spawnfile 0.1.33 → 0.1.34

package/dist/compiler/daimonTelemetryArtifacts.js

@@ -1,56 +0,0 @@
-import path from "node:path/posix";
-import { resolveNoopolisRunId } from "../runtime/index.js";
-import { createPersistentVolumeName } from "./moltnetArtifactPaths.js";
-/** Only the legacy generated Pi application writes this telemetry layout. */
-const PI_TELEMETRY_RUNTIME_NAMES = new Set(["pi"]);
-const createTelemetryMountId = (agentSlug) => `agent-${agentSlug}-daimon-telemetry`;
-/**
- * Registers one run-scoped durable volume per legacy Pi agent for its daimon turn/wake
- * causal telemetry directory (`<instanceRoot>/runtime/agents/<slug>/telemetry` — the parent
- * of `causal.jsonl`, see `appCoreSource.ts`'s `runtimeHomePath`/`instanceRoot`), mirroring
- * exactly how `moltnetArtifacts.ts` mounts the Moltnet causal directory (Piece 4b,
- * Decision 21: daimon inner-truth telemetry was container-local — `docker cp` only — until
- * now). Daimon's own write path is untouched: this only makes the HOST side of that same
- * directory a named volume, so `docker rm` no longer discards it.
- */
-export const createDaimonTelemetryArtifacts = (plan, runtimePlans, compiledNodes) => {
-    // Same run-scoping key as every other durable mount (see
-    // moltnetArtifactPaths.ts's createPersistentVolumeName doc comment): present for
-    // `spawnfile run`/`up` (which always call ensureNoopolisRunId() first), absent for a
-    // bare `spawnfile compile`/`build`, keeping those byte-identical to before this module
-    // existed.
-    const runId = resolveNoopolisRunId(process.env);
-    const agentSlugByNodeId = new Map(compiledNodes
-        .filter((node) => node.kind === "agent" && Boolean(node.id))
-        .map((node) => [node.id, node.slug]));
-    const mounts = [];
-    const telemetryMountIdsByInstance = new Map();
-    for (const runtimePlan of runtimePlans) {
-        if (!PI_TELEMETRY_RUNTIME_NAMES.has(runtimePlan.runtimeName) || !runtimePlan.instancePaths.homePath) {
-            continue;
-        }
-        const instanceRoot = runtimePlan.instancePaths.instanceRoot ?? path.dirname(runtimePlan.instancePaths.homePath);
-        const mountIdsByNodeId = {};
-        for (const nodeId of runtimePlan.sourceIds ?? []) {
-            const agentSlug = agentSlugByNodeId.get(nodeId);
-            if (!agentSlug) {
-                continue;
-            }
-            const mountId = createTelemetryMountId(agentSlug);
-            mounts.push({
-                id: mountId,
-                mount_path: path.join(instanceRoot, "runtime", "agents", agentSlug, "telemetry"),
-                reason: `daimon turn/wake causal telemetry for ${agentSlug}`,
-                volume_name: createPersistentVolumeName(plan.root, mountId, runId)
-            });
-            mountIdsByNodeId[nodeId] = mountId;
-        }
-        if (Object.keys(mountIdsByNodeId).length > 0) {
-            telemetryMountIdsByInstance.set(runtimePlan.id, mountIdsByNodeId);
-        }
-    }
-    return {
-        mounts: mounts.sort((left, right) => left.id.localeCompare(right.id)),
-        telemetryMountIdsByInstance
-    };
-};

package/dist/compiler/training/broker/clockProbe.d.ts

@@ -1,6 +0,0 @@
-/** Clock directories are public by contract; prove the sibling mask in the worker's mount namespace. */
-export declare const probeTrainingSiblingClock: (slot: number, target: string, execute?: (command: string, args: string[], options: {
-    timeout: number;
-}) => Promise<{
-    stdout: string;
-}>) => Promise<boolean>;

