spawnfile 0.1.33 → 0.1.34

package/dist/compiler/training/index.js

@@ -2,13 +2,6 @@ export * from "./contract.js";
 export * from "./context.js";
 export * from "./plan/index.js";
 export * from "./rewind/index.js";
-export { parseTrainingMappedPreparation, trainingPreparationSchema } from "./preparation/contract.js";
-export { prepareTrainingEvaluators } from "./container/evaluators.js";
-export { TRAINING_SLOTS_FILE, TRAINING_SLOTS_VERSION, trainingSlotPaths, trainingSlotDescriptors, trainingSlotsDocument } from "./broker/paths.js";
 export * from "./execution.js";
 export * from "./moments.js";
 export * from "./compiledAgent.js";
-export { TRAINING_FAKETIME_LIBRARY_PATH } from "./container/contract.js";
-export * from "./subjectLease.js";
-export * from "./subjectDeclaration.js";
-export { recycleTrainingSlot } from "./broker/recycleClient.js";

package/dist/compiler/training/output.d.ts

@@ -1,2 +1,3 @@
+export declare const within: (root: string, file: string) => boolean;
 /** Durable default namespace disjoint from every declared input, even a project ancestor. */
 export declare const defaultTrainingOutputRoot: (projectRoot: string, inputs?: readonly string[]) => string;

package/dist/compiler/training/output.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import path from "node:path";
-import { within } from "./preparation/files.js";
+export const within = (root, file) => file === root || file.startsWith(root + path.sep);
 /** Durable default namespace disjoint from every declared input, even a project ancestor. */
 export const defaultTrainingOutputRoot = (projectRoot, inputs = []) => {
     const sources = [projectRoot, ...inputs].map(source => path.resolve(source));

package/dist/compiler/training/trial/boot.d.ts

@@ -0,0 +1,53 @@
+import { type DaimonControlCall } from "../../../runtime/daimon/control.js";
+import { type UsageRecord } from "../../../runtime/usageLedger.js";
+import { type TrialDocker } from "./docker.js";
+import type { TrainingGatewayAccess } from "./gateway.js";
+/**
+ * Lineage namespace for training trials: every trial derives its own durable
+ * volume names, so no trial ever attaches production's, dev's or another
+ * trial's state (see `deploymentLineage.ts`).
+ */
+export declare const TRAINING_TRIAL_LINEAGE_NAMESPACE = "training";
+export interface TrialOptions {
+    agentManifestPath: string;
+    instructions: string;
+    trialId: string;
+    /** Fresh per trial; holds the trial project, compile output and boot env file. */
+    directory: string;
+    docker?: TrialDocker;
+    control?: DaimonControlCall;
+}
+export interface TrialWake {
+    state: "completed" | "failed" | "stopped" | "timeout";
+    acceptanceId: string;
+    executionId: string | null;
+    code: string | null;
+    text: string;
+    /** Usage ledger rows this wake appended; empty means none were written, never zero spend. */
+    usage: UsageRecord[];
+    /** The engine's own newest session record, bounded; null when none exists. */
+    transcript: string | null;
+}
+export interface BootedTrial {
+    container: string;
+    wake(text: string, options: {
+        deliveryId: string;
+        timeoutMs: number;
+        signal?: AbortSignal;
+    }): Promise<TrialWake>;
+    /** Credential-shaped files anywhere in the trial container (expected: none). */
+    scanCredentials(): Promise<string[]>;
+    teardown(): Promise<void>;
+}
+export interface PreparedTrial {
+    image: string;
+    runtimeRoot: string;
+    engines: string[];
+    agentId: string;
+    boot(gateway: TrainingGatewayAccess, options?: {
+        readyTimeoutMs?: number;
+    }): Promise<BootedTrial>;
+    dispose(): Promise<void>;
+}
+/** Compiles and builds the trial's one-agent organization under its own lineage, as production does. */
+export declare const prepareTrial: (options: TrialOptions) => Promise<PreparedTrial>;

