spawnfile 0.1.33 → 0.1.34

package/dist/runtime/daimon/training/native/child/diagnostics.js

@@ -1,215 +0,0 @@
-import { canonicalWireId } from '../../../../../training/index.js';
-import { lstat, realpath, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-const limit = 65_536;
-/** Published tails are for identifying a defect class, not for reading a transcript. */
-const published = 4_096;
-/**
- * Below this length a value cannot carry credential entropy, and substituting it
- * would corrupt unrelated text while proving nothing. Such values are not
- * redaction targets; the assignment scrub below still keeps them from being
- * published as a named environment value.
- */
-const shortestRedactableSecret = 8;
-/** Environment values are never published verbatim, including ones this adapter was never told were secret. */
-const assignment = /(^|[\s"'([{,;])([A-Za-z_][A-Za-z0-9_]{1,63})=(\S+)/gu;
-/** Paths whose name says credential: published as a class, never as a location. */
-const credentialPath = /(?:^|(?<=\s))\S*\/\S*(?:auth\.json|\.pem|\.key|token)\S*/giu;
-/** Undeclared credential-shaped material: what substitution cannot remove because nobody declared it. */
-const credentialShaped = [/bearer\s+\S+/iu, /-----BEGIN [A-Z ]*(?:PRIVATE KEY|CERTIFICATE)/u];
-const opaqueRun = /[A-Za-z0-9_-]{40,}/gu;
-export const redactedMarker = '[redacted]';
-export const redactedPathMarker = '[redacted-path]';
-const truncate = (text) => text.length > published ? `${text.slice(0, published)}…` : text;
-/** Longest message published from a frame; a frame is an identity and a sentence, not a transcript. */
-const framedMessage = 512;
-const maximumFrames = 8;
-export const withholdDetectors = ['declared-secret', 'bearer', 'pem', 'opaque-run'];
-/**
- * Which detector refuses this text, named rather than counted.
- *
- * Knowing that a bearer header fired tells an operator "the runtime threw with a
- * capability token in the message"; knowing that a long opaque run fired tells
- * them "something printed a blob". Without the name, a withheld stream is
- * indistinguishable from a crash with no output at all.
- */
-function withholdingDetectors(text, survivingSecret) {
-    const detectors = [];
-    if (survivingSecret)
-        detectors.push('declared-secret');
-    if (credentialShaped[0].test(text))
-        detectors.push('bearer');
-    if (credentialShaped[1].test(text))
-        detectors.push('pem');
-    if ([...text.matchAll(opaqueRun)].some(match => !/^[0-9a-f]+$/u.test(match[0])))
-        detectors.push('opaque-run');
-    return detectors;
-}
-/**
- * Removes every value this adapter knows to be secret, then refuses to call the
- * result clean if anything credential-shaped is left.
- *
- * Substitution covers the control token, the declared environment values and the
- * credential file paths. The assignment scrub covers a secret nobody declared: a
- * line that echoes `SOMETHING=value` publishes the name and drops the value. What
- * substitution cannot reach is an undeclared credential printed on its own — a
- * bearer header, a PEM block, a long opaque token — so its presence makes the
- * text unpublishable rather than published in the hope that it is harmless.
- */
-export function redactNativeDiagnostic(text, secrets) {
-    const substitutable = [...new Set(secrets.filter(secret => secret.length >= shortestRedactableSecret))];
-    let value = text;
-    for (const secret of substitutable.sort((left, right) => right.length - left.length))
-        value = value.split(secret).join(redactedMarker);
-    value = value.replace(assignment, (_match, lead, key) => `${lead}${key}=${redactedMarker}`);
-    value = value.replace(credentialPath, redactedPathMarker);
-    const detectors = withholdingDetectors(value, substitutable.some(secret => value.includes(secret)));
-    return { text: value, clean: !detectors.length, detectors };
-}
-/** Every `{"schema":…}` line the runtime printed, with the field it states its failure in. */
-function readFrames(stream, text, secrets) {
-    const frames = [];
-    for (const line of text.split(/\r?\n/u)) {
-        if (frames.length >= maximumFrames || !line.trim().startsWith('{'))
-            continue;
-        let row;
-        try {
-            row = JSON.parse(line);
-        }
-        catch {
-            continue;
-        }
-        if (!row || typeof row !== 'object' || typeof row.schema !== 'string' || !row.schema)
-            continue;
-        const stated = [row.error, row.reason, row.message].find(value => typeof value === 'string' && value);
-        if (stated === undefined) {
-            frames.push({ stream, schema: row.schema });
-            continue;
-        }
-        // The schema is an identity, never a secret, so it publishes even when the message it carries cannot.
-        const message = redactNativeDiagnostic(String(stated).slice(0, framedMessage), secrets);
-        frames.push({ stream, schema: row.schema, ...(message.clean ? { message: message.text } : { withheldBy: message.detectors }) });
-    }
-    return frames.length ? frames : undefined;
-}
-const lineCount = (text) => text ? text.split(/\r?\n/u).length : 0;
-/** The worker's own stated failure is the best reason; a frame from any layer beats an exit status. */
-function classify(frames, exitCode, exitSignal, fallback) {
-    const stated = frames?.filter(frame => frame.message !== undefined) ?? [];
-    const worker = stated.find(frame => canonicalWireId(frame.schema) === 'spawnfile.training.daimon-native.start-failed.v1');
-    // Any layer's own account — the worker's, or a caller bootstrap's — outranks an exit code.
-    const frame = worker ?? stated.at(-1);
-    if (frame)
-        return `${frame.schema}: ${frame.message}`;
-    if (exitSignal)
-        return `Native worker terminated by signal ${exitSignal}: ${fallback}`;
-    if (exitCode !== null && exitCode !== 0)
-        return `Native worker exited with code ${exitCode}: ${fallback}`;
-    return fallback;
-}
-/**
- * Carries the publishable record, and the unredacted capture, out of startup.
- *
- * The caller persists the record durably and writes the capture to the