package/dist/compiler/training/broker/clockProbe.js

@@ -1,27 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { SpawnfileError } from "../../../shared/index.js";
-import { trainingSlotPaths } from "./paths.js";
-const run = promisify(execFile);
-const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
-/** Clock directories are public by contract; prove the sibling mask in the worker's mount namespace. */
-export const probeTrainingSiblingClock = async (slot, target, execute = run) => {
-    const p = trainingSlotPaths(slot);
-    const script = [
-        'set -eu',
-        `cat ${quote(p.clockFile)} >/dev/null`,
-        // Use the same mode-000 directory bind as Grok's deny mounts. Neither an unavailable
-        // namespace nor a hidden own clock is a successful denial.
-        `blocked=$(mktemp -d ${quote(`${p.privateTmp}/clock-probe.XXXXXX`)})`,
-        'trap \'chmod 700 "$blocked"; rmdir "$blocked"\' EXIT',
-        'chmod 000 "$blocked"',
-        `bwrap --die-with-parent --cap-drop ALL --ro-bind / / --dev /dev --ro-bind "$blocked" ${quote(target)} -- /bin/sh -ceu ${quote(`cat ${quote(p.clockFile)} >/dev/null; if ls -A ${quote(target)} >/dev/null 2>&1; then echo reachable; else echo denied; fi`)}`
-    ].join("\n");
-    const result = await execute("setpriv", ["--clear-groups", `--reuid=${p.workerUid}`, `--regid=${p.workerUid}`,
-        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", "/bin/sh", "-ceu", script], { timeout: 10_000 });
-    if (result.stdout.trim() === "denied")
-        return true;
-    if (result.stdout.trim() === "reachable")
-        return false;
-    throw new SpawnfileError("runtime_error", "Training clock canary returned no verified verdict");
-};

package/dist/compiler/training/broker/declaration.d.ts

@@ -1,54 +0,0 @@
-import { z } from "zod";
-/**
- * `spawnfile.training-broker.v2`: the only thing the host tells the
- * broker-capable training container about its slot. It is data, never code —
- * the image's own Spawnfile distribution renders the provisioning from it with
- * the same renderers production uses, so no host-written executable is ever
- * mounted (`../container/AGENTS.md`).
- *
- * It carries no credentials: the training Grok login reaches the container only
- * as the read-only bootstrap leaf bind, and the rotating credential lives on
- * the named realm volume.
- */
-export declare const trainingBrokerDeclarationSchema: z.ZodObject<{
-    version: z.ZodLiteral<"spawnfile.training-broker.v2">;
-    maxRunRequests: z.ZodDefault<z.ZodNumber>;
-    slots: z.ZodDefault<z.ZodNumber>;
-    engine: z.ZodLiteral<"grok">;
-    agentId: z.ZodString;
-    model: z.ZodEnum<{
-        "grok-4.6": "grok-4.6";
-        "grok-4.5": "grok-4.5";
-        "grok-build": "grok-build";
-    }>;
-    reasoningEffort: z.ZodEnum<{
-        low: "low";
-        medium: "medium";
-        high: "high";
-    }>;
-    architecture: z.ZodEnum<{
-        arm64: "arm64";
-        x64: "x64";
-    }>;
-    limits: z.ZodObject<{
-        maxRequests: z.ZodNumber;
-        maxTokens: z.ZodNumber;
-        timeoutMs: z.ZodNumber;
-    }, z.core.$strict>;
-    bootstrap: z.ZodString;
-    organizationUid: z.ZodLiteral<2000>;
-    seccompProfileSha256: z.ZodString;
-    unenforcedBindPolicy: z.ZodDefault<z.ZodEnum<{
-        refuse: "refuse";
-        "profile-only": "profile-only";
-    }>>;
-    skills: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        files: z.ZodArray<z.ZodObject<{
-            path: z.ZodString;
-            content: z.ZodString;
-        }, z.core.$strict>>;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-export type TrainingBrokerDeclaration = z.infer<typeof trainingBrokerDeclarationSchema>;
-export declare const parseTrainingBrokerDeclaration: (value: unknown) => TrainingBrokerDeclaration;

