spawnfile 0.1.33 → 0.1.35

package/dist/compiler/training/broker/registration.js

@@ -1,113 +0,0 @@
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { DAIMON_GROK_WORKER_HOME_DIRECTORY, daimonGrokWorkerSandboxProfileSha256, renderDaimonGrokWorkerSandboxProfile, resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
-import { resolveDaimonGrokWorkerSkills } from "../../../runtime/daimon/grokWorkerSkills.js";
-import { DAIMON_GROK_BASE_PROFILE_GRANTS, assertCanonicalRegisteredPath } from "../../containerDaimonGrokWorkerRender.js";
-import { trainingSlotPaths, trainingEvaluatorPaths, TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, TRAINING_DEFERRED_DENY_PATHS } from "./paths.js";
-const fail = (message) => {
-    throw new SpawnfileError("compile_error", message);
-};
-const within = (candidate, root) => candidate === root || candidate.startsWith(`${root}/`);
-/**
- * The one training slot's deny list: Daimon's own protected set for a
- * single-agent organization (Grok bootstrap, realm, and the slot state root that
- * holds the wake-acceptance store) plus everything this container provisions that the subject must not read —
- * the evaluator roots, the caller's protected `/run/spawnfile-training` paths, the broker
- * control and registration roots, the grant home root, the inference ledger,
- * the per-slot ledger, turn store and supervisor socket directory.
- *
- * The same two refusals the production render enforces apply here: an entry
- * that equals or contains a Grok 1.0.34 base-profile grant makes Grok refuse
- * the profile outright, and masks cannot nest, so an entry covered by another
- * entry is a provisioning bug rather than something to silently drop.
- */
-export const resolveTrainingGrokDenyPaths = (added = undefined, slot = 0, slots = 1) => {
-    const p = trainingSlotPaths(slot);
-    const required = trainingEvaluatorPaths(slot, slots).map(entry => entry.path);
-    // The wake-acceptance store is masked through `p.state`, never directly: Grok 1.0.34
-    // materializes every deny target inside bubblewrap AS THE WORKER UID, and the store's parent is
-    // `2000:2000 0700`, so the store itself is unplaceable and would make Grok refuse the whole profile
-    // (`.runtime/grok-deny-placement/EVIDENCE.md`). The state root covers it and nothing else lives there.
-    const daimonOwn = [TRAINING_BOOTSTRAP_MOUNT, TRAINING_REALM_MOUNT, p.state];
-    const grokHome = path.posix.join(p.workerHome, DAIMON_GROK_WORKER_HOME_DIRECTORY);
-    const grants = [
-        ...DAIMON_GROK_BASE_PROFILE_GRANTS, p.workspace, grokHome,
-        path.posix.join(grokHome, "sessions"), path.posix.join(p.workerHome, "tmp")
-    ];
-    const candidates = [...new Set([...daimonOwn, ...required, ...(added ?? [])])].sort();
-    for (const entry of candidates) {
-        assertCanonicalRegisteredPath("deny path", entry);
-        const grant = grants.find((candidate) => within(candidate, entry));
-        if (grant)
-            fail(`Training Grok deny path ${entry} equals or contains the base profile grant ${grant}; Grok refuses such a profile`);
-        if (within(p.workspace, entry) || within(p.workerHome, entry) || within(p.runtimeHome, entry)) {
-            fail(`Training Grok deny path ${entry} would hide the subject's own workspace, home, or runtime home`);
-        }
-        if ([p.clockFile, DAIMON_GROK_ENGINE_BROKER.worker.taskClock.preloadPath,
-            "/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1", "/usr/lib/aarch64-linux-gnu/faketime/libfaketime.so.1"].some(file => within(file, entry))) {
