spawnfile 0.1.33 → 0.1.35

package/README.md

@@ -83,7 +83,7 @@ See [container deployment](specs/CONTAINERS.md), [status](specs/STATUS.md), and
 | **OpenClaw** | OpenClaw agents and their native messaging surfaces. The default agent scaffold. |
 | **PicoClaw** | PicoClaw agents and their native messaging surfaces. |
 
-Daimon requires a pinned runtime image matching the compiler contract. The older `pi` adapter remains available for existing projects.
+Daimon requires a pinned runtime image matching the compiler contract.
 
 Portability is capability-specific: the compiler reports each feature as **supported**, **degraded**, or **unsupported**. Read that report before switching runtimes. Exact versions live in [runtimes.yaml](runtimes.yaml); the [runtime specification](specs/RUNTIMES.md) describes the adapter model.
 

package/dist/audit/readAudit.d.ts

@@ -3,12 +3,12 @@ import type { AuditReport } from "./types.js";
 export declare const auditReportSchema: z.ZodObject<{
     checks: z.ZodArray<z.ZodObject<{
         category: z.ZodEnum<{
-            provenance: "provenance";
-            causal: "causal";
             container: "container";
-            control: "control";
             memory: "memory";
             network: "network";
+            provenance: "provenance";
+            causal: "causal";
+            control: "control";
         }>;
         evidence: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         id: z.ZodString;

package/dist/auth/profileStore.d.ts

@@ -1,9 +1,11 @@
-import type { AuthProfile, ImportedAuthKind, ResolvedAuthProfile } from "./types.js";
+import type { AuthProfile, ImportedAuthKind, ResolvedAuthProfile, SubscriptionRealmBinding } from "./types.js";
 export declare const createResolvedAuthProfile: (profileName: string, profile: AuthProfile) => ResolvedAuthProfile;
 export declare const loadAuthProfile: (profileName: string) => Promise<ResolvedAuthProfile | null>;
 export declare const requireAuthProfile: (profileName: string) => Promise<ResolvedAuthProfile>;
 export declare const ensureAuthProfile: (profileName: string) => Promise<ResolvedAuthProfile>;
 export declare const setAuthProfileEnv: (profileName: string, env: Record<string, string>) => Promise<ResolvedAuthProfile>;
+/** Records an engine's volume-held login on the profile (names only, never login bytes). */
+export declare const registerSubscriptionRealm: (profileName: string, engine: string, binding: SubscriptionRealmBinding) => Promise<ResolvedAuthProfile>;
 export declare const registerImportedAuth: (profileName: string, kind: ImportedAuthKind) => Promise<{
     directory: string;
     profile: ResolvedAuthProfile;