package/dist/compiler/training/broker/declaration.js

@@ -1,70 +0,0 @@
-import { DAIMON_BROKER_ENGINE_ID } from "../../../runtime/daimon/index.js";
-import path from "node:path";
-import { z } from "zod";
-import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-const canonical = z.string().min(2).max(4_096).refine((value) => path.posix.isAbsolute(value) && path.posix.normalize(value) === value && !value.endsWith("/") && !value.includes("\0"), "canonical absolute path");
-/**
- * `spawnfile.training-broker.v2`: the only thing the host tells the
- * broker-capable training container about its slot. It is data, never code —
- * the image's own Spawnfile distribution renders the provisioning from it with
- * the same renderers production uses, so no host-written executable is ever
- * mounted (`../container/AGENTS.md`).
- *
- * It carries no credentials: the training Grok login reaches the container only
- * as the read-only bootstrap leaf bind, and the rotating credential lives on
- * the named realm volume.
- */
-export const trainingBrokerDeclarationSchema = z.strictObject({
-    version: z.literal("spawnfile.training-broker.v2"),
-    maxRunRequests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).default(1000),
-    slots: z.number().int().min(1).max(8).default(4),
-    engine: z.literal(DAIMON_BROKER_ENGINE_ID),
-    agentId: z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u),
-    model: z.enum(DAIMON_GROK_BROKER_MODELS),
-    reasoningEffort: z.enum(DAIMON_GROK_BROKER_REASONING_EFFORTS),
-    architecture: z.enum(["arm64", "x64"]),
-    limits: z.strictObject({
-        maxRequests: z.number().int().min(DAIMON_GROK_ENGINE_BROKER.turnLimits.bounds.maxRequests[0]).max(DAIMON_GROK_ENGINE_BROKER.turnLimits.bounds.maxRequests[1]),
-        maxTokens: z.number().int().min(DAIMON_GROK_ENGINE_BROKER.turnLimits.bounds.maxTokens[0]).max(DAIMON_GROK_ENGINE_BROKER.turnLimits.bounds.maxTokens[1]),
-        timeoutMs: z.number().int().min(DAIMON_GROK_ENGINE_BROKER.turnLimits.bounds.timeoutMs[0]).max(DAIMON_GROK_ENGINE_BROKER.turnLimits.bounds.timeoutMs[1])
-    }),
-    /** The read-only bootstrap credential leaf, already refused if it is the desktop `~/.grok/auth.json`. */
-    bootstrap: canonical,
-    /** The uid the trained evaluator (Training, DSPy, judges) runs as; the only uid the slot supervisor serves. */
-    organizationUid: z.literal(DAIMON_GROK_ENGINE_BROKER.identities.organizationUid),
-    seccompProfileSha256: z.string().regex(/^[a-f0-9]{64}$/u),
-    /**
-     * What the slot supervisor does with a deny path whose backing filesystem
-     * does not enforce unix ownership — virtiofs and grpcfuse under Docker
-     * Desktop and Colima, where `chown` is silently ignored and uid 2200 reads a
-     * root `0600` file (P0 §5). The backing filesystem decides, not the fact of
-     * being a host bind: the same bind over ext4 or overlay on a Linux daemon is
-     * probed for real, which is what makes `refuse` a default a run can meet.
-     *
-     * `refuse` (the default) fails the slot and writes no receipt: a worker-uid
-     * probe over such a path carries no information, so the supervisor will not
-     * certify it. `profile-only` is the operator's explicit acceptance that for
-     * those paths the boundary is the bubblewrap-enforced `deny` list alone —
-     * verified to block both shell `cat` and `read_file` on 1.0.34 (P0 §4), but
-     * *not* a boundary a worker-uid namespace cannot lift — and the supervisor
-     * records every path that used that weaker evidence in its log.
-     *
-     * It does not reach `TRAINING_SEALED_DENY_PATHS`. The sealed train and test
-     * datasets are held by DAC on their ancestor under both values, and a slot
-     * that cannot prove that denial is refused whatever this says.
-     */
-    unenforcedBindPolicy: z.enum(["refuse", "profile-only"]).default("refuse"),
-    /**
-     * The subject's declared skills in Daimon's engine-neutral form (the
-     * compiled `.agents/skills` tree), omitted when it declares none. Root
-     * provisioning renders them into every slot's `$GROK_HOME/skills`, and the
-     * entrypoint, supervisor and lease all resolve the projection from this one
-     * read-only input, so they bind the same `skillsSha256`. Daimon's own parser
-     * (mirrored in `runtime/daimon/grokWorkerSkills.ts`) enforces the bounds.
-     */
-    skills: z.array(z.strictObject({
-        name: z.string().min(1).max(128),
-        files: z.array(z.strictObject({ path: z.string().min(1).max(1_024), content: z.string() })).min(1).max(64)
-    })).min(1).max(64).optional()
-}).strict();
-export const parseTrainingBrokerDeclaration = (value) => trainingBrokerDeclarationSchema.parse(value);

