spawnfile 0.1.33 → 0.1.34

package/dist/compiler/containerDaimonGatewayRender.d.ts

@@ -0,0 +1,50 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+import { type DaimonGatewayedDescriptor } from "../runtime/daimon/gateway.js";
+import { DAIMON_GATEWAY_UID } from "../runtime/daimon/runtimeIdentity.js";
+export { DAIMON_GATEWAY_UID };
+export declare const DAIMON_GATEWAY_STARTUP_TIMEOUT_SECONDS = 60;
+/** Gatewayed engines this container's Daimon organization runs; empty means no gateway. */
+export declare const resolveDaimonGatewayEngines: (plans: readonly RuntimeTargetPlan[]) => DaimonGatewayedDescriptor[];
+/** Persistent realm volumes the gateway, not the organization uid, owns. */
+export declare const resolveDaimonGatewayRealmPaths: (plans: readonly RuntimeTargetPlan[]) => string[];
+/**
+ * Root provisioning of the gateway's private state, before any engine process
+ * starts: the digest-only key table and config under `root:<gateway> 0440`,
+ * each realm re-owned to the gateway uid at `0700`, and a gateway-owned copy of
+ * each bootstrap leaf, whose bind mount sits under a root-only directory the
+ * organization uid cannot reach. Reads the key from `$daimon_gateway_key`.
+ * Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_FOWNER`, so
+ * every chmod happens while root owns the path. Shared by the in-container
+ * placement and the training sidecar (`host` is the only difference).
+ */
+export declare const renderDaimonGatewayStateProvisioning: (descriptors: readonly DaimonGatewayedDescriptor[], host?: string) => string[];
+/**
+ * The organization's gateway placement, decided at boot. With
+ * `DAIMON_GATEWAY_URL` (and its key) in the container environment, an external
+ * gateway (the training sidecar) serves this organization: nothing is
+ * provisioned, no gateway starts and no realm is mounted. Otherwise root
+ * generates a fresh 32-byte key per start (so no key exists in the image or the
+ * compile output) and provisions the in-container gateway. Either way the
+ * runtime gets the same two variables: one agent contract.
+ */
+export declare const renderDaimonGatewayProvisioning: (plans: readonly RuntimeTargetPlan[]) => string[];
+/**
+ * Starts the gateway as its own uid with no capabilities, after proving the
+ * organization uid (and a broker uid) cannot read any gateway-held path, then waits for its uid,
+ * bounding set and loopback port. Uses the shared startup supervision helpers.
+ */
+export declare const renderDaimonGatewayLaunch: (plans: readonly RuntimeTargetPlan[], runtimeRoot: string) => string[];
+/** Env assignments prefixed onto the organization runtime launch; empty without a gateway. */
+export declare const renderDaimonGatewayRuntimeEnv: (plans: readonly RuntimeTargetPlan[]) => string;
+/** The training sidecar answers on its run's private network under this alias. */
+export declare const DAIMON_GATEWAY_SIDECAR_ALIAS = "daimon-gateway";
+export declare const DAIMON_GATEWAY_SIDECAR_URL = "http://daimon-gateway:43200";
+/** Env name carrying the run's 64-hex gateway key into the sidecar's root shell; unset before anything else starts. */
+export declare const DAIMON_GATEWAY_SIDECAR_KEY_ENV = "SPAWNFILE_DAIMON_GATEWAY_KEY";
+/**
+ * Root script for the sidecar placement: the same binary, state provisioning
+ * and uid as the in-container gateway, bound to the run's private network
+ * instead of loopback, with the run's key supplied rather than generated.
+ * Trials reach it at {@link DAIMON_GATEWAY_SIDECAR_URL} with that key.
+ */
+export declare const renderDaimonGatewaySidecarScript: (engines: readonly string[], runtimeRoot: string) => string;

