spawnfile 0.1.33 → 0.1.34

package/dist/compiler/training/container/outputVolume.js

@@ -1,185 +0,0 @@
-import { constants, realpathSync } from "node:fs";
-import { lstat, mkdir, open, realpath, rename } from "node:fs/promises";
-import path from "node:path";
-import { parseDetachedContainerInspect } from "../../runProjectDocker.js";
-import { boundedRedactedText } from "../../../shared/redaction.js";
-import { trainingOutputCopyProgram } from "./outputCopy.js";
-const ownerLabel = "com.spawnfile.training.owner";
-const inspectFormat = "{{json .Id}}\n{{json .Name}}\n{{json .Image}}\n{{json .Config.Labels}}";
-const target = "/run/training/output";
-export const trainingOutputVolumeEnabled = () => {
-    const setting = process.env.SPAWNFILE_TRAINING_OUTPUT_STORAGE;
-    if (setting !== undefined && setting !== "volume" && setting !== "bind")
-        throw Error("SPAWNFILE_TRAINING_OUTPUT_STORAGE must be volume or bind");
-    return setting !== "bind";
-};
-/** One launch owns this volume; budgets and auth volumes are never touched. */
-export const createTrainingOutputVolume = (options) => {
-    const { call } = options;
-    const authPaths = new Set();
-    for (const source of options.authSources ?? []) {
-        authPaths.add(source);
-        authPaths.add(path.resolve(source));
-        try {
-            authPaths.add(realpathSync(source));
-        }
-        catch { /* Retain lexical redaction if the leaf disappeared. */ }
-    }
-    for (const source of [...authPaths]) {
-        // Docker Desktop can report either spelling of macOS's system symlink roots,
-        // including the short spelling when the declared bind is already canonical.
-        if (/^\/private\/(?:var|tmp|etc)\//u.test(source))
-            authPaths.add(source.slice('/private'.length));
-        if (/^\/(?:var|tmp|etc)\//u.test(source))
-            authPaths.add(`/private${source}`);
-    }
-    const redactions = [...authPaths].filter(Boolean).sort((a, b) => b.length - a.length);
-    const diagnostic = (text) => {
-        for (const source of redactions)
-            text = text.replaceAll(source, "[auth source]");
-        return boundedRedactedText(text.replace(/\p{Cc}/gu, " "), 2048);
-    };
-    const volume = `${options.name}-output`;
-    let attempted = false, seeded = false, exported = false, exportAttempted = false, helperClosed = true;
-    const recovery = () => `Training output retained in Docker volume ${volume}. Recover with: docker --context ${options.context} run --rm --network none --read-only --mount type=volume,src=${volume},dst=/output,readonly --entrypoint /bin/tar ${options.image} -C /output -cpf - . > training-output-recovery.tar`;
-    const owned = async () => {
-        const result = await call(["volume", "inspect", volume, "--format", "{{json .}}"], true);
-        if (result.code !== 0) {
-            const listed = await call(["volume", "ls", "--filter", `name=^${volume}$`, "--format", "{{.Name}}"], true);
-            if (listed.code === 0 && !listed.stdout.trim())
-                return false;
-            throw Error("Training output volume closure is unknown");
-        }
-        const info = JSON.parse(result.stdout);
-        if (info.Name !== volume || info.Driver !== "local" || (info.Options && Object.keys(info.Options).length) || info.Labels?.[ownerLabel] !== options.name)
-            throw Error("Refusing unverified training output volume");
-        return true;
-    };
-    const transfer = async (direction) => {
-        if (!await owned())
-            throw Error("Training output volume is missing");
-        const name = `${volume}-${direction}`;
-        const labels = { [ownerLabel]: name };
-        const hostStage = path.join(options.scratch, "output-export");
-        if (direction === "export")
-            await mkdir(hostStage, { mode: 0o700 });
-        const mounts = direction === "seed"
-            ? [`type=bind,src=${options.host},dst=/source,readonly`, `type=volume,src=${volume},dst=/destination,volume-nocopy`]
-            : [`type=volume,src=${volume},dst=/source,readonly,volume-nocopy`, `type=bind,src=${hostStage},dst=/destination`];
-        let creationAttempted = false, containerId;
-        try {
-            creationAttempted = true;
-            helperClosed = false;
-            const created = await call(["container", "create", "--name", name, "--label", `${ownerLabel}=${name}`,
-                "--network", "none", "--read-only", "--user", "0:0", "--security-opt", "no-new-privileges",
-                // Retain only Docker's default CHOWN, DAC_OVERRIDE, FOWNER and FSETID for copying
-                // private runtime files and assigning the native/broker uid. No cap-add.
-                ...["AUDIT_WRITE", "KILL", "MKNOD", "NET_BIND_SERVICE", "NET_RAW", "SETFCAP", "SETGID", "SETPCAP", "SETUID", "SYS_CHROOT"].flatMap(cap => ["--cap-drop", cap]),
-                "--pids-limit", "32", "--memory", "256m", "--cpus", "1", "--workdir", "/",
-                ...mounts.flatMap(mount => ["--mount", mount]), "--entrypoint", "node", options.image,
-                "-e", trainingOutputCopyProgram, "/source", "/destination",
-                String(direction === "seed" ? options.runtimeUid : options.uid), String(direction === "seed" ? options.runtimeGid : options.gid)], direction === "export");
-            const id = created.stdout.trim();
-            containerId = id;
-            if (created.code !== 0 || !/^[a-f0-9]{64}$/u.test(id))