-            fail(`Training Grok deny path ${entry} would hide the subject's task clock`);
-        }
-        const ancestor = candidates.find((other) => other !== entry && within(entry, other));
-        if (ancestor)
-            fail(`Training Grok deny path ${ancestor} would cover ${entry}; masks cannot nest`);
-    }
-    return candidates;
-};
-/**
- * The single brokered Grok registration a training container runs, at the
- * fixed container paths in `paths.ts`. Unlike production it points
- * `usageLedgerPath` at the per-slot ledger, because each trial's spend must be
- * separable and a recycle wipes it; the container-wide ledger and wake fuse do
- * not exist here.
- */
-export const resolveTrainingGrokRegistration = (input) => {
-    const p = trainingSlotPaths(input.slot ?? 0);
-    if (!input.agentId.trim())
-        fail("Training Grok slot requires an agent id");
-    if (!DAIMON_GROK_BROKER_MODELS.includes(input.model)
-        || !DAIMON_GROK_BROKER_REASONING_EFFORTS.includes(input.reasoningEffort)) {
-        fail(`Training Grok slot has no declared broker model and reasoning effort: ${input.agentId}`);
-    }
-    const home = assertCanonicalRegisteredPath("home", p.workerHome);
-    const grokHome = path.posix.join(home, DAIMON_GROK_WORKER_HOME_DIRECTORY);
-    const config = resolveDaimonGrokClockedWorkerConfig(input.model, input.reasoningEffort, p.slot);
-    const denyPaths = resolveTrainingGrokDenyPaths(input.denyPaths, p.slot, input.slots ?? 1);
-    const profile = renderDaimonGrokWorkerSandboxProfile(denyPaths);
-    const eventsPath = path.posix.join(grokHome, DAIMON_GROK_ENGINE_BROKER.worker.home.sandboxEvents.relativePath);
-    const profilePath = path.posix.join(grokHome, "sandbox.toml");
-    for (const [label, value] of [["GROK_HOME", grokHome], ["profile", profilePath], ["events", eventsPath],
-        ["workspace", p.workspace], ["runtime home", p.runtimeHome],
-        ["usage ledger", p.usageLedger]])
-        assertCanonicalRegisteredPath(label, value);
-    const skills = resolveDaimonGrokWorkerSkills(input.skills);
-    return {
-        ...(skills ? { skills } : {}),
-        agentId: input.agentId,
-        config: config.bytes,
-        configVariant: "clocked",
-        ...(input.limits === undefined ? {} : { limits: { ...input.limits } }),
-        configSha256: config.sha256,
-        deferredDenyPaths: denyPaths.filter((entry) => TRAINING_DEFERRED_DENY_PATHS.includes(entry)),
-        denyPaths,
-        eventsPath,
-        grokHome,
-        home,
-        model: input.model,
-        profile,
-        profilePath,
-        profileSha256: daimonGrokWorkerSandboxProfileSha256(denyPaths),
-        privateTmp: path.posix.join(home, DAIMON_GROK_ENGINE_BROKER.worker.home.privateTmp.relativeToWorkerHome),
-        reasoningEffort: input.reasoningEffort,
-        runtimeHome: p.runtimeHome,
-        // Empty on purpose: training has no persistent mounts at all. Everything a trial writes under the slot
-        // runtime home is per-slot tmpfs the recycle wipes, and the only thing provisioned inside it is the
-        // setgid `tool-output/` spill directory, so the traversable `0710` home exposes nothing else.
-        runtimeHomeMounts: [],
-        slot: p.slot,
-        spillDirectory: path.posix.join(p.runtimeHome, DAIMON_GROK_ENGINE_BROKER.worker.home.spillDirectory.relativeToRuntimeHome),
-        uid: p.workerUid,
-        usageLedgerPath: p.usageLedger,
-        workspace: p.workspace
-    };
-};