package/dist/compiler/containerDaimonGatewayRender.js

@@ -0,0 +1,157 @@
+import path from "node:path";
+import { DAIMON_GATEWAY_BOOTSTRAP_ROOT, DAIMON_GATEWAY_CONFIG, DAIMON_GATEWAY_ETC, DAIMON_GATEWAY_KEY_ENV, DAIMON_GATEWAY_KEY_TABLE, DAIMON_GATEWAY_KEY_TABLE_VERSION, DAIMON_GATEWAY_PORT, DAIMON_GATEWAY_PRINCIPAL, DAIMON_GATEWAY_RUN, DAIMON_GATEWAY_URL, DAIMON_GATEWAY_URL_ENV, DAIMON_GATEWAY_HOST, daimonGatewayBootstrapCopyPath, daimonGatewayBootstrapMountPath, daimonGatewayedEngines, daimonGatewayRealmPath, daimonGatewayRefreshScratchPath, renderDaimonGatewayConfig } from "../runtime/daimon/gateway.js";
+import { DAIMON_BROKER_UID, DAIMON_GATEWAY_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
+export { DAIMON_GATEWAY_UID };
+export const DAIMON_GATEWAY_STARTUP_TIMEOUT_SECONDS = 60;
+/** Root-shell variable holding this start's key; never exported, passed only to the runtime launch. */
+const KEY_VARIABLE = "daimon_gateway_key";
+/** Root-shell variable holding the gateway URL this start hands the runtime. */
+const URL_VARIABLE = "daimon_gateway_url";
+/** `1` when an external gateway was supplied at boot. */
+const EXTERNAL_VARIABLE = "daimon_gateway_external";
+const drop = (uid) => `setpriv --clear-groups --reuid ${uid} --regid ${uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all --`;
+/** Gatewayed engines this container's Daimon organization runs; empty means no gateway. */
+export const resolveDaimonGatewayEngines = (plans) => daimonGatewayedEngines(plans.filter((plan) => plan.runtimeName === "daimon")
+    .flatMap((plan) => Object.values(plan.engineByNodeId ?? {})));
+/** Persistent realm volumes the gateway, not the organization uid, owns. */
+export const resolveDaimonGatewayRealmPaths = (plans) => resolveDaimonGatewayEngines(plans).map(daimonGatewayRealmPath);
+/**
+ * Root provisioning of the gateway's private state, before any engine process
+ * starts: the digest-only key table and config under `root:<gateway> 0440`,
+ * each realm re-owned to the gateway uid at `0700`, and a gateway-owned copy of
+ * each bootstrap leaf, whose bind mount sits under a root-only directory the
+ * organization uid cannot reach. Reads the key from `$daimon_gateway_key`.
+ * Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_FOWNER`, so
+ * every chmod happens while root owns the path. Shared by the in-container
+ * placement and the training sidecar (`host` is the only difference).
+ */
+export const renderDaimonGatewayStateProvisioning = (descriptors, host = DAIMON_GATEWAY_HOST) => {
+    const realms = descriptors.map((descriptor) => ({
+        bootstrap: daimonGatewayBootstrapMountPath(descriptor.auth.realm),
+        copy: daimonGatewayBootstrapCopyPath(descriptor.auth.realm),
+        durable: daimonGatewayRealmPath(descriptor),
+        maxBytes: descriptor.auth.realm.maxCredentialBytes,
+        scratch: daimonGatewayRefreshScratchPath(descriptor) ?? null
+    }));
+    const program = [
+        "const crypto = require('node:crypto'); const fs = require('node:fs'); const { constants } = fs;",
+        `const gateway = ${DAIMON_GATEWAY_UID}; const realms = ${JSON.stringify(realms)};`,
+        `const key = process.env.SPAWNFILE_DAIMON_GATEWAY_KEY ?? ''; if (!/^[0-9a-f]{64}$/.test(key)) throw new Error('gateway key generation failed');`,
+        "const privateWrite = (target, bytes, mode, uid, gid) => { const fd = fs.openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600); try { let written = 0; while (written < bytes.length) written += fs.writeSync(fd, bytes, written, bytes.length - written, written); fs.fchmodSync(fd, mode); fs.fchownSync(fd, uid, gid); fs.fsyncSync(fd); } finally { fs.closeSync(fd); } };",
+        `const table = { version: '${DAIMON_GATEWAY_KEY_TABLE_VERSION}', keys: { [crypto.createHash('sha256').update(key, 'utf8').digest('hex')]: { agent_id: '${DAIMON_GATEWAY_PRINCIPAL}', engines: ${JSON.stringify(descriptors.map(({ id }) => id))} } } };`,
+        `privateWrite('${DAIMON_GATEWAY_KEY_TABLE}', Buffer.from(JSON.stringify(table) + '\\n'), 0o440, 0, gateway);`,
+        `privateWrite('${DAIMON_GATEWAY_CONFIG}', Buffer.from(${JSON.stringify(renderDaimonGatewayConfig(descriptors, host))}), 0o440, 0, gateway);`,
+        "for (const realm of realms) {",
+        "  const info = fs.lstatSync(realm.durable); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('gateway realm is not a directory');",
+        "  fs.chownSync(realm.durable, 0, 0); fs.chmodSync(realm.durable, 0o700);",
+        // Re-own the whole tree: a migrated broker realm also holds its legacy journal and turn directories.
+        "  const reown = (target) => { for (const name of fs.readdirSync(target)) { const entry = `${target}/${name}`, stat = fs.lstatSync(entry); if (stat.isDirectory()) { fs.chownSync(entry, 0, 0); fs.chmodSync(entry, stat.mode & 0o700); reown(entry); } else if (!stat.isFile() || stat.nlink !== 1) throw new Error('gateway realm holds an unsafe entry'); else { fs.chownSync(entry, 0, 0); fs.chmodSync(entry, stat.mode & 0o700); } fs.chownSync(entry, gateway, gateway); } };",
+        "  reown(realm.durable); fs.chownSync(realm.durable, gateway, gateway);",
+        "  if (realm.scratch !== null) { fs.mkdirSync(realm.scratch, { mode: 0o700 }); fs.chownSync(realm.scratch, gateway, gateway); }",
+        "  let source; try { source = fs.lstatSync(realm.bootstrap); } catch (error) { if (error.code !== 'ENOENT') throw error; }",
+        "  if (source === undefined) continue;",
+        "  if (!source.isFile() || source.size < 2 || source.size > realm.maxBytes) throw new Error('gateway bootstrap leaf is unsafe');",
+        "  const fd = fs.openSync(realm.bootstrap, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); let bytes; try { const opened = fs.fstatSync(fd); if (opened.dev !== source.dev || opened.ino !== source.ino) throw new Error('gateway bootstrap leaf changed'); bytes = fs.readFileSync(fd); } finally { fs.closeSync(fd); }",
+        "  try { privateWrite(realm.copy, bytes, 0o600, gateway, gateway); } finally { bytes.fill(0); }",
+        "}"
+    ].join("\n");
+    return [
+        `if [ -d ${DAIMON_GATEWAY_ETC} ]; then chmod u+rwx ${DAIMON_GATEWAY_ETC}; fi`,
+        `if [ -d ${DAIMON_GATEWAY_RUN} ]; then chmod u+rwx ${DAIMON_GATEWAY_RUN}; fi`,
+        `rm -rf ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN}`,
+        `install -d -o root -g root -m 0700 ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN}`,