package/dist/auth/profileStore.js

@@ -4,7 +4,7 @@ import { ensurePrivateDirectory, fileExists, readUtf8File, removeDirectory, writ
 import { SpawnfileError } from "../shared/index.js";
 import { resolveAuthHome, resolveImportedAuthDirectory, resolveProfileDirectory, resolveProfilePath, resolveProfilesRoot } from "./paths.js";
 const importedAuthEntrySchema = z.object({
-    kind: z.enum(["claude-code", "codex"]),
+    kind: z.enum(["claude-code", "codex", "grok"]),
     relativePath: z.string().min(1)
 });
 const authProfileSchema = z.object({
@@ -12,9 +12,15 @@ const authProfileSchema = z.object({
     imports: z
         .object({
         "claude-code": importedAuthEntrySchema.optional(),
-        codex: importedAuthEntrySchema.optional()
+        codex: importedAuthEntrySchema.optional(),
+        grok: importedAuthEntrySchema.optional()
     })
         .default({}),
+    realms: z.record(z.string().regex(/^[a-z][a-z0-9-]*$/u), z.object({
+        realmVolume: z.string().min(1),
+        unlockVolume: z.string().min(1),
+        homeVolume: z.string().min(1).optional()
+    }).strict()).optional(),
     version: z.literal(1)
 });
 const createEmptyProfile = () => ({
@@ -35,6 +41,17 @@ export const createResolvedAuthProfile = (profileName, profile) => ({
     name: profileName,
     profileDirectory: resolveProfileDirectory(profileName),
     profilePath: resolveProfilePath(profileName),
+    ...(profile.realms && Object.keys(profile.realms).length > 0 ? { realms: structuredClone(profile.realms) } : {}),
+    version: 1
+});
+/** The stored form of a resolved profile: import paths relative to its directory again. */
+const storedProfile = (current) => ({
+    env: { ...current.env },
+    imports: Object.fromEntries(Object.entries(current.imports).map(([kind, entry]) => [
+        kind,
+        { kind: entry.kind, relativePath: path.relative(current.profileDirectory, entry.path) }
+    ])),
+    ...(current.realms ? { realms: structuredClone(current.realms) } : {}),
     version: 1
 });
 export const loadAuthProfile = async (profileName) => {
@@ -80,20 +97,13 @@ const writeProfile = async (profileName, profile) => {
 };
 export const setAuthProfileEnv = async (profileName, env) => {
     const current = (await loadAuthProfile(profileName)) ?? (await ensureAuthProfile(profileName));
-    return writeProfile(profileName, {
-        env: {
-            ...current.env,
-            ...env
-        },
-        imports: Object.fromEntries(Object.entries(current.imports).map(([kind, entry]) => [
-            kind,
-            {
-                kind: entry.kind,
-                relativePath: path.relative(current.profileDirectory, entry.path)
-            }
-        ])),
-        version: 1
-    });
+    const stored = storedProfile(current);
+    return writeProfile(profileName, { ...stored, env: { ...stored.env, ...env } });
+};
+/** Records an engine's volume-held login on the profile (names only, never login bytes). */
+export const registerSubscriptionRealm = async (profileName, engine, binding) => {
+    const stored = storedProfile((await loadAuthProfile(profileName)) ?? (await ensureAuthProfile(profileName)));
+    return writeProfile(profileName, { ...stored, realms: { ...stored.realms, [engine]: { ...binding } } });
 };
 export const registerImportedAuth = async (profileName, kind) => {
     const current = (await loadAuthProfile(profileName)) ?? (await ensureAuthProfile(profileName));
@@ -104,22 +114,13 @@ export const registerImportedAuth = async (profileName, kind) => {
     if (kind !== "grok")
         await removeDirectory(importDirectory);
     await ensurePrivateDirectory(importDirectory);
+    const stored = storedProfile(current);
     const nextProfile = {
-        env: { ...current.env },
+        ...stored,
         imports: {
-            ...Object.fromEntries(Object.entries(current.imports).map(([entryKind, entry]) => [
-                entryKind,
-                {
-                    kind: entry.kind,
-                    relativePath: path.relative(current.profileDirectory, entry.path)
-                }
-            ])),
-            [kind]: {
-                kind,
-                relativePath: path.relative(current.profileDirectory, importDirectory)
-            }
-        },
-        version: 1
+            ...stored.imports,
+            [kind]: { kind, relativePath: path.relative(current.profileDirectory, importDirectory) }
+        }
     };
     return {
         directory: importDirectory,

package/dist/auth/trainingAuth.d.ts

@@ -1,9 +1,6 @@
 /**
- * Grok is deliberately absent. `spawnfile.training-container.v3` holds the one
- * dedicated training Grok login in a broker-owned realm volume seeded from a
- * read-only bootstrap leaf, and judges spend it through short inference grants
- * (D2). Staging a Grok credential into a shared runtime home would put a
- * rotating login where the evaluator and the image both reach it.
+ * Grok is deliberately absent: a training run's Grok login lives in its auth
+ * gateway's realm volume, never in a staged runtime home.
  */
 export type TrainingAuthProvider = "codex" | "claude";
 export interface TrainingAuthStageOptions {

package/dist/auth/types.d.ts

@@ -3,9 +3,23 @@ export interface ImportedAuthEntry {
     kind: ImportedAuthKind;
     relativePath: string;
 }
+/**
+ * A login that lives in Docker volumes rather than an importable file: the
+ * engine's durable realm volume, the volume holding its unlock secret, and the
+ * volume holding the engine's login files from its runtime home (seeded into
+ * each fresh home at boot, written back after the container stops).
+ * Created once by `spawnfile auth login <engine>`; the profile records names only.
+ */
+export interface SubscriptionRealmBinding {
+    realmVolume: string;
+    unlockVolume: string;
+    /** Absent on a login recorded before home login files were kept: log in again. */
+    homeVolume?: string;
+}
 export interface AuthProfile {
     env: Record<string, string>;
     imports: Partial<Record<ImportedAuthKind, ImportedAuthEntry>>;
+    realms?: Record<string, SubscriptionRealmBinding>;
     version: 1;
 }
 export interface ResolvedAuthProfile {
@@ -18,5 +32,7 @@ export interface ResolvedAuthProfile {
     name: string;
     profileDirectory: string;
     profilePath: string;
+    /** Volume-held logins by engine id; absent means none. */
+    realms?: Record<string, SubscriptionRealmBinding>;
     version: 1;
 }

