spawnfile 0.1.33 → 0.1.35

package/dist/compiler/training/broker/entrypoint.js

@@ -1,124 +0,0 @@
-import { normalizedTrainingEnvironment } from "../../../shared/index.js";
-import { spawn } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { lstat, readFile } from "node:fs/promises";
-import os from "node:os";
-import { renderTrainingBrokerProvisioning } from "./provisioning.js";
-import { runTrainingRootScript } from "./rootScript.js";
-import { stageTrainingEvaluatorSecret } from "./evaluatorSecrets.js";
-import { startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-import { resetTrainingBrokerSlotAsOrganization } from "./reset.js";
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { parseTrainingBrokerDeclaration } from "./declaration.js";
-import { loadDaimonProjectionModule, resolveTrainingSlotProjection } from "./projection.js";
-import { createTrainingSlotRuntime } from "./runtime.js";
-import { createTrainingSlotSupervisor, serveTrainingSlotSupervisor, startTrainingSlot } from "./supervisor.js";
-import { trainingSlotDescriptors, assertTrainingSlotsDocument, TRAINING_SLOTS_FILE, DAIMON_ORGANIZATION_UID, TRAINING_BOOTSTRAP_MOUNT, TRAINING_BROKER_DECLARATION_FILE, TRAINING_GRANT_HOME_ROOT, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
-export const TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV = "SPAWNFILE_TRAINING_GROK_BROKER_CONTROL_SOCKET";
-export const TRAINING_GROK_GRANT_HOME_ROOT_ENV = "SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT";
-export const TRAINING_ENTRYPOINT_COMMAND = "/opt/training/bin/train";
-/**
- * The desktop Grok login, in every spelling a caller might reach it by.
- *
- * D2 is explicit: training uses one dedicated Grok login and never the
- * developer's own. An in-container refresh rotates the credential, so mounting
- * the desktop leaf would invalidate the developer's desktop session as a side
- * effect of a training run — and the refreshed token would live on tmpfs, so
- * the desktop login would be gone rather than moved.
- */
-export const desktopGrokAuthPaths = (home = os.homedir()) => [path.resolve(home, ".grok/auth.json"), path.resolve(home, ".grok", "auth.json")];
-export const assertNotDesktopGrokAuth = (source, home = os.homedir()) => {
-    if (desktopGrokAuthPaths(home).includes(path.resolve(source))) {
-        throw new SpawnfileError("validation_error", "Training refuses the desktop ~/.grok/auth.json as its Grok bootstrap; import a dedicated login with `spawnfile auth import grok --profile spawnfile-training --from <dir>`");
-    }
-    return source;
-};
-/** The bootstrap leaf inside the container: the fixed read-only mount, a bounded regular file, never a symlink. */
-const assertBootstrap = async (declaration) => {
-    if (declaration.bootstrap !== TRAINING_BOOTSTRAP_MOUNT) {
-        throw new SpawnfileError("validation_error", `The training Grok bootstrap must be mounted at ${TRAINING_BOOTSTRAP_MOUNT}`);
-    }
-    const info = await lstat(declaration.bootstrap);
-    if (!info.isFile() || info.isSymbolicLink() || info.size < 2 || info.size > DAIMON_GROK_SUBSCRIPTION_MAX_BYTES) {
-        throw new SpawnfileError("validation_error", "The training Grok bootstrap must be a bounded regular credential leaf");
-    }
-};
-const DAIMON_GROK_SUBSCRIPTION_MAX_BYTES = 64 * 1024;
-/**
- * The broker-capable training container's root entrypoint.
- *
- * Order matters and is the whole privilege model: provision as root with the
- * production capability set, start the launcher (root) and the broker and
- * relay (2100) and prove each one's post-drop identity, publish the slot
- * supervisor socket, and only then drop to uid 2000 with an empty capability
- * bounding set to run `train`. The training core, DSPy and the judges are that uid; the
- * model's own tools are the worker uid the launcher alone can reach.
- */
-export const runTrainingBrokerEntrypoint = async (options) => {