-                throw Error(`Cannot create training output ${direction} helper${created.stderr ? `: ${diagnostic(created.stderr)}` : ""}`);
-            const checked = await call(["container", "inspect", "--format", inspectFormat, name], true);
-            if (checked.code !== 0 || parseDetachedContainerInspect(checked.stdout, id, labels, name).imageId !== options.image)
-                throw Error("Training output helper identity mismatch");
-            const result = await call(["container", "start", "--attach", id], direction === "export");
-            const terminal = await call(["container", "inspect", "--format", "{{json .State}}", id], true);
-            const state = JSON.parse(terminal.stdout);
-            if (result.code !== 0 || result.stdout.trim() !== "spawnfile-output-copy-complete" || terminal.code !== 0 || state.Running !== false || state.ExitCode !== 0)
-                throw Error(`Training output ${direction} failed (copy incomplete or exceeds limits): ${diagnostic(result.stderr)}`);
-        }
-        finally {
-            if (creationAttempted) {
-                const found = await call(["container", "inspect", "--format", inspectFormat, name], true);
-                if (found.code === 0) {
-                    const id = JSON.parse(found.stdout.split("\n")[0]);
-                    if (typeof id !== "string" || parseDetachedContainerInspect(found.stdout, id, labels, name).imageId !== options.image || (containerId && /^[a-f0-9]{64}$/u.test(containerId) && id !== containerId))
-                        throw Error("Refusing cleanup of unverified training output helper");
-                    const removed = await call(["container", "rm", "--force", id], true);
-                    if (removed.code !== 0)
-                        throw Error("Cannot remove training output helper");
-                }
-                const remaining = await call(["container", "ls", "--all", "--filter", `name=^/${name}$`, "--format", "{{.ID}}"], true);
-                if (remaining.code !== 0 || remaining.stdout.trim())
-                    throw Error("Training output helper closure is unknown");
-                helperClosed = true;
-            }
-        }
-        if (direction === "export") {
-            if (await realpath(options.host) !== options.host || !(await lstat(options.host)).isDirectory())
-                throw Error("Training host output changed before export");
-            const backup = path.join(options.scratch, "output-before-export");
-            await rename(options.host, backup);
-            try {
-                await rename(hostStage, options.host);
-            }
-            catch (error) {
-                await rename(backup, options.host);
-                throw error;
-            }
-            for (const directory of [options.scratch, path.dirname(options.host)]) {
-                const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-                try {
-                    await handle.sync();
-                }
-                finally {
-                    await handle.close();
-                }
-            }
-        }
-    };
-    return {
-        safeToCleanup: () => helperClosed && (!exportAttempted || exported),
-        mount: `type=volume,src=${volume},dst=${target},volume-nocopy`,
-        async seed() {
-            attempted = true;
-            const created = await call(["volume", "create", "--driver", "local", "--label", `${ownerLabel}=${options.name}`, volume]);
-            if (created.code !== 0 || created.stdout.trim() !== volume || !await owned())
-                throw Error("Cannot create owned training output volume");
-            await transfer("seed");
-            seeded = true;
-            options.stderr(`Training output uses VM-local volume ${volume}; host checkpoints update at exit.`);
-        },
-        async export() {
-            if (!seeded || exportAttempted)
-                return;
-            exportAttempted = true;
-            try {
-                await transfer("export");
-                exported = true;
-            }
-            catch (error) {
-                options.stderr(`Training output export failed: ${error instanceof Error ? error.message : "unknown failure"}. Scratch retained at ${options.scratch}. ${recovery()}`);
-                throw Error(`Training output export failed. ${recovery()}`, { cause: error });
-            }
-        },
-        async dispose(closureVerified) {
-            if (!attempted)
-                return;
-            try {
-                if (!await owned())
-                    return;
-                if (!helperClosed)
-                    throw Error("Training output helper closure is unverified");
-                if (!closureVerified) {
-                    options.stderr(recovery());
-                    return;
-                }
-                if (seeded && !exported)
-                    throw Error("Training output has not been exported");
-                const removed = await call(["volume", "rm", volume], true);
-                const remaining = await call(["volume", "ls", "--filter", `name=^${volume}$`, "--format", "{{.Name}}"], true);
-                if (removed.code !== 0 || remaining.code !== 0 || remaining.stdout.trim())
-                    throw Error("Training output volume removal is unverified");
-            }
-            catch (error) {
-                options.stderr(recovery());
-                throw Error(recovery(), { cause: error });
-            }
-        }
-    };
-};