package/dist/compiler/training/broker/entrypoint.d.ts

@@ -1,39 +0,0 @@
-import { type DaimonProjectionModule } from "./projection.js";
-export declare const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "SPAWNFILE_TRAINING_GROK_BROKER_CONTROL_SOCKET";
-export declare const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT";
-export declare const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
-/**
- * The desktop Grok login, in every spelling a caller might reach it by.
- *
- * D2 is explicit: training uses one dedicated Grok login and never the
- * developer's own. An in-container refresh rotates the credential, so mounting
- * the desktop leaf would invalidate the developer's desktop session as a side
- * effect of a training run — and the refreshed token would live on tmpfs, so
- * the desktop login would be gone rather than moved.
- */
-export declare const desktopGrokAuthPaths: (home?: string) => string[];
-export declare const assertNotDesktopGrokAuth: (source: string, home?: string) => string;
-export interface TrainingEntrypointOptions {
-    argv: readonly string[];
-    declarationPath?: string;
-    loadDaimon?: () => Promise<DaimonProjectionModule>;
-    log?: (line: string) => void;
-}
-/**
- * The broker-capable training container's root entrypoint.
- *
- * Order matters and is the whole privilege model: provision as root with the
- * production capability set, start the launcher (root) and the broker and
- * relay (2100) and prove each one's post-drop identity, publish the slot
- * supervisor socket, and only then drop to uid 2000 with an empty capability
- * bounding set to run `train`. The training core, DSPy and the judges are that uid; the
- * model's own tools are the worker uid the launcher alone can reach.
- */
-export declare const runTrainingBrokerEntrypoint: (options: TrainingEntrypointOptions) => Promise<number>;
-/**
- * `train` as uid 2000 with an empty bounding set, proven inside the child
- * before it execs: `setpriv --bounding-set=-all` silently does nothing without
- * `CAP_SETPCAP`, so the guard has to read `/proc/self/status` rather than
- * trust the flag.
- */
-export declare const trainingChildArgv: (argv: readonly string[], uid?: number) => string[];

