spawnfile 0.1.33 → 0.1.35

package/dist/compiler/training/broker/provisioning.js

@@ -1,231 +0,0 @@
-import path from "node:path";
-import { renderTrainingTaskClockReset } from "./taskClock.js";
-import { DAIMON_GROK_SECCOMP_PROFILE_SHA256 } from "../../../shared/daimonGrokSeccompProfile.js";
-import { DAIMON_GROK_ENGINE_BROKER, DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
-import { DAIMON_WAKE_FUSE_DIRECTORY } from "../../../runtime/daimon/config.js";
-import { renderDaimonBrokerProvisioningProgram, renderDaimonWorkspaceResourceSecurity } from "../../containerDaimonBrokerRender.js";
-import { renderDaimonGrokHostPreflight, renderDaimonGrokWorkerProvisioning } from "../../containerDaimonGrokWorkerProvisioning.js";
-import { trainingSlotPaths, trainingSlotDescriptors, TRAINING_TURN_STORE_ROOT, TRAINING_RUN_REQUEST_STORE, DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID, TRAINING_GRANT_HOME_ROOT, TRAINING_INFERENCE_DIRECTORY, TRAINING_INFERENCE_LEDGER, TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_ROOT, TRAINING_SEALED_INPUTS_IDENTITY, TRAINING_SEALED_INPUTS_ROOT, TRAINING_SUPERVISOR_DIRECTORY, TRAINING_BROKER_TMPDIR, TRAINING_WORKER_ROOT, } from "./paths.js";
-import { trainingNamespaceDenialMechanism } from "./seccompRoutes.js";
-const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
-/**
- * Root only ever chmods an inode it currently owns: the container's capability
- * set grants `CAP_CHOWN` but not `CAP_FOWNER` (P0 §2), so `install -d -o u -g g
- * -m m` — which chowns before it chmods — fails with `EPERM` for every
- * non-root owner. Reclaim, set the mode, then hand over.
- */
-const PROVISION_DIRECTORY_HELPER = [
-    "provision_dir() {",
-    "  target=$1; mode=$2; owner=$3; group=$4",
-    "  test -d \"$target\" && test ! -L \"$target\"",
-    "  chown 0:0 \"$target\"; chmod \"$mode\" \"$target\"; chown \"$owner:$group\" \"$target\"",
-    "}"
-];
-/**
- * Every directory the training slot owns, with the identity that must hold it.
- *
- * The two ledger directories are setgid to the organization group on purpose:
- * the broker writes its rows `0640` owned by the broker group, so without
- * `2100:2000 2750` uid 2000 — Training, DSPy and every judge — cannot read a
- * single subject usage row or inference row it paid for.
- */
-export const trainingSlotDirectories = (slot = 0) => [
-    // `/run/training` itself is deliberately absent: it is a mount-point parent on the read-only
-    // image root, and every writable child below it is its own tmpfs or bind.
-    { path: trainingSlotPaths(slot).root, mode: "0711", uid: 0, gid: 0 },
-    { path: TRAINING_ROOT, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: "/home/training", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: "/work", mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: trainingSlotPaths(slot).workspace, mode: "0750", uid: DAIMON_ORGANIZATION_UID, gid: trainingSlotPaths(slot).workerUid },
-    // The agent runtime home is deliberately absent: the shared broker provisioning creates it root-owned,
-    // fills its setgid `tool-output/`, and only then narrows it to `2000:<worker> 0710`. Handing it over here
-    // would leave root — which holds no `CAP_DAC_OVERRIDE` — unable to create the spill directory inside it.
-    { path: trainingSlotPaths(slot).state, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: trainingSlotPaths(slot).acceptanceStore, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: TRAINING_TURN_STORE_ROOT, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
-    { path: TRAINING_RUN_REQUEST_STORE, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
-    { path: trainingSlotPaths(slot).usageDirectory, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: TRAINING_INFERENCE_DIRECTORY, mode: "2750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: TRAINING_GRANT_HOME_ROOT, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID },
-    // Traverse only: the supervisor socket inside it is the uid gate, and a directory nobody but root may
-    // write is what keeps that socket from being replaced by a laxer one.
-    { path: TRAINING_SUPERVISOR_DIRECTORY, mode: "0711", uid: 0, gid: 0 },
-    // The broker and its relay run as uid 2100, outside the organization group, and shared `/tmp` is closed
-    // to them; this is their own temp, outside every wipe target (see `TRAINING_BROKER_TMPDIR`).
-    { path: TRAINING_BROKER_TMPDIR, mode: "0700", uid: DAIMON_BROKER_UID, gid: DAIMON_BROKER_UID },
-    { path: TRAINING_WORKER_ROOT, mode: "0711", uid: 0, gid: 0 },
-    // Denied and unused by training, which meters per slot — but a world-readable directory would make its
-    // worker-uid canary meaningless, so both get the modes the production organization gives them.
-    { path: DAIMON_GROK_TURN_USAGE_LEDGER.directoryPath, mode: "0750", uid: DAIMON_BROKER_UID, gid: DAIMON_ORGANIZATION_UID },
-    { path: DAIMON_WAKE_FUSE_DIRECTORY, mode: "0700", uid: DAIMON_ORGANIZATION_UID, gid: DAIMON_ORGANIZATION_UID }
-];
-/**
- * The fixed identities the slot needs, checked rather than created.