-    const log = options.log ?? ((line) => process.stderr.write(`[training-entrypoint] ${line}\n`));
-    if (process.getuid?.() !== 0)
-        throw new SpawnfileError("runtime_error", "The broker-capable training container must start as root");
-    const declaration = parseTrainingBrokerDeclaration(JSON.parse(await readFile(options.declarationPath ?? TRAINING_BROKER_DECLARATION_FILE, "utf8")));
-    await assertBootstrap(declaration);
-    const descriptors = trainingSlotDescriptors(declaration.slots);
-    const document = JSON.parse(await readFile(TRAINING_SLOTS_FILE, "utf8"));
-    assertTrainingSlotsDocument(document, declaration.slots);
-    const daimon = await (options.loadDaimon ?? loadDaimonProjectionModule)();
-    const reset = resetTrainingBrokerSlotAsOrganization;
-    const slots = await Promise.all(descriptors.map(p => resolveTrainingSlotProjection(declaration, p.slot, daimon)));
-    const registrations = slots.map(slot => slot.registration);
-    const runtimes = slots.map(({ registration, projectionSha256 }) => createTrainingSlotRuntime({ declaration, registration, projectionSha256, reset }));
-    await stageTrainingEvaluatorSecret();
-    await runTrainingRootScript(renderTrainingBrokerProvisioning(registrations, declaration.maxRunRequests).join("\n"), { maxBuffer: 8 * 1024 * 1024 });
-    const children = await startBrokerProcesses({ log });
-    let server;
-    try {
-        for (const runtime of runtimes)
-            await startTrainingSlot(runtime, randomBytes(32).toString("hex"));
-        const supervisor = createTrainingSlotSupervisor({ runtimes, organizationUid: declaration.organizationUid });
-        server = serveTrainingSlotSupervisor(supervisor, TRAINING_SUPERVISOR_SOCKET, log, declaration.organizationUid);
-        log(`provisioned ${registrations.length} training slots with one broker process set`);
-        return await runTrainingChild(options.argv, declaration, log);
-    }
-    finally {
-        server?.close();
-        await stopBrokerProcesses(children, log);
-    }
-};
-/**
- * `train` as uid 2000 with an empty bounding set, proven inside the child
- * before it execs: `setpriv --bounding-set=-all` silently does nothing without
- * `CAP_SETPCAP`, so the guard has to read `/proc/self/status` rather than
- * trust the flag.
- */
-export const trainingChildArgv = (argv, uid = DAIMON_ORGANIZATION_UID) => [
-    "setpriv", "--clear-groups", `--reuid=${uid}`, `--regid=${uid}`, "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all",
-    "--", "/bin/bash", "-ceu",
-    'if [ "$EUID" -eq 0 ]; then echo "training must not run as root" >&2; exit 1; fi\n'
-        + 'test "$(sed -n "s/^CapBnd:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
-        + 'test "$(sed -n "s/^CapEff:[[:space:]]*//p" /proc/self/status)" = 0000000000000000\n'
-        + 'exec "$@"',
-    "bash", TRAINING_ENTRYPOINT_COMMAND, ...argv
-];
-const runTrainingChild = (argv, declaration, log) => new Promise((resolve) => {
-    const command = trainingChildArgv(argv, declaration.organizationUid);
-    const child = spawn(command[0], command.slice(1), {
-        stdio: ["ignore", "inherit", "inherit"],
-        env: {
-            ...normalizedTrainingEnvironment(),
-            [TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV]: DAIMON_GROK_ENGINE_BROKER.controlSocketPath,
-            [TRAINING_GROK_GRANT_HOME_ROOT_ENV]: TRAINING_GRANT_HOME_ROOT,
-            SPAWNFILE_TRAINING_SLOTS_FILE: TRAINING_SLOTS_FILE,
-            HOME: "/home/training"
-        }
-    });
-    const forward = (signal) => () => child.kill(signal);
-    for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"])
-        process.on(signal, forward(signal));
-    child.once("exit", (code, signal) => {
-        log(`training exited code=${code ?? "null"} signal=${signal ?? "none"}`);
-        resolve(signal ? (signal === "SIGINT" ? 130 : 143) : code ?? 1);
-    });
-});