package/dist/compiler/training/broker/reset.d.ts

@@ -1,9 +0,0 @@
-/** Root uses the broker's slot reset seam; the broker owns active-turn, worker-reap and clock checks. */
-export declare const resetTrainingBrokerSlot: (slot: number, signal: AbortSignal, socketPath?: "/run/daimon-engine-broker/control.sock") => Promise<void>;
-/** The native control relay authenticates SO_PEERCRED uid 2000 and rejects root. */
-export declare const resetTrainingBrokerSlotAsOrganization: (slot: number, signal: AbortSignal, execute?: (file: string, args: string[], options: {
-    signal: AbortSignal;
-    timeout: number;
-}) => Promise<{
-    stdout: string;
-}>) => Promise<void>;

package/dist/compiler/training/broker/reset.js

@@ -1,71 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { randomUUID } from "node:crypto";
-import { createConnection } from "node:net";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { trainingSlotPaths } from "./paths.js";
-/** Root uses the broker's slot reset seam; the broker owns active-turn, worker-reap and clock checks. */
-export const resetTrainingBrokerSlot = (slot, signal, socketPath = DAIMON_GROK_ENGINE_BROKER.controlSocketPath) => {
-    trainingSlotPaths(slot);
-    signal.throwIfAborted();
-    const requestId = randomUUID();
-    const version = DAIMON_GROK_ENGINE_BROKER.controlProtocolVersion;
-    const payload = Buffer.from(JSON.stringify({ version, kind: "reset_slot", requestId, slot }));
-    const frame = Buffer.alloc(4 + payload.length);
-    frame.writeUInt32BE(payload.length);
-    payload.copy(frame, 4);
-    return new Promise((resolve, reject) => {
-        const socket = createConnection(socketPath);
-        let buffer = Buffer.alloc(0), settled = false;
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            signal.removeEventListener("abort", abort);
-            socket.destroy();
-            if (error)
-                reject(error);
-            else
-                resolve();
-        };
-        const abort = () => finish(new Error("Training broker reset aborted; slot must be quarantined"));
-        signal.addEventListener("abort", abort, { once: true });
-        socket.once("error", error => finish(error));
-        socket.once("close", () => finish(new Error("Training broker reset refused: slot active, unavailable, or reset failed")));
-        socket.once("connect", () => socket.write(frame));
-        socket.on("data", chunk => {
-            buffer = Buffer.concat([buffer, chunk]);
-            if (buffer.length < 4)
-                return;
-            const size = buffer.readUInt32BE(0);
-            if (size < 2 || size > 4096 || buffer.length > size + 4) {
-                finish(new Error("Invalid broker reset response frame"));
-                return;
-            }
-            if (buffer.length < size + 4)
-                return;
-            try {
-                const response = JSON.parse(buffer.subarray(4).toString("utf8"));
-                if (!response || response.version !== version || response.kind !== "slot_reset" || response.requestId !== requestId
-                    || response.slot !== slot || Object.keys(response).length !== 4)
-                    throw Error("Invalid broker reset acknowledgement");
-                finish();
-            }
-            catch (error) {
-                finish(error instanceof Error ? error : new Error("Invalid broker reset response"));
-            }
-        });
-    });
-};
-/** The native control relay authenticates SO_PEERCRED uid 2000 and rejects root. */
-export const resetTrainingBrokerSlotAsOrganization = async (slot, signal, execute = promisify(execFile)) => {
-    trainingSlotPaths(slot);
-    signal.throwIfAborted();
-    const uid = DAIMON_GROK_ENGINE_BROKER.identities.organizationUid;
-    const program = `import { resetTrainingBrokerSlot } from ${JSON.stringify(import.meta.url)}; await resetTrainingBrokerSlot(Number(process.argv[1]), AbortSignal.timeout(10000)); process.stdout.write("slot-reset-complete\\n");`;
-    const result = await execute("setpriv", ["--clear-groups", `--reuid=${uid}`, `--regid=${uid}`,
-        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", process.execPath,
-        "--input-type=module", "--eval", program, String(slot)], { signal, timeout: 15_000 });
-    if (result.stdout !== "slot-reset-complete\n")
-        throw Error("Broker reset child returned no verified acknowledgement");
-};

package/dist/compiler/training/broker/rootScript.d.ts

@@ -1,32 +0,0 @@
-/**
- * Linux `MAX_ARG_STRLEN`: the most bytes one `execve` argument may carry. A
- * generated root program passed as `bash -c <script>` dies with `E2BIG` past
- * it — and a slot program embeds its declared skills, so the size grows with
- * the declaration. macOS has no per-argument limit, which is why this is
- * asserted in tests rather than observed.
- */
-export declare const LINUX_MAX_ARG_STRLEN = 131072;
-export type TrainingRootScriptRunner = (file: string, args: readonly string[], options: {
-    maxBuffer: number;
-}) => Promise<{
-    stdout: string;
-    stderr: string;
-}>;
-export interface TrainingRootScriptOptions {
-    shell?: string;
-    maxBuffer?: number;
-    run?: TrainingRootScriptRunner;
-    tmpRoot?: string;
-}
-/** The argv a generated script runs under: bounded and independent of the script's size. */
-export declare const trainingRootScriptArgv: (scriptFile: string) => string[];
-/**
- * Runs a generated root shell program from a fresh `0700` directory holding a
- * `0600` script file, never from argv and never from stdin (a child that reads
- * stdin would consume the rest of the program). The directory is removed
- * afterwards, whatever the outcome.
- */
-export declare const runTrainingRootScript: (script: string, options?: TrainingRootScriptOptions) => Promise<{
-    stdout: string;
-    stderr: string;
-}>;

