spawnfile 0.1.33 → 0.1.34

package/dist/compiler/training/broker/runtime.js

@@ -1,128 +0,0 @@
-import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { appendFileSync } from "node:fs";
-import { chmod, chown, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { promisify } from "node:util";
-import { SpawnfileError } from "../../../shared/index.js";
-import { MOUNT_AWARE_CLEAR_HELPER } from "../../containerDaimonBrokerRender.js";
-import { probeTrainingSiblingClock } from "./clockProbe.js";
-import { renderTrainingTaskClockAssertions } from "./taskClock.js";
-import { renderTrainingSlotProvisioning } from "./provisioning.js";
-import { runTrainingRootScript } from "./rootScript.js";
-import { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveTrainingCanaries } from "./receipt.js";
-import { DAIMON_ORGANIZATION_UID, TRAINING_HOST_BIND_DENY_PATHS, TRAINING_SEALED_DENY_PATHS, trainingSlotPaths, trainingWipeTargets, trainingClearTargets, TRAINING_SUPERVISOR_LOG } from "./paths.js";
-const run = promisify(execFile);
-const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
-export const createTrainingSlotRuntime = (options) => {
-    const shell = options.shell ?? "/bin/bash";
-    const logPath = options.logPath ?? TRAINING_SUPERVISOR_LOG;
-    const p = trainingSlotPaths(options.registration.slot);
-    const script = renderTrainingSlotProvisioning(options.registration).join("\n");
-    const log = (line) => {
-        const entry = `${new Date().toISOString()} ${line}\n`;
-        process.stderr.write(`[slot-supervisor] ${entry}`);
-        try {
-            appendFileSync(logPath, entry, { mode: 0o640 });
-        }
-        catch { /* the log is diagnostics, never the gate */ }
-    };
-    const siblingClocks = Array.from({ length: options.declaration.slots }, (_, slot) => trainingSlotPaths(slot))
-        .filter(peer => peer.slot !== p.slot).map(peer => peer.clockDirectory);
-    const probe = (target, depth) => siblingClocks.includes(target)
-        ? probeTrainingSiblingClock(p.slot, target)
-        : probeTrainingWorker(options.registration.uid, target, depth);
-    return {
-        log,
-        reset: signal => options.reset(p.slot, signal),
-        wipe: async () => {
-            // Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_DAC_OVERRIDE`, so it cannot delete
-            // inside a directory it handed to the worker or the broker. Reclaim each tree first, then remove it.
-            const script = renderTrainingSlotWipe(p.slot).join("\n");
-            await runTrainingRootScript(script, { shell, maxBuffer: 1024 * 1024 }).catch((error) => {
-                const detail = error;
-                throw new SpawnfileError("runtime_error", `Training slot wipe failed: ${(detail.stderr ?? "").slice(-1024).trim() || "no diagnostic"}`);
-            });
-        },
-        provision: async () => {
-            const result = await runTrainingRootScript(script, { shell, maxBuffer: 8 * 1024 * 1024 }).catch((error) => {
-                const detail = error;
-                throw new SpawnfileError("runtime_error", `Training slot provisioning failed: ${(detail.stderr ?? detail.stdout ?? "").slice(-2048).trim()}`);
-            });
-            if (result.stdout.trim())
-                log(`provisioning: ${result.stdout.trim().slice(-2048)}`);
-        },
-        canaries: async () => {
-            await runTrainingRootScript(renderTrainingTaskClockAssertions(options.registration).join("\n"), { shell });
-            return resolveTrainingCanaries({
-                denyPaths: options.registration.denyPaths, probe, log, hostBindPaths: TRAINING_HOST_BIND_DENY_PATHS,
-                sealedPaths: TRAINING_SEALED_DENY_PATHS,
-                mountinfo: await readFile(`${options.procRoot ?? "/proc"}/self/mountinfo`, "utf8"),
-                unenforcedBindPolicy: options.declaration.unenforcedBindPolicy
-            });
-        },
-        nextGeneration: async () => {
-            const previous = await readFile(p.generationFile, "utf8").catch(() => "");
-            const parsed = Number.parseInt(JSON.parse(previous || "{}").generation ?? "0", 10);
-            // Seeded from the wall clock so a container restart cannot hand out a generation an evaluator already accepted.
-            const generation = Math.max(Number.isSafeInteger(parsed) && parsed > 0 ? parsed + 1 : 1, Math.floor(Date.now() / 1000));