package/dist/compiler/training/container/prepare.d.ts

@@ -1,10 +0,0 @@
-import { type TrainingContext } from "../contract.js";
-import { type TrainingContainerConfig } from "./contract.js";
-export declare const prepareTrainingContainer: (raw: unknown, context: TrainingContext, args: readonly string[], options?: {
-    createOutput?: boolean;
-}) => Promise<{
-    config: TrainingContainerConfig;
-    context: TrainingContext;
-    args: string[];
-    viewerPort?: number;
-}>;

package/dist/compiler/training/container/prepare.js

@@ -1,125 +0,0 @@
-import { lstat, mkdir, realpath } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { trainingContextSchema } from "../contract.js";
-import { trainingContainerConfigSchema } from "./contract.js";
-import { allocateTrainingOutputParent } from "../execution.js";
-import { assertTrainingSubjectIsolation } from "./subjectIsolation.js";
-const inside = (root, value) => value === root || value.startsWith(`${root}/`);
-export const prepareTrainingContainer = async (raw, context, args, options = {}) => {
-    const config = trainingContainerConfigSchema.parse(raw);
-    await assertTrainingSubjectIsolation(config, context);
-    const entries = [...config.inputs, config.output];
-    const protectedLeaves = [...config.auth, ...config.evaluatorSecrets ?? []];
-    const home = path.resolve(os.homedir());
-    const globalConfigRoots = [".codex", ".claude", ".grok", ".ssh", ".config"].map((name) => path.join(home, name));
-    let missingOutput = false;
-    for (const entry of [...entries, ...protectedLeaves]) {
-        let canonical;
-        try {
-            canonical = await realpath(entry.source);
-        }
-        catch (error) {
-            if (entry !== config.output || !options.createOutput || error.code !== "ENOENT")
-                throw error;
-            canonical = path.resolve(entry.source);
-            missingOutput = true;
-        }
-        if (canonical !== entry.source)
-            throw Error("Training bind sources must be canonical, without symlink aliases");
-        if (entry !== config.output || !missingOutput) {
-            const stat = await lstat(canonical);
-            if (stat.isSymbolicLink() || (!stat.isFile() && !stat.isDirectory()))
-                throw Error("Training binds require regular files or directories");
-            if (config.evaluatorSecrets?.includes(entry) && stat.nlink !== 1)
-                throw Error("Evaluator secrets must not have hardlink aliases");
-            if (protectedLeaves.includes(entry) && !stat.isFile())
-                throw Error("Auth must be a single regular leaf file");
-        }
-        if (entries.includes(entry)) {
-            if (["/", "/etc", "/var", "/run", "/tmp", "/opt", "/usr", "/Users", "/home", home].includes(canonical) || globalConfigRoots.some((root) => inside(root, canonical)))
-                throw Error("Host homes, configuration and system roots cannot be training inputs");
-            if (protectedLeaves.some((auth) => inside(canonical, auth.source)))
-                throw Error("Auth must not be exposed through input or output mounts");
-        }
-    }
-    if (config.inputs.some((entry, index) => config.inputs.some((other, otherIndex) => index !== otherIndex && inside(entry.source, other.source))))
-        throw Error("Training input source roots must not overlap");
-    if (!missingOutput && !(await lstat(config.output.source)).isDirectory())
-        throw Error("Training output must be an existing directory");
-    if (config.inputs.some((entry) => inside(entry.source, config.output.source) || inside(config.output.source, entry.source)))
-        throw Error("Training output and inputs must not overlap");
-    const map = (value) => {
-        const absolute = path.resolve(value);
-        const entry = entries.find((item) => inside(item.source, absolute));
-        if (!entry)
-            throw Error(`Training path is not covered by a declared mount: ${value}`);
-        return path.posix.join(entry.destination, path.relative(entry.source, absolute).split(path.sep).join("/"));
-    };
-    const source = (entry) => ({ ...entry, sourcePath: map(entry.sourcePath) });
-    const mapped = trainingContextSchema.parse({ ...context,
-        project: { ...context.project, root: map(context.project.root), manifest: map(context.project.manifest) },
-        agent: { ...context.agent, source: map(context.agent.source) },
-        sources: context.sources.map(source), documents: context.documents.map(source), skills: context.skills.map(source)
-    });
-    const mappedArgs = [...args];
-    let viewerPort;
-    for (let index = 0; index < mappedArgs.length; index++) {
-        const flag = mappedArgs[index];
-        if (["--train", "--validation", "--test", "--out", "--cost-config"].includes(flag)) {
-            const value = mappedArgs[++index];
-            if (!value)
-                throw Error(`Missing ${flag} path`);
-            mappedArgs[index] = map(value);
-            if (flag === "--out" && !inside("/run/training/output", mappedArgs[index]))
-                throw Error("Training --out must use the writable output mount");
-        }
-        else if (flag === "--resource") {
-            const value = mappedArgs[++index] ?? "", equals = value.indexOf("=");
-            if (equals < 1)
-                throw Error("Expected resource=id path mapping");
-            mappedArgs[index] = `${value.slice(0, equals)}=${map(value.slice(equals + 1))}`;
-        }
-        else if (flag === "--bridge-command") {
-            const value = mappedArgs[++index] ?? "";
-            if (!/^\/opt\/training\/[A-Za-z0-9._/-]+$/u.test(value) || path.posix.normalize(value) !== value)
-                throw Error("Bridge must be an installed executable under /opt/training");
-        }
-        else if (flag === "--view") {
-            const value = mappedArgs[++index] ?? "";
-            const port = Number(value);
-            if (viewerPort !== undefined || !/^\d+$/u.test(value) || !Number.isSafeInteger(port) || port < 1 || port > 65535)
-                throw Error("Container --view requires one explicit port from 1 to 65535");
-            viewerPort = port;
-            mappedArgs[index] = String(port);
-        }
-    }
-    {
-        const flags = mappedArgs.filter(arg => arg === "--concurrency" || arg.startsWith("--concurrency="));
-        if (flags.length > 1)
-            throw Error("Training accepts one --concurrency value");
-        const flag = flags[0];
-        if (flag !== undefined) {
-            const value = flag === "--concurrency" ? mappedArgs[mappedArgs.indexOf(flag) + 1] : flag.slice("--concurrency=".length);
-            if (!value || !/^[1-8]$/u.test(value) || Number(value) > config.slots) {
-                throw Error("Training concurrency must fit the provisioned slots");
-            }
-            if (flag !== "--concurrency")
-                mappedArgs.splice(mappedArgs.indexOf(flag), 1, "--concurrency", value);
-        }
-    }
-    if (missingOutput) {
-        await allocateTrainingOutputParent(config.output.source);
-        try {
-            await mkdir(config.output.source, { mode: 0o700 });
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-        }
-        if (await realpath(config.output.source) !== config.output.source || !(await lstat(config.output.source)).isDirectory()) {
-            throw Error("Training output must be a canonical directory");
-        }
-    }
-    return { config, context: mapped, args: mappedArgs, ...(viewerPort === undefined ? {} : { viewerPort }) };
-};