package/dist/compiler/training/broker/evaluatorSecrets.d.ts

@@ -1,2 +0,0 @@
-/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
-export declare const stageTrainingEvaluatorSecret: (env?: NodeJS.ProcessEnv) => Promise<void>;

package/dist/compiler/training/broker/evaluatorSecrets.js

@@ -1,62 +0,0 @@
-import { trainingEnvironment } from "../../../shared/index.js";
-import { constants } from "node:fs";
-import { chmod, chown, lstat, mkdir, open } from "node:fs/promises";
-import path from "node:path";
-import { TRAINING_TYPESAFE_SECRET_FILE, TRAINING_TYPESAFE_SECRET_INGRESS } from "../container/evaluators.js";
-import { DAIMON_ORGANIZATION_UID } from "./paths.js";
-/** Root stages into tmpfs before provisioning drops directory ownership and evaluator capabilities. */
-export const stageTrainingEvaluatorSecret = async (env = process.env) => {
-    const secretFile = trainingEnvironment("SPAWNFILE_TRAINING_TYPESAFE_SECRET_FILE", env);
-    if (secretFile === undefined)
-        return;
-    if (process.getuid?.() !== 0 || secretFile !== TRAINING_TYPESAFE_SECRET_FILE) {
-        throw Error("Invalid evaluator secret staging declaration");
-    }
-    try {
-        const ingress = path.posix.dirname(TRAINING_TYPESAFE_SECRET_INGRESS);
-        const parent = await lstat(ingress);
-        if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== 0)
-            throw Error("Invalid ingress directory");
-        // This directory is tmpfs, never the mounted credential inode.
-        await chmod(ingress, 0o700);
-        const source = await open(TRAINING_TYPESAFE_SECRET_INGRESS, constants.O_RDONLY | constants.O_NOFOLLOW);
-        let bytes;
-        try {
-            const info = await source.stat();
-            if (!info.isFile() || info.nlink !== 1 || info.size < 1 || info.size > 64 * 1024)
-                throw Error("Invalid ingress leaf");
-            const buffer = Buffer.alloc(64 * 1024 + 1);
-            const { bytesRead } = await source.read(buffer, 0, buffer.length, 0);
-            const after = await source.stat();
-            if (bytesRead !== info.size || after.size !== info.size || after.mtimeMs !== info.mtimeMs || after.ctimeMs !== info.ctimeMs) {
-                throw Error("Secret changed while staging");
-            }
-            bytes = buffer.subarray(0, bytesRead);
-        }
-        finally {
-            await source.close();
-        }
-        const destination = path.posix.dirname(TRAINING_TYPESAFE_SECRET_FILE);
-        await mkdir(destination, { mode: 0o700 });
-        const target = await open(TRAINING_TYPESAFE_SECRET_FILE, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-        try {
-            await target.writeFile(bytes);
-            await target.sync();
-            await target.chown(DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
-        }
-        finally {
-            bytes.fill(0);
-            await target.close();
-        }
-        await chown(destination, DAIMON_ORGANIZATION_UID, DAIMON_ORGANIZATION_UID);
-        const info = await lstat(TRAINING_TYPESAFE_SECRET_FILE), directory = await lstat(destination);
-        if (info.uid !== DAIMON_ORGANIZATION_UID || info.gid !== DAIMON_ORGANIZATION_UID || (info.mode & 0o777) !== 0o600 ||
-            directory.uid !== DAIMON_ORGANIZATION_UID || directory.gid !== DAIMON_ORGANIZATION_UID || (directory.mode & 0o777) !== 0o700) {
-            throw Error("Invalid evaluator secret ownership");
-        }
-    }
-    catch {
-        // Filesystem errors may contain credential bytes supplied by a transport; emit only a fixed diagnostic.
-        throw Error("Evaluator secret staging failed");
-    }
-};