- * operator's own run output as an operator-only file. The capture never reaches
- * the event stream, a report or a viewer projection.
- */
-export class NativeStartupFailure extends Error {
-    diagnostic;
-    capture;
-    constructor(message, diagnostic, capture) {
-        super(message);
-        this.diagnostic = diagnostic;
-        this.capture = capture;
-        this.name = 'NativeStartupFailure';
-    }
-}
-/** Protected process output, never a public observation or a model/judge input. */
-export async function childDiagnostics(root, trialId, configSha256, secrets = []) {
-    const directory = await lstat(root);
-    if (!directory.isDirectory() || directory.isSymbolicLink() || await realpath(root) !== root || (directory.mode & 0o777) !== 0o700) {
-        throw new Error('Native diagnostics require the protected canonical control directory');
-    }
-    const file = join(root, 'child-diagnostics.json');
-    const streams = { stdout: { bytes: Buffer.alloc(0), truncated: false }, stderr: { bytes: Buffer.alloc(0), truncated: false } };
-    let saved;
-    let status = { exitCode: null, exitSignal: null };
-    return {
-        file,
-        append(chunk, stdout) {
-            if (saved)
-                return;
-            const stream = stdout ? streams.stdout : streams.stderr;
-            const remaining = limit - stream.bytes.length;
-            stream.truncated ||= chunk.length > remaining;
-            if (remaining > 0)
-                stream.bytes = Buffer.concat([stream.bytes, chunk.subarray(0, remaining)]);
-        },
-        save(exitCode, exitSignal) {
-            status = { exitCode, exitSignal };
-            return saved ??= writeFile(file, JSON.stringify({ schema: 'spawnfile.training.daimon-native.child-diagnostics.v1', trialId, configSha256,
-                exitCode, exitSignal, limitBytesPerStream: limit,
-                stdout: streams.stdout.bytes.toString('utf8'), stderr: streams.stderr.bytes.toString('utf8'),
-                truncated: { stdout: streams.stdout.truncated, stderr: streams.stderr.truncated },
-            }) + '\n', { flag: 'wx', mode: 0o600 });
-        },
-        /**
-         * The durable half of the protected file above.
-         *
-         * The full capture stays in the control root, which on a training slot is
-         * tmpfs that dies with the container; this redacted record is what an
-         * operator can still read afterwards, and it always names the failure class
-         * even when the bytes themselves have to be withheld.
-         */
-        /**
-         * The publishable record on its own, for a worker that died *after*
-         * readiness. Startup already published one; a mid-turn death published
-         * nothing at all, so the one account of why the worker stopped answering
-         * lived only in the protected file on the slot's tmpfs and died with the
-         * container. Same redaction, same withholding rules, no capture: this
-         * travels in the durable event stream, which outlives the container, and an
-         * unredacted capture has no business there.
-         */
-        record(caught) {
-            return build(caught);
-        },
-        startupFailure(caught) {
-            const diagnostic = build(caught);
-            const raw = { stdout: streams.stdout.bytes.toString('utf8'), stderr: streams.stderr.bytes.toString('utf8') };
-            const capture = { basename: 'OPERATOR-ONLY.native-startup-capture.json',
-                content: `${JSON.stringify({ schema: 'spawnfile.training.daimon-native.operator-capture.v1', trialId, configSha256,
-                    exitCode: status.exitCode, exitSignal: status.exitSignal, protectedArtifact: file,
-                    limitBytesPerStream: limit, stdout: raw.stdout, stderr: raw.stderr,
-                    truncated: { stdout: streams.stdout.truncated, stderr: streams.stderr.truncated } }, null, 2)}\n` };
-            return new NativeStartupFailure(`Native worker failed before readiness: ${diagnostic.reason}`, diagnostic, capture);
-        },
-    };
-    function build(caught) {
-        const fallback = caught instanceof Error ? caught.message : String(caught);
-        const raw = { stdout: streams.stdout.bytes.toString('utf8'), stderr: streams.stderr.bytes.toString('utf8') };
-        const out = redactNativeDiagnostic(raw.stdout, secrets);
-        const err = redactNativeDiagnostic(raw.stderr, secrets);
-        // Frames publish per field, so one unpublishable message never costs the whole account of the failure.
-        const frames = [...readFrames('stdout', raw.stdout, secrets) ?? [], ...readFrames('stderr', raw.stderr, secrets) ?? []];
-        const reason = redactNativeDiagnostic(classify(frames, status.exitCode, status.exitSignal, fallback), secrets);
-        const clean = out.clean && err.clean;
-        const withheld = [['stdout', raw.stdout, out], ['stderr', raw.stderr, err]]
-            .filter(([, , result]) => !result.clean)
-            .map(([stream, text, result]) => ({ stream, bytes: Buffer.byteLength(text), lines: lineCount(text),
-            frame: frames.find(row => row.stream === stream)?.schema ?? null, detectors: result.detectors }));
-        const diagnostic = {
-            schema: 'spawnfile.training.daimon-native.startup-diagnostic.v1', trialId,
-            // A withheld stream still leaves the class identified, so the reason is kept whenever it is itself clean.
-            reason: reason.clean ? truncate(reason.text) : 'Native worker failed before readiness; its stated reason could not be published safely',
-            exitCode: status.exitCode, exitSignal: status.exitSignal,
-            redaction: clean ? 'applied' : 'withheld',
-            ...(clean ? { streams: { stdout: truncate(out.text), stderr: truncate(err.text),
-                    truncated: { stdout: streams.stdout.truncated || out.text.length > published, stderr: streams.stderr.truncated || err.text.length > published } } } : {}),
-            ...(frames.length ? { frames } : {}),
-            ...(withheld.length ? { withheld } : {}),
-            protectedArtifact: file,
-        };
-        return diagnostic;
-    }
-}
-//# sourceMappingURL=diagnostics.js.map