package/dist/compiler/training/broker/entrypoint.js

@@ -1,124 +0,0 @@
-import { normalizedTrainingEnvironment } from "../../../shared/index.js";
-import { spawn } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { lstat, readFile } from "node:fs/promises";
-import os from "node:os";
-import { renderTrainingBrokerProvisioning } from "./provisioning.js";
-import { runTrainingRootScript } from "./rootScript.js";
-import { stageTrainingEvaluatorSecret } from "./evaluatorSecrets.js";
-import { startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-import { resetTrainingBrokerSlotAsOrganization } from "./reset.js";
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { parseTrainingBrokerDeclaration } from "./declaration.js";
-import { loadDaimonProjectionModule, resolveTrainingSlotProjection } from "./projection.js";
-import { createTrainingSlotRuntime } from "./runtime.js";
-import { createTrainingSlotSupervisor, serveTrainingSlotSupervisor, startTrainingSlot } from "./supervisor.js";
-import { trainingSlotDescriptors, assertTrainingSlotsDocument, TRAINING_SLOTS_FILE, DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
-export const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "SPAWNFILE_TRAINING_GROK_BROKER_CONTROL_SOCKET";
-export const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT";
-export const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
-/**
- * The desktop Grok login, in every spelling a caller might reach it by.
- *
- * D2 is explicit: training uses one dedicated Grok login and never the
- * developer's own. An in-container refresh rotates the credential, so mounting
- * the desktop leaf would invalidate the developer's desktop session as a side
- * effect of a training run — and the refreshed token would live on tmpfs, so
- * the desktop login would be gone rather than moved.
- */
-export const desktopGrokAuthPaths = (home = os.homedir()) => [path.resolve(home, ".grok/auth.json"), path.resolve(home, ".grok", "auth.json")];
-export const assertNotDesktopGrokAuth = (source, home = os.homedir()) => {
-    if (desktopGrokAuthPaths(home).includes(path.resolve(source))) {
-        throw new SpawnfileError("validation_error", "Training refuses the desktop ~/.grok/auth.json as its Grok bootstrap; import a dedicated login with `spawnfile auth import grok --profile spawnfile-training --from <dir>`");
-    }
-    return source;
-};
-/** The bootstrap leaf inside the container: the fixed read-only mount, a bounded regular file, never a symlink. */
-const assertBootstrap = async (declaration) => {
-    if (declaration.bootstrap !== TRAINING_BOOTSTRAP_MOUNT) {
-        throw new SpawnfileError("validation_error", `The training Grok bootstrap must be mounted at ${TRAINING_BOOTSTRAP_MOUNT}`);
-    }
-    const info = await lstat(declaration.bootstrap);
-    if (!info.isFile() || info.isSymbolicLink() || info.size < 2 || info.size > DAIMON_GROK_SUBSCRIPTION_MAX_BYTES) {
-        throw new SpawnfileError("validation_error", "The training Grok bootstrap must be a bounded regular credential leaf");
-    }
-};
-const DAIMON_GROK_SUBSCRIPTION_MAX_BYTES = 64 * 1024;
-/**
- * The broker-capable training container's root entrypoint.
- *
- * Order matters and is the whole privilege model: provision as root with the
- * production capability set, start the launcher (root) and the broker and
- * relay (2100) and prove each one's post-drop identity, publish the slot
- * supervisor socket, and only then drop to uid 2000 with an empty capability
- * bounding set to run `train`. The training core, DSPy and the judges are that uid; the
- * model's own tools are the worker uid the launcher alone can reach.
- */
-export const runTrainingBrokerEntrypoint = async (options) => {
-    const log = options.log ?? ((line) => process.stderr.write(`[training-entrypoint] ${line}\n`));