package/dist/compiler/training/broker/index.d.ts

@@ -1,12 +0,0 @@
-export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema, type TrainingBrokerDeclaration } from "./declaration.js";
-export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
-export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-export { loadDaimonProjectionModule, resolveTrainingGrokProjection, resolveTrainingSlotProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
-export { recycleTrainingSlot, TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS, TRAINING_RECYCLE_MAX_REPLY_BYTES, type RecycleTrainingSlotOptions, type TrainingSlotRecycleReceipt } from "./recycleClient.js";
-export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
-export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
-export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
-export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
-export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
-export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL, type TrainingSlotRuntime } from "./supervisor.js";
-export * from "./paths.js";

package/dist/compiler/training/broker/index.js

@@ -1,12 +0,0 @@
-export { parseTrainingBrokerDeclaration, trainingBrokerDeclarationSchema } from "./declaration.js";
-export { assertNotDesktopGrokAuth, desktopGrokAuthPaths, runTrainingBrokerEntrypoint, trainingChildArgv, TRAINING_GROK_BROKER_CONTROL_SOCKET_ENV, TRAINING_GROK_GRANT_HOME_ROOT_ENV } from "./entrypoint.js";
-export { brokerProcessPlan, startBrokerProcesses, stopBrokerProcesses } from "./processes.js";
-export { loadDaimonProjectionModule, resolveTrainingGrokProjection, resolveTrainingSlotProjection, trainingOrganizationRuntimeConfig } from "./projection.js";
-export { recycleTrainingSlot, TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS, TRAINING_RECYCLE_MAX_REPLY_BYTES } from "./recycleClient.js";
-export { renderTrainingBrokerProvisioning, renderTrainingIdentities, renderTrainingSlotProvisioning, trainingSlotDirectories } from "./provisioning.js";
-export { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveBackingFilesystem, resolveTrainingCanaries } from "./receipt.js";
-export { resolveTrainingGrokDenyPaths, resolveTrainingGrokRegistration } from "./registration.js";
-export { resetTrainingBrokerSlot, resetTrainingBrokerSlotAsOrganization } from "./reset.js";
-export { createTrainingSlotRuntime, renderTrainingSlotWipe } from "./runtime.js";
-export { assertTrainingSupervisorSocketIdentity, createTrainingSlotSupervisor, serveTrainingSlotSupervisor, TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
-export * from "./paths.js";

package/dist/compiler/training/broker/main.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/dist/compiler/training/broker/main.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-import { runTrainingBrokerEntrypoint } from "./entrypoint.js";
-/**
- * The broker-capable training image's root entrypoint process. The image ships
- * it; the host supplies only the read-only `spawnfile.training-broker.v2`
- * declaration and never a script, so no host executable enters the container.
- */
-const main = async () => {
-    process.exitCode = await runTrainingBrokerEntrypoint({ argv: process.argv.slice(2) });
-};
-main().catch((error) => {
-    process.stderr.write(`[training-entrypoint] ${error instanceof Error ? error.message : String(error)}\n`);
-    process.exitCode = 1;
-});