package/dist/runtime/daimon/training/native/child/diagnostics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,KAAK,GAAG,MAAM,CAAC;AACrB,wFAAwF;AACxF,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,+GAA+G;AAC/G,MAAM,UAAU,GAAG,sDAAsD,CAAC;AAC1E,mFAAmF;AACnF,MAAM,cAAc,GAAG,6DAA6D,CAAC;AACrF,yGAAyG;AACzG,MAAM,gBAAgB,GAAG,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;AAC9F,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEpD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAE3G,uGAAuG;AACvG,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAU,CAAC;AAG7F;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,eAAwB;IAClE,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,eAAe;QAAE,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvD,IAAI,gBAAgB,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,gBAAgB,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,OAA0B;IAC7E,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC,CAAC,CAAC;IACxG,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;IAC5G,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,MAA2B,EAAE,IAAY,EAAE,OAA0B;IACvF,MAAM,MAAM,GAAoD,EAAE,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7E,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAC/F,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC;QACtG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpF,sGAAsG;QACtG,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnF,uGAAuG;AACvG,SAAS,QAAQ,CAAC,MAA0C,EAAE,QAAuB,EAAE,UAAyB,EAAE,QAAgB;IAChI,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,kDAAkD,CAAC,CAAC;IAC1H,2FAA2F;IAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAQ,EAAE,CAAC;IACvD,IAAI,UAAU;QAAE,OAAO,sCAAsC,UAAU,KAAK,QAAQ,EAAE,CAAC;IACvF,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,kCAAkC,QAAQ,KAAK,QAAQ,EAAE,CAAC;IAC1G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACP;IAA+C;IAArF,YAAY,OAAe,EAAW,UAAoC,EAAW,OAA8B;QACjH,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,eAAU,GAAV,UAAU,CAA0B;QAAW,YAAO,GAAP,OAAO,CAAuB;QAEjH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,YAAoB,EAAE,UAA6B,EAAE;IACzH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAClI,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/H,IAAI,KAAgC,CAAC;IACrC,IAAI,MAAM,GAAmE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAClH,OAAO;QACL,IAAI;QACJ,MAAM,CAAC,KAAa,EAAE,MAAe;YACnC,IAAI,KAAK;gBAAE,OAAO;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACxD,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAC9C,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YAC9C,IAAI,SAAS,GAAG,CAAC;gBAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAuB,EAAE,UAAiC;YAC7D,MAAM,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,uDAAuD,EAAE,OAAO,EAAE,YAAY;gBACtI,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK;gBAChD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC5F,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE;aAClF,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD;;;;;;;WAOG;QACH;;;;;;;;WAQG;QACH,MAAM,CAAC,MAAe;YACpB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,cAAc,CAAC,MAAe;YAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7G,MAAM,OAAO,GAA0B,EAAE,QAAQ,EAAE,2CAA2C;gBAC5F,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD,EAAE,OAAO,EAAE,YAAY;oBAChH,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI;oBACjF,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACxG,OAAO,IAAI,oBAAoB,CAAC,0CAA0C,UAAU,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACtH,CAAC;KACF,CAAC;IACF,SAAS,KAAK,CAAC,MAAe;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7G,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,uGAAuG;QACvG,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;QACrC,MAAM,QAAQ,GAAI,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAW;aACnF,MAAM,CAAC,CAAC,CAAC,EAAE,AAAD,EAAG,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC;YAChG,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,UAAU,GAA6B;YAC3C,MAAM,EAAE,wDAAwD,EAAE,OAAO;YACzE,0GAA0G;YAC1G,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,wFAAwF;YACvI,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;YACxD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC7E,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3J,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,iBAAiB,EAAE,IAAI;SACxB,CAAC;QACF,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/runtime/daimon/training/native/child/fixture.d.ts