-    if (process.getuid?.() !== 0)
-        throw new SpawnfileError("runtime_error", "The broker-capable training container must start as root");
-    const declaration = parseTrainingBrokerDeclaration(JSON.parse(await readFile(options.declarationPath ?? TRAINING_BROKER_DECLARATION_FILE, "utf8")));
-    await assertBootstrap(declaration);
-    const descriptors = trainingSlotDescriptors(declaration.slots);
-    const document = JSON.parse(await readFile(TRAINING_SLOTS_FILE, "utf8"));
-    assertTrainingSlotsDocument(document, declaration.slots);
-    const daimon = await (options.loadDaimon ?? loadDaimonProjectionModule)();
-    const reset = resetTrainingBrokerSlotAsOrganization;
-    const slots = await Promise.all(descriptors.map(p => resolveTrainingSlotProjection(declaration, p.slot, daimon)));
-    const registrations = slots.map(slot => slot.registration);
-    const runtimes = slots.map(({ registration, projectionSha256 }) => createTrainingSlotRuntime({ declaration, registration, projectionSha256, reset }));
-    await stageTrainingEvaluatorSecret();
-    await runTrainingRootScript(renderTrainingBrokerProvisioning(registrations, declaration.maxRunRequests).join("\n"), { maxBuffer: 8 * 1024 * 1024 });
-    const children = await startBrokerProcesses({ log });
-    let server;
-    try {
-        for (const runtime of runtimes)
-            await startTrainingSlot(runtime, randomBytes(32).toString("hex"));
-        const supervisor = createTrainingSlotSupervisor({ runtimes, organizationUid: declaration.organizationUid });
-        server = serveTrainingSlotSupervisor(supervisor, TRAINING_SUPERVISOR_SOCKET, log, declaration.organizationUid);
-        log(`provisioned ${registrations.length} training slots with one broker process set`);
-        return await runTrainingChild(options.argv, declaration, log);
-    }
-    finally {
-        server?.close();
-        await stopBrokerProcesses(children, log);
-    }
-};
-/**
- * `train` as uid 2000 with an empty bounding set, proven inside the child
- * before it execs: `setpriv --bounding-set=-all` silently does nothing without
- * `CAP_SETPCAP`, so the guard has to read `/proc/self/status` rather than
- * trust the flag.
- */
-export const trainingChildArgv = (argv, uid = DAIMON_ORGANIZATION_UID) => [
-    "setpriv", "--clear-groups", `--reuid=${uid}`, `--regid=${uid}`, "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all",
-    "--", "/bin/bash", "-ceu",
-    'if [ "$EUID" -eq 0 ]; then echo "training must not run as root" >&2; exit 1; fi\n'
-        + 'test "$(sed -n "s/^CapBnd:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
-        + 'test "$(sed -n "s/^CapEff:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
-        + 'exec "$@"',
-    "bash", TRAINING_ENTRYPOINT_COMMAND, ...argv
-];
-const runTrainingChild = (argv, declaration, log) => new Promise((resolve) => {
-    const command = trainingChildArgv(argv, declaration.organizationUid);
-    const child = spawn(command[0], command.slice(1), {
-        stdio: ["ignore", "inherit", "inherit"],
-        env: {
-            ...normalizedTrainingEnvironment(),
-            [TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV]: DAIMON_GROK_ENGINE_BROKER.controlSocketPath,
-            [TRAINING_GROK_GRANT_HOME_ROOT_ENV]: TRAINING_GRANT_HOME_ROOT,
-            SPAWNFILE_TRAINING_SLOTS_FILE: TRAINING_SLOTS_FILE,
-            HOME: "/home/training"
-        }
-    });
-    const forward = (signal) => () => child.kill(signal);
-    for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"])
-        process.on(signal, forward(signal));
-    child.once("exit", (code, signal) => {
-        log(`training exited code=${code ?? "null"} signal=${signal ?? "none"}`);
-        resolve(signal ? (signal === "SIGINT" ? 130 : 143) : code ?? 1);
-    });
-});