package/dist/compiler/training/broker/rootScript.js

@@ -1,33 +0,0 @@
-import { execFile } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { promisify } from "node:util";
-/**
- * Linux `MAX_ARG_STRLEN`: the most bytes one `execve` argument may carry. A
- * generated root program passed as `bash -c <script>` dies with `E2BIG` past
- * it — and a slot program embeds its declared skills, so the size grows with
- * the declaration. macOS has no per-argument limit, which is why this is
- * asserted in tests rather than observed.
- */
-export const LINUX_MAX_ARG_STRLEN = 131_072;
-const execFileAsync = promisify(execFile);
-/** The argv a generated script runs under: bounded and independent of the script's size. */
-export const trainingRootScriptArgv = (scriptFile) => ["--noprofile", "--norc", "-eu", scriptFile];
-/**
- * Runs a generated root shell program from a fresh `0700` directory holding a
- * `0600` script file, never from argv and never from stdin (a child that reads
- * stdin would consume the rest of the program). The directory is removed
- * afterwards, whatever the outcome.
- */
-export const runTrainingRootScript = async (script, options = {}) => {
-    const directory = await mkdtemp(path.join(options.tmpRoot ?? os.tmpdir(), "spawnfile-root-script-"));
-    try {
-        const file = path.join(directory, "script.sh");
-        await writeFile(file, script, { mode: 0o600, flag: "wx" });
-        return await (options.run ?? execFileAsync)(options.shell ?? "/bin/bash", trainingRootScriptArgv(file), { maxBuffer: options.maxBuffer ?? 1024 * 1024 });
-    }
-    finally {
-        await rm(directory, { recursive: true, force: true });
-    }
-};

package/dist/compiler/training/broker/runtime.d.ts

@@ -1,22 +0,0 @@
-import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
-import type { TrainingBrokerDeclaration } from "./declaration.js";
-import type { TrainingSlotRuntime } from "./supervisor.js";
-export interface TrainingSlotRuntimeOptions {
-    declaration: TrainingBrokerDeclaration;
-    registration: DaimonGrokRegistration;
-    projectionSha256: string;
-    reset: (slot: number, signal: AbortSignal) => Promise<void>;
-    /** Test seam: the shell the provisioning script runs in and the `/proc` it reads identities from. */
-    shell?: string;
-    procRoot?: string;
-    logPath?: string;
-}
-export declare const createTrainingSlotRuntime: (options: TrainingSlotRuntimeOptions) => TrainingSlotRuntime;
-/** Never remove or change the ownership/mode of a worker home or tmp: siblings attest those inodes. */
-export declare const renderTrainingSlotWipe: (slot: number) => string[];
-/** A failed privilege drop is not evidence of denial; require a positive worker verdict. */
-export declare const probeTrainingWorker: (uid: number, target: string, depth: "read" | "enter", execute?: (command: string, args: string[], options: {
-    timeout: number;
-}) => Promise<{
-    stdout: string;
-}>) => Promise<boolean>;