package/dist/cli/authCommands.d.ts

@@ -1,5 +1,5 @@
 import type { Command } from "commander";
 import type { CliHandlers, CliStreams } from "./runCli.js";
-type AuthCommandHandlers = Pick<CliHandlers, "importClaudeCodeAuth" | "importCodexAuth" | "importGrokAuth" | "importEnvFile" | "initializeTargetSecretSourceLifecycle" | "provisionCredentials" | "requireAuthProfile" | "syncProjectAuth">;
+type AuthCommandHandlers = Pick<CliHandlers, "importClaudeCodeAuth" | "importCodexAuth" | "importGrokAuth" | "importEnvFile" | "initializeTargetSecretSourceLifecycle" | "loginSubscriptionRealm" | "provisionCredentials" | "requireAuthProfile" | "syncProjectAuth">;
 export declare const registerAuthCommands: (program: Command, handlers: AuthCommandHandlers, streams: CliStreams, stdin: AsyncIterable<unknown>) => void;
 export {};

package/dist/cli/authCommands.js

@@ -9,10 +9,12 @@ import { envFileAliasOption, resolveEnvFileOption, runtimeEnvFileOption } from "
 const formatAuthProfileSummary = (profile) => {
     const envKeys = Object.keys(profile.env).sort();
     const importedKinds = Object.keys(profile.imports).sort();
+    const realms = Object.keys(profile.realms ?? {}).sort();
     return [
         `profile: ${profile.name}`,
         `env: ${envKeys.length > 0 ? envKeys.join(", ") : "none"}`,
-        `imports: ${importedKinds.length > 0 ? importedKinds.join(", ") : "none"}`
+        `imports: ${importedKinds.length > 0 ? importedKinds.join(", ") : "none"}`,
+        ...(realms.length > 0 ? [`logins: ${realms.join(", ")}`] : [])
     ];
 };
 const emitLines = (streams, lines) => lines.forEach((line) => streams.stdout(line));
@@ -108,6 +110,24 @@ export const registerAuthCommands = (program, handlers, streams, stdin) => {
         const profile = await handlers.importCodexAuth(options.profile, options.from);
         emitLines(streams, formatAuthProfileSummary(profile));
     });
+    authCommand
+        .command("login")
+        .description("Sign an auth profile into its own volume-held login (AGY) from this terminal")
+        .argument("<engine>", "Daimon engine whose login lives in a keyring realm, e.g. agy")
+        .option("-p, --profile <name>", "Auth profile name", "default")
+        .option("--dry-run", "Prepare the login volumes and print the login command without running it")
+        .action(async (engine, options) => {
+        if (!options.dryRun && process.stdin.isTTY !== true) {
+            throw new Error("spawnfile auth login is interactive; run it from a terminal");
+        }
+        const result = await handlers.loginSubscriptionRealm({ engine, profileName: options.profile, dryRun: options.dryRun === true });
+        emitLines(streams, [
+            ...formatAuthProfileSummary(result.profile),
+            `realm volume: ${result.binding.realmVolume}`,
+            `unlock volume: ${result.binding.unlockVolume}`,
+            ...(options.dryRun ? [`login command: ${result.command.join(" ")}`] : [])
+        ]);
+    });
     authCommand
         .command("sync")
         .description("Provision auth material a project requires into a profile")

package/dist/cli/devCommands.d.ts

@@ -1,3 +1,3 @@
-import { type Command } from "commander";
+import type { Command } from "commander";
 import type { CliHandlers, CliStreams } from "./runCli.js";
 export declare const registerDevCommands: (program: Command, handlers: CliHandlers, streams: CliStreams) => void;