- *
- * The broker-capable training container runs on a read-only root, so
- * `/etc/passwd` and `/etc/group` cannot be written at start-up the way the
- * production Daimon entrypoint writes them. The image bakes uid/gid 2000, 2100
- * and the worker uid instead, and this refuses to provision a slot in an image
- * that did not.
- */
-export const renderTrainingIdentities = (slots = 4) => [
-    `for fixed_uid in ${DAIMON_ORGANIZATION_UID} ${DAIMON_BROKER_UID} ${trainingSlotDescriptors(slots).map(p => p.workerUid).join(" ")}; do`,
-    '  getent passwd "$fixed_uid" >/dev/null && getent group "$fixed_uid" >/dev/null || { echo "the training image must bake uid/gid $fixed_uid; the container root is read-only" >&2; exit 1; }',
-    "done"
-];
-/** Slot-local skeleton, shared by initial provisioning and recycle. */
-const slotDirectories = (slot) => trainingSlotDirectories(slot).filter(entry => entry.path === trainingSlotPaths(slot).root || entry.path.startsWith(`${trainingSlotPaths(slot).root}/`));
-const renderDirectories = (entries, ledgers) => [
-    ...PROVISION_DIRECTORY_HELPER,
-    ...entries.map(entry => `mkdir -p ${quote(entry.path)}`),
-    ...ledgers.map(ledger => `if [ ! -e ${quote(ledger)} ]; then : > ${quote(ledger)}; fi; chown 0:0 ${quote(ledger)}; chmod 0640 ${quote(ledger)}; chown ${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} ${quote(ledger)}`),
-    ...[...entries].sort((a, b) => b.path.split("/").length - a.path.split("/").length)
-        .map(entry => `provision_dir ${quote(entry.path)} ${entry.mode} ${entry.uid} ${entry.gid}`)
-];
-const renderSlotAssertions = (r) => [
-    `test "$(stat -c '%u:%g %a' ${quote(trainingSlotPaths(r.slot).usageDirectory)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
-    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_INFERENCE_DIRECTORY)})" = "${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} 2750"`,
-    `test "$(stat -c '%u:%g %a' ${quote(TRAINING_GRANT_HOME_ROOT)})" = "${DAIMON_ORGANIZATION_UID}:${DAIMON_ORGANIZATION_UID} 700"`,
-    `setpriv --clear-groups --reuid ${r.uid} --regid ${r.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu '! test -r ${quote(TRAINING_GRANT_HOME_ROOT)}'`,
-    `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'test -r ${quote(r.usageLedgerPath)} && test -r ${quote(TRAINING_INFERENCE_LEDGER)}'`
-];
-/** Full container provisioning runs exactly once, before any broker process starts. */
-export const renderTrainingBrokerProvisioning = (input, maxRunRequests = 1000) => {
-    if (!Number.isSafeInteger(maxRunRequests) || maxRunRequests < 1)
-        throw new Error("Invalid run request cap");
-    const registrations = Array.isArray(input) ? input : [input];
-    const directories = [...new Map(registrations.flatMap(r => trainingSlotDirectories(r.slot)).map(d => [d.path, d])).values()];
-    return [
-        ...renderTrainingIdentities(registrations.length),
-        ...renderTrainingTaskClockReset(),
-        ...renderDirectories(directories, [...registrations.map(r => r.usageLedgerPath), TRAINING_INFERENCE_LEDGER]),
-        ...renderDaimonGrokHostPreflight(),
-        ...renderDaimonBrokerProvisioningProgram(registrations, [], {
-            version: "v3", maxRunRequests, runRequestStore: TRAINING_RUN_REQUEST_STORE,
-            turnStore: TRAINING_TURN_STORE_ROOT, inferenceLedgerPath: TRAINING_INFERENCE_LEDGER
-        }, "clear", TRAINING_OPTIONAL_DENY_DIRECTORIES, TRAINING_BROKER_TMPDIR, [
-            `mkdir -p ${quote(DAIMON_GROK_ENGINE_BROKER.worker.taskClock.rootDirectoryPath)}; chmod 0755 ${quote(DAIMON_GROK_ENGINE_BROKER.worker.taskClock.rootDirectoryPath)}`,
-            ...registrations.flatMap(r => {
-                const p = trainingSlotPaths(r.slot);
-                return [
-                    `mkdir -p ${quote(p.clockDirectory)}; chown 0:0 ${quote(p.clockDirectory)}; chmod 0755 ${quote(p.clockDirectory)}`,
-                    `printf '+0\\n' > ${quote(p.clockFile)}; chmod 0644 ${quote(p.clockFile)}; chown ${DAIMON_BROKER_UID}:${DAIMON_BROKER_UID} ${quote(p.clockFile)}`,
-                    `chown ${DAIMON_BROKER_UID}:${DAIMON_BROKER_UID} ${quote(p.clockDirectory)}`
-                ];
-            })
-        ]),
-        `chmod 0550 /etc/daimon-engine-broker; chown 0:${DAIMON_BROKER_UID} /etc/daimon-engine-broker`,
-        ...registrations.flatMap(r => [...renderSlotAssertions(r), ...renderTrainingSealedInputsAssertions(r.uid, r.privateTmp)])
-    ];
-};
-/** Reuse the audited worker renderer; never touch service config, credentials, shared temps or siblings. */
-export const renderTrainingSlotProvisioning = (registration) => [
-    ...renderDirectories(slotDirectories(registration.slot), [registration.usageLedgerPath]),
-    // Keep worker-home and private-tmp identities stable: sibling turns attest them concurrently.