-            await writeFile(p.generationFile, `${JSON.stringify({ generation })}\n`, { mode: 0o600 });
-            return generation;
-        },
-        publishReceipt: async ({ generation, nonce, canaries }) => {
-            const receipt = buildTrainingSlotReceipt({
-                slot: options.registration.slot, workerUid: options.registration.uid, generation, nonce,
-                projectionSha256: options.projectionSha256, sandboxProfileSha256: options.registration.profileSha256,
-                seccompProfileSha256: options.declaration.seccompProfileSha256,
-                grokExecutableSha256: readGrokExecutableSha256(), canaries, createdAt: new Date()
-            });
-            const temporary = `${p.preflightReceipt}.${randomUUID()}.tmp`;
-            await mkdir(path.dirname(p.preflightReceipt), { recursive: true });
-            await writeFile(temporary, `${JSON.stringify(receipt)}\n`, { mode: 0o600, flag: "wx" });
-            await chown(temporary, 0, DAIMON_ORGANIZATION_UID);
-            await chmod(temporary, 0o640);
-            await rename(temporary, p.preflightReceipt);
-            return p.preflightReceipt;
-        }
-    };
-};
-/** Never remove or change the ownership/mode of a worker home or tmp: siblings attest those inodes. */
-export const renderTrainingSlotWipe = (slot) => {
-    const p = trainingSlotPaths(slot);
-    const worker = `setpriv --clear-groups --reuid=${p.workerUid} --regid=${p.workerUid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all --`;
-    return [
-        ...MOUNT_AWARE_CLEAR_HELPER,
-        // Attested roots must still be canonical before any recursive mutation.
-        ...[p.workerHome, p.privateTmp, ...trainingWipeTargets(slot), ...trainingClearTargets(slot)].map(target => `if [ -e ${quote(target)} ] || [ -L ${quote(target)} ]; then if [ -L ${quote(target)} ] || [ "$(realpath ${quote(target)})" != ${quote(target)} ]; then echo "noncanonical slot wipe target" >&2; exit 1; fi; fi`),
-        'reclaim() { parent=$(dirname "$1"); chown 0:0 "$parent"; chmod u+rwx "$parent"; if [ -e "$1" ]; then chown -R 0:0 "$1"; chmod -R u+rwX "$1"; fi; }',
-        ...trainingWipeTargets(slot).map(target => `reclaim ${quote(target)}; spawnfile_remove_tree ${quote(target)}`),
-        ...trainingClearTargets(slot).map(target => `reclaim ${quote(target)}; spawnfile_clear_tree ${quote(target)}`),
-        // Reclaim descendants only, then unlink as the worker, who owns the stable parent. No sibling inode changes.
-        `for worker_entry in ${quote(p.workerHome)}/* ${quote(p.workerHome)}/.[!.]* ${quote(p.workerHome)}/..?*; do`,
-        '  if [ ! -e "$worker_entry" ] && [ ! -L "$worker_entry" ]; then continue; fi',
-        `  if [ "$worker_entry" = ${quote(p.privateTmp)} ]; then continue; fi`,
-        '  if spawnfile_holds_mount "$worker_entry"; then echo "worker home contains a mount" >&2; exit 1; fi',
-        `  chown -hR ${p.workerUid}:${p.workerUid} "$worker_entry"`,
-        `  ${worker} /bin/sh -ceu 'if [ ! -L "$1" ]; then chmod -R u+rwX "$1"; fi; rm -rf "$1"' sh "$worker_entry"`,
-        'done',
-        `for worker_entry in ${quote(p.privateTmp)}/* ${quote(p.privateTmp)}/.[!.]* ${quote(p.privateTmp)}/..?*; do`,
-        '  if [ ! -e "$worker_entry" ] && [ ! -L "$worker_entry" ]; then continue; fi',
-        '  if spawnfile_holds_mount "$worker_entry"; then echo "worker tmp contains a mount" >&2; exit 1; fi',
-        `  chown -hR ${p.workerUid}:${p.workerUid} "$worker_entry"`,
-        `  ${worker} /bin/sh -ceu 'if [ ! -L "$1" ]; then chmod -R u+rwX "$1"; fi; rm -rf "$1"' sh "$worker_entry"`,
-        'done'
-    ];
-};
-/** A failed privilege drop is not evidence of denial; require a positive worker verdict. */
-export const probeTrainingWorker = async (uid, target, depth, execute = run) => {
-    const q = quote(target);
-    const reachable = depth === "enter" ? `test -r ${q} || test -x ${q} || ls -1 ${q} >/dev/null 2>&1` : `test -r ${q}`;
-    const result = await execute("setpriv", ["--clear-groups", `--reuid=${uid}`, `--regid=${uid}`,
-        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", "/bin/sh", "-c",
-        `if ${reachable}; then echo reachable; else echo denied; fi`], { timeout: 10_000 });
-    if (result.stdout.trim() === "denied")
-        return true;
-    if (result.stdout.trim() === "reachable")
-        return false;
-    throw new SpawnfileError("runtime_error", "Training worker canary returned no verified verdict");
-};

