
-    const profilePath = path.posix.join(grokHome, "sandbox.toml");
-    for (const [label, value] of [["GROK_HOME", grokHome], ["profile", profilePath], ["events", eventsPath],
-        ["workspace", p.workspace], ["runtime home", p.runtimeHome],
-        ["usage ledger", p.usageLedger]])
-        assertCanonicalRegisteredPath(label, value);
-    const skills = resolveDaimonGrokWorkerSkills(input.skills);
-    return {
-        ...(skills ? { skills } : {}),
-        agentId: input.agentId,
-        config: config.bytes,
-        configVariant: "clocked",
-        ...(input.limits === undefined ? {} : { limits: { ...input.limits } }),
-        configSha256: config.sha256,
-        deferredDenyPaths: denyPaths.filter((entry) => TRAINING_DEFERRED_DENY_PATHS.includes(entry)),
-        denyPaths,
-        eventsPath,
-        grokHome,
-        home,
-        model: input.model,
-        profile,
-        profilePath,
-        profileSha256: daimonGrokWorkerSandboxProfileSha256(denyPaths),
-        privateTmp: path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome),
-        reasoningEffort: input.reasoningEffort,
-        runtimeHome: p.runtimeHome,
-        // Empty on purpose: training has no persistent mounts at all. Everything a trial writes under the slot
-        // runtime home is per-slot tmpfs the recycle wipes, and the only thing provisioned inside it is the
-        // setgid `tool-output/` spill directory, so the traversable `0710` home exposes nothing else.
-        runtimeHomeMounts: [],
-        slot: p.slot,
-        spillDirectory: path.posix.join(p.runtimeHome, DAIMON_GROK_ENGINE_BROKER.worker.home.spillDirectory.relativeToRuntimeHome),
-        uid: p.workerUid,
-        usageLedgerPath: p.usageLedger,
-        workspace: p.workspace
-    };
-};

package/dist/compiler/training/broker/reset.d.ts

@@ -1,9 +0,0 @@
-/** Root uses the broker's slot reset seam; the broker owns active-turn, worker-reap and clock checks. */
-export declare const resetTrainingBrokerSlot: (slot: number, signal: AbortSignal, socketPath?: "/run/daimon-engine-broker/control.sock") => Promise<void>;
-/** The native control relay authenticates SO_PEERCRED uid 2000 and rejects root. */
-export declare const resetTrainingBrokerSlotAsOrganization: (slot: number, signal: AbortSignal, execute?: (file: string, args: string[], options: {
-    signal: AbortSignal;
-    timeout: number;
-}) => Promise<{
-    stdout: string;
-}>) => Promise<void>;

package/dist/compiler/training/broker/reset.js

@@ -1,71 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { randomUUID } from "node:crypto";
-import { createConnection } from "node:net";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { trainingSlotPaths } from "./paths.js";
-/** Root uses the broker's slot reset seam; the broker owns active-turn, worker-reap and clock checks. */
-export const resetTrainingBrokerSlot = (slot, signal, socketPath = DAIMON_GROK_ENGINE_BROKER.controlSocketPath) => {
-    trainingSlotPaths(slot);
-    signal.throwIfAborted();
-    const requestId = randomUUID();
-    const version = DAIMON_GROK_ENGINE_BROKER.controlProtocolVersion;
-    const payload = Buffer.from(JSON.stringify({ version, kind: "reset_slot", requestId, slot }));
-    const frame = Buffer.alloc(4 + payload.length);
-    frame.writeUInt32BE(payload.length);
-    payload.copy(frame, 4);
-    return new Promise((resolve, reject) => {
-        const socket = createConnection(socketPath);
-        let buffer = Buffer.alloc(0), settled = false;
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            signal.removeEventListener("abort", abort);
-            socket.destroy();
-            if (error)
-                reject(error);
-            else
-                resolve();
-        };
-        const abort = () => finish(new Error("Training broker reset aborted; slot must be quarantined"));
-        signal.addEventListener("abort", abort, { once: true });
-        socket.once("error", error => finish(error));
-        socket.once("close", () => finish(new Error("Training broker reset refused: slot active, unavailable, or reset failed")));
-        socket.once("connect", () => socket.write(frame));
-        socket.on("data", chunk => {
-            buffer = Buffer.concat([buffer, chunk]);
-            if (buffer.length < 4)
-                return;
-            const size = buffer.readUInt32BE(0);
-            if (size < 2 || size > 4096 || buffer.length > size + 4) {
-                finish(new Error("Invalid broker reset response frame"));
-                return;
-            }
-            if (buffer.length < size + 4)
-                return;
-            try {
-                const response = JSON.parse(buffer.subarray(4).toString("utf8"));
-                if (!response || response.version !== version || response.kind !== "slot_reset" || response.requestId !== requestId
-                    || response.slot !== slot || Object.keys(response).length !== 4)
-                    throw Error("Invalid broker reset acknowledgement");
-                finish();
-            }
-            catch (error) {
-                finish(error instanceof Error ? error : new Error("Invalid broker reset response"));
-            }
-        });
-    });
-};
-/** The native control relay authenticates SO_PEERCRED uid 2000 and rejects root. */
-export const resetTrainingBrokerSlotAsOrganization = async (slot, signal, execute = promisify(execFile)) => {
-    trainingSlotPaths(slot);
-    signal.throwIfAborted();
-    const uid = DAIMON_GROK_ENGINE_BROKER.identities.organizationUid;
-    const program = `import { resetTrainingBrokerSlot } from ${JSON.stringify(import.meta.url)}; await resetTrainingBrokerSlot(Number(process.argv[1]), AbortSignal.timeout(10000)); process.stdout.write("slot-reset-complete\\n");`;
-    const result = await execute("setpriv", ["--clear-groups", `--reuid=${uid}`, `--regid=${uid}`,
-        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", process.execPath,
-        "--input-type=module", "--eval", program, String(slot)], { signal, timeout: 15_000 });
-    if (result.stdout !== "slot-reset-complete\n")
-        throw Error("Broker reset child returned no verified acknowledgement");
-};