@@ -1,16 +0,0 @@
-/**
- * Real child/loopback protocol fixture only; it does not execute a model or prove
- * sandboxing.
- *
- * `frames` names a file of terminal frames a REAL worker controller produced, one
- * per wake. In that mode this fixture stops inventing evidence and replays them by
- * wake id, which is the only way a test can put the worker's own poll and the
- * parent's evidence reader on the same trial: the two halves live in different
- * processes, and every fix that passed on one side alone went on to fail live.
- */
-export declare function childFixture(mode?: string, frames?: string): Promise<{
-    root: string;
-    input: import("../../../../../training/index.js").SubjectStart;
-    launch: import("../receipt/schema.js").VerifiedNativeLaunch;
-    save(): Promise<void>;
-}>;

package/dist/runtime/daimon/training/native/child/fixture.js

@@ -1,159 +0,0 @@
-import { createServer } from 'node:net';
-import { join } from 'node:path';
-import { readFile, writeFile } from 'node:fs/promises';
-import { launchFixture } from '../test-fixtures.js';
-import { sha256 } from '../receipt/index.js';
-/**
- * Real child/loopback protocol fixture only; it does not execute a model or prove
- * sandboxing.
- *
- * `frames` names a file of terminal frames a REAL worker controller produced, one
- * per wake. In that mode this fixture stops inventing evidence and replays them by
- * wake id, which is the only way a test can put the worker's own poll and the
- * parent's evidence reader on the same trial: the two halves live in different
- * processes, and every fix that passed on one side alone went on to fail live.
- */
-export async function childFixture(mode = 'complete', frames) {
-    const f = await launchFixture();
-    // TMPDIR may sit below an ESM package (as it does in CI). This worker is CommonJS.
-    f.launch.bootstrap.entrypoint = 'bootstrap.cjs';
-    const reservation = createServer();
-    await new Promise(resolve => reservation.listen(0, '127.0.0.1', resolve));
-    f.launch.host.port = reservation.address().port;
-    await new Promise(resolve => reservation.close(() => resolve()));
-    f.launch.workspace.target = f.launch.workspace.source;
-    for (const row of f.launch.projections)
-        row.target = row.source;
-    for (const row of f.launch.credentials)
-        row.target = row.source;
-    const config = JSON.parse(await readFile(f.launch.config, 'utf8'));
-    config.host.port = f.launch.host.port;
-    config.agents[0].workspacePath = f.launch.workspace.target;
-    config.agents[0].runtimeHomePath = f.launch.projections[0].target;
-    config.agents[0].instructions = f.input.instructions;
-    const bytes = JSON.stringify(config);
-    f.launch.configSha256 = sha256(bytes);
-    await writeFile(f.launch.config, bytes);
-    await f.save();
-    await writeFile(f.launch.envFile, `UNIT_CHILD_MODE=${mode}\nNATIVE_TRANSPORT_TOKEN=unit-transport-value\n${frames ? `UNIT_CHILD_FRAMES=${frames}\n` : ''}`);
-    await writeFile(join(f.launch.bootstrap.root, f.launch.bootstrap.entrypoint), worker);
-    return f;
-}
-const worker = `
-const fs=require('node:fs'),http=require('node:http'),crypto=require('node:crypto'),path=require('node:path');
-const args=Object.fromEntries(process.argv.slice(2).reduce((rows,v,i,all)=>i%2?rows:[...rows,[v.slice(2),all[i+1]]],[]));
-const launch=JSON.parse(fs.readFileSync(args.launch)),token=fs.readFileSync(args['token-file'],'utf8').trim(),trial=args['trial-id'],mode=process.env.UNIT_CHILD_MODE;
-fs.writeFileSync(path.join(launch.controlRoot,'child-env.json'),JSON.stringify({fresh:!process.env.UNIT_PARENT_SECRET,home:process.env.HOME,transport:process.env.NATIVE_TRANSPORT_TOKEN,pid:process.pid}));
-if(mode==='noisy'){console.log('Bootstrap progress');process.stderr.write('Unit diagnostic');}
-if(mode==='leak'){process.stderr.write('upstream refused: Bearer sk-unit-'+'A1b2C3d4'.repeat(6)+'\\n');process.stderr.write(JSON.stringify({schema:'spawnfile.training.daimon-native.start-failed.v1',error:'unit missing native library'})+'\\n');process.exit(1);}
-if(mode==='exit'){process.stderr.write(JSON.stringify({schema:'spawnfile.training.daimon-native.start-failed.v1',error:'unit missing native library'})+'\\n');process.exit(1);}if(mode==='overflow'){process.stdout.write('X'.repeat(1100000));setInterval(()=>{},1000);return;}
-let terminal;const replay=process.env.UNIT_CHILD_FRAMES?JSON.parse(fs.readFileSync(process.env.UNIT_CHILD_FRAMES,'utf8')):undefined;const health={version:'noopolis.daimon.organization-runtime-health.v1',state:'running',agents:[{agentId:mode==='bad-health'?'foreign':launch.agent.id}]};
-// The real worker stops its own Daimon host as soon as a delivery closes its execution and
-// stays deferred with no continuation left, so the caller's closure query lands on a stopped
-// runtime. Daimon seals the v2 activity projection at that stop and keeps answering it;
-// an 'unanswerable' mode reproduces the host that answers HTTP 503 native_host_unavailable there.
-let hostStopped=false,wakes=0,budget=0,stopOutcome,items=[],admitted=[],closed=[];
-// Daimon's real seal keeps one accepted-delivery record per wake of the trial, so a
-// continued trial's projection is never the single-item shape one wake produces.
-const activity=()=>({version:'noopolis.daimon.organization-runtime-activity.v2',