package/dist/compiler/training/broker/runtime.js

@@ -1,128 +0,0 @@
-import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { appendFileSync } from "node:fs";
-import { chmod, chown, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { promisify } from "node:util";
-import { SpawnfileError } from "../../../shared/index.js";
-import { MOUNT_AWARE_CLEAR_HELPER } from "../../containerDaimonBrokerRender.js";
-import { probeTrainingSiblingClock } from "./clockProbe.js";
-import { renderTrainingTaskClockAssertions } from "./taskClock.js";
-import { renderTrainingSlotProvisioning } from "./provisioning.js";
-import { runTrainingRootScript } from "./rootScript.js";
-import { buildTrainingSlotReceipt, readGrokExecutableSha256, resolveTrainingCanaries } from "./receipt.js";
-import { DAIMON_ORGANIZATION_UID, TRAINING_HOST_BIND_DENY_PATHS, TRAINING_SEALED_DENY_PATHS, trainingSlotPaths, trainingWipeTargets, trainingClearTargets, TRAINING_SUPERVISOR_LOG } from "./paths.js";
-const run = promisify(execFile);
-const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
-export const createTrainingSlotRuntime = (options) => {
-    const shell = options.shell ?? "/bin/bash";
-    const logPath = options.logPath ?? TRAINING_SUPERVISOR_LOG;
-    const p = trainingSlotPaths(options.registration.slot);
-    const script = renderTrainingSlotProvisioning(options.registration).join("\n");
-    const log = (line) => {
-        const entry = `${new Date().toISOString()} ${line}\n`;
-        process.stderr.write(`[slot-supervisor] ${entry}`);
-        try {
-            appendFileSync(logPath, entry, { mode: 0o640 });
-        }
-        catch { /* the log is diagnostics, never the gate */ }
-    };
-    const siblingClocks = Array.from({ length: options.declaration.slots }, (_, slot) => trainingSlotPaths(slot))
-        .filter(peer => peer.slot !== p.slot).map(peer => peer.clockDirectory);
-    const probe = (target, depth) => siblingClocks.includes(target)
-        ? probeTrainingSiblingClock(p.slot, target)
-        : probeTrainingWorker(options.registration.uid, target, depth);
-    return {
-        log,
-        reset: signal => options.reset(p.slot, signal),
-        wipe: async () => {
-            // Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_DAC_OVERRIDE`, so it cannot delete
-            // inside a directory it handed to the worker or the broker. Reclaim each tree first, then remove it.
-            const script = renderTrainingSlotWipe(p.slot).join("\n");
-            await runTrainingRootScript(script, { shell, maxBuffer: 1024 * 1024 }).catch((error) => {
-                const detail = error;
-                throw new SpawnfileError("runtime_error", `Training slot wipe failed: ${(detail.stderr ?? "").slice(-1024).trim() || "no diagnostic"}`);
-            });
-        },
-        provision: async () => {
-            const result = await runTrainingRootScript(script, { shell, maxBuffer: 8 * 1024 * 1024 }).catch((error) => {
-                const detail = error;
-                throw new SpawnfileError("runtime_error", `Training slot provisioning failed: ${(detail.stderr ?? detail.stdout ?? "").slice(-2048).trim()}`);
-            });
-            if (result.stdout.trim())
-                log(`provisioning: ${result.stdout.trim().slice(-2048)}`);
-        },
-        canaries: async () => {
-            await runTrainingRootScript(renderTrainingTaskClockAssertions(options.registration).join("\n"), { shell });
-            return resolveTrainingCanaries({
-                denyPaths: options.registration.denyPaths, probe, log, hostBindPaths: TRAINING_HOST_BIND_DENY_PATHS,
-                sealedPaths: TRAINING_SEALED_DENY_PATHS,
-                mountinfo: await readFile(`${options.procRoot ?? "/proc"}/self/mountinfo`, "utf8"),
-                unenforcedBindPolicy: options.declaration.unenforcedBindPolicy
-            });
-        },
-        nextGeneration: async () => {
-            const previous = await readFile(p.generationFile, "utf8").catch(() => "");
-            const parsed = Number.parseInt(JSON.parse(previous || "{}").generation ?? "0", 10);
-            // Seeded from the wall clock so a container restart cannot hand out a generation an evaluator already accepted.
-            const generation = Math.max(Number.isSafeInteger(parsed) && parsed > 0 ? parsed + 1 : 1, Math.floor(Date.now() / 1000));
-            await writeFile(p.generationFile, `${JSON.stringify({ generation })}\n`, { mode: 0o600 });