-    `setpriv --clear-groups --reuid=${registration.uid} --regid=${registration.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- mkdir -p ${quote(registration.grokHome)}`,
-    `chown 0:0 ${quote(registration.grokHome)}; chmod 0700 ${quote(registration.grokHome)}`,
-    "node <<'SPAWNFILE_TRAINING_SLOT_PROVISION'",
-    "const crypto = require('node:crypto'); const fs = require('node:fs');",
-    ...renderDaimonWorkspaceResourceSecurity([]),
-    ...renderDaimonGrokWorkerProvisioning([registration], {}, [], "slot"),
-    "SPAWNFILE_TRAINING_SLOT_PROVISION",
-    ...renderSlotAssertions(registration),
-    ...renderTrainingSealedInputsAssertions(registration.uid, registration.privateTmp)
-];
-/**
- * The sealed-inputs seal, asserted and then attacked before any slot is used.
- *
- * The declared datasets are bind-mounted at `/run/training/inputs/<id>`, so
- * `/run/training/inputs` is their common ancestor and the only inode in the
- * chain the container controls: it lives on the read-only image root, the image
- * bakes it `0:<organization gid> 0750`, and nothing in the container can widen
- * it afterwards. The worker uid is in neither its owner nor its group class, so
- * it loses *search* permission on the directory every dataset read must
- * traverse.
- *
- * Four attacker routes, not a cooperating tool's read: a direct
- * read/search/list; a user + mount namespace of the worker's own with the
- * bubblewrap mask and its parent lazily unmounted; a fresh `mount --bind` of
- * `/run/training` made inside that namespace; and, per dataset, a `mount --bind`
- * of the dataset's *own* mount, which carries no mask and — unlike its parent —
- * is not refused for locked children. A live control container left at Docker's
- * own `0755 root:root` hands the held-out answer key to uid 2200 through routes
- * one, two and four (`.runtime/sealed-inputs-dac/EVIDENCE.md`).
- *
- * Every route reports one verdict, and the verdicts are deliberately not
- * interchangeable:
- *
- *  - `reachable` — the bytes were read. Refuse.
- *  - `denied at-read` — the route ran and the kernel's permission check refused
- *    the open or the list. This is the DAC seal doing the work.
- *  - `denied at-mount` — the mount the route needs was refused although the
- *    syscall is available.
- *  - `unavailable seccomp` / `unavailable kernel` — the worker uid cannot open
- *    the namespace the route needs at all, so the route provably cannot happen.
- *    That is a *stronger* denial than DAC, and naming which layer refused is
- *    the point: `EPERM` from a seccomp filter and `EPERM` from a kernel or LSM
- *    policy are indistinguishable by errno, so the mechanism is derived from
- *    the pinned profile Spawnfile ships and the declaration's digest binds
- *    (`seccompRoutes.ts`), never guessed.
- *  - anything else — no verdict. Refuse. "Provably cannot happen" and "could
- *    not tell" must never collapse into one pass.
- *
- * The probe's workspace is the worker's **private** tmp, never `/tmp`: the
- * shared temps are provisioned `root:<organization gid> 1774` so a worker lists
- * names only, and probing from there is what made the first live run refuse
- * every trial on `namespace-rebind reached no verdict` — the `mkdir` failed, not
- * the seal. The private tmp is also the workspace the subject itself has.
- */
-export const renderTrainingSealedInputsAssertions = (workerUid = trainingSlotPaths(0).workerUid, privateTmp = trainingSlotPaths(0).privateTmp, mechanism = trainingNamespaceDenialMechanism()) => [
-    // Diagnostics go to a file rather than into the verdict: a route's stderr is util-linux prose that
-    // would turn every real verdict into "unknown", but a no-verdict refusal with no diagnostic is what
-    // made the first live failure unreadable, so the unknown branch prints it back.
-    `seal_diagnostic=${quote(`${trainingSlotPaths(workerUid - trainingSlotPaths(0).workerUid).root}/seal-probe.err`)}`,
-    `seal_worker() { setpriv --clear-groups --reuid ${workerUid} --regid ${workerUid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- /bin/sh -c "$1" 2>"$seal_diagnostic"; }`,
-    "seal_rows=''",
-    'seal_record() { if [ -n "$seal_rows" ]; then seal_rows="$seal_rows,"; fi; seal_rows="$seal_rows{\\"route\\":\\"$1\\",\\"verdict\\":\\"$2\\"}"; }',
-    "seal_route() {",
-    '  case "$2" in',
-    `    reachable) echo "the sealed inputs root ${TRAINING_SEALED_INPUTS_ROOT} is REACHABLE by uid ${workerUid} via $1" >&2; exit 1 ;;`,
-    '    "denied at-read"|"denied at-mount") echo "sealed inputs route $1: $2"; seal_record "$1" "$2" ;;',
-    '    "unavailable seccomp"|"unavailable kernel") echo "sealed inputs route $1: $2 — the worker uid cannot open the namespace this route needs, so it provably cannot happen"; seal_record "$1" "$2" ;;',
-    '    *) echo "sealed inputs route $1 reached no verdict, so the denial is unproven: ${2:-no stdout} [stderr: $(cat "$seal_diagnostic" 2>/dev/null | tr "\\n" " " | cut -c1-400)]" >&2; exit 1 ;;',
-    "  esac",
-    "}",
-    // One availability determination for every namespace route, so a filtered syscall is reported as the
-    // verdict it is instead of surfacing as a route that mysteriously produced nothing.