-state:hostStopped?'stopped':'running',items,
-// A host that stopped with work still admitted seals that honestly, and the caller
-// must refuse the closure rather than read the empty-list case into it.
-// Production admits an execution for as long as its wake runs and drops it when the
-// wake closes, which is the whole of the live quiescence answer: a worker still in a
-// turn reports it here, and a caller reading anything else is reading its own notes.
-executions:hostStopped&&mode.endsWith('-busy-seal')?[{agent_id:launch.agent.id,execution_id:'x'.repeat(64),state:'running',delivery_ids:[]}]
-// A projection carrying an execution that is not this agent's cannot be counted at
-// all, and a count nobody can account for is the one answer closure must refuse.
-:mode==='foreign-execution'?[{agent_id:'another-agent',execution_id:'y'.repeat(64),state:'running',delivery_ids:[]}]
-:admitted.length?admitted:terminal?.activity?.executions??[]});
-// The worker settles its stop exactly once and every later /trial/stop replays that
-// same value, including an internal stop that did not acknowledge: control.ts races
-// host.stop() against a 5s deadline and memoizes whatever it got.
-const settleStop=()=>{hostStopped=true;stopOutcome=stopOutcome??(mode==='bad-stop'||mode.endsWith('-stop-unknown')
-?{schema:'spawnfile.training.daimon-native.stop.v1',state:'unknown',quiescence:'unknown',error:'unit native shutdown deadline exceeded'}
-:{schema:'spawnfile.training.daimon-native.stop.v1',state:'acknowledged',quiescence:'unknown',containmentVerification:'parent-container-owner'});return stopOutcome;};
-const server=http.createServer(async(req,res)=>{if(req.headers.authorization!=='Bearer '+token){res.writeHead(401);res.end();return;}
-if(req.url==='/v2/activity'&&hostStopped&&mode.endsWith('-unanswerable')){res.writeHead(503,{'content-type':'application/json'});res.end(JSON.stringify({error:'native_host_unavailable'}));return;}
-res.writeHead(200,{'content-type':'application/json'});
-if(req.url==='/trial/health'){res.end(JSON.stringify(health));return;}
-if(req.url==='/v2/activity'){res.end(JSON.stringify(activity()));return;}
-if(req.url==='/trial/stop'){res.end(JSON.stringify(settleStop()));return;}
-// An admitted execution names the deliveries it covers, because that projection is
-// the runtime's own binding of a delivery to an execution and the only thing that
-// answers for a wake whose receipt has already dropped its execution id.
-if(req.url==='/trial/run'){const running={agent_id:launch.agent.id,execution_id:crypto.randomUUID(),state:'running',delivery_ids:[]};admitted=[...admitted,running];
-if(mode==='stall')return;if(mode==='die-mid-turn'){process.stderr.write('worker: stream bound crossed, terminating\\n');server.closeAllConnections();process.exit(1);}let text='';for await(const chunk of req)text+=chunk;const input=JSON.parse(text),id=crypto.randomUUID(),at=new Date().toISOString();
-// The runtime's own binding of this delivery to the execution running it: the
-// projection names the delivery ids an admitted execution covers.
-running.delivery_ids=[trial+':'+input.wakeId];
-admitted=admitted.filter(row=>row!==running);
-// A real worker's own frames, replayed verbatim: this fixture authors nothing in
-// this mode, so what the reader parses is exactly what the worker published.
-if(replay){terminal=replay.find(row=>row.wakeId===input.wakeId);if(!terminal){res.end('{}');return;}items=[...items,{...terminal.receipt,active:false}];res.end(JSON.stringify(terminal));return;}
-if(!wakes++)budget=input.controls?.maxExternalDeliveries??0;
-const receipt={version:'noopolis.daimon.wake-receipt-status.v2',acceptance_id:crypto.randomUUID(),agent_id:launch.agent.id,delivery_id:trial+':'+input.wakeId,request_digest:'a'.repeat(64),state:'completed',accepted_at:at,updated_at:at,execution_id:id};
-items=[...items,{...receipt,active:false,queue_position:wakes}];
-const closedTrace={schema:'daimon.turn_trace.v1',agent_id:launch.agent.id,turn_id:id,started_at:at,completed_at:at,status:'completed',tools:[]};
-closed=[...closed,closedTrace];
-// Every wake of a continued trial closes an execution of its own, and a worker that
-// does not strip its own history publishes all of them on the frame. The frame still
-// names the one THIS wake closed; the '-history' modes are that shape, with the two
-// ways it can go wrong beside it: an earlier trace that is not this agent's work at
-// all, and two traces answering to the one execution the frame names.
-const history=mode.includes('-history')?closed.map(row=>({...row})):[closedTrace];
-// Both faults are injected only once the trial HAS history, so neither can be
-// mistaken for the arity: the first wake of each mode publishes a clean single trace.
-if(history.length>1&&mode.endsWith('-foreign'))history[0]={...history[0],agent_id:'another-agent'};
-if(history.length>1&&mode.endsWith('-ambiguous'))history.push({...closedTrace});
-terminal={schema:'spawnfile.training.daimon-native.trial.v1',trialId:trial,wakeId:input.wakeId,agentId:launch.agent.id,model:launch.agent.model,configSha256:launch.configSha256,status:'completed',startedAt:at,completedAt:at,executionId:id,receipt,activity:{version:'noopolis.daimon.organization-runtime-activity.v2',items:[{...receipt,active:false}],executions:[]},native:{traces:history,usage:[{v:'noopolis.daimon.turn-usage.v1',agent:launch.agent.id,wake:id,engine:'codex',input:100,output:20,cache_read:40,total:120,complete:true}],toolReceipts:[],modelContexts:[{model:launch.agent.model}]},coverage:[{channel:'usage',completeness:'complete',ordering:'source'}]};