-            return generation;
-        },
-        publishReceipt: async ({ generation, nonce, canaries }) => {
-            const receipt = buildTrainingSlotReceipt({
-                slot: options.registration.slot, workerUid: options.registration.uid, generation, nonce,
-                projectionSha256: options.projectionSha256, sandboxProfileSha256: options.registration.profileSha256,
-                seccompProfileSha256: options.declaration.seccompProfileSha256,
-                grokExecutableSha256: readGrokExecutableSha256(), canaries, createdAt: new Date()
-            });
-            const temporary = `${p.preflightReceipt}.${randomUUID()}.tmp`;
-            await mkdir(path.dirname(p.preflightReceipt), { recursive: true });
-            await writeFile(temporary, `${JSON.stringify(receipt)}\n`, { mode: 0o600, flag: "wx" });
-            await chown(temporary, 0, DAIMON_ORGANIZATION_UID);
-            await chmod(temporary, 0o640);
-            await rename(temporary, p.preflightReceipt);
-            return p.preflightReceipt;
-        }
-    };
-};
-/** Never remove or change the ownership/mode of a worker home or tmp: siblings attest those inodes. */
-export const renderTrainingSlotWipe = (slot) => {
-    const p = trainingSlotPaths(slot);
-    const worker = `setpriv --clear-groups --reuid=${p.workerUid} --regid=${p.workerUid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all --`;
-    return [
-        ...MOUNT_AWARE_CLEAR_HELPER,
-        // Attested roots must still be canonical before any recursive mutation.
-        ...[p.workerHome, p.privateTmp, ...trainingWipeTargets(slot), ...trainingClearTargets(slot)].map(target => `if [ -e ${quote(target)} ] || [ -L ${quote(target)} ]; then if [ -L ${quote(target)} ] || [ "$(realpath ${quote(target)})" != ${quote(target)} ]; then echo "noncanonical slot wipe target" >&2; exit 1; fi; fi`),
-        'reclaim() { parent=$(dirname "$1"); chown 0:0 "$parent"; chmod u+rwx "$parent"; if [ -e "$1" ]; then chown -R 0:0 "$1"; chmod -R u+rwX "$1"; fi; }',
-        ...trainingWipeTargets(slot).map(target => `reclaim ${quote(target)}; spawnfile_remove_tree ${quote(target)}`),
-        ...trainingClearTargets(slot).map(target => `reclaim ${quote(target)}; spawnfile_clear_tree ${quote(target)}`),
-        // Reclaim descendants only, then unlink as the worker, who owns the stable parent. No sibling inode changes.
-        `for worker_entry in ${quote(p.workerHome)}/* ${quote(p.workerHome)}/.[!.]* ${quote(p.workerHome)}/..?*; do`,
-        '  if [ ! -e "$worker_entry" ] && [ ! -L "$worker_entry" ]; then continue; fi',
-        `  if [ "$worker_entry" = ${quote(p.privateTmp)} ]; then continue; fi`,
-        '  if spawnfile_holds_mount "$worker_entry"; then echo "worker home contains a mount" >&2; exit 1; fi',
-        `  chown -hR ${p.workerUid}:${p.workerUid} "$worker_entry"`,
-        `  ${worker} /bin/sh -ceu 'if [ ! -L "$1" ]; then chmod -R u+rwX "$1"; fi; rm -rf "$1"' sh "$worker_entry"`,
-        'done',
-        `for worker_entry in ${quote(p.privateTmp)}/* ${quote(p.privateTmp)}/.[!.]* ${quote(p.privateTmp)}/..?*; do`,
-        '  if [ ! -e "$worker_entry" ] && [ ! -L "$worker_entry" ]; then continue; fi',
-        '  if spawnfile_holds_mount "$worker_entry"; then echo "worker tmp contains a mount" >&2; exit 1; fi',
-        `  chown -hR ${p.workerUid}:${p.workerUid} "$worker_entry"`,
-        `  ${worker} /bin/sh -ceu 'if [ ! -L "$1" ]; then chmod -R u+rwX "$1"; fi; rm -rf "$1"' sh "$worker_entry"`,
-        'done'
-    ];
-};
-/** A failed privilege drop is not evidence of denial; require a positive worker verdict. */
-export const probeTrainingWorker = async (uid, target, depth, execute = run) => {
-    const q = quote(target);
-    const reachable = depth === "enter" ? `test -r ${q} || test -x ${q} || ls -1 ${q} >/dev/null 2>&1` : `test -r ${q}`;
-    const result = await execute("setpriv", ["--clear-groups", `--reuid=${uid}`, `--regid=${uid}`,
-        "--inh-caps=-all", "--ambient-caps=-all", "--bounding-set=-all", "--", "/bin/sh", "-c",
-        `if ${reachable}; then echo reachable; else echo denied; fi`], { timeout: 10_000 });
-    if (result.stdout.trim() === "denied")
-        return true;
-    if (result.stdout.trim() === "reachable")
-        return false;
-    throw new SpawnfileError("runtime_error", "Training worker canary returned no verified verdict");
-};