package/dist/compiler/training/trial/boot.js

@@ -0,0 +1,147 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { DAIMON_GATEWAY_KEY_ENV, DAIMON_GATEWAY_URL_ENV, getDaimonEngineDescriptor, isDaimonGatewayRealmMountId } from "../../../runtime/daimon/index.js";
+import { daimonHelperControlCall } from "../../../runtime/daimon/control.js";
+import { RUNTIME_INSTALL_ROOT } from "../../../runtime/container.js";
+import { parseUsageLedger } from "../../../runtime/usageLedger.js";
+import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
+import { SpawnfileError } from "../../../shared/index.js";
+import { buildCompiledProject } from "../../buildProject.js";
+import { compileProject } from "../../compileProject.js";
+import { resolveDeploymentLineage } from "../../deploymentLineage.js";
+import { slugify } from "../../helpers.js";
+import { createDockerRunInvocation, runDockerContainer } from "../../runProject.js";
+import { executeDockerRunWithSupportCleanup } from "../../runProjectLifecycle.js";
+import { createTrialDocker, waitFor } from "./docker.js";
+import { writeTrialProject } from "./project.js";
+/**
+ * Lineage namespace for training trials: every trial derives its own durable
+ * volume names, so no trial ever attaches production's, dev's or another
+ * trial's state (see `deploymentLineage.ts`).
+ */
+export const TRAINING_TRIAL_LINEAGE_NAMESPACE = "training";
+const CONTROL_TOKEN_ENV = "SPAWNFILE_DAIMON_CONTROL_TOKEN";
+const WAKE_VERSION = "noopolis.daimon.wake.v2";
+const TERMINAL = new Set(["completed", "failed", "stopped"]);
+const MAX_TRANSCRIPT_BYTES = 1024 * 1024;
+/** Compiles and builds the trial's one-agent organization under its own lineage, as production does. */
+export const prepareTrial = async (options) => {
+    const docker = options.docker ?? createTrialDocker();
+    // Readable and collision-free: trial ids may share long prefixes.
+    const slug = `${slugify(options.trialId).slice(0, 32) || "trial"}-${createHash("sha256").update(options.trialId).digest("hex").slice(0, 8)}`;
+    const project = await writeTrialProject(options.agentManifestPath, options.instructions, path.join(options.directory, "project"));
+    const compiled = await compileProject(project, {
+        deploymentLineage: resolveDeploymentLineage(slug, TRAINING_TRIAL_LINEAGE_NAMESPACE),
+        outputDirectory: path.join(options.directory, "out")
+    });
+    const image = `spawnfile-training-trial:${slug}`;
+    await buildCompiledProject(project, compiled, { imageTag: image });
+    const instance = compiled.report.container?.runtime_instances.find((entry) => entry.runtime === "daimon");
+    const agents = Object.entries(instance?.engine_by_node_id ?? {});
+    if (!instance || agents.length !== 1)
+        throw new SpawnfileError("validation_error", "A production-booted trial compiles exactly one Daimon agent");
+    const [agentId] = agents[0];
+    const home = instance.agent_paths?.[agentId]?.home_path;
+    // The engine writes its own session records under its home inside the agent's runtime home.
+    const engineHome = getDaimonEngineDescriptor(agents[0][1])?.homeDirectory;
+    const sessionsPath = home && engineHome !== undefined ? path.posix.join(home, engineHome, "sessions") : null;
+    const dispose = async () => {
+        await docker(["image", "rm", "-f", image]).catch(() => undefined);
+        await rm(options.directory, { recursive: true, force: true });
+    };
+    return {
+        agentId, dispose, image,
+        engines: agents.map(([, engine]) => engine),
+        runtimeRoot: `${RUNTIME_INSTALL_ROOT}/daimon`,
+        boot: async (gateway, bootOptions = {}) => {
+            const token = randomBytes(32).toString("base64url");
+            const container = `spawnfile-trial-${slug}`;
+            await mkdir(options.directory, { recursive: true });
+            const envFilePath = path.join(options.directory, "boot.env");
+            // The boot inputs: control token, gateway URL and key. No login, no realm.
+            await writeFile(envFilePath, `${CONTROL_TOKEN_ENV}=${token}\n${DAIMON_GATEWAY_URL_ENV}=${gateway.url}\n${DAIMON_GATEWAY_KEY_ENV}=${gateway.key}\n`, { mode: 0o600 });
+            const invocation = await createDockerRunInvocation(compiled, image, {
+                containerName: container, deploymentName: slug, detach: true, envFilePath, network: gateway.network
+            });
+            const volumes = (compiled.report.container?.persistent_mounts ?? [])
+                .filter((mount) => !isDaimonGatewayRealmMountId(mount.id)).map((mount) => mount.volume_name);
+            const teardown = async () => {
+                await docker(["rm", "-f", container]).catch(() => undefined);
+                for (const volume of volumes)