package/dist/compiler/training/container/process.d.ts

@@ -1,14 +0,0 @@
-export interface TrainingDockerProcess {
-    (args: readonly string[], options: {
-        timeoutMs: number;
-        signal?: AbortSignal;
-        stdout?: (line: string) => void;
-        stderr?: (line: string) => void;
-    }): Promise<{
-        code: number;
-        stdout: string;
-        stderr: string;
-    }>;
-}
-/** Docker client only; no model executable runs on the host. */
-export declare const runTrainingDocker: TrainingDockerProcess;

package/dist/compiler/training/container/process.js

@@ -1,70 +0,0 @@
-import { spawn } from "node:child_process";
-/** Docker client only; no model executable runs on the host. */
-export const runTrainingDocker = (args, options) => new Promise((resolve, reject) => {
-    if (options.signal?.aborted) {
-        reject(Error("Training Docker operation cancelled"));
-        return;
-    }
-    const child = spawn("docker", [...args], { shell: false, stdio: ["ignore", "pipe", "pipe"] });
-    let stdout = "", stderr = "", failure;
-    let forceClose;
-    let settled = false;
-    const pending = { stdout: "", stderr: "" };
-    const stop = (message) => {
-        failure ??= Error(message);
-        child.kill("SIGKILL");
-        forceClose ??= setTimeout(() => {
-            // Releasing a stuck client lets the owner independently stop/verify the container.
-            child.stdout.destroy();
-            child.stderr.destroy();
-            finish(null);
-        }, 1000);
-    };
-    const abort = () => stop("Training Docker operation cancelled");
-    const timer = setTimeout(() => stop("Training Docker operation exceeded deadline"), options.timeoutMs);
-    options.signal?.addEventListener("abort", abort, { once: true });
-    if (options.signal?.aborted)
-        abort();
-    const consume = (channel, chunk) => {
-        pending[channel] += chunk;
-        if (Buffer.byteLength(pending[channel]) > 1024 * 1024) {
-            stop("Docker output exceeded bounded line size");
-            return;
-        }
-        const lines = pending[channel].split("\n");
-        pending[channel] = lines.pop();
-        for (const line of lines) {
-            options[channel]?.(line);
-            if (channel === "stdout")
-                stdout = options.stdout ? line : stdout + line + "\n";
-            else
-                stderr = options.stderr ? line : stderr + line + "\n";
-            if (stdout.length + stderr.length > 2 * 1024 * 1024)
-                stop("Docker output exceeded bounded capture size");
-        }
-    };
-    child.stdout.setEncoding("utf8").on("data", (chunk) => consume("stdout", chunk));
-    child.stderr.setEncoding("utf8").on("data", (chunk) => consume("stderr", chunk));
-    child.once("error", (error) => { failure = error; });
-    const finish = (code) => {
-        if (settled)
-            return;
-        settled = true;
-        clearTimeout(forceClose);
-        clearTimeout(timer);
-        options.signal?.removeEventListener("abort", abort);
-        for (const channel of ["stdout", "stderr"])
-            if (pending[channel]) {
-                options[channel]?.(pending[channel]);
-                if (channel === "stdout")
-                    stdout = options.stdout ? pending[channel] : stdout + pending[channel];
-                else
-                    stderr = options.stderr ? pending[channel] : stderr + pending[channel];
-            }
-        if (failure)
-            reject(failure);
-        else
-            resolve({ code: code ?? 1, stdout, stderr });
-    };
-    child.once("close", finish);
-});

package/dist/compiler/training/container/security.d.ts

@@ -1,38 +0,0 @@
-export declare const TRAINING_BROKER_ENTRYPOINT = "/opt/training/bin/train-broker";
-/** Same output directory is the same resumable run; different outputs never share a counter. */
-export declare const trainingRunRequestMount: (outputSource: string, args: readonly string[]) => string;
-/**
- * Disposable state of a broker-capable training container, all on tmpfs.
- *
- * The image root stays read-only and nothing here is a host bind, so a trial's
- * worker home, workspace, turn store, wake-acceptance store and ledgers are
- * on a filesystem that enforces unix ownership — which is what lets the slot
- * supervisor's worker-uid canaries mean anything (P0 §5: a host bind under
- * Docker Desktop or Colima silently ignores `chown`). The Grok realm is the
- * credential mount. The run request counter has its own persistent named volume.
- */
-export declare const trainingBrokerTmpfsTargets: (slots?: number) => readonly {
-    path: string;
-    size: string;
-    mode: string;
-}[];
-/**
- * `docker create` arguments for the broker-capable training container.
- *
- * It starts as root with the *production* Daimon capability set rather than
- * the v1 path's `--cap-drop ALL` as the host user: the root entrypoint has to
- * provision uid-owned directories (`CAP_CHOWN`), let the native launcher
- * `setuid` to a worker (`CAP_SETUID`/`SETGID`), drop bounding sets
- * (`CAP_SETPCAP`), supervise dropped children (`CAP_KILL`) and read the
- * attested layout it does not own (`CAP_DAC_READ_SEARCH`). `CAP_FOWNER` is
- * deliberately absent, which is why every provisioning chmod reclaims the
- * inode first. Grok 1.0.34 runs every sandbox profile inside bubblewrap, so
- * the container also needs the pinned default-plus-userns seccomp profile and
- * AppArmor unconfined — the narrowest combination P0 found.
- */
-export declare const trainingBrokerSecurityArgs: (seccompProfileDirectory: string) => Promise<string[]>;
-export declare const trainingBrokerMounts: (broker: {
-    realmVolume: string;
-    bootstrap: string;
-    declaration: string;
-}) => string[];