+        `if [ ! -d ${DAIMON_GATEWAY_BOOTSTRAP_ROOT} ]; then install -d -o root -g root -m 0700 ${DAIMON_GATEWAY_BOOTSTRAP_ROOT}; fi`,
+        `test -d ${DAIMON_GATEWAY_BOOTSTRAP_ROOT} && test ! -L ${DAIMON_GATEWAY_BOOTSTRAP_ROOT}`,
+        `chown 0:0 ${DAIMON_GATEWAY_BOOTSTRAP_ROOT} && chmod 0700 ${DAIMON_GATEWAY_BOOTSTRAP_ROOT}`,
+        `SPAWNFILE_DAIMON_GATEWAY_KEY="$${KEY_VARIABLE}" node <<'SPAWNFILE_DAIMON_GATEWAY_PROVISION'`,
+        program,
+        "SPAWNFILE_DAIMON_GATEWAY_PROVISION",
+        `chmod 0750 ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN} && chown 0:${DAIMON_GATEWAY_UID} ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN}`
+    ];
+};
+/**
+ * The organization's gateway placement, decided at boot. With
+ * `DAIMON_GATEWAY_URL` (and its key) in the container environment, an external
+ * gateway (the training sidecar) serves this organization: nothing is
+ * provisioned, no gateway starts and no realm is mounted. Otherwise root
+ * generates a fresh 32-byte key per start (so no key exists in the image or the
+ * compile output) and provisions the in-container gateway. Either way the
+ * runtime gets the same two variables: one agent contract.
+ */
+export const renderDaimonGatewayProvisioning = (plans) => {
+    const descriptors = resolveDaimonGatewayEngines(plans);
+    if (descriptors.length === 0)
+        return [];
+    return [
+        `if [ -n "\${${DAIMON_GATEWAY_URL_ENV}:-}" ]; then`,
+        `  ${EXTERNAL_VARIABLE}=1 ${URL_VARIABLE}=$${DAIMON_GATEWAY_URL_ENV}`,
+        `  ${KEY_VARIABLE}=\${${DAIMON_GATEWAY_KEY_ENV}:?${DAIMON_GATEWAY_KEY_ENV} must accompany ${DAIMON_GATEWAY_URL_ENV}}`,
+        // Only the runtime and broker launches below get them, as with the in-container gateway.
+        `  export -n ${DAIMON_GATEWAY_URL_ENV} ${DAIMON_GATEWAY_KEY_ENV}`,
+        "else",
+        `  ${EXTERNAL_VARIABLE}=0 ${URL_VARIABLE}=${DAIMON_GATEWAY_URL}`,
+        // Rotated every start: 32 random bytes as lowercase hex, held only in this root shell.
+        `  ${KEY_VARIABLE}=$(od -An -vtx1 -N32 /dev/urandom | tr -d ' \\n')`,
+        ...renderDaimonGatewayStateProvisioning(descriptors),
+        "fi"
+    ];
+};
+/**
+ * Starts the gateway as its own uid with no capabilities, after proving the
+ * organization uid (and a broker uid) cannot read any gateway-held path, then waits for its uid,
+ * bounding set and loopback port. Uses the shared startup supervision helpers.
+ */
+export const renderDaimonGatewayLaunch = (plans, runtimeRoot) => {
+    const descriptors = resolveDaimonGatewayEngines(plans);
+    if (descriptors.length === 0)
+        return [];
+    const realmPaths = descriptors.map(daimonGatewayRealmPath);
+    const hidden = [...realmPaths, DAIMON_GATEWAY_BOOTSTRAP_ROOT, DAIMON_GATEWAY_ETC, DAIMON_GATEWAY_RUN];
+    // Neither the organization uid nor a broker (which reaches the gateway only by key) may read the login.
+    const outsiders = [DAIMON_ORGANIZATION_UID, ...(descriptors.some((descriptor) => descriptor.broker !== null) ? [DAIMON_BROKER_UID] : [])];
+    return [
+        `if [ "$${EXTERNAL_VARIABLE}" = 0 ]; then`,
+        ...outsiders.flatMap((uid) => hidden.map((target) => `${drop(uid)} bash -ceu '! test -r ${target} && ! test -x ${target}'`)),
+        ...realmPaths.map((target) => `${drop(DAIMON_GATEWAY_UID)} bash -ceu 'probe=${target}/.daimon-gateway-probe; umask 077; : > "$probe"; rm "$probe"'`),
+        `${drop(DAIMON_GATEWAY_UID)} env -i PATH="$PATH" HOME=/nonexistent LANG=C.UTF-8 ${path.posix.join(runtimeRoot, "bin/daimon-runtime")} gateway --config ${DAIMON_GATEWAY_CONFIG} &`,
+        "gateway_pid=$!",
+        "startup_children+=(\"$gateway_pid\")",
+        `wait_for_broker_identity "$gateway_pid" ${DAIMON_GATEWAY_UID} 0000000000000000 "auth gateway"`,
+        "until (exec 3<>/dev/tcp/127.0.0.1/" + DAIMON_GATEWAY_PORT + ") 2>/dev/null; do",
+        "  if ! kill -0 \"$gateway_pid\" 2>/dev/null; then echo \"auth gateway exited before readiness\" >&2; exit 1; fi",
+        "  if [ $((SECONDS - broker_startup_started)) -ge \"$broker_startup_timeout_seconds\" ]; then echo \"auth gateway readiness timed out after ${broker_startup_timeout_seconds}s\" >&2; exit 1; fi",
+        "  sleep \"$broker_startup_poll_seconds\"",
+        "done",
+        "fi"
+    ];
+};
+/** Env assignments prefixed onto the organization runtime launch; empty without a gateway. */
+export const renderDaimonGatewayRuntimeEnv = (plans) => resolveDaimonGatewayEngines(plans).length === 0
+    ? ""
+    : `${DAIMON_GATEWAY_URL_ENV}="$${URL_VARIABLE}" ${DAIMON_GATEWAY_KEY_ENV}="$${KEY_VARIABLE}" `;
+/** The training sidecar answers on its run's private network under this alias. */
+export const DAIMON_GATEWAY_SIDECAR_ALIAS = "daimon-gateway";
+export const DAIMON_GATEWAY_SIDECAR_URL = `http://${DAIMON_GATEWAY_SIDECAR_ALIAS}:${DAIMON_GATEWAY_PORT}`;
+/** Env name carrying the run's 64-hex gateway key into the sidecar's root shell; unset before anything else starts. */
+export const DAIMON_GATEWAY_SIDECAR_KEY_ENV = "SPAWNFILE_DAIMON_GATEWAY_KEY";
+/**
+ * Root script for the sidecar placement: the same binary, state provisioning
+ * and uid as the in-container gateway, bound to the run's private network
+ * instead of loopback, with the run's key supplied rather than generated.
+ * Trials reach it at {@link DAIMON_GATEWAY_SIDECAR_URL} with that key.
+ */
+export const renderDaimonGatewaySidecarScript = (engines, runtimeRoot) => {
+    const descriptors = daimonGatewayedEngines(engines);
+    if (descriptors.length === 0)
+        throw new Error("the auth gateway sidecar needs at least one gatewayed engine");
+    return [
+        "set -euo pipefail",
+        `if ! getent group ${DAIMON_GATEWAY_UID} >/dev/null; then groupadd -K GID_MIN=1 --gid ${DAIMON_GATEWAY_UID} daimon-${DAIMON_GATEWAY_UID}; fi`,
+        `if ! getent passwd ${DAIMON_GATEWAY_UID} >/dev/null; then useradd -K UID_MIN=1 --no-create-home --no-log-init --uid ${DAIMON_GATEWAY_UID} --gid ${DAIMON_GATEWAY_UID} --home-dir /nonexistent --shell /usr/sbin/nologin daimon-${DAIMON_GATEWAY_UID}; fi`,
+        `${KEY_VARIABLE}=\${${DAIMON_GATEWAY_SIDECAR_KEY_ENV}:?the gateway sidecar needs its run key}`,
+        `unset ${DAIMON_GATEWAY_SIDECAR_KEY_ENV}`,
+        ...renderDaimonGatewayStateProvisioning(descriptors, "0.0.0.0"),
+        `unset ${KEY_VARIABLE}`,
+        `exec ${drop(DAIMON_GATEWAY_UID)} env -i PATH="$PATH" HOME=/nonexistent LANG=C.UTF-8 ${path.posix.join(runtimeRoot, "bin/daimon-runtime")} gateway --config ${DAIMON_GATEWAY_CONFIG}`
+    ].join("\n") + "\n";
+};