+                    await docker(["volume", "rm", "-f", volume]).catch(() => undefined);
+                await rm(invocation.supportDirectory, { recursive: true, force: true });
+                await rm(envFilePath, { force: true });
+            };
+            try {
+                await executeDockerRunWithSupportCleanup(invocation, runDockerContainer);
+                await rm(envFilePath, { force: true });
+                const target = { containerRef: container, dockerArgs: [], dockerCommand: "docker", imageRef: image, token };
+                const call = options.control ?? daimonHelperControlCall;
+                await waitFor(async () => {
+                    if (await docker(["inspect", "--format", "{{.State.Running}}", container]) !== "true") {
+                        const logs = await docker(["logs", "--tail", "30", container]).catch(() => "");
+                        throw new SpawnfileError("runtime_error", `trial organization exited before readiness: ${logs.replace(/\s+/gu, " ").slice(-600)}`);
+                    }
+                    return call(target, "GET", "/v2/availability").then((response) => response.status === 200, () => false);
+                }, bootOptions.readyTimeoutMs ?? 180_000, "trial organization readiness", 1_000);
+                return createBootedTrial({ agentId, call, container, docker, sessionsPath, target, teardown });
+            }
+            catch (error) {
+                await teardown();
+                throw error;
+            }
+        }
+    };
+};
+const readLedger = async (docker, container) => {
+    const text = await docker(["exec", container, "cat", DAIMON_GROK_TURN_USAGE_LEDGER.filePath]).catch(() => "");
+    return parseUsageLedger(text);
+};
+const createBootedTrial = (input) => {
+    let seenRows = 0;
+    return {
+        container: input.container,
+        teardown: input.teardown,
+        scanCredentials: async () => {
+            const found = await input.docker(["exec", input.container, "find", "/", "-xdev", "(", "-name", "auth.json", "-o", "-name", "*token*", "-o", "-name", "*bootstrap-auth*", ")",
+                "-not", "-path", "/proc/*", "-not", "-path", "/sys/*", "-not", "-path", "/usr/*", "-not", "-path", "/opt/spawnfile/runtime-installs/*"], { timeoutMs: 60_000 }).catch((error) => error.message);
+            return found.split("\n").filter(Boolean);
+        },
+        wake: async (text, options) => {
+            const body = { agent_id: input.agentId, delivery_id: options.deliveryId,
+                event: { version: WAKE_VERSION, kind: "manual", text, occurred_at: new Date().toISOString() } };
+            const accepted = await input.call(input.target, "POST", "/v2/wakes", body);
+            const acceptance = JSON.parse(accepted.body);
+            if (accepted.status !== 202 || acceptance.state !== "accepted" || !acceptance.acceptance_id) {
+                throw new SpawnfileError("runtime_error", `trial wake was not accepted (HTTP ${accepted.status}${acceptance.code ? `, ${acceptance.code}` : ""})`);
+            }
+            const id = acceptance.acceptance_id;
+            let receipt = {};
+            const deadline = Date.now() + options.timeoutMs;
+            while (!TERMINAL.has(receipt.state ?? "") && Date.now() < deadline && !options.signal?.aborted) {
+                await new Promise((resolve) => setTimeout(resolve, 1_000));
+                const response = await input.call(input.target, "GET", `/v2/wake-receipts/${id}`);
+                if (response.status === 200)
+                    receipt = JSON.parse(response.body);
+            }
+            const rows = await readLedger(input.docker, input.container);
+            const usage = rows.slice(seenRows).filter((row) => row.agent === input.agentId);
+            seenRows = rows.length;
+            return {
+                acceptanceId: id, code: receipt.code ?? null, executionId: receipt.execution_id ?? null, usage,
+                state: TERMINAL.has(receipt.state ?? "") ? receipt.state : "timeout",
+                text: receipt.text ?? "",
+                transcript: input.sessionsPath === null ? null : await readTranscript(input.docker, input.container, input.sessionsPath)
+            };
+        }
+    };
+};
+/** The engine's newest session record, bounded. */
+const readTranscript = async (docker, container, sessionsPath) => {
+    const newest = await docker(["exec", container, "sh", "-c", 'find "$1" -name "*.jsonl" -type f -printf "%T@ %p\\n" 2>/dev/null | sort -n | tail -1 | cut -d" " -f2-', "sh", sessionsPath]).catch(() => "");
+    if (!newest)
+        return null;
+    const text = await docker(["exec", container, "head", "-c", String(MAX_TRANSCRIPT_BYTES), newest]).catch(() => "");
+    return text || null;
+};