package/dist/compiler/training/container/security.js

@@ -1,68 +0,0 @@
-import { createHash } from "node:crypto";
-import { DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, materializeDaimonGrokSeccompProfile } from "../../../shared/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
-import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
-import { TRAINING_BROKER_TMPDIR, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_ROOT, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_WORKER_ROOT } from "../broker/paths.js";
-export const TRAINING_BROKER_ENTRYPOINT = "/opt/training/bin/train-broker";
-/** Same output directory is the same resumable run; different outputs never share a counter. */
-export const trainingRunRequestMount = (outputSource, args) => {
-    const index = args.indexOf("--out"), output = args[index + 1];
-    if (index < 0 || !output || args.lastIndexOf("--out") !== index)
-        throw Error("Brokered training requires one --out directory");
-    const identity = createHash("sha256").update(JSON.stringify([outputSource, output])).digest("hex");
-    return `type=volume,src=spawnfile-training-budget-${identity},dst=${TRAINING_RUN_REQUEST_STORE}`;
-};
-/**
- * Disposable state of a broker-capable training container, all on tmpfs.
- *
- * The image root stays read-only and nothing here is a host bind, so a trial's
- * worker home, workspace, turn store, wake-acceptance store and ledgers are
- * on a filesystem that enforces unix ownership — which is what lets the slot
- * supervisor's worker-uid canaries mean anything (P0 §5: a host bind under
- * Docker Desktop or Colima silently ignores `chown`). The Grok realm is the
- * credential mount. The run request counter has its own persistent named volume.
- */
-export const trainingBrokerTmpfsTargets = (slots = 4) => [
-    { path: "/tmp", size: "1g", mode: "1777" },
-    { path: "/var/tmp", size: "256m", mode: "1777" },
-    { path: "/work", size: "4g", mode: "0755" },
-    { path: "/home/training", size: "1g", mode: "0755" },
-    { path: TRAINING_ROOT, size: "64m", mode: "0755" },
-    ...trainingSlotDescriptors(slots).map(p => ({ path: p.root, size: "4g", mode: "0711" })),
-    { path: TRAINING_TURN_STORE_ROOT, size: "256m", mode: "0700" },
-    { path: TRAINING_GRANT_HOME_ROOT, size: "64m", mode: "0755" },
-    { path: TRAINING_INFERENCE_DIRECTORY, size: "64m", mode: "0755" },
-    { path: TRAINING_SUPERVISOR_DIRECTORY, size: "16m", mode: "0755" },
-    { path: TRAINING_WORKER_ROOT, size: "1g", mode: "0755" },
-    { path: "/etc/daimon-engine-broker", size: "16m", mode: "0755" },
-    { path: "/run/daimon-engine-broker", size: "64m", mode: "0755" },
-    { path: TRAINING_BROKER_TMPDIR, size: "64m", mode: "0755" },
-    { path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, size: "64m", mode: "0755" },
-    { path: DAIMON_WAKE_FUSE_DIRECTORY, size: "16m", mode: "0755" }
-];
-/**
- * `docker create` arguments for the broker-capable training container.
- *
- * It starts as root with the *production* Daimon capability set rather than
- * the v1 path's `--cap-drop ALL` as the host user: the root entrypoint has to
- * provision uid-owned directories (`CAP_CHOWN`), let the native launcher
- * `setuid` to a worker (`CAP_SETUID`/`SETGID`), drop bounding sets
- * (`CAP_SETPCAP`), supervise dropped children (`CAP_KILL`) and read the
- * attested layout it does not own (`CAP_DAC_READ_SEARCH`). `CAP_FOWNER` is
- * deliberately absent, which is why every provisioning chmod reclaims the
- * inode first. Grok 1.0.34 runs every sandbox profile inside bubblewrap, so
- * the container also needs the pinned default-plus-userns seccomp profile and
- * AppArmor unconfined — the narrowest combination P0 found.
- */
-export const trainingBrokerSecurityArgs = async (seccompProfileDirectory) => [
-    "--user", "0:0",
-    ...DAIMON_DOCKER_RUNTIME_SECURITY_ARGS,
-    `--security-opt=seccomp=${await materializeDaimonGrokSeccompProfile(seccompProfileDirectory)}`,
-    "--security-opt=apparmor=unconfined"
-];
-export const trainingBrokerMounts = (broker) => [
-    `type=volume,src=${broker.realmVolume},dst=${DAIMON_GROK_ENGINE_BROKER.credentialHomePath}`,
-    `type=bind,src=${broker.bootstrap},dst=/var/lib/spawnfile/daimon/grok-bootstrap-auth,readonly`,
-    `type=bind,src=${broker.declaration},dst=${TRAINING_ROOT}/training-broker.json,readonly`
-];

package/dist/compiler/training/container/subjectIsolation.d.ts

@@ -1,5 +0,0 @@
-import { type TrainingContext } from "../contract.js";
-/** Resolve host-side subject policy; the public v1 context carries no sandbox authority. */
-export declare const assertTrainingSubjectIsolation: (config: {
-    subjectIsolation?: "codex-native-sandbox";
-}, context: TrainingContext) => Promise<void>;