package/dist/compiler/training/broker/seccompRoutes.d.ts

@@ -1,31 +0,0 @@
-/**
- * The syscalls a worker-uid namespace escape needs before it can even be
- * attempted: a new user namespace, a new mount namespace, and the mount and
- * unmount calls inside them.
- *
- * `clone`/`clone3` are deliberately absent. The pinned profile allows them only
- * under an argument filter, so a static "is it allowed" question has no honest
- * yes/no answer for them, and `unshare` already gates the route.
- */
-export declare const TRAINING_NAMESPACE_ROUTE_SYSCALLS: readonly ["unshare", "mount", "umount2", "setns"];
-/**
- * Whether the pinned seccomp profile lets the worker uid attempt a namespace
- * escape at all — an **unconditional** `SCMP_ACT_ALLOW`, with no
- * `includes.caps` (the container drops `CAP_SYS_ADMIN`) and no argument filter.
- *
- * This exists to keep one specific lie out of the slot receipt. When a probe
- * route cannot run, the honest record is *which layer refused it*: a syscall
- * the profile filters is a stronger denial than DAC and must be named as
- * `seccomp`, while the same syscall refused by a profile that allows it came
- * from the kernel or an LSM and must be named `kernel`. Merging the two into
- * "denied" would let a filtered-syscall run read as though DAC had held.
- */
-export declare const pinnedProfileAllowsNamespaceRoutes: (bytes?: string) => boolean;
-/**
- * What to blame when the worker uid cannot open the namespace a route needs.
- *
- * Derived, never guessed: seccomp and a DAC/LSM refusal both surface as
- * `EPERM`, so errno cannot tell them apart. The pinned profile can — Spawnfile
- * ships its bytes and the declaration binds their digest.
- */
-export declare const trainingNamespaceDenialMechanism: (bytes?: string) => "seccomp" | "kernel";

package/dist/compiler/training/broker/seccompRoutes.js

@@ -1,36 +0,0 @@
-import { DAIMON_GROK_SECCOMP_PROFILE_BYTES } from "../../../shared/daimonGrokSeccompProfile.js";
-/**
- * The syscalls a worker-uid namespace escape needs before it can even be
- * attempted: a new user namespace, a new mount namespace, and the mount and
- * unmount calls inside them.
- *
- * `clone`/`clone3` are deliberately absent. The pinned profile allows them only
- * under an argument filter, so a static "is it allowed" question has no honest
- * yes/no answer for them, and `unshare` already gates the route.
- */
-export const TRAINING_NAMESPACE_ROUTE_SYSCALLS = ["unshare", "mount", "umount2", "setns"];
-/**
- * Whether the pinned seccomp profile lets the worker uid attempt a namespace
- * escape at all — an **unconditional** `SCMP_ACT_ALLOW`, with no
- * `includes.caps` (the container drops `CAP_SYS_ADMIN`) and no argument filter.
- *
- * This exists to keep one specific lie out of the slot receipt. When a probe
- * route cannot run, the honest record is *which layer refused it*: a syscall
- * the profile filters is a stronger denial than DAC and must be named as
- * `seccomp`, while the same syscall refused by a profile that allows it came
- * from the kernel or an LSM and must be named `kernel`. Merging the two into
- * "denied" would let a filtered-syscall run read as though DAC had held.
- */
-export const pinnedProfileAllowsNamespaceRoutes = (bytes = DAIMON_GROK_SECCOMP_PROFILE_BYTES) => {
-    const profile = JSON.parse(bytes);
-    return TRAINING_NAMESPACE_ROUTE_SYSCALLS.every((syscall) => (profile.syscalls ?? []).some((rule) => (rule.names ?? []).includes(syscall) && rule.action === "SCMP_ACT_ALLOW"
-        && (rule.includes?.caps ?? []).length === 0 && (rule.args ?? []).length === 0));
-};
-/**
- * What to blame when the worker uid cannot open the namespace a route needs.
- *
- * Derived, never guessed: seccomp and a DAC/LSM refusal both surface as
- * `EPERM`, so errno cannot tell them apart. The pinned profile can — Spawnfile
- * ships its bytes and the declaration binds their digest.
- */
-export const trainingNamespaceDenialMechanism = (bytes) => pinnedProfileAllowsNamespaceRoutes(bytes) ? "kernel" : "seccomp";