-    "seal_namespace=available",
-    `if ! seal_worker 'unshare --user --map-root-user --mount true' >/dev/null 2>&1; then seal_namespace='unavailable ${mechanism}'; fi`,
-    'seal_ns_route() { if [ "$seal_namespace" != available ]; then seal_route "$1" "$seal_namespace"; else seal_route "$1" "$(seal_worker "$2")"; fi; }',
-    // Asserted, never set: the root filesystem is read-only, so an image that did not bake this mode
-    // cannot be corrected here — and that is the point. Refuse instead.
-    `test ! -L ${quote(TRAINING_SEALED_INPUTS_ROOT)} && test -d ${quote(TRAINING_SEALED_INPUTS_ROOT)}`,
-    `if [ "$(stat -c '%u:%g %a' ${quote(TRAINING_SEALED_INPUTS_ROOT)})" != "${TRAINING_SEALED_INPUTS_IDENTITY.uid}:${TRAINING_SEALED_INPUTS_IDENTITY.gid} ${TRAINING_SEALED_INPUTS_IDENTITY.mode}" ]; then`,
-    `  echo "the training image must bake ${TRAINING_SEALED_INPUTS_ROOT} as ${TRAINING_SEALED_INPUTS_IDENTITY.uid}:${TRAINING_SEALED_INPUTS_IDENTITY.gid} ${TRAINING_SEALED_INPUTS_IDENTITY.mode} on its read-only root; the sealed datasets are unprotected otherwise" >&2; exit 1`,
-    "fi",
-    `seal_route direct-read "$(seal_worker 'if ls -1 ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1 || test -r ${TRAINING_SEALED_INPUTS_ROOT} || test -x ${TRAINING_SEALED_INPUTS_ROOT}; then echo reachable; else echo denied at-read; fi')"`,
-    `seal_ns_route namespace-unmount "unshare --user --map-root-user --mount -- /bin/sh -c 'umount -l ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1; umount -l /run/training >/dev/null 2>&1; if ls -1 ${TRAINING_SEALED_INPUTS_ROOT} >/dev/null 2>&1; then echo reachable; else echo denied at-read; fi; exit 0'"`,
-    `seal_ns_route namespace-rebind-parent "unshare --user --map-root-user --mount -- /bin/sh -c 'mkdir -p ${privateTmp}/seal-parent 2>/dev/null || { echo unknown private-tmp-unwritable; exit 0; }; if mount --bind /run/training ${privateTmp}/seal-parent 2>/dev/null; then ls -1 ${privateTmp}/seal-parent/inputs >/dev/null 2>&1 && echo reachable || echo denied at-read; else echo denied at-mount; fi; exit 0'"`,
-    // Per dataset, because the strongest route is specific. Root enumerates the children; the worker may not.
-    `for sealed_child in ${TRAINING_SEALED_INPUTS_ROOT}/*; do`,
-    '  test -e "$sealed_child" || continue',
-    `  seal_route "direct-read $sealed_child" "$(seal_worker "if ls -1 '$sealed_child' >/dev/null 2>&1 || cat '$sealed_child'/* >/dev/null 2>&1; then echo reachable; else echo denied at-read; fi")"`,
-    `  seal_ns_route "namespace-rebind $sealed_child" "unshare --user --map-root-user --mount -- /bin/sh -c 'mkdir -p ${privateTmp}/seal-child 2>/dev/null || { echo unknown private-tmp-unwritable; exit 0; }; if mount --bind \\"$sealed_child\\" ${privateTmp}/seal-child 2>/dev/null; then ls -1 ${privateTmp}/seal-child >/dev/null 2>&1 && echo reachable || echo denied at-read; else echo denied at-mount; fi; exit 0'"`,
-    "done",
-    // A Spawnfile-owned attestation beside the slot receipt, readable by the organization uid. The
-    // cross-repo `noopolis.daimon.grok-slot-preflight.v2` canary shape is deliberately untouched — its
-    // schema lives in Daimon and no consumer here can validate an added member — so the per-route
-    // mechanism is recorded here rather than implied by a bare `result: "denied"` there.
-    `seal_attestation=${quote(trainingSlotPaths(workerUid - trainingSlotPaths(0).workerUid).sealedInputsAttestation)}`,
-    `printf '{"version":"spawnfile.training-sealed-inputs.v1","root":"%s","worker_uid":%s,"identity":"%s","pinned_seccomp_profile_sha256":"%s","namespace_routes":"%s","routes":[%s]}\\n' `
-        + `${quote(TRAINING_SEALED_INPUTS_ROOT)} ${workerUid} `
-        + `"$(stat -c '%u:%g %a' ${quote(TRAINING_SEALED_INPUTS_ROOT)})" ${quote(DAIMON_GROK_SECCOMP_PROFILE_SHA256)} `
-        + '"$seal_namespace" "$seal_rows" > "$seal_attestation.tmp"',
-    'chown 0:0 "$seal_attestation.tmp"; chmod 0640 "$seal_attestation.tmp"; chown 0:' + String(DAIMON_ORGANIZATION_UID) + ' "$seal_attestation.tmp"',
-    'mv "$seal_attestation.tmp" "$seal_attestation"',
-    'echo "sealed inputs attestation written to $seal_attestation"'
-];
-/** Where the broker's own `service.json` lands, so the supervisor can prove the slot it restarted is the slot it provisioned. */
-export const TRAINING_SERVICE_CONFIG_PATH = DAIMON_GROK_ENGINE_BROKER.serviceConfigPath;
-export const TRAINING_REGISTRATION_PATH = DAIMON_GROK_ENGINE_BROKER.registrationPath;
-export const TRAINING_BROKER_CONTROL_ROOT = path.posix.dirname(DAIMON_GROK_ENGINE_BROKER.controlSocketPath);

package/dist/compiler/training/broker/receipt.d.ts

@@ -1,77 +0,0 @@
-/** Filesystems that silently ignore `chown`/`chmod`, so a worker-uid probe over them proves nothing. */
-export declare const UNENFORCED_OWNERSHIP_FILESYSTEMS: readonly ["virtiofs", "9p", "nfs", "nfs4", "cifs", "smb3", "vboxsf", "grpcfuse"];
-/**
- * The filesystem type backing `target`, from the longest mount point that is a
- * prefix of it. `/proc/self/mountinfo` octal-escapes space, tab, newline and
- * backslash in the mount point field, exactly as the durable-mount guard
- * already handles elsewhere in this compiler.
- */
-export declare const resolveBackingFilesystem: (target: string, mountinfo: string) => string;
-export interface TrainingCanaryProbe {
-    /**
-     * Runs one worker-uid attempt and resolves true when it was denied.
-     *
-     * `read` is an `open()` for reading. `enter` additionally requires that the
-     * worker uid cannot *search* the directory, which is the property a sealed
-     * root actually needs: its protection is that every dataset read has to
-     * traverse it, not that the directory listing itself is unreadable.
-     */
-    (target: string, depth: "read" | "enter"): Promise<boolean>;
-}
-export interface TrainingCanaryOptions {
-    denyPaths: readonly string[];
-    probe: TrainingCanaryProbe;
-    mountinfo: string;
-    /** Deny entries the launch bound from the host. Diagnostics only: the backing filesystem decides, not this list. */
-    hostBindPaths: readonly string[];
-    /** Deny entries no policy may waive; each one must be observed unenterable by the worker uid. */
-    sealedPaths: readonly string[];
-    unenforcedBindPolicy: "refuse" | "profile-only";
-    log(line: string): void;
-}
-/**
- * One denied canary per deny path, or a refusal naming the first path whose
- * denial this container cannot prove.
- *
- * Three cases, in decreasing strength:
- *
- *  - A **sealed** path (the datasets' root) must sit on a filesystem that
- *    enforces unix ownership and must be observed *unenterable* by the worker
- *    uid. `unenforcedBindPolicy` does not reach it: the sandbox profile alone
- *    is a boundary the worker can lift from inside a namespace of its own, and
- *    the held-out test set is the one thing that cannot rest on it.
- *  - Any other path on an ownership-enforcing filesystem — a host bind over
- *    ext4/xfs/btrfs/overlay included — gets a real worker-uid read probe. This
- *    is what makes the documented `refuse` default reachable: a host bind is
- *    only unprovable where the filesystem says so.
- *  - A path on a filesystem that ignores ownership (virtiofs and grpcfuse under
- *    Docker Desktop and Colima, 9p, nfs, cifs, fuse) cannot be probed at all.
- *    `refuse` — the default — fails the recycle and writes no receipt;
- *    `profile-only` accepts the attested deny entry as that path's only
- *    boundary and names every such path in the supervisor log.
- */
-export declare const resolveTrainingCanaries: (options: TrainingCanaryOptions) => Promise<{
-    path: string;
-    method: "sandboxed-read";
-    result: "denied";
-}[]>;
-export interface TrainingSlotReceiptInput {
-    slot: number;
-    workerUid: number;
-    generation: number;
-    nonce: string;
-    projectionSha256: string;
-    sandboxProfileSha256: string;
-    seccompProfileSha256: string;
-    grokExecutableSha256: string;
-    canaries: readonly {
-        path: string;
-        method: "sandboxed-read";
-        result: "denied";
-    }[];
-    createdAt: Date;
-}
-/** `noopolis.daimon.grok-slot-preflight.v2`, in the exact member order Daimon's strict schema accepts. */
-export declare const buildTrainingSlotReceipt: (input: TrainingSlotReceiptInput) => Record<string, unknown>;
-/** sha256 of the pinned Grok executable the slot's workers exec, refused unless it is a manifest-pinned 1.0.34 build. */
-export declare const readGrokExecutableSha256: (executable?: "/usr/local/bin/grok") => string;

package/dist/compiler/training/broker/receipt.js

@@ -1,110 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-/** Filesystems that silently ignore `chown`/`chmod`, so a worker-uid probe over them proves nothing. */
-export const UNENFORCED_OWNERSHIP_FILESYSTEMS = ["virtiofs", "9p", "nfs", "nfs4", "cifs", "smb3", "vboxsf", "grpcfuse"];
-const isUnenforced = (fstype) => UNENFORCED_OWNERSHIP_FILESYSTEMS.includes(fstype) || fstype.startsWith("fuse");
-/**
- * The filesystem type backing `target`, from the longest mount point that is a
- * prefix of it. `/proc/self/mountinfo` octal-escapes space, tab, newline and
- * backslash in the mount point field, exactly as the durable-mount guard
- * already handles elsewhere in this compiler.
- */
-export const resolveBackingFilesystem = (target, mountinfo) => {
-    let best = "", fstype = "";
-    for (const line of mountinfo.split("\n")) {
-        const fields = line.split(" ");
-        const separator = fields.indexOf("-");
-        if (separator < 0 || fields.length < separator + 2)
-            continue;
-        const mountPoint = (fields[4] ?? "").replace(/\\(04[0011]|134)/gu, (match) => ({ "\\040": " ", "\\011": "\t", "\\012": "\n", "\\134": "\\" }[match] ?? match));
-        if (mountPoint !== "/" && target !== mountPoint && !target.startsWith(`${mountPoint}/`))
-            continue;
-        if (mountPoint.length >= best.length) {
-            best = mountPoint;
-            fstype = fields[separator + 1] ?? "";
-        }
-    }
-    return fstype;
-};
-/**
- * One denied canary per deny path, or a refusal naming the first path whose
- * denial this container cannot prove.
- *
- * Three cases, in decreasing strength:
- *
- *  - A **sealed** path (the datasets' root) must sit on a filesystem that
- *    enforces unix ownership and must be observed *unenterable* by the worker
- *    uid. `unenforcedBindPolicy` does not reach it: the sandbox profile alone
- *    is a boundary the worker can lift from inside a namespace of its own, and
- *    the held-out test set is the one thing that cannot rest on it.
- *  - Any other path on an ownership-enforcing filesystem — a host bind over
- *    ext4/xfs/btrfs/overlay included — gets a real worker-uid read probe. This
- *    is what makes the documented `refuse` default reachable: a host bind is
- *    only unprovable where the filesystem says so.
- *  - A path on a filesystem that ignores ownership (virtiofs and grpcfuse under
- *    Docker Desktop and Colima, 9p, nfs, cifs, fuse) cannot be probed at all.
- *    `refuse` — the default — fails the recycle and writes no receipt;
- *    `profile-only` accepts the attested deny entry as that path's only
- *    boundary and names every such path in the supervisor log.
- */
-export const resolveTrainingCanaries = async (options) => {
-    const canaries = [];
-    for (const target of options.denyPaths) {
-        const fstype = resolveBackingFilesystem(target, options.mountinfo);
-        const origin = `${options.hostBindPaths.includes(target) ? "a host bind mount on " : ""}${fstype || "an unknown filesystem"}`;
-        if (options.sealedPaths.includes(target)) {
-            if (isUnenforced(fstype)) {
-                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is backed by ${origin}, which ignores unix ownership, so the worker uid's denial cannot be proven; the sealed datasets must sit under a directory on an ownership-enforcing filesystem and no unenforcedBindPolicy waives this`);
-            }
-            if (!await options.probe(target, "enter")) {
-                throw new SpawnfileError("runtime_error", `Grok slot sealed canary ${target} is still reachable by the worker uid`);
-            }
-        }
-        else if (isUnenforced(fstype)) {
-            if (options.unenforcedBindPolicy === "refuse") {
-                throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is backed by ${origin}, which ignores unix ownership; declare unenforcedBindPolicy "profile-only" to accept the bubblewrap deny list as its only boundary`);
-            }
-            options.log(`canary ${target} certified by the enforced sandbox profile only (${origin} ignores unix ownership)`);
-        }
-        else if (!await options.probe(target, "read")) {
-            throw new SpawnfileError("runtime_error", `Grok slot canary ${target} is still readable by the worker uid`);
-        }
-        canaries.push({ path: target, method: "sandboxed-read", result: "denied" });
-    }
-    return canaries;
-};
-/** `noopolis.daimon.grok-slot-preflight.v2`, in the exact member order Daimon's strict schema accepts. */
-export const buildTrainingSlotReceipt = (input) => {
-    if (!/^[a-f0-9]{64}$/u.test(input.nonce))
-        throw new SpawnfileError("runtime_error", "Grok slot recycle nonce must be 32 random bytes in lowercase hex");
-    if (!Number.isSafeInteger(input.generation) || input.generation < 1)
-        throw new SpawnfileError("runtime_error", "Grok slot generation must be a positive integer");
-    if (input.canaries.length === 0)
-        throw new SpawnfileError("runtime_error", "Grok slot receipt requires at least one denied canary");
-    return {
-        version: DAIMON_GROK_ENGINE_BROKER.slotPreflightVersion,
-        slot: input.slot,
-        worker_uid: input.workerUid,
-        generation: input.generation,
-        nonce: input.nonce,
-        projection_sha256: input.projectionSha256,
-        sandbox_profile_sha256: input.sandboxProfileSha256,
-        seccomp_profile_sha256: input.seccompProfileSha256,
-        sandbox_runtime: "bubblewrap",
-        grok_executable_sha256: input.grokExecutableSha256,
-        canaries: [...input.canaries],
-        created_at: `${input.createdAt.toISOString().slice(0, 23)}Z`
-    };
-};
-/** sha256 of the pinned Grok executable the slot's workers exec, refused unless it is a manifest-pinned 1.0.34 build. */