package/dist/compiler/training/trial/docker.d.ts

@@ -0,0 +1,8 @@
+/** Bounded Docker CLI call for trial lifecycle; stdout trimmed, stderr bounded into the error. */
+export type TrialDocker = (args: readonly string[], options?: {
+    timeoutMs?: number;
+    stdin?: string;
+}) => Promise<string>;
+export declare const createTrialDocker: (dockerCommand?: string) => TrialDocker;
+/** Poll `probe` until it resolves true, or fail after `timeoutMs`. */
+export declare const waitFor: (probe: () => Promise<boolean>, timeoutMs: number, label: string, pollMs?: number) => Promise<void>;

package/dist/compiler/training/trial/docker.js

@@ -0,0 +1,22 @@
+import { execFile } from "node:child_process";
+import { SpawnfileError } from "../../../shared/index.js";
+export const createTrialDocker = (dockerCommand = "docker") => (args, options = {}) => new Promise((resolve, reject) => {
+    const child = execFile(dockerCommand, [...args], { maxBuffer: 16 * 1024 * 1024, timeout: options.timeoutMs ?? 120_000 }, (error, stdout, stderr) => error
+        ? reject(new SpawnfileError("runtime_error", `docker ${args[0]} ${args[1] ?? ""} failed: ${String(stderr).replace(/\s+/gu, " ").slice(-400)}`))
+        : resolve(String(stdout).trim()));
+    if (options.stdin !== undefined)
+        child.stdin?.end(options.stdin);
+    else
+        child.stdin?.end();
+});
+/** Poll `probe` until it resolves true, or fail after `timeoutMs`. */
+export const waitFor = async (probe, timeoutMs, label, pollMs = 500) => {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (await probe())
+            return;
+        if (Date.now() >= deadline)
+            throw new SpawnfileError("runtime_error", `${label} timed out after ${timeoutMs}ms`);
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+    }
+};

package/dist/compiler/training/trial/gateway.d.ts

@@ -0,0 +1,42 @@
+import type { ResolvedAuthProfile } from "../../../auth/index.js";
+import { type TrialDocker } from "./docker.js";
+export interface TrainingGatewayOptions {
+    /** Any compiled image of the subject: it carries the pinned Daimon runtime the gateway binary comes from. */
+    image: string;
+    runtimeRoot: string;
+    engines: readonly string[];
+    authProfile: ResolvedAuthProfile;
+    /** Training run identity; names the run's networks and labels every resource. */
+    runId: string;
+    docker?: TrialDocker;
+    /** Overrides the rendered sidecar script (tests and diagnostics only). */
+    script?: (script: string) => string;
+    readyTimeoutMs?: number;
+}
+/** What a trial needs to boot against the sidecar: one agent contract, never a login. */
+export interface TrainingGatewayAccess {
+    url: string;
+    key: string;
+    /** Internal (no egress) network the trials join; only the gateway reaches the internet. */
+    network: string;
+}
+export interface TrainingGateway extends TrainingGatewayAccess {
+    container: string;
+    realmVolumes: readonly string[];
+    /** Stops and removes the sidecar and both networks. The realm volumes stay: they are the login. */
+    stop(): Promise<void>;
+    /** Replaces a dead or stuck sidecar in place: same key, networks and realm, so booted trials keep working. */
+    restart(script?: (script: string) => string): Promise<void>;
+}
+/** One durable realm volume per auth profile and engine: the gateway is its sole holder (exclusive flock). */
+export declare const trainingGatewayRealmVolume: (profile: string, engine: string) => string;
+/**
+ * Places Daimon's auth gateway as a sidecar for one training run: a container
+ * from the subject's own compiled image (the pinned Daimon runtime is a
+ * scratch copy source and runs nothing by itself), with the production Docker
+ * security posture, owning the engine realm volume, on a dedicated egress
+ * network plus the run's internal network that the trials join. Nothing is
+ * published to the host. The bootstrap leaf of the selected auth profile is
+ * staged through the same gate as `spawnfile up`.
+ */
+export declare const startTrainingGateway: (options: TrainingGatewayOptions) => Promise<TrainingGateway>;