package/dist/compiler/training/broker/seccompRoutes.d.ts

@@ -1,31 +0,0 @@
-/**
- * The syscalls a worker-uid namespace escape needs before it can even be
- * attempted: a new user namespace, a new mount namespace, and the mount and
- * unmount calls inside them.
- *
- * `clone`/`clone3` are deliberately absent. The pinned profile allows them only
- * under an argument filter, so a static "is it allowed" question has no honest
- * yes/no answer for them, and `unshare` already gates the route.
- */
-export declare const TRAINING_NAMESPACE_ROUTE_SYSCALLS: readonly ["unshare", "mount", "umount2", "setns"];
-/**
- * Whether the pinned seccomp profile lets the worker uid attempt a namespace
- * escape at all — an **unconditional** `SCMP_ACT_ALLOW`, with no
- * `includes.caps` (the container drops `CAP_SYS_ADMIN`) and no argument filter.
- *
- * This exists to keep one specific lie out of the slot receipt. When a probe
- * route cannot run, the honest record is *which layer refused it*: a syscall
- * the profile filters is a stronger denial than DAC and must be named as
- * `seccomp`, while the same syscall refused by a profile that allows it came
- * from the kernel or an LSM and must be named `kernel`. Merging the two into
- * "denied" would let a filtered-syscall run read as though DAC had held.
- */
-export declare const pinnedProfileAllowsNamespaceRoutes: (bytes?: string) => boolean;
-/**
- * What to blame when the worker uid cannot open the namespace a route needs.
- *
- * Derived, never guessed: seccomp and a DAC/LSM refusal both surface as
- * `EPERM`, so errno cannot tell them apart. The pinned profile can — Spawnfile
- * ships its bytes and the declaration binds their digest.
- */
-export declare const trainingNamespaceDenialMechanism: (bytes?: string) => "seccomp" | "kernel";

package/dist/compiler/training/broker/seccompRoutes.js

@@ -1,36 +0,0 @@
-import { DAIMON_GROK_SECCOMP_PROFILE_BYTES } from "../../../shared/daimonGrokSeccompProfile.js";
-/**
- * The syscalls a worker-uid namespace escape needs before it can even be
- * attempted: a new user namespace, a new mount namespace, and the mount and
- * unmount calls inside them.
- *
- * `clone`/`clone3` are deliberately absent. The pinned profile allows them only
- * under an argument filter, so a static "is it allowed" question has no honest
- * yes/no answer for them, and `unshare` already gates the route.
- */
-export const TRAINING_NAMESPACE_ROUTE_SYSCALLS = ["unshare", "mount", "umount2", "setns"];
-/**
- * Whether the pinned seccomp profile lets the worker uid attempt a namespace
- * escape at all — an **unconditional** `SCMP_ACT_ALLOW`, with no
- * `includes.caps` (the container drops `CAP_SYS_ADMIN`) and no argument filter.
- *
- * This exists to keep one specific lie out of the slot receipt. When a probe
- * route cannot run, the honest record is *which layer refused it*: a syscall
- * the profile filters is a stronger denial than DAC and must be named as
- * `seccomp`, while the same syscall refused by a profile that allows it came
- * from the kernel or an LSM and must be named `kernel`. Merging the two into
- * "denied" would let a filtered-syscall run read as though DAC had held.
- */
-export const pinnedProfileAllowsNamespaceRoutes = (bytes = DAIMON_GROK_SECCOMP_PROFILE_BYTES) => {
-    const profile = JSON.parse(bytes);
-    return TRAINING_NAMESPACE_ROUTE_SYSCALLS.every((syscall) => (profile.syscalls ?? []).some((rule) => (rule.names ?? []).includes(syscall) && rule.action === "SCMP_ACT_ALLOW"
-        && (rule.includes?.caps ?? []).length === 0 && (rule.args ?? []).length === 0));
-};
-/**
- * What to blame when the worker uid cannot open the namespace a route needs.
- *
- * Derived, never guessed: seccomp and a DAC/LSM refusal both surface as
- * `EPERM`, so errno cannot tell them apart. The pinned profile can — Spawnfile
- * ships its bytes and the declaration binds their digest.
- */
-export const trainingNamespaceDenialMechanism = (bytes) => pinnedProfileAllowsNamespaceRoutes(bytes) ? "kernel" : "seccomp";