package/dist/compiler/training/broker/paths.d.ts

@@ -1,236 +0,0 @@
-import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../../../runtime/daimon/runtimeIdentity.js";
-/**
- * Every container path the broker-capable training container fixes.
- *
- * They are deterministic because three parties must agree on them
- * without talking to each other: the root entrypoint that provisions them, the
- * root slot supervisor that wipes and re-provisions them on recycle, and
- * Spawnfile's native training adapter, which writes them into `spawnfile.training.daimon-native.launch.v2`
- * and has no way to ask the container what it chose. Daimon's projection never
- * resolves a path, so each one must also be canonical and never a symlink; the
- * provisioning program asserts that before a slot is used.
- *
- * Everything under `/run/training/slots/<i>` is per-trial state on tmpfs — never the
- * Grok realm volume (R2). The realm volume holds only `auth.json` and the
- * broker credential journal, so a recycle can wipe the slot without touching
- * the one durable rotating credential.
- */
-export declare const TRAINING_RUN_ROOT = "/run/training/output";
-export declare const TRAINING_SEALED_INPUTS_ROOT = "/run/training/inputs";
-export declare const TRAINING_ROOT = "/run/spawnfile-training";
-export declare const TRAINING_CONTEXT_FILE = "/run/spawnfile-training/context.json";
-/** Host-written, read-only `spawnfile.training-broker.v2` declaration the root entrypoint reads. */
-export declare const TRAINING_BROKER_DECLARATION_FILE = "/run/spawnfile-training/training-broker.json";
-export declare const TRAINING_INFERENCE_DIRECTORY = "/run/training/inference";
-export declare const TRAINING_INFERENCE_LEDGER = "/run/training/inference/inference.jsonl";
-/** Judge grant homes: `2000:2000 0700`, denied to every worker uid. Training reads it as `SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT`. */
-export declare const TRAINING_GRANT_HOME_ROOT = "/run/training/grants";
-/**
- * Private temp for the broker and its relay (uid 2100, outside the organization
- * group), deliberately **outside** `/run/daimon-engine-broker`.
- *
- * Production puts it at `<control root>/tmp`, which is fine there: that root is
- * removed and recreated exactly once, at container start. Training
- * re-provisions the same root on every recycle, and the launch mounts this
- * directory as its own tmpfs — so a `tmp/` inside the cleared root is a *mount
- * point*, and clearing a mount point fails `EBUSY`. A live P8 launch died
- * exactly there. Its own tmpfs under `/run/training` is never a wipe target and
- * is denied to every worker uid.
- */
-export declare const TRAINING_BROKER_TMPDIR = "/run/training/broker-tmp";
-export declare const TRAINING_SUPERVISOR_DIRECTORY = "/run/training/supervisor";
-export declare const TRAINING_SUPERVISOR_SOCKET = "/run/training/supervisor/control.sock";
-export declare const TRAINING_SUPERVISOR_LOG = "/run/training/supervisor/supervisor.log";
-export declare const TRAINING_WORKER_ROOT = "/var/lib/daimon-workers";
-/**
- * Training's own fixed container paths (`containerPaths` in its native launch
- * schema). They are *not* individual deny entries: Grok 1.0.34 materializes
- * every `deny` target inside bubblewrap as the worker uid, and it cannot
- * create a file inside `/run/spawnfile-training`, which belongs to uid 2000 alone. The
- * single `/run/spawnfile-training` mask below covers all of them, which is also stronger
- * — a file Training adds later is covered without re-provisioning the slot.
- */
-export declare const TRAINING_CALLER_PROTECTED_PATHS: readonly ["/run/spawnfile-training/config.json", "/run/spawnfile-training/control", "/run/spawnfile-training/launch.json", "/run/spawnfile-training/token", "/run/spawnfile-training/env", "/run/spawnfile-training/preparation.json", "/run/spawnfile-training/repair.json"];
-/**
- * `spawnfile.training.daimon-native.launch.v2`'s `broker.evaluatorPaths`, in full.
- *
- * This is not a summary of the five roles — it is the **whole** set of deny
- * entries this container adds beyond Daimon's own protected paths, because
- * Training's worker resolves the projection from exactly
- * `[...new Set(broker.evaluatorPaths.map(row => row.path))].sort()`. A launch