-export const readGrokExecutableSha256 = (executable = DAIMON_GROK_ENGINE_BROKER.grokExecutablePath) => {
-    const digest = createHash("sha256").update(readFileSync(executable)).digest("hex");
-    const pinned = [DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.arm64.sha256, DAIMON_GROK_ENGINE_BROKER.grokCliArtifacts.x64.sha256];
-    if (!pinned.includes(digest)) {
-        throw new SpawnfileError("runtime_error", `${path.basename(executable)} is not the manifest-pinned Grok ${DAIMON_GROK_ENGINE_BROKER.grokCliVersion} build`);
-    }
-    return digest;
-};

package/dist/compiler/training/broker/recycleClient.d.ts

@@ -1,33 +0,0 @@
-import { type Socket } from "node:net";
-/** A reply is one short JSON line; anything longer is not this supervisor. */
-export declare const TRAINING_RECYCLE_MAX_REPLY_BYTES = 65536;
-/** Above the supervisor's 120 s drain deadline plus wipe, provision and canaries. */
-export declare const TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS = 180000;
-export interface RecycleTrainingSlotOptions {
-    slot: number;
-    /** This trial's 32-byte hex nonce; the published receipt must echo it. */
-    nonce: string;
-    signal?: AbortSignal;
-    /** Opens the supervisor connection; defaults to the container's fixed supervisor socket. */
-    connect?: () => Socket;
-    timeoutMs?: number;
-}
-export interface TrainingSlotRecycleReceipt {
-    slot: number;
-    generation: number;
-    nonce: string;
-    /** The receipt path the supervisor says it published; callers compare it to the slot descriptor. */
-    receipt: string;
-    durationMs: number;
-}
-/**
- * One `recycle` over the root slot supervisor socket (`spawnfile.training-slot-supervisor.v2`).
- *
- * The verb takes a slot and a nonce, never a path or a command: the container
- * replays its own audited provisioning and publishes the slot preflight receipt
- * echoing this nonce. The answer must bind this request exactly (protocol,
- * verb, slot, nonce, a generation of at least 1) or it is refused; a supervisor
- * refusal surfaces with its own reason. The reply is bounded, and the call is
- * bounded by `timeoutMs` and `signal`.
- */
-export declare const recycleTrainingSlot: (options: RecycleTrainingSlotOptions) => Promise<TrainingSlotRecycleReceipt>;

package/dist/compiler/training/broker/recycleClient.js

@@ -1,112 +0,0 @@
-import { createConnection } from "node:net";
-import { SpawnfileError } from "../../../shared/index.js";
-import { TRAINING_MAX_SLOTS, TRAINING_SUPERVISOR_SOCKET } from "./paths.js";
-import { TRAINING_SUPERVISOR_PROTOCOL } from "./supervisor.js";
-/** A reply is one short JSON line; anything longer is not this supervisor. */
-export const TRAINING_RECYCLE_MAX_REPLY_BYTES = 65_536;
-/** Above the supervisor's 120 s drain deadline plus wipe, provision and canaries. */
-export const TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS = 180_000;
-const NONCE = /^[a-f0-9]{64}$/u;
-const REPLY_KEYS = ["durationMs", "generation", "nonce", "ok", "receipt", "slot", "v", "verb"];
-const refuse = (message) => new SpawnfileError("runtime_error", message);
-/** The supervisor's refusal text is diagnostic only; keep it one bounded printable line. */
-const refusalText = (value) => typeof value === "string" ? value.replace(/[^\x20-\x7e]/gu, "?").slice(0, 512) || "unknown" : "unknown";
-const bindReply = (answer, slot, nonce) => {
-    if (answer.ok !== true)
-        throw refuse(`Training slot ${slot} recycle refused: ${refusalText(answer.error)}`);
-    if (Object.keys(answer).sort().join(",") !== REPLY_KEYS.join(",") || answer.verb !== "recycle") {
-        throw refuse("Training slot recycle answer is not a recycle receipt");
-    }
-    if (answer.slot !== slot)
-        throw refuse(`Training slot recycle answer names slot ${String(answer.slot)}, not the leased slot ${slot}`);
-    if (answer.nonce !== nonce)
-        throw refuse("Training slot recycle answer does not echo this trial's nonce");
-    if (!Number.isSafeInteger(answer.generation) || answer.generation < 1) {
-        throw refuse("Training slot recycle answer carries no valid generation");
-    }
-    if (typeof answer.receipt !== "string" || answer.receipt.length === 0)
-        throw refuse("Training slot recycle answer names no receipt");
-    if (typeof answer.durationMs !== "number" || !Number.isFinite(answer.durationMs) || answer.durationMs < 0) {
-        throw refuse("Training slot recycle answer carries no valid duration");
-    }
-    return { slot, generation: answer.generation, nonce, receipt: answer.receipt, durationMs: answer.durationMs };
-};
-/**
- * One `recycle` over the root slot supervisor socket (`spawnfile.training-slot-supervisor.v2`).
- *
- * The verb takes a slot and a nonce, never a path or a command: the container
- * replays its own audited provisioning and publishes the slot preflight receipt
- * echoing this nonce. The answer must bind this request exactly (protocol,
- * verb, slot, nonce, a generation of at least 1) or it is refused; a supervisor
- * refusal surfaces with its own reason. The reply is bounded, and the call is
- * bounded by `timeoutMs` and `signal`.