package/dist/compiler/containerDaimonGrokWorkerProvisioning.d.ts

@@ -1,4 +1,4 @@
-import { type DaimonGrokRegistration, type DaimonGrokServiceConfigOptions } from "./containerDaimonGrokWorkerRender.js";
+import { type DaimonGrokRegistration } from "./containerDaimonGrokWorkerRender.js";
 /**
  * Root provisioning for every brokered Grok worker, as lines of the broker's
  * node provisioning program (which already defines `crypto`, `fs`, and
@@ -18,15 +18,7 @@ import { type DaimonGrokRegistration, type DaimonGrokServiceConfigOptions } from
  * the wrong inode. Root chmods only paths it owns at that moment (no
  * `CAP_FOWNER`): reclaim, mode, then hand over.
  */
-export declare const renderDaimonGrokWorkerProvisioning: (registrations: readonly DaimonGrokRegistration[], serviceOptions?: DaimonGrokServiceConfigOptions, 
-/**
- * Deny targets this program creates root-owned `0700` when they are absent,
- * so every mask always has an inode. The default is the production
- * container's set; the training container passes its own, because its roots
- * are tmpfs mounts and `/run/secrets` and the shared state roots do not
- * exist there at all.
- */
-optionalDenyPaths?: readonly string[], scope?: "container" | "slot") => string[];
+export declare const renderDaimonGrokWorkerProvisioning: (registrations: readonly DaimonGrokRegistration[]) => string[];
 /**
  * Grok 1.0.34 runs every sandbox profile inside bubblewrap, which needs
  * unprivileged user namespaces. Ubuntu 24.04+ hosts (and Colima's default VM)

package/dist/compiler/containerDaimonGrokWorkerProvisioning.js

@@ -1,6 +1,5 @@
-import { renderDaimonGrokTaskClockProvisioning } from "./containerDaimonGrokTaskClock.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../runtime/daimon/contractManifest.js";
-import { resolveDaimonGrokClockedWorkerConfig, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
+import { resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
 import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
 import { DAIMON_GROK_DENIED_STATE_ROOTS, DAIMON_GROK_OPTIONAL_DENY_PATHS, DAIMON_GROK_WORKER_READ_ONLY_FILES, DAIMON_WORKER_ROOT, renderDaimonGrokServiceConfig } from "./containerDaimonGrokWorkerRender.js";
 /** Only the bytes the program writes; everything else it needs is recomputed or checked in place. */
@@ -64,22 +63,12 @@ const renderDaimonGrokWorkerSkillsProvisioning = (registrations) => registration
  * the wrong inode. Root chmods only paths it owns at that moment (no
  * `CAP_FOWNER`): reclaim, mode, then hand over.
  */
-export const renderDaimonGrokWorkerProvisioning = (registrations, serviceOptions = {}, 
-/**
- * Deny targets this program creates root-owned `0700` when they are absent,
- * so every mask always has an inode. The default is the production
- * container's set; the training container passes its own, because its roots
- * are tmpfs mounts and `/run/secrets` and the shared state roots do not
- * exist there at all.
- */
-optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS], scope = "container") => [
+export const renderDaimonGrokWorkerProvisioning = (registrations) => [
     `const grokWorkers = ${JSON.stringify(registrations.map(programRegistration))};`,
-    `const optionalDenyPaths = new Set(${JSON.stringify([...optionalDenyPaths])});`,
+    // Deny targets created root-owned `0700` when absent, so every mask always has an inode.
+    `const optionalDenyPaths = new Set(${JSON.stringify([...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS])});`,
     // Derive each expected hash from manifest-validated bytes, never from the registration's digest.
-    // Clocked templates are pinned at slot zero, then specialized by the contract resolver.
-    `const pinnedConfigSha256 = ${JSON.stringify(registrations.map(entry => (entry.configVariant === "clocked"
-        ? resolveDaimonGrokClockedWorkerConfig(entry.model, entry.reasoningEffort, entry.slot)
-        : resolveDaimonGrokWorkerConfig(entry.model, entry.reasoningEffort)).sha256))};`,
+    `const pinnedConfigSha256 = ${JSON.stringify(registrations.map(entry => resolveDaimonGrokWorkerConfig(entry.model, entry.reasoningEffort).sha256))};`,
     "const sha256Hex = (value) => crypto.createHash('sha256').update(value).digest('hex');",
     "for (const [index, entry] of grokWorkers.entries()) { if (sha256Hex(entry.config) !== entry.configSha256 || pinnedConfigSha256[index] !== entry.configSha256 || sha256Hex(entry.profile) !== entry.profileSha256 || entry.denyPaths.length === 0) throw new Error(`Grok worker contract bytes for ${entry.agentId} do not match their pins`); }",
     // Root holds no CAP_FOWNER: every mode change reclaims the inode, sets the mode, then restores or hands over ownership.
@@ -92,19 +81,18 @@ optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_S
     "const ensureDirectory = (target, uid, gid, mode) => { fs.mkdirSync(target, { recursive: true, mode: 0o700 }); const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('unsafe worker runtime directory'); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
     "const ensureExactFile = (target, content, mode) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, content, { mode, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) throw new Error('unsafe worker runtime file'); if (fs.readFileSync(target, 'utf8') !== content) throw new Error(`worker runtime file identity mismatch: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); };",
     `const ensureEventsFile = (target, uid) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, '', { mode: 0o640, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (info.uid !== uid && info.uid !== 0) || ![0, uid, ${DAIMON_BROKER_UID}].includes(info.gid) || ![0o600, 0o640, 0o644].includes(info.mode & 0o777)) throw new Error('unsafe worker attestation events'); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o640); fs.chownSync(target, uid, ${DAIMON_BROKER_UID}); };`,
-    ...(scope === "slot" ? [] : renderDaimonGrokTaskClockProvisioning(registrations)),
-    ...(scope === "slot" ? [] : [`fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`]),
+    `fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`,
     // Pass 1: every workspace and home exists, root-held, before any deny list is checked.
-    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ${scope === "container" ? "ensureDirectory(entry.home, 0, 0, 0o700);" : ""} ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
+    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ensureDirectory(entry.home, 0, 0, 0o700); ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
     "for (const denied of optionalDenyPaths) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.mkdirSync(denied, { mode: 0o700 }); fs.chownSync(denied, 0, 0); fs.chmodSync(denied, 0o700); } }",
     "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { try { assertCanonical(denied, 'deny path'); } catch (error) { if (error.code === 'ENOENT' && entry.deferredDenyPaths.includes(denied)) continue; if (error.code === 'ENOENT') throw new Error(`Grok worker deny path is missing: ${denied}`); throw error; } }",
     ...renderDaimonGrokWorkerSkillsProvisioning(registrations),
     // Pass 2: exact root-owned read-only files, the events file, then the final sticky modes.
-    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ${scope === "container" ? `ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710);` : ""} for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
+    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710); for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
     // Worker-private temp: the launcher compiles TMPDIR=<home>/tmp, the only temp the worker may write. It is
     // created in the pass above, while the home is still root-owned: root here holds no CAP_DAC_OVERRIDE, so
     // once the home is `<worker>:<broker> 0710` root can no longer create anything inside it.
-    `for (const entry of grokWorkers) { ${scope === "container" ? "ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700);" : ""} assertCanonical(entry.privateTmp, 'private temp'); }`,
+    `for (const entry of grokWorkers) { ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); assertCanonical(entry.privateTmp, 'private temp'); }`,
     // Spills: <runtimeHome>/tool-output 2000:<worker> 2750 (setgid) under a runtime home the worker's group can
     // traverse. Root reclaims the runtime home before creating the spill directory: the compiler lists every
     // organization runtime home as a private directory, so the container's ownership pass has already handed
@@ -113,7 +101,7 @@ optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_S
     // `withMode` still narrows the home to its final `2000:<worker> 0710`, so the end state is unchanged.
     `for (const entry of grokWorkers) { traversable(entry.runtimeHome); fs.mkdirSync(entry.runtimeHome, { recursive: true, mode: 0o700 }); assertCanonical(entry.runtimeHome, 'runtime home'); reclaimForRoot(entry.runtimeHome); try { fs.mkdirSync(entry.spillDirectory, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; } assertCanonical(entry.spillDirectory, 'spill directory'); withMode(entry.spillDirectory, 0o2750, ${DAIMON_ORGANIZATION_UID}, entry.uid); for (const mounted of entry.runtimeHomeMounts) { assertCanonical(mounted, 'runtime home mount'); withMode(mounted, 0o700, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } withMode(entry.runtimeHome, 0o710, ${DAIMON_ORGANIZATION_UID}, entry.uid); }`,
     // Shared temp: Grok refuses a profile denying /tmp or /var/tmp, so modes close them: root:<org group> 1774 lets workers list names only.
-    ...(scope === "slot" ? [] : [`for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`]),
+    `for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`,
     // Deny-path placement, asserted once every mode above is final. A resource backing the organization
     // entrypoint only materializes later is created here, empty and root-owned, rather than skipped: the
     // engine broker starts before that entrypoint runs and its own placement preflight refuses a deny target
@@ -131,9 +119,9 @@ optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_S
     "const searches = (info, uid, gid) => info.uid === uid ? (info.mode & 0o100) !== 0 : info.gid === gid ? (info.mode & 0o010) !== 0 : (info.mode & 0o001) !== 0;",
     "const assertPlaceable = (denied, uid, gid) => { const parts = denied.split('/').slice(1); let at = ''; for (const part of parts.slice(0, -1)) { at += `/${part}`; let info; try { info = fs.lstatSync(at); } catch (error) { throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} could not be read (${error.code})`); } if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} is not a directory`); if (!searches(info, uid, gid)) throw new Error(`Grok worker deny path ${denied} is not placeable: worker uid ${uid} cannot search ${at} (${(info.mode & 0o7777).toString(8)} ${info.uid}:${info.gid}); deny that directory itself instead`); } };",
     "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { if (entry.deferredDenyPaths.includes(denied)) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; createDeferredDenyTarget(denied); } } assertPlaceable(denied, entry.uid, entry.uid); }",
-    ...(scope === "slot" ? [] : [`const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations, serviceOptions))};`,
-        "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.slot === registration.slot); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
-        `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`])
+    `const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations))};`,
+    "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.slot === registration.slot); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
+    `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`
 ];
 const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
 /**