-// Daimon CLEARS the receipt's execution id when the subject defers the delivery,
-// so a deferred wake's frame names an execution its own receipt no longer does.
-// A fixture that kept it made every reader test bind through a field production
-// never supplies on this path.
-if((mode.startsWith('blocked')||mode==='undisposed')&&(input.wakeId==='task'||mode.startsWith('blocked-always'))){terminal.status='failed';terminal.blocked='awaiting-external-input';receipt.state='accepted';receipt.deferred=true;delete receipt.execution_id;
-if(wakes>budget)settleStop();
-terminal.error='Native execution completed; delivery blocked awaiting external input';
-// Production derives \`blocked\` from the deferred marker, so a delivery without one
-// never carries it; control.ts reports the disposition it actually found and stops
-// the host on its own failure path. A fixture pairing the two is a shape nothing emits.
-// A reclaimed-undisposed delivery keeps its execution id; only a deferral clears it.
-if(mode==='blocked-no-deferred'||mode==='undisposed'){delete receipt.deferred;delete terminal.blocked;receipt.execution_id=id;receipt.code='active_wake_aborted';
-terminal.error='Native execution completed; delivery reclaimed undisposed (active_wake_aborted)';settleStop();}
-if(mode==='blocked-failed-trace')terminal.native.traces[0].status='failed';
-if(mode==='blocked-active')terminal.activity.executions=[{agent_id:launch.agent.id,turn_id:id}];
-if(mode==='blocked-wrong-execution')terminal.executionId='foreign';
-// The same observed shape — a deferred delivery over a closed trace, on a frame that
-// names an execution nothing answers to — placed on the wakes a continued trial adds.
-// '-unbound-continuation' binds the assignment and loses only its continuations, which
-// is the trial that had an admissible frame and published none; '-unbound' loses every
-// wake, so nothing in it may be selected however many frames it published.
-if(mode==='blocked-always-unbound'||mode.startsWith('blocked-always-unbound-continuation')&&input.wakeId!=='task')terminal.executionId='foreign';
-if(mode==='blocked-always-failed-continuation-foreign'&&input.wakeId!=='task')terminal.native.traces[0].status='failed';
-if(mode.endsWith('-continuation-foreign')&&input.wakeId!=='task')terminal.native.traces.push({...closedTrace,turn_id:'foreign-execution',agent_id:'another-agent'});}
-// A closed execution the broker sealed on the subject's own declared timeout: the
-// worker labels the frame only when that execution's own usage row says so;
-// '-unbacked' is a label that row does not support.
-if(mode.startsWith('limit')){terminal.status='failed';receipt.state='failed';closedTrace.status='failed';closedTrace.error={message:'engine broker turn failed (limit_exceeded; limit=timeout)',stage:'engine_prompt'};
-terminal.native.usage[0].complete=false;terminal.native.usage[0].limit_reason=mode.startsWith('limit-unlabelled')||mode==='limit-unbacked'?'none':'timeout';terminal.coverage=[{channel:'usage',completeness:'partial',ordering:'source'}];
-terminal.error='Native execution failed: Grok broker turn limit_exceeded (limit_reason timeout)';if(!mode.startsWith('limit-unlabelled'))terminal.limit='timeout';
-// A timeout counts only once the trace spans the configured wake ceiling (20s here);
-// '-idle' is Daimon's idle watchdog sealing the same reason after a short stall.
-closedTrace.started_at=new Date(Date.parse(at)-(mode==='limit-idle'?1000:20000)).toISOString();
-// Daimon's retry shape: the failed execution ran again under a fresh id, and after that
-// failed too the receipt is accepted, deferred and no longer names an execution.
-if(mode==='limit-retried'){const first={...closedTrace,turn_id:crypto.randomUUID()};terminal.native.traces=[first,closedTrace];
-terminal.native.usage=[{...terminal.native.usage[0],wake:first.turn_id},terminal.native.usage[0]];receipt.state='accepted';receipt.deferred=true;delete receipt.execution_id;
-terminal.activity.items=[{...receipt,active:false}];}
-settleStop();}
-if(mode==='bad-terminal')terminal.trialId='foreign';
-// A frame whose receipt answers for another trial's delivery, with every other
-// identity on the frame itself matching: the delivery is the only thing that says so.
-if(mode==='foreign-delivery')receipt.delivery_id='other-trial:'+input.wakeId;
-res.end(JSON.stringify(terminal));return;}
-res.end('{}');});
-const engine=launch.agent.engine==='grok'?{engine:'grok',reasoningEffort:mode==='bad-effort'?'high':launch.agent.reasoningEffort}:{};
-server.listen(launch.host.port,'127.0.0.1',()=>console.log(JSON.stringify({schema:'spawnfile.training.daimon-native.ready.v1',trialId:mode==='bad-ready'?'foreign':trial,configSha256:launch.configSha256,agentId:launch.agent.id,model:mode==='bad-model'?'grok-4.5':launch.agent.model,port:launch.host.port,...engine})));
-process.on('SIGTERM',()=>{if(mode==='ignore-term')return;server.closeAllConnections();server.close(()=>process.exit(0));});
-`;
-//# sourceMappingURL=fixture.js.map