package/dist/compiler/training/broker/rootScript.d.ts

@@ -1,32 +0,0 @@
-/**
- * Linux `MAX_ARG_STRLEN`: the most bytes one `execve` argument may carry. A
- * generated root program passed as `bash -c <script>` dies with `E2BIG` past
- * it — and a slot program embeds its declared skills, so the size grows with
- * the declaration. macOS has no per-argument limit, which is why this is
- * asserted in tests rather than observed.
- */
-export declare const LINUX_MAX_ARG_STRLEN = 131072;
-export type TrainingRootScriptRunner = (file: string, args: readonly string[], options: {
-    maxBuffer: number;
-}) => Promise<{
-    stdout: string;
-    stderr: string;
-}>;
-export interface TrainingRootScriptOptions {
-    shell?: string;
-    maxBuffer?: number;
-    run?: TrainingRootScriptRunner;
-    tmpRoot?: string;
-}
-/** The argv a generated script runs under: bounded and independent of the script's size. */
-export declare const trainingRootScriptArgv: (scriptFile: string) => string[];
-/**
- * Runs a generated root shell program from a fresh `0700` directory holding a
- * `0600` script file, never from argv and never from stdin (a child that reads
- * stdin would consume the rest of the program). The directory is removed
- * afterwards, whatever the outcome.
- */
-export declare const runTrainingRootScript: (script: string, options?: TrainingRootScriptOptions) => Promise<{
-    stdout: string;
-    stderr: string;
-}>;

package/dist/compiler/training/broker/rootScript.js

@@ -1,33 +0,0 @@
-import { execFile } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { promisify } from "node:util";
-/**
- * Linux `MAX_ARG_STRLEN`: the most bytes one `execve` argument may carry. A
- * generated root program passed as `bash -c <script>` dies with `E2BIG` past
- * it — and a slot program embeds its declared skills, so the size grows with
- * the declaration. macOS has no per-argument limit, which is why this is
- * asserted in tests rather than observed.
- */
-export const LINUX_MAX_ARG_STRLEN = 131_072;
-const execFileAsync = promisify(execFile);
-/** The argv a generated script runs under: bounded and independent of the script's size. */
-export const trainingRootScriptArgv = (scriptFile) => ["--noprofile", "--norc", "-eu", scriptFile];
-/**
- * Runs a generated root shell program from a fresh `0700` directory holding a
- * `0600` script file, never from argv and never from stdin (a child that reads
- * stdin would consume the rest of the program). The directory is removed
- * afterwards, whatever the outcome.
- */
-export const runTrainingRootScript = async (script, options = {}) => {
-    const directory = await mkdtemp(path.join(options.tmpRoot ?? os.tmpdir(), "spawnfile-root-script-"));
-    try {
-        const file = path.join(directory, "script.sh");
-        await writeFile(file, script, { mode: 0o600, flag: "wx" });
-        return await (options.run ?? execFileAsync)(options.shell ?? "/bin/bash", trainingRootScriptArgv(file), { maxBuffer: options.maxBuffer ?? 1024 * 1024 });
-    }
-    finally {
-        await rm(directory, { recursive: true, force: true });
-    }
-};

package/dist/compiler/training/broker/runtime.d.ts

@@ -1,22 +0,0 @@
-import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
-import type { TrainingBrokerDeclaration } from "./declaration.js";
-import type { TrainingSlotRuntime } from "./supervisor.js";
-export interface TrainingSlotRuntimeOptions {
-    declaration: TrainingBrokerDeclaration;
-    registration: DaimonGrokRegistration;
-    projectionSha256: string;
-    reset: (slot: number, signal: AbortSignal) => Promise<void>;
-    /** Test seam: the shell the provisioning script runs in and the `/proc` it reads identities from. */
-    shell?: string;
-    procRoot?: string;
-    logPath?: string;
-}
-export declare const createTrainingSlotRuntime: (options: TrainingSlotRuntimeOptions) => TrainingSlotRuntime;
-/** Never remove or change the ownership/mode of a worker home or tmp: siblings attest those inodes. */
-export declare const renderTrainingSlotWipe: (slot: number) => string[];
-/** A failed privilege drop is not evidence of denial; require a positive worker verdict. */
-export declare const probeTrainingWorker: (uid: number, target: string, depth: "read" | "enter", execute?: (command: string, args: string[], options: {
-    timeout: number;
-}) => Promise<{
-    stdout: string;
-}>) => Promise<boolean>;