package/dist/compiler/containerDaimonGrokWorkerRender.d.ts

@@ -49,8 +49,6 @@ export interface DaimonGrokRegistration {
     agentId: string;
     config: string;
     configSha256: string;
-    /** Selects trusted config bytes; production retains the unclocked default. */
-    configVariant?: "unclocked" | "clocked";
     denyPaths: string[];
     /** Deny entries the main entrypoint materializes after root provisioning (workspace resource backings); absent is allowed there, a symlink never. */
     deferredDenyPaths: string[];
@@ -138,26 +136,20 @@ export declare const DAIMON_GROK_DENIED_STATE_ROOTS: readonly ["/var/lib/spawnfi
  */
 export declare const resolveDaimonGrokWorkerDenyPaths: (plans: readonly RuntimeTargetPlan[], plan: RuntimeTargetPlan, agentId: string, workerHomes: readonly string[], ownHome: string) => string[];
 export declare const resolveDaimonGrokRegistrations: (plans: RuntimeTargetPlan[]) => DaimonGrokRegistration[];
-export interface DaimonGrokServiceConfigOptions {
-    /** Repeated agent IDs use v3 slot policies; production retains v2 by default. */
-    version?: "v3";
-    maxRunRequests?: number;
-    runRequestStore?: string;
-    /**
-     * Where the broker keeps its durable turn registry. Production keeps it on
-     * the realm volume beside the credential; training overrides it to per-slot
-     * tmpfs so a recycled slot can never replay trial N's sealed turn in trial
-     * N+1 (R2), and refuses any path on the realm volume for that reason.
-     */
-    turnStore?: string;
-    /** `service.json` v2's optional evaluator inference ledger. Without it the broker refuses every grant. */
-    inferenceLedgerPath?: string;
-}
 /** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
-export declare const renderDaimonGrokServiceConfig: (registrations: readonly DaimonGrokRegistration[], options?: DaimonGrokServiceConfigOptions) => {
-    slotPolicies?: {
+export declare const renderDaimonGrokServiceConfig: (registrations: readonly DaimonGrokRegistration[]) => {
+    version: "noopolis.daimon.engine-broker-service.v2";
+    credentialHome: "/var/lib/spawnfile/daimon/grok-subscription-realm";
+    turnStore: "/var/lib/spawnfile/daimon/grok-subscription-realm/turns";
+    registrations: {
         skillsSha256?: string | undefined;
+        agentId: string;
         slot: number;
+        workerUid: number;
+        workspace: string;
+        profilePath: string;
+        eventsPath: string;
+        profileSha256: string;
         usageLedgerPath: string;
         limits: {
             maxRequests: 32;
@@ -172,35 +164,5 @@ export declare const renderDaimonGrokServiceConfig: (registrations: readonly Dai
             id: "grok-4.6" | "grok-4.5" | "grok-build";
             reasoningEffort: "low" | "medium" | "high";
         };
-    }[] | undefined;
-    registrations: {
-        skillsSha256?: string | undefined;
-        usageLedgerPath?: string | undefined;
-        limits?: {
-            maxRequests: 32;
-            maxTokens: 300000;
-            timeoutMs: 240000;
-        } | {
-            maxRequests: number;
-            maxTokens: number;
-            timeoutMs: number;
-        } | undefined;
-        model?: {
-            id: "grok-4.6" | "grok-4.5" | "grok-build";
-            reasoningEffort: "low" | "medium" | "high";
-        } | undefined;
-        agentId: string;
-        slot: number;
-        workerUid: number;
-        workspace: string;
-        profilePath: string;
-        eventsPath: string;
-        profileSha256: string;
     }[];
-    inferenceLedgerPath?: string | undefined;
-    runRequestStore?: string | undefined;
-    maxRunRequests?: number | undefined;
-    version: "noopolis.daimon.engine-broker-service.v2" | "noopolis.daimon.engine-broker-service.v3";
-    credentialHome: "/var/lib/spawnfile/daimon/grok-subscription-realm";
-    turnStore: string;
 };