package/dist/compiler/training/container/subjectIsolation.js

@@ -1,16 +0,0 @@
-import { getDaimonEngineDescriptor } from "../../../runtime/daimon/index.js";
-import { resolveDaimonEngine } from "../../../runtime/daimon/config.js";
-import { resolveTrainingContextGraph } from "../context.js";
-import { trainingContextSchema } from "../contract.js";
-/** Resolve host-side subject policy; the public v1 context carries no sandbox authority. */
-export const assertTrainingSubjectIsolation = async (config, context) => {
-    if (config.subjectIsolation !== "codex-native-sandbox")
-        return;
-    const parsed = trainingContextSchema.parse(context);
-    const { selected } = await resolveTrainingContextGraph(parsed.project.manifest, parsed.agent.id);
-    const agent = selected.value;
-    if (agent.runtime.name !== "daimon" || getDaimonEngineDescriptor(resolveDaimonEngine(agent))?.training.subject.isolation !== "native-sandbox" ||
-        agent.runtime.options.codex_policy !== "workspace-no-network" || agent.execution?.sandbox?.mode !== "workspace") {
-        throw Error("codex-native-sandbox subject isolation requires the selected training agent to use runtime daimon, engine codex, and strict codex_policy: workspace-no-network (execution.sandbox.mode: workspace)");
-    }
-};