package/dist/compiler/training/trial/gateway.js

@@ -0,0 +1,98 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { DAIMON_GATEWAY_PORT, daimonGatewayBootstrapMountPath, daimonGatewayedEngines, daimonGatewayRealmPath } from "../../../runtime/daimon/gateway.js";
+import { assertSafeDaimonSourceFile, daimonSourcePathForEngine } from "../../../runtime/daimon/runAuth.js";
+import { DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, SpawnfileError } from "../../../shared/index.js";
+import { createDockerTargetExecutors } from "../../../target/dockerCommandExecutor.js";
+import { removeExactDockerResource } from "../../../target/dockerResources.js";
+import { createDockerResourceSpec, executeDockerResource } from "../../../target/dockerResourcesProvider.js";
+import { parseOpaqueTargetHandle } from "../../../target/contracts.js";
+import { DAIMON_GATEWAY_SIDECAR_ALIAS, DAIMON_GATEWAY_SIDECAR_KEY_ENV, DAIMON_GATEWAY_SIDECAR_URL, renderDaimonGatewaySidecarScript } from "../../containerDaimonGatewayRender.js";
+import { slugify } from "../../helpers.js";
+import { createTrialDocker, waitFor } from "./docker.js";
+const hex = (value) => createHash("sha256").update(value).digest("hex");
+const opaque = (value) => parseOpaqueTargetHandle(`opaque_${hex(value)}`);
+const LABEL = "spawnfile.training-gateway";
+/** One durable realm volume per auth profile and engine: the gateway is its sole holder (exclusive flock). */
+export const trainingGatewayRealmVolume = (profile, engine) => `spawnfile-training-${slugify(profile) || "profile"}-${engine}-realm`;
+/**
+ * Places Daimon's auth gateway as a sidecar for one training run: a container
+ * from the subject's own compiled image (the pinned Daimon runtime is a
+ * scratch copy source and runs nothing by itself), with the production Docker
+ * security posture, owning the engine realm volume, on a dedicated egress
+ * network plus the run's internal network that the trials join. Nothing is
+ * published to the host. The bootstrap leaf of the selected auth profile is
+ * staged through the same gate as `spawnfile up`.
+ */
+export const startTrainingGateway = async (options) => {
+    const docker = options.docker ?? createTrialDocker();
+    const descriptors = daimonGatewayedEngines(options.engines);
+    if (descriptors.length === 0)
+        throw new SpawnfileError("validation_error", "Training gateway needs a gatewayed engine");
+    const context = await docker(["context", "show"]);
+    const executor = createDockerTargetExecutors().resource;
+    const internal = createDockerResourceSpec({
+        kind: "data_network", operationHandle: opaque(`${options.runId}\0network`), requestDigest: `sha256:${hex(options.runId)}`,
+        runId: options.runId, selectedTargetHandle: opaque(context)
+    });
+    const suffix = hex(options.runId).slice(0, 16);
+    const egress = `spawnfile-training-egress-${suffix}`;
+    const container = `spawnfile-training-gateway-${suffix}`;
+    const key = randomBytes(32).toString("hex");
+    const mounts = [];
+    const realmVolumes = [];
+    for (const descriptor of descriptors) {
+        const source = daimonSourcePathForEngine(descriptor.id, process.env, options.authProfile);
+        await assertSafeDaimonSourceFile(source, descriptor.id, descriptor.auth.maxCredentialBytes, descriptor.id);
+        const volume = trainingGatewayRealmVolume(options.authProfile.name, descriptor.id);
+        realmVolumes.push(volume);
+        mounts.push("--mount", `type=volume,source=${volume},target=${daimonGatewayRealmPath(descriptor)}`, "-v", `${source}:${daimonGatewayBootstrapMountPath(descriptor.auth.realm)}:ro`);
+    }
+    const stop = async () => {
+        await docker(["rm", "-f", container]).catch(() => undefined);
+        await docker(["network", "rm", egress]).catch(() => undefined);
+        await removeExactDockerResource(internal, { context, executor, timeoutMs: 30_000 }).catch(() => undefined);
+    };
+    const launch = async (wrap = options.script) => {
+        const support = await mkdtemp(path.join(os.tmpdir(), "spawnfile-training-gateway-"));
+        try {
+            const envFile = path.join(support, "gateway.env");
+            await writeFile(envFile, `${DAIMON_GATEWAY_SIDECAR_KEY_ENV}=${key}\n`, { mode: 0o600 });
+            const script = renderDaimonGatewaySidecarScript(options.engines, options.runtimeRoot);
+            await docker(["create", "--name", container, "--restart", "no", "--network", egress, "--label", `${LABEL}=${suffix}`,
+                ...DAIMON_DOCKER_RUNTIME_SECURITY_ARGS, ...mounts, "--env-file", envFile,
+                "--entrypoint", "bash", options.image, "-ceu", wrap ? wrap(script) : script]);
+        }
+        finally {
+            await rm(support, { recursive: true, force: true });
+        }
+        await docker(["network", "connect", "--alias", DAIMON_GATEWAY_SIDECAR_ALIAS, internal.name, container]);
+        await docker(["start", container]);
+        await waitFor(async () => {
+            const state = await docker(["inspect", "--format", "{{.State.Running}}", container]);
+            if (state !== "true") {
+                const logs = await docker(["logs", "--tail", "20", container]).catch(() => "");
+                throw new SpawnfileError("runtime_error", `training auth gateway exited before readiness: ${logs.replace(/\s+/gu, " ").slice(-400)}`);
+            }
+            return docker(["exec", container, "bash", "-c", `(exec 3<>/dev/tcp/127.0.0.1/${DAIMON_GATEWAY_PORT})`]).then(() => true, () => false);
+        }, options.readyTimeoutMs ?? 60_000, "training auth gateway readiness");
+    };
+    try {
+        await executeDockerResource({ args: ["--context", context, ...internal.args], executor, timeoutMs: 30_000 });
+        await docker(["network", "create", "--label", `${LABEL}=${suffix}`, egress]);
+        await launch();
+    }
+    catch (error) {
+        await stop();
+        throw error;
+    }
+    return {
+        container, key, network: internal.name, realmVolumes, stop, url: DAIMON_GATEWAY_SIDECAR_URL,
+        restart: async (wrap) => {
+            await docker(["rm", "-f", container]);
+            await launch(wrap);
+        }
+    };
+};