package/dist/compiler/containerDaimonGrokWorkerRender.js

@@ -1,3 +1,4 @@
+import { DAIMON_GATEWAY_BOOTSTRAP_ROOT, DAIMON_GATEWAY_ETC, DAIMON_GATEWAY_RUN, daimonGatewayRealmPath, isDaimonGatewayedEngine } from "../runtime/daimon/gateway.js";
 import { daimonEngineHasBroker, getDaimonEngineDescriptor } from "../runtime/daimon/index.js";
 import path from "node:path";
 import { SpawnfileError } from "../shared/index.js";
@@ -125,10 +126,13 @@ export const resolveDaimonGrokWorkerDenyPaths = (plans, plan, agentId, workerHom
     const peers = agents.filter(([id]) => id !== agentId).map(([id]) => nodeSlug(id));
     const daimonOwn = [
         ...[...new Set(agents.map(([, engine]) => engine))].flatMap((engine) => {
-            const auth = getDaimonEngineDescriptor(engine)?.auth;
-            return auth?.staging === "portable-realm" ? [auth.realm.bootstrapMountPath, auth.realm.durableMountPath] : [];
+            const descriptor = getDaimonEngineDescriptor(engine);
+            // A gatewayed bootstrap leaf sits under the root-only gateway root; mask that root, the realm and the gateway's state.
+            return isDaimonGatewayedEngine(descriptor)
+                ? [DAIMON_GATEWAY_BOOTSTRAP_ROOT, daimonGatewayRealmPath(descriptor), DAIMON_GATEWAY_ETC, DAIMON_GATEWAY_RUN]
+                : [];
         }),
-        DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath,
+        // The broker's local turn-state home (it holds no credential in gateway mode).
         DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath,
         ...(agents.some(([, engine]) => getDaimonEngineDescriptor(engine)?.auth.staging === "secret-service") ? [DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath, DAIMON_AGY_SUBSCRIPTION_REALM.durableMountPath] : []),
         daimonGrokAcceptanceStoreDenyPath(instanceRoot),
@@ -242,33 +246,11 @@ export const resolveDaimonGrokRegistrations = (plans) => {
         };
     });
 };
-const resolveDaimonGrokTurnStore = (turnStore) => {
-    if (turnStore === undefined)
-        return DAIMON_GROK_ENGINE_BROKER.turnStorePath;
-    assertCanonicalRegisteredPath("turn store", turnStore);
-    if (turnStore === DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath || turnStore.startsWith(`${DAIMON_GROK_SUBSCRIPTION_REALM.durableMountPath}/`)) {
-        fail(`Grok broker turn store ${turnStore} is on the durable credential realm; a recycled slot would replay the previous trial's sealed turns`);
-    }
-    return turnStore;
-};
-const resolveDaimonGrokInferenceLedger = (inferenceLedgerPath, registrations) => {
-    assertCanonicalRegisteredPath("inference ledger", inferenceLedgerPath);
-    if (!inferenceLedgerPath.endsWith(".jsonl"))
-        fail(`Grok inference ledger must be a .jsonl path: ${inferenceLedgerPath}`);
-    const subject = new Set([DAIMON_GROK_TURN_USAGE_LEDGER.filePath, path.posix.join(DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, "requests.jsonl"),
-        ...registrations.flatMap((entry) => [entry.usageLedgerPath, path.posix.join(path.posix.dirname(entry.usageLedgerPath), "requests.jsonl")])]);
-    if (subject.has(inferenceLedgerPath))
-        fail(`Grok inference ledger ${inferenceLedgerPath} is a subject usage ledger; judge spend must never reach the wake fuse`);
-    return inferenceLedgerPath;
-};
 /** `service.json` v2, exactly the shape Daimon's strict `parseEngineBrokerServiceConfig` accepts. */
-export const renderDaimonGrokServiceConfig = (registrations, options = {}) => ({
-    version: DAIMON_GROK_ENGINE_BROKER.serviceConfigVersions[options.version === "v3" ? 2 : 1],
+export const renderDaimonGrokServiceConfig = (registrations) => ({
+    version: DAIMON_GROK_ENGINE_BROKER.serviceConfigVersions[1],
     credentialHome: DAIMON_GROK_ENGINE_BROKER.credentialHomePath,
-    turnStore: resolveDaimonGrokTurnStore(options.turnStore),
-    ...(options.maxRunRequests === undefined ? {} : { maxRunRequests: options.maxRunRequests }),
-    ...(options.runRequestStore === undefined ? {} : { runRequestStore: assertCanonicalRegisteredPath("run request store", options.runRequestStore) }),
-    ...(options.inferenceLedgerPath === undefined ? {} : { inferenceLedgerPath: resolveDaimonGrokInferenceLedger(options.inferenceLedgerPath, registrations) }),
+    turnStore: DAIMON_GROK_ENGINE_BROKER.turnStorePath,
     registrations: registrations.map((entry) => ({
         agentId: entry.agentId,
         slot: entry.slot,
@@ -277,15 +259,9 @@ export const renderDaimonGrokServiceConfig = (registrations, options = {}) => ({
         profilePath: entry.profilePath,
         eventsPath: entry.eventsPath,
         profileSha256: entry.profileSha256,
-        ...(options.version === "v3" ? {} : { usageLedgerPath: entry.usageLedgerPath,
-            limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
-            model: { id: entry.model, reasoningEffort: entry.reasoningEffort },
-            ...(entry.skills ? { skillsSha256: entry.skills.sha256 } : {}) })
-    })),
-    ...(options.version === "v3" ? { slotPolicies: registrations.map(entry => ({
-            slot: entry.slot, usageLedgerPath: entry.usageLedgerPath,
-            limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
-            model: { id: entry.model, reasoningEffort: entry.reasoningEffort },
-            ...(entry.skills ? { skillsSha256: entry.skills.sha256 } : {})
-        })) } : {})
+        usageLedgerPath: entry.usageLedgerPath,
+        limits: { ...(entry.limits ?? DAIMON_GROK_ENGINE_BROKER.turnLimits.v1Defaults) },
+        model: { id: entry.model, reasoningEffort: entry.reasoningEffort },
+        ...(entry.skills ? { skillsSha256: entry.skills.sha256 } : {})
+    }))
 });