package/dist/compiler/training/preparation/assets/Dockerfile

@@ -1,100 +0,0 @@
-ARG NATIVE_IMAGE
-ARG PYTHON_IMAGE
-FROM ${PYTHON_IMAGE} AS python
-FROM ${NATIVE_IMAGE} AS training
-
-# Both parents must use the same architecture and Debian release.
-COPY --from=python /usr/local /opt/python
-COPY --from=python /usr/lib/*-linux-gnu/libsqlite3.so.0* /opt/python/lib/
-# The bridge intentionally clears ambient environment variables. Register native
-# libraries in the image so Python extensions also load in that clean process.
-RUN echo /opt/python/lib > /etc/ld.so.conf.d/training-python.conf && ldconfig
-
-# Bookworm's distro library, shared by broker shell tools and direct clocked
-# Daimon children. Resolve the multiarch path at build time; never preload the image.
-RUN . /etc/os-release && test "$VERSION_CODENAME" = bookworm \
- && apt-get update && apt-get install --yes --no-install-recommends libfaketime=0.9.10-2.1 \
- && library="$(dpkg-query -L libfaketime | sed -n '\|/faketime/libfaketime\.so\.1$|p')" \
- && test -f "$library" \
- && install -d -o root -g root -m 0755 /usr/local/lib/daimon \
- && ln -s "$library" /usr/local/lib/daimon/libfaketime.so.1 \
- && chown -h root:root /usr/local/lib/daimon/libfaketime.so.1 \
- && rm -rf /var/lib/apt/lists/*
-
-# The broker-capable container runs on a read-only root, so the fixed Daimon
-# identities are baked here instead of being created by the entrypoint the way
-# the production organization image creates them. It depends on nothing from the
-# build context, so it sits first: it is the least frequently changing layer.
-RUN for fixed_uid in 2000 2100 2200 2201 2202 2203 2204 2205 2206 2207; do \
-      groupadd -K GID_MIN=1 --gid "$fixed_uid" "daimon-$fixed_uid" \
-   && useradd -K UID_MIN=1 --no-create-home --no-log-init --uid "$fixed_uid" --gid "$fixed_uid" \
-        --home-dir /nonexistent --shell /usr/sbin/nologin "daimon-$fixed_uid"; \
-    done
-
-# The sealed train and test datasets are bind-mounted UNDER /run/training/inputs, so this directory is
-# the ancestor every read of them must traverse, and it is the only inode in that chain the image owns.
-# Root-owned with no world bits, on the read-only root: uid 2200 is in neither the owner nor the group
-# class, so it loses search permission; a `unshare --map-root-user` namespace maps only uid 2200, so
-# CAP_DAC_OVERRIDE there cannot override an inode owned by real uid 0; and a fresh bind of the parent
-# re-exposes this same directory rather than the bytes under it. Nothing at runtime can widen it,
-# because the container root is read-only — the slot provisioning asserts the mode and refuses otherwise.
-RUN mkdir -p /run/training/inputs /run/training/output /run/training/slots \
- && chown 0:0 /run/training /run/training/output && chmod 0755 /run/training /run/training/output \
- && chown 0:2000 /run/training/inputs && chmod 0750 /run/training/inputs
-
-# Layers run from least to most frequently changing: locked dependencies, the
-# DSPy venv, bridge source, pinned executables, then distributions. Staged context
-# modes are already `a+rX`-closed (train/train-broker 0555), so late COPY layers need no RUN.
-COPY claude/package.json claude/package-lock.json /opt/training/claude/
-RUN cd /opt/training/claude && npm ci --omit=dev
-
-WORKDIR /opt/training/spawnfile
-COPY spawnfile/package.json spawnfile/package-lock.json ./
-RUN npm ci --omit=dev --ignore-scripts
-
-WORKDIR /opt/training/compiler
-COPY compiler/package.json compiler/package-lock.json ./
-RUN npm ci --omit=dev --ignore-scripts