package/dist/compiler/training/broker/supervisor.d.ts

@@ -1,108 +0,0 @@
-export declare const TRAINING_SUPERVISOR_PROTOCOL: "spawnfile.training-slot-supervisor.v2";
-export declare const TRAINING_SUPERVISOR_MAX_REQUEST_BYTES = 4096;
-/**
- * Everything the recycle verb does to the running slot. It is an interface so
- * the state machine below can be tested without Docker, a broker, or root:
- * the order of these calls *is* the contract, and getting it wrong (wiping
- * before draining, writing a receipt before the canaries) is exactly the class
- * of bug a live check finds far too late.
- */
-export interface TrainingSlotRuntime {
-    /** Broker refuses active turns and live workers, then resets only this slot clock/turn store. */
-    reset(signal: AbortSignal): Promise<void>;
-    /** Clears this slot while preserving the worker-home/tmp identities attested by sibling turns. */
-    wipe(): Promise<void>;
-    /** Reuses the audited worker provisioning; shared broker files are untouched. */
-    provision(): Promise<void>;
-    /** Worker-uid denial canaries over every deny path; throws when one is still reachable. */
-    canaries(): Promise<{
-        path: string;
-        method: "sandboxed-read";
-        result: "denied";
-    }[]>;
-    /** Writes the slot preflight receipt v2 atomically, readable by the organization uid. */
-    publishReceipt(input: {
-        generation: number;
-        nonce: string;
-        canaries: readonly {
-            path: string;
-            method: "sandboxed-read";
-            result: "denied";
-        }[];
-    }): Promise<string>;
-    /** Monotonic per-slot generation; strictly greater than every generation this slot has ever published. */
-    nextGeneration(): Promise<number>;
-    log(line: string): void;
-}
-/**
- * Bringing a slot up, receipt included — the only way this container starts one.
- *
- * `provision → start` alone was the whole start-up path, and `canaries` and
- * `publishReceipt` were reachable only from `recycle`. The first trial of every
- * run therefore executed with no worker-uid denial evidence at all, and a
- * refusal that should have cost nothing surfaced only after that trial's spend.
- * Trial 1 is exactly the trial whose sealed datasets have never been probed, so
- * it is the one that most needs the evidence.
- *
- * The receipt this publishes carries generation 1..N and a nonce of the
- * container's own, so an evaluator that reads `preflight.json` before its first
- * wake sees the same `noopolis.daimon.grok-slot-preflight.v2` shape a recycle
- * publishes, from the same canaries.
- */
-export declare const startTrainingSlot: (runtime: TrainingSlotRuntime, nonce: string) => Promise<{
-    generation: number;
-    receipt: string;
-    canaries: number;
-}>;
-export interface TrainingSlotSupervisorOptions {
-    runtimes: readonly TrainingSlotRuntime[];
-    /** Only this uid may recycle. Training, DSPy and the judges all run as it; every worker uid is refused. */
-    organizationUid?: number;
-    drainTimeoutMs?: number;
-    now?: () => number;
-}
-export interface TrainingRecycleResult {
-    ok: true;
-    verb: "recycle";
-    slot: number;
-    generation: number;
-    nonce: string;
-    receipt: string;
-    durationMs: number;
-}
-/**
- * The single-verb root slot supervisor.
- *
- * One verb, slot and nonce, no path or command ever supplied by the caller: the
- * whole point of D4 is that recycling replays the container's own audited
- * provisioning rather than exposing a root file-system API to the evaluator.
- * Recycles of the same slot are serialized — a second caller waits rather than interleaving a
- * wipe with a provision.
- */
-export declare const createTrainingSlotSupervisor: (options: TrainingSlotSupervisorOptions) => {
-    /** Serialized: a recycle already in flight completes before the next one starts. */
-    recycle: (slot: number, nonce: string, peerUid: number) => Promise<TrainingRecycleResult>;
-};
-export type TrainingSlotSupervisor = ReturnType<typeof createTrainingSlotSupervisor>;
-/**
- * Re-establishes, and re-checks on every connection, the only uid gate this
- * socket has.
- *
- * The scope asked for `SO_PEERCRED`. Node exposes no ancillary-data or
- * peer-credential API on a unix socket and no native addon ships in this
- * image, so the gate is the socket node itself, which the kernel enforces on
- * `connect()` exactly as it does on `open()`: the node is
- * `root:<organization gid> 0660` inside a root-owned `0711` directory on
- * tmpfs, where modes *are* enforced. Only uid 2000 (and root) can connect;
- * uid 2200 gets `EACCES` before a byte is written. A `0600` root-owned socket
- * — the literal reading of the scope — would deny the one caller it exists
- * for, so this is the same restriction stated in the only mechanism available.
- * The directory holds no write permission for anyone but root, so the node
- * cannot be replaced by a laxer one.
- */
-export declare const assertTrainingSupervisorSocketIdentity: (socketPath: string, organizationGid: number) => void;
-/**
- * Line-delimited JSON over a unix socket. Every request is bounded,
- * single-line, and must name the protocol, the one verb and nothing else.
- */
-export declare const serveTrainingSlotSupervisor: (supervisor: TrainingSlotSupervisor, socketPath: string, log: (line: string) => void, organizationUid?: number) => import("net").Server;