package/dist/compiler/containerDaimonStartupSupervision.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Root-side supervision for the privileged startup children (engine broker,
+ * relay, launcher and auth gateway): bounded readiness waits plus one EXIT
+ * trap that terminates every started child if startup fails.
+ */
+export declare const DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS = 60;
+export declare const renderDaimonBrokerSocketWait: (timeoutSeconds?: number, pollSeconds?: number) => string[];
+export declare const renderDaimonStartupSupervision: () => string[];

package/dist/compiler/containerDaimonStartupSupervision.js

@@ -0,0 +1,39 @@
+/**
+ * Root-side supervision for the privileged startup children (engine broker,
+ * relay, launcher and auth gateway): bounded readiness waits plus one EXIT
+ * trap that terminates every started child if startup fails.
+ */
+export const DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS = 60;
+export const renderDaimonBrokerSocketWait = (timeoutSeconds = DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS, pollSeconds = 0.1) => [
+    `broker_startup_timeout_seconds=${timeoutSeconds}`,
+    `broker_startup_poll_seconds=${pollSeconds}`,
+    "broker_startup_started=$SECONDS",
+    "broker_process_status_root=/proc",
+    "wait_for_broker_socket() {",
+    "  socket=$1; child=$2; label=$3",
+    "  while [ ! -S \"$socket\" ]; do",
+    "    if ! kill -0 \"$child\" 2>/dev/null; then set +e; wait \"$child\"; child_status=$?; set -e; echo \"$label exited before readiness (status $child_status)\" >&2; return 1; fi",
+    "    if [ $((SECONDS - broker_startup_started)) -ge \"$broker_startup_timeout_seconds\" ]; then echo \"$label readiness timed out after ${broker_startup_timeout_seconds}s\" >&2; return 1; fi",
+    "    sleep \"$broker_startup_poll_seconds\"",
+    "  done",
+    "}",
+    "wait_for_broker_identity() {",
+    "  child=$1; expected_uid=$2; expected_caps=$3; label=$4",
+    "  while kill -0 \"$child\" 2>/dev/null; do",
+    "    status_path=$broker_process_status_root/$child/status",
+    "    observed_uid=$(awk '/^Uid:/{print $2}' \"$status_path\" 2>/dev/null || true)",
+    "    observed_caps=$(awk '/^CapBnd:/{print $2}' \"$status_path\" 2>/dev/null || true)",
+    "    if [ \"$observed_uid\" = \"$expected_uid\" ] && [ \"$observed_caps\" = \"$expected_caps\" ]; then return 0; fi",
+    "    if [ $((SECONDS - broker_startup_started)) -ge \"$broker_startup_timeout_seconds\" ]; then echo \"$label identity readiness timed out after ${broker_startup_timeout_seconds}s\" >&2; return 1; fi",
+    "    sleep \"$broker_startup_poll_seconds\"",
+    "  done",
+    "  set +e; wait \"$child\"; child_status=$?; set -e; echo \"$label exited before identity readiness (status $child_status)\" >&2; return 1",
+    "}"
+];
+export const renderDaimonStartupSupervision = () => [
+    ...renderDaimonBrokerSocketWait(),
+    "startup_children=()",
+    "cleanup_broker_startup() { status=$?; trap - EXIT; for child in \"${startup_children[@]}\"; do kill -TERM \"$child\" 2>/dev/null || true; wait \"$child\" 2>/dev/null || true; done; return \"$status\"; }",
+    "trap cleanup_broker_startup EXIT",
+    "trap 'exit 143' TERM INT HUP"
+];

package/dist/compiler/containerDaimonUidEntrypointRender.d.ts

@@ -2,12 +2,11 @@ import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
 import type { EntrypointOptions } from "./containerEntrypointRender.js";
 import { type BackedMountRequirement } from "./containerBackedMountRender.js";
 export { resolveDaimonVolumeIdentityFiles } from "./containerDaimonOwnershipGuardRender.js";
+export { DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS, renderDaimonBrokerSocketWait } from "./containerDaimonStartupSupervision.js";
 export declare const DAIMON_AUTHORIZED_UID_ENV = "SPAWNFILE_DAIMON_AUTHORIZED_UID";
 export declare const DAIMON_RUNTIME_UID = 2000;
 export declare const DAIMON_UID_ENTRYPOINT_PATH = "/opt/spawnfile/daimon-uid-entrypoint.sh";
 export declare const DAIMON_RUNTIME_HOMES_DIRECTORY = "runtime-homes";
-export declare const DAIMON_BROKER_STARTUP_TIMEOUT_SECONDS = 60;
-export declare const renderDaimonBrokerSocketWait: (timeoutSeconds?: number, pollSeconds?: number) => string[];
 export declare const resolveDaimonUidEntrypointStateRoots: (runtimePlans: RuntimeTargetPlan[]) => string[];
 export interface DaimonUidEntrypointOwnershipPlan {
     creatablePrivateDirectories: Array<{