-
-COPY spawnfile/dist/training/dspy/requirements.lock /opt/training/spawnfile/dist/training/dspy/requirements.lock
-RUN /opt/python/bin/python3 -m venv /opt/training/spawnfile/dist/training/dspy/.venv \
- && /opt/training/spawnfile/dist/training/dspy/.venv/bin/pip install --no-cache-dir -r /opt/training/spawnfile/dist/training/dspy/requirements.lock \
- && /opt/training/spawnfile/dist/training/dspy/.venv/bin/pip install --no-cache-dir setuptools==80.9.0
-
-# Exactly `chmod -R a+rX /opt/training`, but only entries that need a change are
-# touched, so unchanged lower-layer files are never copied up into a new layer.
-# This layer also puts the native parent's own pinned Grok and engine broker at the two fixed paths
-# `GROK_ENGINE_BROKER` names, exactly as a generated organization image does (`src/runtime/container.ts`).
-# No second build is introduced: both are installed from the parent's runtime install, and the slot
-# provisioning and the slot supervisor both refuse an executable that is not a manifest-pinned one.
-RUN find /opt/training \( \( -type d ! -perm -0555 \) -o \( ! -type d ! -type l \( ! -perm -0444 -o \( \( -perm -0100 -o -perm -0010 -o -perm -0001 \) ! -perm -0111 \) \) \) \) -exec chmod a+rX {} + \
- && mkdir -m 0755 /opt/training/bin /opt/training/integration \
- && mkdir -p /opt/daimon/bin \
- && install -o root -g root -m 0555 /opt/spawnfile/runtime-installs/daimon/bin/grok /usr/local/bin/grok \
- && install -o root -g root -m 0555 /opt/spawnfile/runtime-installs/daimon/bin/daimon-engine-broker /opt/daimon/bin/daimon-engine-broker \
- && ln -s /opt/training/claude/node_modules/.bin/claude /opt/training/bin/claude \
- && ln -s /opt/training/spawnfile/dist/cli/index.js /opt/training/bin/spawnfile \
- && mkdir -p /opt/training/integration/node_modules/@noopolis \
- && ln -s /opt/training/spawnfile /opt/training/integration/node_modules/spawnfile \
- && ln -s /opt/spawnfile/runtime-installs/daimon/node_modules/@noopolis/daimon /opt/training/integration/node_modules/@noopolis/daimon \
- && mkdir -p /opt/training/spawnfile/node_modules/@noopolis \
- && ln -s /opt/spawnfile/runtime-installs/daimon/node_modules/@noopolis/daimon /opt/training/spawnfile/node_modules/@noopolis/daimon
-
-COPY spawnfile/dist/training/dspy /opt/training/spawnfile/dist/training/dspy
-RUN /opt/training/spawnfile/dist/training/dspy/.venv/bin/pip install --no-deps --no-build-isolation -e /opt/training/spawnfile/dist/training/dspy \
- && find /opt/training/spawnfile/dist/training/dspy \( \( -type d ! -perm -0555 \) -o \( ! -type d ! -type l \( ! -perm -0444 -o \( \( -perm -0100 -o -perm -0010 -o -perm -0001 \) ! -perm -0111 \) \) \) \) -exec chmod a+rX {} +
-
-# No Grok binary: `spawnfile.training-container.v3` runs the native parent's pinned
-# /usr/local/bin/grok through the broker, so a second copy could only be an unattested build.
-COPY train /opt/training/bin/train
-COPY train-broker /opt/training/bin/train-broker
-COPY compiler/runtimes.yaml compiler/moltnet-releases.json /opt/training/compiler/
-COPY spawnfile/runtimes.yaml spawnfile/moltnet-releases.json /opt/training/spawnfile/
-COPY compiler/dist /opt/training/compiler/dist
-COPY integration /opt/training/integration
-COPY bootstrap /opt/training/bootstrap
-COPY spawnfile/dist /opt/training/spawnfile/dist
-ENV PATH=/opt/training/bin:/opt/training/spawnfile/dist/training/dspy/.venv/bin:/opt/spawnfile/runtime-installs/daimon/bin:/usr/local/bin:/usr/bin:/bin
-ENV HOME=/home/training
-WORKDIR /work
-ENTRYPOINT ["/opt/training/bin/train"]