package/dist/compiler/training/broker/supervisor.js

@@ -1,172 +0,0 @@
-import { chmodSync, chownSync, lstatSync, rmSync } from "node:fs";
-import { createServer } from "node:net";
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_ORGANIZATION_UID } from "./paths.js";
-export const TRAINING_SUPERVISOR_PROTOCOL = "spawnfile.training-slot-supervisor.v2";
-export const TRAINING_SUPERVISOR_MAX_REQUEST_BYTES = 4_096;
-const NONCE = /^[a-f0-9]{64}$/u;
-/**
- * Bringing a slot up, receipt included — the only way this container starts one.
- *
- * `provision → start` alone was the whole start-up path, and `canaries` and
- * `publishReceipt` were reachable only from `recycle`. The first trial of every
- * run therefore executed with no worker-uid denial evidence at all, and a
- * refusal that should have cost nothing surfaced only after that trial's spend.
- * Trial 1 is exactly the trial whose sealed datasets have never been probed, so
- * it is the one that most needs the evidence.
- *
- * The receipt this publishes carries generation 1..N and a nonce of the
- * container's own, so an evaluator that reads `preflight.json` before its first
- * wake sees the same `noopolis.daimon.grok-slot-preflight.v2` shape a recycle
- * publishes, from the same canaries.
- */
-export const startTrainingSlot = async (runtime, nonce) => {
-    const canaries = await runtime.canaries();
-    const generation = await runtime.nextGeneration();
-    const receipt = await runtime.publishReceipt({ generation, nonce, canaries });
-    runtime.log(`slot start generation=${generation} canaries=${canaries.length} receipt=${receipt}`);
-    return { generation, receipt, canaries: canaries.length };
-};
-/**
- * The single-verb root slot supervisor.
- *
- * One verb, slot and nonce, no path or command ever supplied by the caller: the
- * whole point of D4 is that recycling replays the container's own audited
- * provisioning rather than exposing a root file-system API to the evaluator.
- * Recycles of the same slot are serialized — a second caller waits rather than interleaving a
- * wipe with a provision.
- */
-export const createTrainingSlotSupervisor = (options) => {
-    const organizationUid = options.organizationUid ?? DAIMON_ORGANIZATION_UID;
-    const drainTimeoutMs = options.drainTimeoutMs ?? 120_000;
-    const now = options.now ?? Date.now;
-    const queues = new Map();
-    const recycle = async (slot, nonce, peerUid) => {
-        if (peerUid !== organizationUid)
-            throw new SpawnfileError("validation_error", `Grok slot recycle refused for uid ${peerUid}`);
-        if (!NONCE.test(nonce))
-            throw new SpawnfileError("validation_error", "Grok slot recycle requires a 32-byte hex nonce");
-        if (!Number.isInteger(slot) || slot < 0 || slot >= options.runtimes.length)
-            throw new SpawnfileError("validation_error", "Grok slot recycle requires a declared slot index");
-        const runtime = options.runtimes[slot];
-        const started = now();
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), drainTimeoutMs);
-        try {
-            await runtime.reset(controller.signal);
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        await runtime.wipe();
-        await runtime.provision();
-        const canaries = await runtime.canaries();
-        const generation = await runtime.nextGeneration();
-        const receipt = await runtime.publishReceipt({ generation, nonce, canaries });
-        const durationMs = now() - started;
-        runtime.log(`recycle generation=${generation} canaries=${canaries.length} durationMs=${durationMs}`);
-        return { ok: true, verb: "recycle", slot, generation, nonce, receipt, durationMs };
-    };
-    return {
-        /** Serialized: a recycle already in flight completes before the next one starts. */
-        recycle: (slot, nonce, peerUid) => {
-            const next = (queues.get(slot) ?? Promise.resolve()).then(() => recycle(slot, nonce, peerUid));
-            queues.set(slot, next.catch(() => undefined));
-            return next;
-        }
-    };
-};
-const failure = (message) => `${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, ok: false, error: message })}\n`;
-/**
- * Re-establishes, and re-checks on every connection, the only uid gate this
- * socket has.
- *
- * The scope asked for `SO_PEERCRED`. Node exposes no ancillary-data or
- * peer-credential API on a unix socket and no native addon ships in this
- * image, so the gate is the socket node itself, which the kernel enforces on
- * `connect()` exactly as it does on `open()`: the node is
- * `root:<organization gid> 0660` inside a root-owned `0711` directory on
- * tmpfs, where modes *are* enforced. Only uid 2000 (and root) can connect;
- * uid 2200 gets `EACCES` before a byte is written. A `0600` root-owned socket
- * — the literal reading of the scope — would deny the one caller it exists
- * for, so this is the same restriction stated in the only mechanism available.
- * The directory holds no write permission for anyone but root, so the node
- * cannot be replaced by a laxer one.
- */
-export const assertTrainingSupervisorSocketIdentity = (socketPath, organizationGid) => {
-    const directory = lstatSync(path.posix.dirname(socketPath));
-    if (!directory.isDirectory() || directory.uid !== 0 || directory.gid !== 0 || (directory.mode & 0o777) !== 0o711) {
-        throw new SpawnfileError("runtime_error", "The slot supervisor socket directory must be root-owned 0711");
-    }
-    const node = lstatSync(socketPath);
-    if (!node.isSocket() || node.uid !== 0 || node.gid !== organizationGid || (node.mode & 0o777) !== 0o660) {
-        throw new SpawnfileError("runtime_error", "The slot supervisor socket must be root-owned, organization-group 0660");
-    }
-};
-/**
- * Line-delimited JSON over a unix socket. Every request is bounded,
- * single-line, and must name the protocol, the one verb and nothing else.
- */
-export const serveTrainingSlotSupervisor = (supervisor, socketPath, log, organizationUid = DAIMON_ORGANIZATION_UID) => {
-    const server = createServer((socket) => {
-        let peerUid;
-        try {
-            assertTrainingSupervisorSocketIdentity(socketPath, organizationUid);
-            peerUid = organizationUid;
-        }
-        catch (error) {
-            log(`refusing a connection on an unverified supervisor socket: ${error instanceof Error ? error.message : "unknown"}`);
-        }
-        let buffer = "", settled = false;
-        socket.setTimeout(600_000, () => socket.destroy());
-        const answer = (line) => { settled = true; socket.end(line); };
-        socket.on("data", (chunk) => {
-            if (settled)
-                return;
-            buffer += chunk.toString("utf8");
-            if (Buffer.byteLength(buffer) > TRAINING_SUPERVISOR_MAX_REQUEST_BYTES) {
-                answer(failure("request too large"));
-                return;
-            }
-            const newline = buffer.indexOf("\n");
-            if (newline < 0)
-                return;
-            const line = buffer.slice(0, newline);
-            let request;
-            try {
-                request = JSON.parse(line);
-            }
-            catch {
-                answer(failure("request is not JSON"));
-                return;
-            }
-            if (!request || typeof request !== "object" || Array.isArray(request) || request.v !== TRAINING_SUPERVISOR_PROTOCOL || request.verb !== "recycle" || typeof request.nonce !== "string"
-                || typeof request.slot !== "number" || Object.keys(request).length !== 4) {
-                answer(failure("unsupported request"));
-                return;
-            }
-            if (peerUid === undefined) {
-                answer(failure("peer identity is unavailable"));
-                return;
-            }
-            supervisor.recycle(request.slot, request.nonce, peerUid)
-                .then((result) => answer(`${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, ...result })}\n`))
-                .catch((error) => {
-                const message = error instanceof Error ? error.message : "recycle failed";
-                log(`recycle failed: ${message}`);
-                answer(failure(message));
-            });
-        });
-        socket.on("error", () => socket.destroy());
-    });
-    rmSync(socketPath, { force: true });
-    server.listen(socketPath, () => {
-        chownSync(socketPath, 0, 0);
-        chmodSync(socketPath, 0o660);
-        chownSync(socketPath, 0, organizationUid);
-        assertTrainingSupervisorSocketIdentity(socketPath, organizationUid);
-        log(`slot supervisor listening on ${socketPath}`);
-    });
-    return server;
-};