package/dist/runtime/daimon/training/native/child/fixture.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fixture.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/fixture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAI,GAAG,UAAU,EAAE,MAAe;IACnE,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;IAChC,mFAAmF;IACnF,CAAC,CAAC,MAAM,CAAC,SAAU,CAAC,UAAU,GAAG,eAAe,CAAC;IACjD,MAAM,WAAW,GAAG,YAAY,EAAE,CAAC;IAAC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAI,WAAW,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACtE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IAClG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;IAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,IAAI,kDAAkD,MAAM,CAAC,CAAC,CAAC,qBAAqB,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5J,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IACxF,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoHd,CAAC"}

package/dist/runtime/daimon/training/native/child/grok.d.ts

@@ -1,14 +0,0 @@
-import type { GrokSlotFreshnessStore } from '../../services/index.js';
-import { type GrokNativeLaunch, type VerifiedNativeLaunch } from '../receipt/index.js';
-/**
- * Grok slot isolation is proven by the root slot supervisor's receipt, which
- * the worker already verified with Daimon's verifier. The parent re-binds it
- * without Daimon and adds the caller's protected paths: each one, every launch
- * evaluator root and the control root must be an exact denied canary. The two
- * digest-bound subject roots are the one exemption, for the reason
- * `grokSubjectRoots` states; a protected path inside them is still required. No local
- * `codex sandbox` process runs and no model is called. The receipt must carry
- * this trial's recycle nonce and a generation above the last one the
- * evaluator's persisted freshness state accepted; acceptance advances that state.
- */
-export declare function verifyChildGrokSlot(launch: VerifiedNativeLaunch & GrokNativeLaunch, trialId: string, protectedPaths: readonly string[], slots: GrokSlotFreshnessStore | undefined): Promise<void>;

package/dist/runtime/daimon/training/native/child/grok.js

@@ -1,47 +0,0 @@
-import { lstat, realpath, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { grokSubjectRoots, nativeTrialArtifactsRoot, parseGrokBrokerReceipt, readPrivateFile, requiredGrokEvaluatorPaths } from '../receipt/index.js';
-/**
- * Grok slot isolation is proven by the root slot supervisor's receipt, which
- * the worker already verified with Daimon's verifier. The parent re-binds it
- * without Daimon and adds the caller's protected paths: each one, every launch
- * evaluator root and the control root must be an exact denied canary. The two
- * digest-bound subject roots are the one exemption, for the reason
- * `grokSubjectRoots` states; a protected path inside them is still required. No local
- * `codex sandbox` process runs and no model is called. The receipt must carry
- * this trial's recycle nonce and a generation above the last one the
- * evaluator's persisted freshness state accepted; acceptance advances that state.
- */
-export async function verifyChildGrokSlot(launch, trialId, protectedPaths, slots) {
-    try {
-        if (!slots)
-            throw new Error('Grok child execution requires the evaluator slot freshness store');
-        // Exempt the digest-bound subject roots BEFORE validating shapes: the evaluator reaches its own
-        // trial workspace and runtime home through symlinks into the slot, and a symlink is neither a
-        // file nor a directory to `lstat`. Everything the receipt must deny is still validated below.
-        const subject = grokSubjectRoots(launch);
-        // Match subject roots by resolved target, not by spelling: the evaluator's own trial workspace and
-        // runtime home are symlinks into the slot, while the launch names the slot paths the digest binds.
-        const resolved = new Set(await Promise.all(subject.map(async (root) => realpath(root).catch(() => root))));
-        const exempt = await Promise.all(protectedPaths.map(async (path) => subject.includes(path) || resolved.has(await realpath(path).catch(() => path))));
-        const required = protectedPaths.filter((_, index) => !exempt[index]);
-        for (const path of required) {
-            const entry = await lstat(path);
-            if (!entry.isDirectory() && !entry.isFile())
-                throw new Error(`Unsupported protected native path: ${path}`);
-        }
-        const artifacts = nativeTrialArtifactsRoot(launch, trialId);
-        const receipt = parseGrokBrokerReceipt(JSON.parse(await readPrivateFile(join(artifacts, 'sandbox-projection.json'), 1_048_576)), launch, trialId, required);
-        await slots.accept(receipt.projection.slot, receipt.slotPreflight);
-        await writeFile(join(artifacts, 'child-sandbox-preflight.json'), JSON.stringify({ schema: 'spawnfile.training.daimon-native.child-grok-slot-preflight.v1',
-            trialId, configSha256: launch.configSha256, projectionSha256: receipt.projectionSha256, slot: receipt.projection.slot,
-            workerUid: receipt.projection.workerUid, slotPreflightCreatedAt: receipt.slotPreflight.created_at, slotGeneration: receipt.slotPreflight.generation, modelCallsMade: 0, localSandboxProbe: false,
-            evaluatorPathsDenied: [...new Set([...requiredGrokEvaluatorPaths(launch), ...required])].sort() }), { flag: 'wx', mode: 0o600 });
-    }
-    catch (error) {
-        // Name the underlying refusal: a wrapped cause is invisible in the published failure record.
-        const reason = error instanceof Error ? error.message : String(error);
-        throw new Error(`Grok broker slot preflight failed before cognition: ${reason}`, { cause: error });
-    }
-}
-//# sourceMappingURL=grok.js.map