- */
-export const recycleTrainingSlot = (options) => {
-    const { slot, nonce } = options;
-    if (!Number.isInteger(slot) || slot < 0 || slot >= TRAINING_MAX_SLOTS) {
-        return Promise.reject(new SpawnfileError("validation_error", `Training slot recycle requires a slot index from 0 to ${TRAINING_MAX_SLOTS - 1}`));
-    }
-    if (!NONCE.test(nonce))
-        return Promise.reject(new SpawnfileError("validation_error", "Training slot recycle requires a 32-byte hex nonce"));
-    try {
-        options.signal?.throwIfAborted();
-    }
-    catch (error) {
-        return Promise.reject(error);
-    }
-    return new Promise((resolve, reject) => {
-        const socket = (options.connect ?? (() => createConnection(TRAINING_SUPERVISOR_SOCKET)))();
-        let buffer = Buffer.alloc(0), settled = false;
-        const onAbort = () => finish(options.signal?.reason instanceof Error ? options.signal.reason : refuse("Training slot recycle was aborted"));
-        const timer = setTimeout(() => finish(refuse(`Training slot ${slot} recycle timed out before the supervisor answered`)), options.timeoutMs ?? TRAINING_RECYCLE_DEFAULT_TIMEOUT_MS);
-        function finish(error, value) {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            options.signal?.removeEventListener("abort", onAbort);
-            socket.destroy();
-            if (error === undefined)
-                resolve(value);
-            else
-                reject(error);
-        }
-        options.signal?.addEventListener("abort", onAbort, { once: true });
-        socket.on("error", (error) => finish(refuse(`Training slot recycle could not reach the root supervisor: ${error.message}`)));
-        socket.on("close", () => finish(refuse("Training slot recycle connection closed before an answer")));
-        socket.on("connect", () => socket.write(`${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, verb: "recycle", slot, nonce })}\n`));
-        socket.on("data", (chunk) => {
-            buffer = Buffer.concat([buffer, chunk]);
-            const end = buffer.indexOf(0x0a);
-            if (end < 0 ? buffer.length > TRAINING_RECYCLE_MAX_REPLY_BYTES : end > TRAINING_RECYCLE_MAX_REPLY_BYTES) {
-                finish(refuse("Training slot recycle answer exceeded its bound"));
-                return;
-            }
-            if (end < 0)
-                return;
-            let answer;
-            try {
-                answer = JSON.parse(buffer.subarray(0, end).toString("utf8"));
-            }
-            catch {
-                finish(refuse("Training slot recycle answer is not JSON"));
-                return;
-            }
-            if (!answer || typeof answer !== "object" || Array.isArray(answer)) {
-                finish(refuse("Training slot recycle answer is not an object"));
-                return;
-            }
-            const record = answer;
-            if (record.v !== TRAINING_SUPERVISOR_PROTOCOL) {
-                finish(refuse("Training slot recycle answer names another protocol"));
-                return;
-            }
-            try {
-                finish(undefined, bindReply(record, slot, nonce));
-            }
-            catch (error) {
-                finish(error);
-            }
-        });
-    });
-};

package/dist/compiler/training/broker/registration.d.ts

@@ -1,46 +0,0 @@
-import { type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../../runtime/daimon/contractManifest.js";
-import { type DaimonAgentSkill } from "../../../runtime/daimon/grokWorkerSkills.js";
-import { type DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
-/**
- * The one training slot's deny list: Daimon's own protected set for a
- * single-agent organization (Grok bootstrap, realm, and the slot state root that
- * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
- * the evaluator roots, the caller's protected `/run/spawnfile-training` paths, the broker
- * control and registration roots, the grant home root, the inference ledger,
- * the per-slot ledger, turn store and supervisor socket directory.
- *
- * The same two refusals the production render enforces apply here: an entry
- * that equals or contains a Grok 1.0.34 base-profile grant makes Grok refuse
- * the profile outright, and masks cannot nest, so an entry covered by another
- * entry is a provisioning bug rather than something to silently drop.
- */
-export declare const resolveTrainingGrokDenyPaths: (added?: readonly string[] | undefined, slot?: number, slots?: number) => string[];
-export interface TrainingGrokSlotInput {
-    slot?: number;
-    slots?: number;
-    agentId: string;
-    model: DaimonGrokBrokerModel;
-    reasoningEffort: DaimonGrokBrokerReasoningEffort;
-    /** Deny entries this container adds beyond Daimon's own protected set; defaults to the fixed training set. */
-    denyPaths?: readonly string[];
-    /**
-     * The declaration's per-turn limits. The broker registration must declare
-     * them, because a wake may only LOWER a declared limit: a trial whose wake
-     * ceiling exceeds the manifest defaults is refused as `invalid_request`.
-     */
-    limits?: {
-        maxRequests: number;
-        maxTokens: number;
-        timeoutMs: number;
-    };
-    /** The declaration's skills; rendered into the slot's `$GROK_HOME/skills` and bound as `skillsSha256`. */
-    skills?: readonly DaimonAgentSkill[];
-}
-/**
- * The single brokered Grok registration a training container runs, at the
- * fixed container paths in `paths.ts`. Unlike production it points
- * `usageLedgerPath` at the per-slot ledger, because each trial's spend must be
- * separable and a recycle wipes it; the container-wide ledger and wake fuse do
- * not exist here.
- */
-export declare const resolveTrainingGrokRegistration: (input: TrainingGrokSlotInput) => DaimonGrokRegistration;