package/dist/compiler/training/broker/evaluatorSecrets.d.ts

@@ -1,2 +0,0 @@
-/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
-export declare const stageTrainingEvaluatorSecret: (env?: NodeJS.ProcessEnv) => Promise<void>;

package/dist/compiler/training/broker/evaluatorSecrets.js

@@ -1,62 +0,0 @@
-import { trainingEnvironment } from "../../../shared/index.js";
-import { constants } from "node:fs";
-import { chmod, chown, lstat, mkdir, open } from "node:fs/promises";
-import path from "node:path";
-import { TRAINING_TYPESAFE_SECRET_FILE, TRAINING_TYPESAFE_SECRET_INGRESS } from "../container/evaluators.js";
-import { DAIMON_ORGANIZATION_UID } from "./paths.js";
-/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
-export const stageTrainingEvaluatorSecret = async (env = process.env) => {
-    const secretFile = trainingEnvironment("SPAWNFILE_TRAINING_TYPESAFE_SECRET_FILE", env);
-    if (secretFile === undefined)
-        return;
-    if (process.getuid?.() !== 0 || secretFile !== TRAINING_TYPESAFE_SECRET_FILE) {
-        throw Error("Invalid evaluator secret staging declaration");
-    }
-    try {
-        const ingress = path.posix.dirname(TRAINING_TYPESAFE_SECRET_INGRESS);
-        const parent = await lstat(ingress);
-        if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== 0)
-            throw Error("Invalid ingress directory");
-        // This directory is tmpfs, never the mounted credential inode.
-        await chmod(ingress, 0o700);
-        const source = await open(TRAINING_TYPESAFE_SECRET_INGRESS, constants.O_RDONLY | constants.O_NOFOLLOW);
-        let bytes;
-        try {
-            const info = await source.stat();
-            if (!info.isFile() || info.nlink !== 1 || info.size < 1 || info.size > 64 * 1024)
-                throw Error("Invalid ingress leaf");
-            const buffer = Buffer.alloc(64 * 1024 + 1);
-            const { bytesRead } = await source.read(buffer, 0, buffer.length, 0);
-            const after = await source.stat();
-            if (bytesRead !== info.size || after.size !== info.size || after.mtimeMs !== info.mtimeMs || after.ctimeMs !== info.ctimeMs) {
-                throw Error("Secret changed while staging");
-            }
-            bytes = buffer.subarray(0, bytesRead);
-        }
-        finally {
-            await source.close();
-        }
-        const destination = path.posix.dirname(TRAINING_TYPESAFE_SECRET_FILE);
-        await mkdir(destination, { mode: 0o700 });
-        const target = await open(TRAINING_TYPESAFE_SECRET_FILE, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-        try {
-            await target.writeFile(bytes);
-            await target.sync();
-            await target.chown(DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
-        }
-        finally {
-            bytes.fill(0);
-            await target.close();
-        }
-        await chown(destination, DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
-        const info = await lstat(TRAINING_TYPESAFE_SECRET_FILE), directory = await lstat(destination);
-        if (info.uid !== DAIMON_ORGANIZATION_UID || info.gid !== DAIMON_ORGANIZATION_UID || (info.mode & 0o777) !== 0o600 ||
-            directory.uid !== DAIMON_ORGANIZATION_UID || directory.gid !== DAIMON_ORGANIZATION_UID || (directory.mode & 0o777) !== 0o700) {
-            throw Error("Invalid evaluator secret ownership");
-        }
-    }
-    catch {
-        // Filesystem errors may contain credential bytes supplied by a transport; emit only a fixed diagnostic.
-        throw Error("Evaluator secret staging failed");
-    }
-};

package/dist/compiler/training/broker/index.d.ts

@@ -1,12 +0,0 @@
-export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema, type TrainingBrokerDeclaration } from "./declaration.js";
-export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
-export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-export { loadDaimonProjectionModule, resolveTrainingGrokProjection, resolveTrainingSlotProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
-export { recycleTrainingSlot, TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS, TRAINING_RECYCLE_MAX_REPLY_BYTES, type RecycleTrainingSlotOptions, type TrainingSlotRecycleReceipt } from "./recycleClient.js";
-export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
-export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
-export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
-export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
-export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
-export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL, type TrainingSlotRuntime } from "./supervisor.js";
-export * from "./paths.js";

package/dist/compiler/training/broker/index.js

@@ -1,12 +0,0 @@
-export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema } from "./declaration.js";
-export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
-export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-export { loadDaimonProjectionModule, resolveTrainingGrokProjection, resolveTrainingSlotProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
-export { recycleTrainingSlot, TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS, TRAINING_RECYCLE_MAX_REPLY_BYTES } from "./recycleClient.js";
-export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
-export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
-export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
-export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
-export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
-export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
-export * from "./paths.js";

package/dist/compiler/training/broker/main.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/dist/compiler/training/broker/main.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-import { runTrainingBrokerEntrypoint } from "./entrypoint.js";
-/**
- * The broker-capable training image's root entrypoint process. The image ships
- * it; the host supplies only the read-only `spawnfile.training-broker.v2`
- * declaration and never a script, so no host executable enters the container.
- */
-const main = async () => {
-    process.exitCode = await runTrainingBrokerEntrypoint({ argv: process.argv.slice(2) });
-};
-main().catch((error) => {
-    process.stderr.write(`[training-entrypoint] ${error instanceof Error ? error.message : String(error)}\n`);
-    process.exitCode = 1;
-});