package/dist/compiler/training/broker/supervisor.d.ts

@@ -1,108 +0,0 @@
-export declare const TRAINING_SUPERVISOR_PROTOCOL: "spawnfile.training-slot-supervisor.v2";
-export declare const TRAINING_SUPERVISOR_MAX_REQUEST_BYTES = 4096;
-/**
- * Everything the recycle verb does to the running slot. It is an interface so
- * the state machine below can be tested without Docker, a broker, or root:
- * the order of these calls *is* the contract, and getting it wrong (wiping
- * before draining, writing a receipt before the canaries) is exactly the class
- * of bug a live check finds far too late.
- */
-export interface TrainingSlotRuntime {
-    /** Broker refuses active turns and live workers, then resets only this slot clock/turn store. */
-    reset(signal: AbortSignal): Promise<void>;
-    /** Clears this slot while preserving the worker-home/tmp identities attested by sibling turns. */
-    wipe(): Promise<void>;
-    /** Reuses the audited worker provisioning; shared broker files are untouched. */
-    provision(): Promise<void>;
-    /** Worker-uid denial canaries over every deny path; throws when one is still reachable. */
-    canaries(): Promise<{
-        path: string;
-        method: "sandboxed-read";
-        result: "denied";
-    }[]>;
-    /** Writes the slot preflight receipt v2 atomically, readable by the organization uid. */
-    publishReceipt(input: {
-        generation: number;
-        nonce: string;
-        canaries: readonly {
-            path: string;
-            method: "sandboxed-read";
-            result: "denied";
-        }[];
-    }): Promise<string>;
-    /** Monotonic per-slot generation; strictly greater than every generation this slot has ever published. */
-    nextGeneration(): Promise<number>;
-    log(line: string): void;
-}
-/**
- * Bringing a slot up, receipt included — the only way this container starts one.
- *
- * `provision → start` alone was the whole start-up path, and `canaries` and
- * `publishReceipt` were reachable only from `recycle`. The first trial of every
- * run therefore executed with no worker-uid denial evidence at all, and a
- * refusal that should have cost nothing surfaced only after that trial's spend.
- * Trial 1 is exactly the trial whose sealed datasets have never been probed, so
- * it is the one that most needs the evidence.
- *
- * The receipt this publishes carries generation 1..N and a nonce of the
- * container's own, so an evaluator that reads `preflight.json` before its first
- * wake sees the same `noopolis.daimon.grok-slot-preflight.v2` shape a recycle
- * publishes, from the same canaries.
- */
-export declare const startTrainingSlot: (runtime: TrainingSlotRuntime, nonce: string) => Promise<{
-    generation: number;
-    receipt: string;
-    canaries: number;
-}>;
-export interface TrainingSlotSupervisorOptions {
-    runtimes: readonly TrainingSlotRuntime[];
-    /** Only this uid may recycle. Training, DSPy and the judges all run as it; every worker uid is refused. */
-    organizationUid?: number;
-    drainTimeoutMs?: number;
-    now?: () => number;
-}
-export interface TrainingRecycleResult {
-    ok: true;
-    verb: "recycle";
-    slot: number;
-    generation: number;
-    nonce: string;
-    receipt: string;
-    durationMs: number;
-}
-/**
- * The single-verb root slot supervisor.
- *
- * One verb, slot and nonce, no path or command ever supplied by the caller: the
- * whole point of D4 is that recycling replays the container's own audited
- * provisioning rather than exposing a root file-system API to the evaluator.
- * Recycles of the same slot are serialized — a second caller waits rather than interleaving a
- * wipe with a provision.
- */
-export declare const createTrainingSlotSupervisor: (options: TrainingSlotSupervisorOptions) => {
-    /** Serialized: a recycle already in flight completes before the next one starts. */
-    recycle: (slot: number, nonce: string, peerUid: number) => Promise<TrainingRecycleResult>;
-};
-export type TrainingSlotSupervisor = ReturnType<typeof createTrainingSlotSupervisor>;
-/**
- * Re-establishes, and re-checks on every connection, the only uid gate this
- * socket has.
- *
- * The scope asked for `SO_PEERCRED`. Node exposes no ancillary-data or
- * peer-credential API on a unix socket and no native addon ships in this
- * image, so the gate is the socket node itself, which the kernel enforces on
- * `connect()` exactly as it does on `open()`: the node is
- * `root:<organization gid> 0660` inside a root-owned `0711` directory on
- * tmpfs, where modes *are* enforced. Only uid 2000 (and root) can connect;
- * uid 2200 gets `EACCES` before a byte is written. A `0600` root-owned socket
- * — the literal reading of the scope — would deny the one caller it exists
- * for, so this is the same restriction stated in the only mechanism available.
- * The directory holds no write permission for anyone but root, so the node
- * cannot be replaced by a laxer one.
- */
-export declare const assertTrainingSupervisorSocketIdentity: (socketPath: string, organizationGid: number) => void;
-/**
- * Line-delimited JSON over a unix socket. Every request is bounded,
- * single-line, and must name the protocol, the one verb and nothing else.
- */
-export declare const serveTrainingSlotSupervisor: (supervisor: TrainingSlotSupervisor, socketPath: string, log: (line: string) => void, organizationUid?: number) => import("net").Server;