package/dist/compiler/training/trial/index.d.ts

@@ -0,0 +1,4 @@
+export { TRAINING_TRIAL_LINEAGE_NAMESPACE, prepareTrial, type BootedTrial, type PreparedTrial, type TrialOptions, type TrialWake } from "./boot.js";
+export { startTrainingGateway, trainingGatewayRealmVolume, type TrainingGateway, type TrainingGatewayAccess, type TrainingGatewayOptions } from "./gateway.js";
+export { createBootedTrialRun, type BootedTrialLauncherOptions, type BootedTrialRun } from "./launcher.js";
+export { TRIAL_INSTRUCTIONS_FILE, writeTrialProject } from "./project.js";

package/dist/compiler/training/trial/index.js

@@ -0,0 +1,4 @@
+export { TRAINING_TRIAL_LINEAGE_NAMESPACE, prepareTrial } from "./boot.js";
+export { startTrainingGateway, trainingGatewayRealmVolume } from "./gateway.js";
+export { createBootedTrialRun } from "./launcher.js";
+export { TRIAL_INSTRUCTIONS_FILE, writeTrialProject } from "./project.js";

package/dist/compiler/training/trial/launcher.d.ts

@@ -0,0 +1,32 @@
+import type { ResolvedAuthProfile } from "../../../auth/index.js";
+import { type TrialWake } from "./boot.js";
+import { type TrialDocker } from "./docker.js";
+export interface BootedTrialLauncherOptions {
+    /** The subject agent's own Spawnfile. */
+    agentManifestPath: string;
+    authProfile: ResolvedAuthProfile;
+    /** Trial projects, compile outputs and boot env files live here, one fresh directory per trial. */
+    scratchRoot: string;
+    docker?: TrialDocker;
+}
+export interface BootedTrialRun {
+    boot(input: {
+        trialId: string;
+        instructions: string;
+    }): Promise<{
+        wake(text: string, options: {
+            deliveryId: string;
+            timeoutMs: number;
+            signal?: AbortSignal;
+        }): Promise<TrialWake>;
+        teardown(): Promise<void>;
+    }>;
+    /** Stops the run's gateway and removes its image and networks; the realm volume stays. */
+    close(): Promise<void>;
+}
+/**
+ * One training run's trials: each boot compiles and starts the subject's
+ * one-agent organization, and every trial shares the run's single auth
+ * gateway, started from the first trial's image on first use.
+ */
+export declare const createBootedTrialRun: (options: BootedTrialLauncherOptions) => BootedTrialRun;

package/dist/compiler/training/trial/launcher.js

@@ -0,0 +1,49 @@
+import { mkdir, mkdtemp } from "node:fs/promises";
+import path from "node:path";
+import { ensureNoopolisRunId } from "../../../runtime/index.js";
+import { prepareTrial } from "./boot.js";
+import { createTrialDocker } from "./docker.js";
+import { startTrainingGateway } from "./gateway.js";
+/**
+ * One training run's trials: each boot compiles and starts the subject's
+ * one-agent organization, and every trial shares the run's single auth
+ * gateway, started from the first trial's image on first use.
+ */
+export const createBootedTrialRun = (options) => {
+    const docker = options.docker ?? createTrialDocker();
+    const runId = ensureNoopolisRunId();
+    let gateway;
+    return {
+        boot: async ({ trialId, instructions }) => {
+            await mkdir(options.scratchRoot, { recursive: true });
+            const prepared = await prepareTrial({ agentManifestPath: options.agentManifestPath, docker, instructions, trialId,
+                directory: await mkdtemp(path.join(options.scratchRoot, "trial-")) });
+            try {
+                gateway ??= (async () => {
+                    const image = `spawnfile-training-gateway:${runId.replace(/[^A-Za-z0-9_.-]/gu, "-").slice(0, 100)}`;
+                    await docker(["tag", prepared.image, image]);
+                    return { image, gateway: await startTrainingGateway({ authProfile: options.authProfile, docker, engines: prepared.engines,
+                            image, runId, runtimeRoot: prepared.runtimeRoot }) };
+                })();
+                const booted = await prepared.boot((await gateway).gateway);
+                return { wake: booted.wake, teardown: async () => { try {
+                        await booted.teardown();
+                    }
+                    finally {
+                        await prepared.dispose();
+                    } } };
+            }
+            catch (error) {
+                await prepared.dispose();
+                throw error;
+            }
+        },
+        close: async () => {
+            const started = await gateway?.catch(() => undefined);
+            if (!started)
+                return;
+            await started.gateway.stop();
+            await docker(["image", "rm", "-f", started.image]).catch(() => undefined);
+        }
+    };
+};