package/dist/runtime/daimon/training/native/child/grok.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grok.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/grok.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,eAAe,EAAE,0BAA0B,EACpE,MAAM,qBAAqB,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA+C,EAAE,OAAe,EAAE,cAAiC,EAC3I,KAAyC;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAChG,gGAAgG;QAChG,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzC,mGAAmG;QACnG,mGAAmG;QACnG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,EAAE,SAAS,CAAC,CAAC,EAC7H,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,+DAA+D;YACvJ,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YACrH,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,EAAE,iBAAiB,EAAE,KAAK;YAChM,oBAAoB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,0BAA0B,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC"}

package/dist/runtime/daimon/training/native/child/index.d.ts

@@ -1,7 +0,0 @@
-export { startOwnedChild, bindTerminalEvidence } from './lifecycle.js';
-export { nativeChildArguments, nativeChildEnvironment } from './arguments.js';
-export type { NativeChildExecution } from './types.js';
-export { createGrokSlotFreshnessStore } from '../../services/index.js';
-export type { GrokSlotFreshness, GrokSlotFreshnessOptions, GrokSlotFreshnessStore } from '../../services/index.js';
-export { redactNativeDiagnostic, redactedMarker, redactedPathMarker, withholdDetectors } from './diagnostics.js';
-export type { WithholdDetector } from './diagnostics.js';

package/dist/runtime/daimon/training/native/child/index.js

@@ -1,5 +0,0 @@
-export { startOwnedChild, bindTerminalEvidence } from './lifecycle.js';
-export { nativeChildArguments, nativeChildEnvironment } from './arguments.js';
-export { createGrokSlotFreshnessStore } from '../../services/index.js';
-export { redactNativeDiagnostic, redactedMarker, redactedPathMarker, withholdDetectors } from './diagnostics.js';
-//# sourceMappingURL=index.js.map

package/dist/runtime/daimon/training/native/child/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/runtime/daimon/training/native/child/lifecycle.d.ts

@@ -1,40 +0,0 @@
-import type { TerminalEvidenceMissing } from '../../../../../training/index.js';
-import { type VerifiedNativeLaunch } from '../receipt/index.js';
-import { type TerminalEvidence } from '../worker/index.js';
-import { type NativeExecutionHandle } from '../transport/index.js';
-import { type TransportDeliverySource } from '../worker/index.js';
-import type { NativeChildExecution } from './types.js';
-/** One fresh worker process in the caller's existing container; no Docker or remote proof. */
-export declare function startOwnedChild(execution: NativeChildExecution, launch: VerifiedNativeLaunch, trialId: string, timeoutMs: number, signal?: AbortSignal, startupMs?: number, protectedPaths?: readonly string[]): Promise<NativeExecutionHandle>;
-/** One delivery's place in the ledger: which wake it was, and why its frame cannot be scored. */
-interface WakeEvidence {
-    wakeId: string;
-    source?: TransportDeliverySource;
-    unevidenced?: TerminalEvidenceMissing;
-}
-/**
- * Whether ONE wake's frame can be scored from — never whether something is still
- * spending, and never a verdict about the trial around it.
- *
- * A frame from another trial, agent, wake or config is not this trial's evidence,
- * and that check lives here rather than in the closure predicate. The receipt has
- * to name this trial's own delivery too: the frame's identity and the delivery the
- * runtime answered for are one delivery, or the frame is accounting for somebody
- * else's wake. Those are attribution failures, so they `seal` the whole trial:
- * nothing this runtime published can be scored past one.
- *
- * A trial whose subject deferred runs its continuations as further wakes, and each
- * one closes an execution of its own. The trace that answers for THIS frame is the
- * one the frame names; the rest are this same trial's earlier, already-closed
- * wakes, and counting them was refusing a healthy run for the arity of its own
- * history. Nothing is admitted by position: an unnamed execution resolves to no
- * trace at all, and that is this wake's own fault rather than the trial's.
- *
- * An identity conflict still throws, because it must fail the turn rather than
- * pass as verified work; it only records what it was first. Two traces answering
- * to the named execution is its own word: the frame is not unbound, it is
- * unreadable, and that distinction is what sends the next look at it upstream
- * instead of here.
- */
-export declare function bindTerminalEvidence(wake: WakeEvidence, value: TerminalEvidence, launch: VerifiedNativeLaunch, trialId: string, seal: (fault: TerminalEvidenceMissing) => void, wakeTimeoutMs?: number): void;
-export {};