package/dist/compiler/training/broker/taskClock.d.ts

@@ -1,5 +0,0 @@
-import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
-/** Reclaim only the clock subtree before the shared program clears the control root at startup. */
-export declare const renderTrainingTaskClockReset: () => string[];
-/** Before a receipt, bind the actual installed bytes and worker access to the clocked projection. */
-export declare const renderTrainingTaskClockAssertions: (registration: DaimonGrokRegistration) => string[];

package/dist/compiler/training/broker/taskClock.js

@@ -1,41 +0,0 @@
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { SpawnfileError } from "../../../shared/index.js";
-import { resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
-const clock = DAIMON_GROK_ENGINE_BROKER.worker.taskClock;
-const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
-/** Reclaim only the clock subtree before the shared program clears the control root at startup. */
-export const renderTrainingTaskClockReset = () => [
-    `test ! -L ${quote(clock.rootDirectoryPath)}`,
-    `if [ -d ${quote(clock.rootDirectoryPath)} ]; then chown -R 0:0 ${quote(clock.rootDirectoryPath)}; chmod -R u+rwX ${quote(clock.rootDirectoryPath)}; fi`
-];
-/** Before a receipt, bind the actual installed bytes and worker access to the clocked projection. */
-export const renderTrainingTaskClockAssertions = (registration) => {
-    const pin = resolveDaimonGrokClockedWorkerConfig(registration.model, registration.reasoningEffort, registration.slot).sha256;
-    const directoryPath = clock.slotDirectoryPattern.replace("{slot}", String(registration.slot));
-    const timestampFilePath = clock.slotFilePattern.replace("{slot}", String(registration.slot));
-    if (registration.configVariant !== "clocked" || registration.configSha256 !== pin) {
-        throw new SpawnfileError("runtime_error", "Training slot requires the pinned clocked worker config");
-    }
-    const worker = [
-        `test -r ${quote(timestampFilePath)}`, `test ! -w ${quote(timestampFilePath)}`,
-        `test -x ${quote(directoryPath)}`, `test ! -w ${quote(directoryPath)}`,
-        `test -r ${quote(clock.preloadPath)}`
-    ].join(" && ");
-    return [
-        `test ! -L ${quote(directoryPath)} && test -d ${quote(directoryPath)}`,
-        `test ! -L ${quote(timestampFilePath)} && test -f ${quote(timestampFilePath)}`,
-        `test "$(stat -c '%u:%g %a' ${quote(directoryPath)})" = "${clock.ownerUid}:${clock.ownerUid} ${clock.directoryMode.toString(8)}"`,
-        `test "$(stat -c '%u:%g %a %h' ${quote(timestampFilePath)})" = "${clock.ownerUid}:${clock.ownerUid} ${clock.fileMode.toString(8)} 1"`,
-        `test "$(sha256sum ${quote(`${registration.grokHome}/config.toml`)} | cut -d ' ' -f1)" = ${quote(pin)}`,
-        // The read-only image bakes both the fixed symlink and the distro target. Refuse writable or
-        // non-root-owned ancestors/targets; a missing library must never masquerade as a working clock.
-        "node <<'SPAWNFILE_TASK_CLOCK_LIBRARY'",
-        "const fs = require('node:fs'), path = require('node:path');",
-        `const preload = ${JSON.stringify(clock.preloadPath)};`,
-        "const link = fs.lstatSync(preload); if (!link.isSymbolicLink() || link.uid !== 0 || link.gid !== 0) throw new Error('unsafe task clock preload link');",
-        "const library = fs.realpathSync(preload); if (!/^\\/usr\\/lib\\/(x86_64|aarch64)-linux-gnu\\/faketime\\/libfaketime\\.so\\.1$/.test(library) || !fs.statSync(library).isFile()) throw new Error('unexpected task clock library');",
-        "for (const root of [path.dirname(preload), library]) { for (let at = root;; at = path.dirname(at)) { const info = fs.lstatSync(at); if (info.isSymbolicLink() || info.uid !== 0 || info.gid !== 0 || (info.mode & 0o022)) throw new Error(`unsafe task clock library path: ${at}`); if (at === '/') break; } }",
-        "SPAWNFILE_TASK_CLOCK_LIBRARY",
-        `setpriv --clear-groups --reuid ${registration.uid} --regid ${registration.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- /bin/sh -ceu ${quote(worker)}`
-    ];
-};

package/dist/compiler/training/container/contract.d.ts

@@ -1,54 +0,0 @@
-import { z } from "zod";
-/** Fixed libfaketime symlink installed and mode-verified by the training image. */
-export declare const TRAINING_FAKETIME_LIBRARY_PATH: "/usr/local/lib/daimon/libfaketime.so.1";
-export declare const trainingImageSchema: z.ZodString;
-export declare const trainingContainerConfigSchema: z.ZodObject<{
-    version: z.ZodEnum<{
-        "spawnfile.training-container.v1": "spawnfile.training-container.v1";
-        "spawnfile.training-container.v3": "spawnfile.training-container.v3";
-        "spawnfile.training-container.v4": "spawnfile.training-container.v4";
-    }>;
-    slots: z.ZodDefault<z.ZodNumber>;
-    dockerContext: z.ZodString;
-    inputs: z.ZodArray<z.ZodObject<{
-        source: z.ZodString;
-        destination: z.ZodString;
-    }, z.core.$strict>>;
-    output: z.ZodObject<{
-        source: z.ZodString;
-        destination: z.ZodLiteral<"/run/training/output">;
-    }, z.core.$strict>;
-    auth: z.ZodArray<z.ZodObject<{
-        source: z.ZodString;
-        provider: z.ZodEnum<{
-            codex: "codex";
-            claude: "claude";
-        }>;
-    }, z.core.$strict>>;
-    evaluatorRoutes: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        purpose: z.ZodEnum<{
-            decisions: "decisions";
-            extraction: "extraction";
-            proposals: "proposals";
-        }>;
-        provider: z.ZodEnum<{
-            "codex-subscription": "codex-subscription";
-            typesafe: "typesafe";
-        }>;
-        model: z.ZodString;
-        maxRequests: z.ZodNumber;
-        maxSpendUsd: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strict>>>;
-    evaluatorSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        provider: z.ZodLiteral<"typesafe">;
-        source: z.ZodString;
-    }, z.core.$strict>>>;
-    subjectIsolation: z.ZodOptional<z.ZodLiteral<"codex-native-sandbox">>;
-    broker: z.ZodOptional<z.ZodObject<{
-        engine: z.ZodLiteral<"grok">;
-        realmVolume: z.ZodString;
-        bootstrap: z.ZodString;
-        declaration: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-export type TrainingContainerConfig = z.infer<typeof trainingContainerConfigSchema>;