package/dist/compiler/training/trial/project.d.ts

@@ -0,0 +1,11 @@
+/** The candidate's instructions become this agent's system document. */
+export declare const TRIAL_INSTRUCTIONS_FILE = "TRAINING_INSTRUCTIONS.md";
+/**
+ * Writes the trial's one-agent organization: a copy of the subject agent's own
+ * declaration directory (so every relative doc, skill and resource keeps
+ * resolving) whose Spawnfile is the subject's, re-rendered with the candidate
+ * prompt as its system document and with every surface (federation), its
+ * schedule and its training block removed. Nothing else changes: runtime,
+ * engine, model, memory and tools are the subject's.
+ */
+export declare const writeTrialProject: (agentManifestPath: string, instructions: string, directory: string) => Promise<string>;

package/dist/compiler/training/trial/project.js

@@ -0,0 +1,31 @@
+import { cp, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { isAgentManifest, loadManifest, renderSpawnfile } from "../../../manifest/index.js";
+import { SpawnfileError } from "../../../shared/index.js";
+/** The candidate's instructions become this agent's system document. */
+export const TRIAL_INSTRUCTIONS_FILE = "TRAINING_INSTRUCTIONS.md";
+const SKIPPED = new Set([".git", "node_modules", ".runtime", ".spawn", ".spawn-dev", ".sim"]);
+/**
+ * Writes the trial's one-agent organization: a copy of the subject agent's own
+ * declaration directory (so every relative doc, skill and resource keeps
+ * resolving) whose Spawnfile is the subject's, re-rendered with the candidate
+ * prompt as its system document and with every surface (federation), its
+ * schedule and its training block removed. Nothing else changes: runtime,
+ * engine, model, memory and tools are the subject's.
+ */
+export const writeTrialProject = async (agentManifestPath, instructions, directory) => {
+    const { manifest } = await loadManifest(agentManifestPath);
+    if (!isAgentManifest(manifest)) {
+        throw new SpawnfileError("validation_error", "A production-booted training subject must be declared in its own agent Spawnfile");
+    }
+    await cp(path.dirname(agentManifestPath), directory, {
+        recursive: true,
+        filter: (source) => !SKIPPED.has(path.basename(source))
+    });
+    const { schedule: _schedule, surfaces: _surfaces, training: _training, ...kept } = manifest;
+    const trial = { ...kept, workspace: { ...kept.workspace, docs: { ...kept.workspace?.docs, system: TRIAL_INSTRUCTIONS_FILE } } };
+    await writeFile(path.join(directory, TRIAL_INSTRUCTIONS_FILE), instructions);
+    const manifestPath = path.join(directory, "Spawnfile");
+    await writeFile(manifestPath, renderSpawnfile(trial));
+    return manifestPath;
+};

package/dist/compiler/upReceipt.d.ts

@@ -1,24 +1,9 @@
 import { type CompiledEngineEntry, type CompiledScheduleEntry, type UpReceipt } from "../deployment/index.js";
 import type { CompilePlan } from "./types.js";
 import type { UpProjectResult } from "./upProject.js";
-/**
- * Extracts the `{agent, cron}` pairs an up-receipt's `compiled_schedule` field carries
- * (Decision 21 Piece 4) — the raw material for simfile's wake-diff denominator oracle.
- * Only `kind: "cron"` schedules are represented; `every`/`disabled` schedules have no
- * cron-fire cadence to diff against sim-time and are intentionally omitted, not zeroed.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export declare const resolveCompiledSchedule: (plan: CompilePlan) => CompiledScheduleEntry[];
-/**
- * Extracts `{agent, engine}` pairs (Piece 5, Slice B) — disclosure ground truth for the
- * run-manifest's `pinned-engine` field, so a `scripted` (or any non-default) pi engine is
- * visibly disclosed rather than an invisible test-only branch. Reads
- * `report.container.runtime_instances[].engine_by_node_id`, the single source of truth
- * `containerArtifacts.ts` already stamps from the pi adapter's own resolved engine kinds
- * (see `src/runtime/pi/adapter.ts`'s `createContainerTargets`) — deliberately not
- * re-derived from a fresh `buildCompilePlan` walk (unlike `resolveCompiledSchedule` above),
- * since that would recompute the exact same fact from pi-adapter-internal logic
- * (`resolvePiEngine`) that compiler code has no business reaching into directly.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export declare const resolveCompiledEngines: (report: UpProjectResult["report"]) => CompiledEngineEntry[];
 /**
  * Builds `spawnfile.up-receipt.v1` from a project-path `upProject()` result. Reads back