package/dist/cli/devCommands.js

@@ -1,11 +1,4 @@
-import { InvalidArgumentError } from "commander";
 import { envFileAliasOption, resolveEnvFileOption, runtimeEnvFileOption } from "./envFileOption.js";
-const parsePositiveIntegerOption = (value) => {
-    if (!/^[1-9]\d*$/u.test(value)) {
-        throw new InvalidArgumentError("must be a positive integer");
-    }
-    return Number(value);
-};
 export const registerDevCommands = (program, handlers, streams) => {
     const dev = program.command("dev").description("Run an interactive Spawnfile development deployment");
     dev
@@ -41,65 +34,6 @@ export const registerDevCommands = (program, handlers, streams) => {
             streams.stdout(`record: ${result.deploymentRecordPath}`);
         }
     });
-    dev
-        .command("apply")
-        .description("Hot-apply one agent into a running dev deployment")
-        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
-        .requiredOption("--agent <id>", "Agent id, slug, or name to hot-apply")
-        .option("--deployment <name>", "Detached deployment record name")
-        .option("--docker-command <command>", "Docker command")
-        .option("-o, --out <directory>", "Dev output directory")
-        .action(async (inputPath, options) => {
-        const result = await handlers.devApplyProject(inputPath, {
-            agent: options.agent,
-            deploymentName: options.deployment,
-            dockerCommand: options.dockerCommand,
-            outputDirectory: options.out
-        });
-        streams.stdout(`applied agent ${result.agentId}`);
-        streams.stdout(`container: ${result.containerName}`);
-        streams.stdout(`bridge: ${result.bridgeStarted ? "started" : "unchanged"}`);
-    });
-    dev
-        .command("restart")
-        .description("Reload one agent in a running dev deployment")
-        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
-        .requiredOption("--agent <id>", "Agent id, slug, or name to reload")
-        .option("--deployment <name>", "Detached deployment record name")
-        .option("--docker-command <command>", "Docker command")
-        .option("-o, --out <directory>", "Dev output directory")
-        .action(async (inputPath, options) => {
-        const result = await handlers.devRestartProject(inputPath, {
-            agent: options.agent,
-            deploymentName: options.deployment,
-            dockerCommand: options.dockerCommand,
-            outputDirectory: options.out
-        });
-        streams.stdout(`restarted agent ${result.agentId}`);
-        streams.stdout(`container: ${result.containerName}`);
-        streams.stdout(`bridge: ${result.bridgeStarted ? "started" : "unchanged"}`);
-    });
-    dev
-        .command("activity")
-        .description("Print the current Pi agent activity buffer from a running dev deployment")
-        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
-        .option("--agent <id>", "Only show events for one agent id, slug, or name")
-        .option("--deployment <name>", "Detached deployment record name")
-        .option("--docker-command <command>", "Docker command")
-        .option("-o, --out <directory>", "Dev output directory")
-        .option("--tail <count>", "Maximum buffered events to print", parsePositiveIntegerOption)
-        .action(async (inputPath, options) => {
-        const result = await handlers.devActivityProject(inputPath, {
-            agent: options.agent,
-            deploymentName: options.deployment,
-            dockerCommand: options.dockerCommand,
-            outputDirectory: options.out,
-            tail: options.tail
-        });
-        for (const event of result.events) {
-            streams.stdout(JSON.stringify(event));
-        }
-    });
     dev
         .command("stop")
         .description("Stop the recorded dev deployment container")

package/dist/cli/runCli.d.ts

@@ -1,6 +1,7 @@
+import { loginSubscriptionRealm } from "../compiler/training/trial/index.js";
 import { importClaudeCodeAuth, importCodexAuth, importGrokAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
 import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, createTrainingContext, createTrainingPlan, loadTrainingProject, resolveTrainingPlan, materializeTrainingMoment, lowerTrainingExecution, allocateTrainingOutputParent, initProject, listInitTemplates, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
-import { devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject } from "../dev/index.js";
+import { devStopProject, devUpProject } from "../dev/index.js";
 import { consumeImageUp } from "../distribution/index.js";
 import { createDockerProbeGateway, downDeployment, exportRunArtifacts, inspectDockerDeployment, listDeploymentRecords, listHomeDeploymentRecords } from "../deployment/index.js";
 import { listRuntimeAdapters } from "../runtime/index.js";
@@ -37,6 +38,7 @@ export interface CliHandlers {
     importClaudeCodeAuth: typeof importClaudeCodeAuth;
     importCodexAuth: typeof importCodexAuth;
     importGrokAuth: typeof importGrokAuth;
+    loginSubscriptionRealm: typeof loginSubscriptionRealm;
     importEnvFile: typeof importEnvFile;
     initProject: typeof initProject;
     listInitTemplates: typeof listInitTemplates;
@@ -55,9 +57,6 @@ export interface CliHandlers {
     upProject: typeof upProject;
     buildUpReceipt: typeof buildUpReceipt;
     consumeImageUp: typeof consumeImageUp;
-    devActivityProject: typeof devActivityProject;
-    devApplyProject: typeof devApplyProject;
-    devRestartProject: typeof devRestartProject;
     devStopProject: typeof devStopProject;
     devUpProject: typeof devUpProject;
     setProjectPrimaryModel: typeof setProjectPrimaryModel;

package/dist/cli/runCli.js

@@ -1,8 +1,9 @@
 import { readFileSync } from "node:fs";
+import { loginSubscriptionRealm } from "../compiler/training/trial/index.js";
 import { Command } from "commander";
 import { importClaudeCodeAuth, importCodexAuth, importGrokAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
 import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, createTrainingContext, createTrainingPlan, loadTrainingProject, resolveTrainingPlan, materializeTrainingMoment, lowerTrainingExecution, allocateTrainingOutputParent, initProject, listInitTemplates, preflightCompilePlan, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
-import { devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject } from "../dev/index.js";
+import { devStopProject, devUpProject } from "../dev/index.js";
 import { consumeImageUp } from "../distribution/index.js";
 import { createDockerProbeGateway, downDeployment, exportRunArtifacts, inspectDockerDeployment, listDeploymentRecords, listHomeDeploymentRecords } from "../deployment/index.js";
 import { errorExitCode, isSpawnfileError } from "../shared/index.js";
@@ -44,12 +45,12 @@ const createDefaultHandlers = () => ({
     addAgentProject, addProjectModelFallback, addProjectSurface,
     addSubagentProject, addTeamProject, clearProjectModelFallbacks,
     importClaudeCodeAuth, importCodexAuth, importGrokAuth, importEnvFile, initializeTargetSecretSourceLifecycle,
-    provisionCredentials,
+    loginSubscriptionRealm, provisionCredentials,
     createDockerProbeGateway, exportRunArtifacts, downDeployment, inspectDockerDeployment,
     listDeploymentRecords, listHomeDeploymentRecords,
     initProject, listInitTemplates, listRuntimeAdapters, removeProjectSurface, requireAuthProfile,
     runProject, setProjectPrimaryModel, setProjectRuntime, upProject, buildUpReceipt, consumeImageUp,
-    devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject,
+    devStopProject, devUpProject,
     setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth
 });
 const isCliStreams = (value) => {

package/dist/cli/trainCommand.js

@@ -8,14 +8,11 @@ export const registerTrainCommand = (program, handlers, streams, packageVersion,
         .description("Plan, rewind, or train one canonical agent through its declared training inputs")
         .argument("[path]", "Canonical project directory or Spawnfile path", process.cwd())
         .option("--agent <id>", "Canonical agent id or unambiguous short name (inferred for one agent)")
-        .option("--training-image <immutable-image>", "Pinned image containing the complete training environment")
-        .option("--training-config <json>", "V2 image recipe and declared inputs, or advanced v1 local bindings")
+        .option("--auth-profile <name>", "Login for production-booted Daimon trials (held by the run's auth gateway)")
         .option("--plan", "Print the resolved training authoring plan without executing training")
         .option("--materialize <example>", "Rewind an authored example into --out without running training")
         .option("--history <directory>", "Local recorded history for --materialize")
         .option("--dry-run", "Validate and estimate without compiling, authenticating or starting models")
-        .option("--repair-measurements <parent-out>", "Fork captured work into a fresh output for authorized measurement repair")
-        .option("--repair-witness <manifest>", "Explicit verified image witness for a legacy parent")
         .option("--resume", "Resume the exact persisted training experiment in --out");
     for (const name of forwarded) {
         const flag = `--${name} <value>`;
@@ -83,11 +80,9 @@ export const registerTrainCommand = (program, handlers, streams, packageVersion,
             args.push("--experiment-timeout-ms", String(timeout));
         if (options.trialTimeoutMs === undefined && plan.deadlines?.trial_ms !== undefined)
             args.push("--trial-timeout-ms", String(plan.deadlines.trial_ms));
-        const lowered = plan.targets.length > 0 ? await handlers.lowerTrainingExecution({ project, plan, args,
-            trainingConfig: options.trainingConfig, trainingImage: options.trainingImage }) : undefined;
+        const lowered = plan.targets.length > 0 ? await handlers.lowerTrainingExecution({ project, plan, args }) : undefined;
         if (lowered && options.dryRun === true) {
-            streams.stdout(JSON.stringify({ ...lowered.execution, container: { configPath: lowered.trainingConfig,
-                    declaration: lowered.declaration, ...(lowered.trainingImage ? { imageOverride: lowered.trainingImage } : {}) } }, null, 2));
+            streams.stdout(JSON.stringify(lowered.execution, null, 2));
             setExitCode(0);
             return;
         }
@@ -97,16 +92,15 @@ export const registerTrainCommand = (program, handlers, streams, packageVersion,
         if (!lowered && options.dryRun !== true && typeof options.out !== "string") {
             throw new SpawnfileError("validation_error", "Actual training requires --out when no training targets are declared");
         }
-        if (!lowered && options.dryRun !== true && typeof options.trainingConfig !== "string") {
-            throw new SpawnfileError("validation_error", "Actual training requires --training-config when no training targets are declared; host execution is disabled");
-        }
         const context = await handlers.createTrainingContext(inputPath, { agent: plan.agent.id, packageVersion });
+        // Trials are production-booted Daimon organizations: the container per trial is the isolation.
+        if (options.dryRun !== true && context.agent.runtime !== "daimon") {
+            throw new SpawnfileError("validation_error", `Actual training boots Daimon trials; agent ${context.agent.id} runs on ${context.agent.runtime}`);
+        }
         if (lowered)
             await handlers.allocateTrainingOutputParent(lowered.execution.output);
-        setExitCode(await handlers.runTraining({ context, args: lowered?.execution.args ?? args, execution: lowered?.execution,
-            repairMeasurements: options.repairMeasurements, repairWitness: options.repairWitness,
-            trainingImage: lowered?.trainingImage ?? options.trainingImage,
-            trainingConfig: lowered?.trainingConfig ?? options.trainingConfig,
+        setExitCode(await handlers.runTraining({ context, args: lowered?.execution.args ?? args,
+            authProfile: options.authProfile,
             dryRun: options.dryRun === true,
             timeoutMs: timeout + 5000, streams, signal }));
     });

package/dist/cli/trainingBooted.d.ts

@@ -0,0 +1,9 @@
+import type { RunTrainingOptions } from "./trainingExecution.js";
+/**
+ * Production-booted training for a Daimon subject: the training core and the
+ * grader run here, and every trial is the subject's own compiled organization
+ * in its own container, sharing the run's one auth gateway (and so one login).
+ * Every subscription judgment of the run wakes one of the run's warm, tool-free
+ * judge containers on that same gateway; none reads a personal login.
+ */
+export declare const runBootedTraining: (options: RunTrainingOptions) => Promise<number>;

package/dist/cli/trainingBooted.js

@@ -0,0 +1,45 @@
+import path from "node:path";
+import { requireAuthProfile } from "../auth/index.js";
+import { createBootedTrialRun } from "../compiler/training/trial/index.js";
+import { bindBootedJudges, createDaimonBootedAdapter } from "../runtime/daimon/training/booted/index.js";
+import { SpawnfileError } from "../shared/index.js";
+const failure = (message) => new SpawnfileError("runtime_error", message);
+const flag = (args, name) => {
+    const index = args.indexOf(`--${name}`);
+    return index < 0 ? undefined : args[index + 1];
+};
+/**
+ * Production-booted training for a Daimon subject: the training core and the
+ * grader run here, and every trial is the subject's own compiled organization
+ * in its own container, sharing the run's one auth gateway (and so one login).
+ * Every subscription judgment of the run wakes one of the run's warm, tool-free
+ * judge containers on that same gateway; none reads a personal login.
+ */
+export const runBootedTraining = async (options) => {
+    if (!options.authProfile)
+        throw failure("Production-booted Daimon training requires --auth-profile (the login its auth gateway holds)");
+    const out = flag(options.args, "out");
+    if (!out)
+        throw failure("Production-booted Daimon training requires --out");
+    const system = options.context.documents.find((document) => document.role === "system");
+    const instructions = flag(options.args, "instructions") === undefined
+        ? system ? ["--source-root", options.context.project.root, "--instructions", system.destinationPath]
+            : (() => { throw failure(`Agent ${options.context.agent.id} declares no system document to train`); })()
+        : [];
+    const run = createBootedTrialRun({
+        agentManifestPath: options.context.agent.source,
+        authProfile: await requireAuthProfile(options.authProfile),
+        scratchRoot: path.join(path.resolve(out), "booted-trials")
+    });
+    bindBootedJudges(run);
+    try {
+        const { main } = await import("../runtime/trainingCli.js");
+        return await main(["train", ...options.args, ...(flag(options.args, "runtime") ? [] : ["--runtime", "daimon"]), ...instructions], {
+            cwd: process.cwd(), signal: options.signal, stdout: options.streams.stdout, stderr: options.streams.stderr
+        }, { adapter: (_runtime, adapter) => createDaimonBootedAdapter({ launcher: run, timeoutMs: adapter.timeoutMs }) });
+    }
+    finally {
+        bindBootedJudges(undefined);
+        await run.close();
+    }
+};

package/dist/cli/trainingExecution.d.ts

@@ -1,17 +1,14 @@
-import { type TrainingContext, type TrainingExecution } from "../compiler/training/index.js";
+import type { TrainingContext } from "../compiler/training/index.js";
 import type { CliStreams } from "./runCli.js";
 export interface RunTrainingOptions {
     context: TrainingContext;
-    execution?: TrainingExecution;
     args: readonly string[];
     dryRun: boolean;
-    repairMeasurements?: string;
-    repairWitness?: string;
-    trainingImage?: string;
-    trainingConfig?: string;
+    /** Auth profile whose login a production-booted run's gateway holds. */
+    authProfile?: string;
     timeoutMs: number;
     streams: CliStreams;
     signal?: AbortSignal;
 }
-/** Owns image preparation/launch and invokes host estimates through the training composition. */
+/** Actual training boots production trials; dry-run estimates run on the host through the training composition. */
 export declare const runTraining: (options: RunTrainingOptions) => Promise<number>;

package/dist/cli/trainingExecution.js

@@ -1,9 +1,6 @@
 import { canonicalWireId } from '../shared/index.js';
-import { launchTrainingContainer } from "../compiler/training/container/index.js";
-import { runTrainingDocker } from "../compiler/training/container/process.js";
-import { prepareTraining } from "../compiler/training/preparation/index.js";
-import { readBoundedJson } from "../compiler/training/preparation/inputs.js";
 import { SpawnfileError } from "../shared/index.js";
+import { runBootedTraining } from "./trainingBooted.js";
 const failure = (message) => new SpawnfileError("runtime_error", message);
 const validCostReceipt = (line) => {
     try {
@@ -16,37 +13,12 @@ const validCostReceipt = (line) => {
         return false;
     }
 };
-/** Owns image preparation/launch and invokes host estimates through the training composition. */
+/** Actual training boots production trials; dry-run estimates run on the host through the training composition. */
 export const runTraining = async (options) => {
     if (options.signal?.aborted)
         return 130;
-    if (options.repairWitness && !options.repairMeasurements)
-        throw failure("--repair-witness requires --repair-measurements");
-    if (options.trainingConfig) {
-        const config = await readBoundedJson(options.trainingConfig);
-        // Image declarations go through preparation; lowered launch configurations go straight to Docker.
-        if (config.version === "spawnfile.training-container.v2" || (["spawnfile.training-container.v3", "spawnfile.training-container.v4"].includes(String(config.version)) && config.image !== undefined)) {
-            if (options.trainingImage && !options.execution)
-                throw failure("V2 owns its image declaration; --training-image is only for v1");
-            const prepared = await prepareTraining({ configPath: options.trainingConfig, context: options.context, args: options.args,
-                repairMeasurements: options.repairMeasurements, repairWitness: options.repairWitness,
-                execution: options.execution, outputOverride: options.execution?.output, imageOverride: options.execution ? options.trainingImage : undefined,
-                dryRun: options.dryRun, process: runTrainingDocker, timeoutMs: options.timeoutMs, signal: options.signal, streams: options.streams });
-            if (!("dryRun" in prepared))
-                return launchTrainingContainer({ ...prepared,
-                    timeoutMs: options.timeoutMs, signal: options.signal, streams: options.streams });
-            options.streams.stderr(`Training preparation plan ${prepared.digest}; no Docker, auth or filesystem mutations`);
-            options = { ...options, repairMeasurements: undefined, repairWitness: undefined };
-        }
-    }
-    if (options.repairMeasurements)
-        throw failure("Measurement repair requires the v2 preparation declaration");
-    if (!options.dryRun) {
-        if (!options.trainingImage || !options.trainingConfig)
-            throw failure("Actual training requires --training-image and --training-config; host execution is disabled");
-        return launchTrainingContainer({ image: options.trainingImage, configPath: options.trainingConfig,
-            context: options.context, args: options.args, execution: options.execution, timeoutMs: options.timeoutMs, streams: options.streams, signal: options.signal });
-    }
+    if (!options.dryRun)
+        return runBootedTraining(options);
     const controller = new AbortController();
     const deadline = performance.now() + options.timeoutMs;
     let active = true, lastLine = "";

package/dist/compiler/containerArtifacts.js

@@ -5,7 +5,6 @@ import { SpawnfileError } from "../shared/index.js";
 import { createMoltnetSummary, createOrganizationSummary } from "./containerArtifactSummaries.js";
 import { createEnvVariableMap, createRuntimeTargetPlans } from "./containerArtifactsPlans.js";
 import { createDockerIgnoreContent } from "./dockerBuildContext.js";
-import { createDaimonTelemetryArtifacts } from "./daimonTelemetryArtifacts.js";
 import { createRootfsFiles, renderDockerfile, renderEntrypoint, renderEnvExample } from "./containerArtifactsRender.js";
 import { createMemoryArtifactBundle } from "./memoryArtifacts.js";
 import { resolveRecordingReport } from "./recordingReport.js";
@@ -39,7 +38,6 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
     const localDaimonIdentityPath = process.env[DAIMON_LOCAL_RUNTIME_IDENTITY_ENV]?.trim();
     const localDaimonIdentity = localDaimonIdentityPath ? await loadLocalDaimonRuntimeIdentity(localDaimonIdentityPath) : undefined;
     const runtimePlans = await createRuntimeTargetPlans(plan, compiledNodes, options.worldBindings, options.deploymentLineage);
-    const daimonTelemetryArtifacts = createDaimonTelemetryArtifacts(plan, runtimePlans, compiledNodes);
     const envVariableMap = createEnvVariableMap(compiledNodes, runtimePlans, options.moltnet);
     const projectedWorldTokenEnvNames = [...new Set(runtimePlans.flatMap((runtimePlan) => runtimePlan.worldTokenEnvNames ?? []))].sort();
     const worldTokenEnvNames = (options.worldBindings?.artifact.bindings ?? [])
@@ -80,7 +78,6 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
     const persistentMountCandidates = [
         ...memoryArtifacts.mounts,
         ...workspaceResourceMounts,
-        ...daimonTelemetryArtifacts.mounts,
         ...runtimePlans.flatMap((runtimePlan) => runtimePlan.persistentMounts ?? []),
         ...((options.moltnet?.persistentMounts ?? []).map((mount) => ({
             ...(mount.declaredVolumeName ? { declared_volume_name: mount.declaredVolumeName } : {}),
@@ -109,7 +106,6 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
     ].sort();
     const runtimeInstances = runtimePlans
         .map((plan) => {
-        const telemetryMountIds = daimonTelemetryArtifacts.telemetryMountIdsByInstance.get(plan.id);
         return {
             ...(plan.agentPathsByNodeId ? { agent_paths: Object.fromEntries(Object.entries(plan.agentPathsByNodeId).map(([id, paths]) => [id, {
                         workspace_path: paths.workspacePath, home_path: paths.homePath, skill_roots: paths.skillRoots
@@ -126,7 +122,6 @@ export const createContainerArtifacts = async (plan, compiledNodes, options = {}
             node_ids: [...(plan.sourceIds ?? [])],
             published_port: plan.publishedPort ?? null,
             runtime: plan.runtimeName,
-            ...(telemetryMountIds ? { telemetry_mount_ids: telemetryMountIds } : {}),
             workspace_path: plan.instancePaths.workspacePath
         };
     })

package/dist/compiler/containerBackedMountRender.js

@@ -30,6 +30,8 @@
  * particular `printf %b` implementation treats `\nnn` vs `\0nnn`. For a path
  * containing none of those four characters both forms are identical.
  */
+import { DAIMON_GATEWAY_URL_ENV } from "../runtime/daimon/gateway.js";
+import { isDaimonGatewayRealmMountId } from "../runtime/daimon/subscriptionRealms.js";
 export const EPHEMERAL_STATE_OPT_OUT_ENV = "SPAWNFILE_ALLOW_EPHEMERAL_STATE";
 const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
 const MOUNTINFO_ESCAPES = {
@@ -79,7 +81,9 @@ export const createBackedMountChecks = (mounts) => {
     }
     return [...byPath.values()]
         .sort((left, right) => left.mount_path.localeCompare(right.mount_path))
-        .map((mount) => `require_backed_mount ${shellQuote(mount.id)} ${shellQuote(escapeMountInfoPath(mount.mount_path))} ${shellQuote(mount.mount_path)} ${shellQuote(mount.volume_name)}`);
+        .map((mount) => 
+    // An organization booted against an external auth gateway mounts no realm.
+    `${isDaimonGatewayRealmMountId(mount.id) ? `[ -n "\${${DAIMON_GATEWAY_URL_ENV}:-}" ] || ` : ""}require_backed_mount ${shellQuote(mount.id)} ${shellQuote(escapeMountInfoPath(mount.mount_path))} ${shellQuote(mount.mount_path)} ${shellQuote(mount.volume_name)}`);
 };
 /**
  * The full guard — function plus checks — or nothing at all when the compile