- * that carried only the five roles made Daimon hash a different deny list than
- * the one provisioning wrote, and a live run died on
- * `Grok broker projection digest differs from the launch receipt`.
- *
- * `role` is Training's closed five-value enum and may repeat; only `path` is
- * unique. The four roles with a dedicated path keep it, and everything else is
- * tagged `context` — the caller-state role — since there is no other way to
- * carry a path through that contract.
- */
-export declare const TRAINING_SLOTS_FILE = "/run/spawnfile-training/slots.json";
-export declare const TRAINING_SLOTS_VERSION: "spawnfile.training-slots.v1";
-export declare const TRAINING_DEFAULT_SLOTS = 4;
-export declare const TRAINING_MAX_SLOTS = 8;
-/** 100 ports per slot: offsets 0=Moltnet, 1=worker control, 2=bridge; 3..99 reserved. */
-export declare const TRAINING_PORT_BASE = 20000;
-export declare const TRAINING_PORT_STRIDE = 100;
-export declare const TRAINING_BROKER_SOCKET_PATHS: readonly ["/run/daimon-engine-broker/control.sock", "/run/daimon-engine-broker/backend.sock", "/run/daimon-engine-broker/launcher.sock"];
-export declare const TRAINING_TURN_STORE_ROOT = "/run/training/turns";
-/** Persistent, broker-only run counter; never part of a slot recycle. */
-export declare const TRAINING_RUN_REQUEST_STORE = "/run/training/request-budget";
-export declare const assertTrainingSlotCount: (slots: number) => number;
-export declare const trainingSlotPaths: (slot: number) => {
-    slot: number;
-    workerUid: number;
-    root: string;
-    workerHome: string;
-    workspace: string;
-    runtimeHome: string;
-    state: string;
-    acceptanceStore: string;
-    turns: string;
-    usageDirectory: string;
-    usageLedger: string;
-    preflightReceipt: string;
-    generationFile: string;
-    sealedInputsAttestation: string;
-    privateTmp: string;
-    clockDirectory: string;
-    clockFile: string;
-    ports: {
-        base: number;
-        stride: number;
-        moltnet: number;
-        workerControl: number;
-        bridge: number;
-    };
-};
-export type TrainingSlotPaths = ReturnType<typeof trainingSlotPaths>;
-export type TrainingEvaluatorPath = {
-    role: "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
-    path: string;
-};
-/** The complete additional projection deny set. Sibling roots and homes never nest with own masks. */
-export declare const trainingEvaluatorPaths: (slot: number, slots: number) => TrainingEvaluatorPath[];
-export declare const trainingSlotDescriptors: (slots?: number) => {
-    evaluatorPaths: TrainingEvaluatorPath[];
-    containerPaths: {
-        path: "/run/spawnfile-training/config.json" | "/run/spawnfile-training/control" | "/run/spawnfile-training/launch.json" | "/run/spawnfile-training/token" | "/run/spawnfile-training/env" | "/run/spawnfile-training/preparation.json" | "/run/spawnfile-training/repair.json";
-    }[];
-    controlRoot: string;
-    slot: number;
-    workerUid: number;
-    root: string;
-    workerHome: string;
-    workspace: string;
-    runtimeHome: string;
-    state: string;
-    acceptanceStore: string;
-    turns: string;
-    usageDirectory: string;
-    usageLedger: string;
-    preflightReceipt: string;
-    generationFile: string;
-    sealedInputsAttestation: string;
-    privateTmp: string;
-    clockDirectory: string;
-    clockFile: string;
-    ports: {
-        base: number;
-        stride: number;
-        moltnet: number;
-        workerControl: number;
-        bridge: number;
-    };
-}[];
-export type TrainingSlotDescriptor = ReturnType<typeof trainingSlotDescriptors>[number];
-export interface TrainingSlotsDocument {
-    schema: typeof TRAINING_SLOTS_VERSION;
-    slots: {
-        index: number;
-        workerUid: number;
-        roots: Record<string, string>;
-        ports: {
-            base: number;
-            count: number;
-        };
-    }[];
-}
-export declare const trainingSlotsDocument: (slots?: number) => TrainingSlotsDocument;
-/** Both sides derive the descriptor bytes; a stale or edited bind must never certify a different pool. */
-export declare const assertTrainingSlotsDocument: (value: unknown, slots: number) => void;
-/** Shared deny targets exist before worker attestation; no per-slot subtree is touched here. */
-export declare const TRAINING_OPTIONAL_DENY_DIRECTORIES: readonly string[];