package/dist/compiler/training/container/contract.js

@@ -1,52 +0,0 @@
-import { DAIMON_BROKER_ENGINE_ID } from "../../../runtime/daimon/index.js";
-import path from "node:path";
-import { z } from "zod";
-import { trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema } from "./evaluators.js";
-/** Fixed libfaketime symlink installed and mode-verified by the training image. */
-export const TRAINING_FAKETIME_LIBRARY_PATH = "/usr/local/lib/daimon/libfaketime.so.1";
-const hostPath = z.string().min(1).refine((value) => path.isAbsolute(value) && !/[,\r\n\0]/u.test(value), "Expected an absolute bind path");
-const inputPath = z.string().regex(/^\/run\/training\/inputs\/[A-Za-z0-9._/-]+$/u).refine((value) => path.posix.normalize(value) === value && !value.endsWith("/"));
-export const trainingImageSchema = z.string().regex(/^(?:sha256:[a-f0-9]{64}|[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[a-f0-9]{64})$/u);
-const brokerLaunchSchema = z.object({
-    engine: z.literal(DAIMON_BROKER_ENGINE_ID),
-    /** The named Docker volume holding the training Grok realm: `auth.json` and the broker credential journal, nothing else. */
-    realmVolume: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
-    /** Host leaf of the dedicated training Grok login. Never the desktop `~/.grok/auth.json`. */
-    bootstrap: hostPath,
-    /** `spawnfile.training-broker.v2`, written beside the launch config and bound read-only into the container. */
-    declaration: hostPath
-}).strict();
-export const trainingContainerConfigSchema = z.object({
-    version: z.enum(["spawnfile.training-container.v1", "spawnfile.training-container.v3", "spawnfile.training-container.v4"]),
-    slots: z.number().int().min(1).max(8).default(4),
-    dockerContext: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
-    inputs: z.array(z.object({ source: hostPath, destination: inputPath }).strict()).min(1).max(64),
-    output: z.object({ source: hostPath, destination: z.literal("/run/training/output") }).strict(),
-    auth: z.array(z.object({ source: hostPath, provider: z.enum(["codex", "claude"]) }).strict()).max(2),
-    evaluatorRoutes: trainingEvaluatorRoutesSchema.optional(),
-    evaluatorSecrets: trainingEvaluatorSecretsSchema(hostPath).optional(),
-    subjectIsolation: z.literal("codex-native-sandbox").optional(),
-    /** Present only on `spawnfile.training-container.v4`: the brokered Grok slot this container runs as root. */
-    broker: brokerLaunchSchema.optional()
-}).strict().superRefine((value, context) => {
-    if (value.evaluatorSecrets && !value.broker && !value.subjectIsolation)
-        context.addIssue({ code: "custom", message: "Evaluator secrets require brokered v4 isolation or explicit codex-native-sandbox subject isolation" });
-    if (value.subjectIsolation && value.version !== "spawnfile.training-container.v1")
-        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a non-brokered v1 launch" });
-    if (value.subjectIsolation && !value.evaluatorRoutes?.some(route => route.provider === "typesafe"))
-        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a TypeSafe evaluator route" });
-    if (value.evaluatorSecrets && !value.evaluatorRoutes?.some(route => route.provider === "typesafe")) {
-        context.addIssue({ code: "custom", message: "TypeSafe secret requires a declared evaluator route" });
-    }
-    if (value.version === "spawnfile.training-container.v3")
-        context.addIssue({ code: "custom", message: "Training-container v3 is unsupported; migrate to v4 with slots: 1" });
-    const destinations = value.inputs.map((entry) => entry.destination);
-    if (destinations.some((entry, index) => destinations.some((other, otherIndex) => otherIndex !== index && (entry === other || entry.startsWith(`${other}/`))))) {
-        context.addIssue({ code: "custom", message: "Input destinations must not overlap" });
-    }
-    if (new Set(value.auth.map((entry) => entry.provider)).size !== value.auth.length)
-        context.addIssue({ code: "custom", message: "Duplicate auth provider" });
-    if ((value.version === "spawnfile.training-container.v4") !== (value.broker !== undefined)) {
-        context.addIssue({ code: "custom", message: "Only spawnfile.training-container.v4 declares broker slots; migrate v3 by setting version to v4 and slots to 1" });
-    }
-});