package/dist/compiler/upReceipt.js

@@ -1,12 +1,7 @@
 import { readDeploymentRecord, UP_RECEIPT_VERSION } from "../deployment/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { buildCompilePlan } from "./buildCompilePlan.js";
-/**
- * Extracts the `{agent, cron}` pairs an up-receipt's `compiled_schedule` field carries
- * (Decision 21 Piece 4) — the raw material for simfile's wake-diff denominator oracle.
- * Only `kind: "cron"` schedules are represented; `every`/`disabled` schedules have no
- * cron-fire cadence to diff against sim-time and are intentionally omitted, not zeroed.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export const resolveCompiledSchedule = (plan) => plan.nodes
     .filter((node) => node.kind === "agent")
     .flatMap((node) => {
@@ -14,17 +9,7 @@ export const resolveCompiledSchedule = (plan) => plan.nodes
     return schedule?.kind === "cron" ? [{ agent: node.id, cron: schedule.cron }] : [];
 })
     .sort((left, right) => left.agent.localeCompare(right.agent));
-/**
- * Extracts `{agent, engine}` pairs (Piece 5, Slice B) — disclosure ground truth for the
- * run-manifest's `pinned-engine` field, so a `scripted` (or any non-default) pi engine is
- * visibly disclosed rather than an invisible test-only branch. Reads
- * `report.container.runtime_instances[].engine_by_node_id`, the single source of truth
- * `containerArtifacts.ts` already stamps from the pi adapter's own resolved engine kinds
- * (see `src/runtime/pi/adapter.ts`'s `createContainerTargets`) — deliberately not
- * re-derived from a fresh `buildCompilePlan` walk (unlike `resolveCompiledSchedule` above),
- * since that would recompute the exact same fact from pi-adapter-internal logic
- * (`resolvePiEngine`) that compiler code has no business reaching into directly.
- */
+/** Reads adapter-resolved engine kinds from the compiled report for the up receipt. */
 export const resolveCompiledEngines = (report) => (report.container?.runtime_instances ?? [])
     .flatMap((instance) => Object.entries(instance.engine_by_node_id ?? {}))
     .map(([agent, engine]) => ({ agent, engine }))

package/dist/deployment/artifactsExportPlan.js

@@ -73,25 +73,9 @@ const planMnemeFiles = (report, mounts) => (report.container?.memory ?? []).flat
         }
     }));
 });
-/** Daimon: per pi/daimon runtime instance, per agent it covers, the turn-causal telemetry
- * stream at `runtime/agents/<slug>/telemetry/causal.jsonl` under the instance root (see
- * `ecosystem/daimon/src/observability/causalEvents.ts`). As of Piece 4b, that directory is
- * a run-scoped durable volume (`daimonTelemetryArtifacts.ts`, mirroring how
- * `moltnetArtifacts.ts` mounts the Moltnet causal directory), resolved here via each
- * instance's `telemetry_mount_ids` (node id -> persistent mount id). This is the real
- * relaxation of the export-before-teardown invariant (Decision 21) for daimon truth:
- * `spawnfile down` (without `--volumes`) can run BEFORE `spawnfile artifacts export`, and
- * export still recovers every agent's causal.jsonl from its named volume.
- *
- * The `instance.home_path`-keyed branch below is a legacy fallback for a compile report
- * written before Piece 4b (no `telemetry_mount_ids` yet) — it reads the old container-local
- * path with `docker cp`, which only works while the container is still live. Any report
- * produced by this compiler build always populates `telemetry_mount_ids` for a pi/daimon
- * instance, so that branch never fires today; it exists only so an out-of-date report
- * doesn't silently export zero daimon files. Optional either way: a fresh instance that
- * never woke has no telemetry file yet. */
+/** Plans optional Daimon causal telemetry exports from declared mounts or a legacy instance home. */
 const planDaimonFiles = (report, mounts) => (report.container?.runtime_instances ?? [])
-    .filter((instance) => instance.runtime === "pi" || instance.runtime === "daimon")
+    .filter((instance) => instance.runtime === "daimon")
     .flatMap((instance) => (instance.node_ids ?? []).flatMap((nodeId) => {
     const slug = agentSlugFromNodeId(nodeId);
     if (!slug) {