-/**
- * Deny entries a launch may legitimately not have mounted. Everything else must
- * exist before a worker turn: Grok 1.0.34 creates an absent `deny` target as
- * the worker uid inside bubblewrap and refuses the whole profile when it
- * cannot, so provisioning materializes every other entry itself.
- */
-export declare const TRAINING_DEFERRED_DENY_PATHS: readonly string[];
-/**
- * Deny entries the launch binds from the host, named so a refusal can say why.
- *
- * Only the run root is one. The sealed inputs root is **not**: the launch binds
- * each declared input at `/run/training/inputs/<id>`, so `/run/training/inputs`
- * itself is the binds' *parent*, a directory on the read-only image root — and
- * that is exactly what makes it sealable (see `TRAINING_SEALED_DENY_PATHS`).
- *
- * Being a host bind is no longer a waiver on its own. On Docker Desktop and
- * Colima a bind lands on virtiofs/grpcfuse, which ignores `chown`, and there a
- * worker-uid probe carries no information; on a Linux daemon over ext4, xfs,
- * btrfs or overlay the same bind enforces ownership and the probe is real. The
- * canary resolver asks the backing filesystem rather than this list, which is
- * why the documented `refuse` default is reachable at all.
- */
-export declare const TRAINING_HOST_BIND_DENY_PATHS: readonly string[];
-/**
- * Deny entries whose denial must be proven by the kernel under **every**
- * policy, because the experiment's central claim depends on them.
- *
- * `/run/training/inputs` holds the sealed train and test datasets. A bubblewrap
- * `deny` mask is not a boundary the subject cannot lift: the pinned seccomp
- * profile must allow `clone/unshare/mount/umount2/pivot_root/setns` for
- * bubblewrap itself, and the container runs `apparmor=unconfined`, so a
- * worker-uid process can open a user + mount namespace of its own and either
- * detach the mask or bind the mask's parent somewhere fresh.
- *
- * What survives that is DAC on the datasets' ancestor. The image bakes this
- * directory `0:<organization gid> 0750` on the read-only root, so:
- *
- *   - the worker uid is in neither the owner nor the group class and loses
- *     search permission on the one directory every dataset read must traverse;
- *   - the inode is owned by real uid 0, which a `unshare --map-root-user`
- *     namespace does not map, so `CAP_DAC_OVERRIDE` there cannot override it;
- *   - the root filesystem is read-only, so nothing in the container — root
- *     included — can loosen the mode after the image is built.
- *
- * Provisioning asserts the mode and then attacks it as the worker uid, and the
- * canary resolver refuses the slot rather than certifying one of these on the
- * sandbox profile alone.
- */
-export declare const TRAINING_SEALED_DENY_PATHS: readonly string[];
-/** Spawnfile-owned per-route seal attestation, written by provisioning beside the slot preflight receipt. */
-/** The image-baked identity of the sealed inputs root, asserted before every slot and never writable at runtime. */
-export declare const TRAINING_SEALED_INPUTS_IDENTITY: {
-    readonly uid: 0;
-    readonly gid: 2000;
-    readonly mode: "750";
-};
-/**
- * What a recycle removes outright, and what it only empties.
- *
- * Nothing the launch mounts may be at or below any of these. A mount point
- * cannot be unlinked while it is mounted, so a wipe target holding one aborts
- * the recycle — which is how the broker/relay `TMPDIR` took down a live launch
- * when it still lived at `<control root>/tmp`. `paths.test.ts` enforces that
- * against the launch's own mount list; the rendered shell skips mount points
- * anyway, so an undeclared one degrades to "left in place and reported" rather
- * than a failed provision.
- */
-export declare const trainingWipeTargets: (slot: number) => readonly string[];
-/** Broker-owned turns and clocks are reset through its control seam, never by filesystem deletion. */
-export declare const trainingClearTargets: (slot: number) => readonly string[];
-export declare const TRAINING_REALM_MOUNT: "/var/lib/spawnfile/daimon/grok-subscription-realm";
-export declare const TRAINING_BOOTSTRAP_MOUNT: "/var/lib/spawnfile/daimon/grok-bootstrap-auth";
-export { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID };