spawnfile 0.1.33 → 0.1.35

package/dist/compiler/training/broker/supervisor.js

@@ -1,172 +0,0 @@
-import { chmodSync, chownSync, lstatSync, rmSync } from "node:fs";
-import { createServer } from "node:net";
-import path from "node:path";
-import { SpawnfileError } from "../../../shared/index.js";
-import { DAIMON_ORGANIZATION_UID } from "./paths.js";
-export const TRAINING_SUPERVISOR_PROTOCOL = "spawnfile.training-slot-supervisor.v2";
-export const TRAINING_SUPERVISOR_MAX_REQUEST_BYTES = 4_096;
-const NONCE = /^[a-f0-9]{64}$/u;
-/**
- * Bringing a slot up, receipt included — the only way this container starts one.
- *
- * `provision → start` alone was the whole start-up path, and `canaries` and
- * `publishReceipt` were reachable only from `recycle`. The first trial of every
- * run therefore executed with no worker-uid denial evidence at all, and a
- * refusal that should have cost nothing surfaced only after that trial's spend.
- * Trial 1 is exactly the trial whose sealed datasets have never been probed, so
- * it is the one that most needs the evidence.
- *
- * The receipt this publishes carries generation 1..N and a nonce of the
- * container's own, so an evaluator that reads `preflight.json` before its first
- * wake sees the same `noopolis.daimon.grok-slot-preflight.v2` shape a recycle
- * publishes, from the same canaries.
- */
-export const startTrainingSlot = async (runtime, nonce) => {
-    const canaries = await runtime.canaries();
-    const generation = await runtime.nextGeneration();
-    const receipt = await runtime.publishReceipt({ generation, nonce, canaries });
-    runtime.log(`slot start generation=${generation} canaries=${canaries.length} receipt=${receipt}`);
-    return { generation, receipt, canaries: canaries.length };
-};
-/**
- * The single-verb root slot supervisor.
- *
- * One verb, slot and nonce, no path or command ever supplied by the caller: the
- * whole point of D4 is that recycling replays the container's own audited
- * provisioning rather than exposing a root file-system API to the evaluator.
- * Recycles of the same slot are serialized — a second caller waits rather than interleaving a
- * wipe with a provision.
- */
-export const createTrainingSlotSupervisor = (options) => {
-    const organizationUid = options.organizationUid ?? DAIMON_ORGANIZATION_UID;
-    const drainTimeoutMs = options.drainTimeoutMs ?? 120_000;
-    const now = options.now ?? Date.now;
-    const queues = new Map();
-    const recycle = async (slot, nonce, peerUid) => {
-        if (peerUid !== organizationUid)
-            throw new SpawnfileError("validation_error", `Grok slot recycle refused for uid ${peerUid}`);
-        if (!NONCE.test(nonce))
-            throw new SpawnfileError("validation_error", "Grok slot recycle requires a 32-byte hex nonce");
-        if (!Number.isInteger(slot) || slot < 0 || slot >= options.runtimes.length)
-            throw new SpawnfileError("validation_error", "Grok slot recycle requires a declared slot index");
-        const runtime = options.runtimes[slot];
-        const started = now();
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), drainTimeoutMs);
-        try {
-            await runtime.reset(controller.signal);
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        await runtime.wipe();
-        await runtime.provision();
-        const canaries = await runtime.canaries();
-        const generation = await runtime.nextGeneration();
-        const receipt = await runtime.publishReceipt({ generation, nonce, canaries });
-        const durationMs = now() - started;
-        runtime.log(`recycle generation=${generation} canaries=${canaries.length} durationMs=${durationMs}`);
-        return { ok: true, verb: "recycle", slot, generation, nonce, receipt, durationMs };
-    };
-    return {
-        /** Serialized: a recycle already in flight completes before the next one starts. */
-        recycle: (slot, nonce, peerUid) => {
-            const next = (queues.get(slot) ?? Promise.resolve()).then(() => recycle(slot, nonce, peerUid));
-            queues.set(slot, next.catch(() => undefined));
-            return next;
-        }
-    };
-};
-const failure = (message) => `${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, ok: false, error: message })}\n`;
-/**
- * Re-establishes, and re-checks on every connection, the only uid gate this
- * socket has.
- *
- * The scope asked for `SO_PEERCRED`. Node exposes no ancillary-data or
- * peer-credential API on a unix socket and no native addon ships in this
- * image, so the gate is the socket node itself, which the kernel enforces on
- * `connect()` exactly as it does on `open()`: the node is
- * `root:<organization gid> 0660` inside a root-owned `0711` directory on
- * tmpfs, where modes *are* enforced. Only uid 2000 (and root) can connect;
- * uid 2200 gets `EACCES` before a byte is written. A `0600` root-owned socket
- * — the literal reading of the scope — would deny the one caller it exists
- * for, so this is the same restriction stated in the only mechanism available.
- * The directory holds no write permission for anyone but root, so the node
- * cannot be replaced by a laxer one.
- */
-export const assertTrainingSupervisorSocketIdentity = (socketPath, organizationGid) => {
-    const directory = lstatSync(path.posix.dirname(socketPath));
-    if (!directory.isDirectory() || directory.uid !== 0 || directory.gid !== 0 || (directory.mode & 0o777) !== 0o711) {
-        throw new SpawnfileError("runtime_error", "The slot supervisor socket directory must be root-owned 0711");
-    }
-    const node = lstatSync(socketPath);
-    if (!node.isSocket() || node.uid !== 0 || node.gid !== organizationGid || (node.mode & 0o777) !== 0o660) {
-        throw new SpawnfileError("runtime_error", "The slot supervisor socket must be root-owned, organization-group 0660");
-    }
-};
-/**
- * Line-delimited JSON over a unix socket. Every request is bounded,
- * single-line, and must name the protocol, the one verb and nothing else.
- */
-export const serveTrainingSlotSupervisor = (supervisor, socketPath, log, organizationUid = DAIMON_ORGANIZATION_UID) => {
-    const server = createServer((socket) => {
-        let peerUid;
-        try {
-            assertTrainingSupervisorSocketIdentity(socketPath, organizationUid);
-            peerUid = organizationUid;
-        }
-        catch (error) {
-            log(`refusing a connection on an unverified supervisor socket: ${error instanceof Error ? error.message : "unknown"}`);
-        }
-        let buffer = "", settled = false;
-        socket.setTimeout(600_000, () => socket.destroy());
-        const answer = (line) => { settled = true; socket.end(line); };
-        socket.on("data", (chunk) => {
-            if (settled)
-                return;
-            buffer += chunk.toString("utf8");
-            if (Buffer.byteLength(buffer) > TRAINING_SUPERVISOR_MAX_REQUEST_BYTES) {
-                answer(failure("request too large"));
-                return;
-            }
-            const newline = buffer.indexOf("\n");
-            if (newline < 0)
-                return;
-            const line = buffer.slice(0, newline);
-            let request;
-            try {
-                request = JSON.parse(line);
-            }
-            catch {
-                answer(failure("request is not JSON"));
-                return;
-            }
-            if (!request || typeof request !== "object" || Array.isArray(request) || request.v !== TRAINING_SUPERVISOR_PROTOCOL || request.verb !== "recycle" || typeof request.nonce !== "string"
-                || typeof request.slot !== "number" || Object.keys(request).length !== 4) {
-                answer(failure("unsupported request"));
-                return;
-            }
-            if (peerUid === undefined) {
-                answer(failure("peer identity is unavailable"));
-                return;
-            }
-            supervisor.recycle(request.slot, request.nonce, peerUid)
-                .then((result) => answer(`${JSON.stringify({ v: TRAINING_SUPERVISOR_PROTOCOL, ...result })}\n`))
-                .catch((error) => {
-                const message = error instanceof Error ? error.message : "recycle failed";
-                log(`recycle failed: ${message}`);
-                answer(failure(message));
-            });
-        });
-        socket.on("error", () => socket.destroy());
-    });
-    rmSync(socketPath, { force: true });
-    server.listen(socketPath, () => {
-        chownSync(socketPath, 0, 0);
-        chmodSync(socketPath, 0o660);
-        chownSync(socketPath, 0, organizationUid);
-        assertTrainingSupervisorSocketIdentity(socketPath, organizationUid);
-        log(`slot supervisor listening on ${socketPath}`);
-    });
-    return server;
-};

package/dist/compiler/training/broker/taskClock.d.ts

@@ -1,5 +0,0 @@
-import type { DaimonGrokRegistration } from "../../containerDaimonGrokWorkerRender.js";
-/** Reclaim only the clock subtree before the shared program clears the control root at startup. */
-export declare const renderTrainingTaskClockReset: () => string[];
-/** Before a receipt, bind the actual installed bytes and worker access to the clocked projection. */
-export declare const renderTrainingTaskClockAssertions: (registration: DaimonGrokRegistration) => string[];

package/dist/compiler/training/broker/taskClock.js

@@ -1,41 +0,0 @@
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-import { SpawnfileError } from "../../../shared/index.js";
-import { resolveDaimonGrokClockedWorkerConfig } from "../../../runtime/daimon/grokWorkerContract.js";
-const clock = DAIMON_GROK_ENGINE_BROKER.worker.taskClock;
-const quote = (value) => `'${value.replace(/'/gu, `'"'"'`)}'`;
-/** Reclaim only the clock subtree before the shared program clears the control root at startup. */
-export const renderTrainingTaskClockReset = () => [
-    `test ! -L ${quote(clock.rootDirectoryPath)}`,
-    `if [ -d ${quote(clock.rootDirectoryPath)} ]; then chown -R 0:0 ${quote(clock.rootDirectoryPath)}; chmod -R u+rwX ${quote(clock.rootDirectoryPath)}; fi`
-];
-/** Before a receipt, bind the actual installed bytes and worker access to the clocked projection. */
-export const renderTrainingTaskClockAssertions = (registration) => {
-    const pin = resolveDaimonGrokClockedWorkerConfig(registration.model, registration.reasoningEffort, registration.slot).sha256;
-    const directoryPath = clock.slotDirectoryPattern.replace("{slot}", String(registration.slot));
-    const timestampFilePath = clock.slotFilePattern.replace("{slot}", String(registration.slot));
-    if (registration.configVariant !== "clocked" || registration.configSha256 !== pin) {
-        throw new SpawnfileError("runtime_error", "Training slot requires the pinned clocked worker config");
-    }
-    const worker = [
-        `test -r ${quote(timestampFilePath)}`, `test ! -w ${quote(timestampFilePath)}`,
-        `test -x ${quote(directoryPath)}`, `test ! -w ${quote(directoryPath)}`,
-        `test -r ${quote(clock.preloadPath)}`
-    ].join(" && ");
-    return [
-        `test ! -L ${quote(directoryPath)} && test -d ${quote(directoryPath)}`,
-        `test ! -L ${quote(timestampFilePath)} && test -f ${quote(timestampFilePath)}`,
-        `test "$(stat -c '%u:%g %a' ${quote(directoryPath)})" = "${clock.ownerUid}:${clock.ownerUid} ${clock.directoryMode.toString(8)}"`,
-        `test "$(stat -c '%u:%g %a %h' ${quote(timestampFilePath)})" = "${clock.ownerUid}:${clock.ownerUid} ${clock.fileMode.toString(8)} 1"`,
-        `test "$(sha256sum ${quote(`${registration.grokHome}/config.toml`)} | cut -d ' ' -f1)" = ${quote(pin)}`,
-        // The read-only image bakes both the fixed symlink and the distro target. Refuse writable or
-        // non-root-owned ancestors/targets; a missing library must never masquerade as a working clock.
-        "node <<'SPAWNFILE_TASK_CLOCK_LIBRARY'",
-        "const fs = require('node:fs'), path = require('node:path');",
-        `const preload = ${JSON.stringify(clock.preloadPath)};`,
-        "const link = fs.lstatSync(preload); if (!link.isSymbolicLink() || link.uid !== 0 || link.gid !== 0) throw new Error('unsafe task clock preload link');",
-        "const library = fs.realpathSync(preload); if (!/^\\/usr\\/lib\\/(x86_64|aarch64)-linux-gnu\\/faketime\\/libfaketime\\.so\\.1$/.test(library) || !fs.statSync(library).isFile()) throw new Error('unexpected task clock library');",
-        "for (const root of [path.dirname(preload), library]) { for (let at = root;; at = path.dirname(at)) { const info = fs.lstatSync(at); if (info.isSymbolicLink() || info.uid !== 0 || info.gid !== 0 || (info.mode & 0o022)) throw new Error(`unsafe task clock library path: ${at}`); if (at === '/') break; } }",
-        "SPAWNFILE_TASK_CLOCK_LIBRARY",
-        `setpriv --clear-groups --reuid ${registration.uid} --regid ${registration.uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- /bin/sh -ceu ${quote(worker)}`
-    ];
-};

package/dist/compiler/training/container/contract.d.ts

@@ -1,54 +0,0 @@
-import { z } from "zod";
-/** Fixed libfaketime symlink installed and mode-verified by the training image. */
-export declare const TRAINING_FAKETIME_LIBRARY_PATH: "/usr/local/lib/daimon/libfaketime.so.1";
-export declare const trainingImageSchema: z.ZodString;
-export declare const trainingContainerConfigSchema: z.ZodObject<{
-    version: z.ZodEnum<{
-        "spawnfile.training-container.v1": "spawnfile.training-container.v1";
-        "spawnfile.training-container.v3": "spawnfile.training-container.v3";
-        "spawnfile.training-container.v4": "spawnfile.training-container.v4";
-    }>;
-    slots: z.ZodDefault<z.ZodNumber>;
-    dockerContext: z.ZodString;
-    inputs: z.ZodArray<z.ZodObject<{
-        source: z.ZodString;
-        destination: z.ZodString;
-    }, z.core.$strict>>;
-    output: z.ZodObject<{
-        source: z.ZodString;
-        destination: z.ZodLiteral<"/run/training/output">;
-    }, z.core.$strict>;
-    auth: z.ZodArray<z.ZodObject<{
-        source: z.ZodString;
-        provider: z.ZodEnum<{
-            codex: "codex";
-            claude: "claude";
-        }>;
-    }, z.core.$strict>>;
-    evaluatorRoutes: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        purpose: z.ZodEnum<{
-            decisions: "decisions";
-            extraction: "extraction";
-            proposals: "proposals";
-        }>;
-        provider: z.ZodEnum<{
-            "codex-subscription": "codex-subscription";
-            typesafe: "typesafe";
-        }>;
-        model: z.ZodString;
-        maxRequests: z.ZodNumber;
-        maxSpendUsd: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strict>>>;
-    evaluatorSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        provider: z.ZodLiteral<"typesafe">;
-        source: z.ZodString;
-    }, z.core.$strict>>>;
-    subjectIsolation: z.ZodOptional<z.ZodLiteral<"codex-native-sandbox">>;
-    broker: z.ZodOptional<z.ZodObject<{
-        engine: z.ZodLiteral<"grok">;
-        realmVolume: z.ZodString;
-        bootstrap: z.ZodString;
-        declaration: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-export type TrainingContainerConfig = z.infer<typeof trainingContainerConfigSchema>;

package/dist/compiler/training/container/contract.js

@@ -1,52 +0,0 @@
-import { DAIMON_BROKER_ENGINE_ID } from "../../../runtime/daimon/index.js";
-import path from "node:path";
-import { z } from "zod";
-import { trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema } from "./evaluators.js";
-/** Fixed libfaketime symlink installed and mode-verified by the training image. */
-export const TRAINING_FAKETIME_LIBRARY_PATH = "/usr/local/lib/daimon/libfaketime.so.1";
-const hostPath = z.string().min(1).refine((value) => path.isAbsolute(value) && !/[,\r\n\0]/u.test(value), "Expected an absolute bind path");
-const inputPath = z.string().regex(/^\/run\/training\/inputs\/[A-Za-z0-9._/-]+$/u).refine((value) => path.posix.normalize(value) === value && !value.endsWith("/"));
-export const trainingImageSchema = z.string().regex(/^(?:sha256:[a-f0-9]{64}|[A-Za-z0-9][A-Za-z0-9._:/-]*@sha256:[a-f0-9]{64})$/u);
-const brokerLaunchSchema = z.object({
-    engine: z.literal(DAIMON_BROKER_ENGINE_ID),
-    /** The named Docker volume holding the training Grok realm: `auth.json` and the broker credential journal, nothing else. */
-    realmVolume: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
-    /** Host leaf of the dedicated training Grok login. Never the desktop `~/.grok/auth.json`. */
-    bootstrap: hostPath,
-    /** `spawnfile.training-broker.v2`, written beside the launch config and bound read-only into the container. */
-    declaration: hostPath
-}).strict();
-export const trainingContainerConfigSchema = z.object({
-    version: z.enum(["spawnfile.training-container.v1", "spawnfile.training-container.v3", "spawnfile.training-container.v4"]),
-    slots: z.number().int().min(1).max(8).default(4),
-    dockerContext: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/u),
-    inputs: z.array(z.object({ source: hostPath, destination: inputPath }).strict()).min(1).max(64),
-    output: z.object({ source: hostPath, destination: z.literal("/run/training/output") }).strict(),
-    auth: z.array(z.object({ source: hostPath, provider: z.enum(["codex", "claude"]) }).strict()).max(2),
-    evaluatorRoutes: trainingEvaluatorRoutesSchema.optional(),
-    evaluatorSecrets: trainingEvaluatorSecretsSchema(hostPath).optional(),
-    subjectIsolation: z.literal("codex-native-sandbox").optional(),
-    /** Present only on `spawnfile.training-container.v4`: the brokered Grok slot this container runs as root. */
-    broker: brokerLaunchSchema.optional()
-}).strict().superRefine((value, context) => {
-    if (value.evaluatorSecrets && !value.broker && !value.subjectIsolation)
-        context.addIssue({ code: "custom", message: "Evaluator secrets require brokered v4 isolation or explicit codex-native-sandbox subject isolation" });
-    if (value.subjectIsolation && value.version !== "spawnfile.training-container.v1")
-        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a non-brokered v1 launch" });
-    if (value.subjectIsolation && !value.evaluatorRoutes?.some(route => route.provider === "typesafe"))
-        context.addIssue({ code: "custom", message: "Codex native subject isolation requires a TypeSafe evaluator route" });
-    if (value.evaluatorSecrets && !value.evaluatorRoutes?.some(route => route.provider === "typesafe")) {
-        context.addIssue({ code: "custom", message: "TypeSafe secret requires a declared evaluator route" });
-    }
-    if (value.version === "spawnfile.training-container.v3")
-        context.addIssue({ code: "custom", message: "Training-container v3 is unsupported; migrate to v4 with slots: 1" });
-    const destinations = value.inputs.map((entry) => entry.destination);
-    if (destinations.some((entry, index) => destinations.some((other, otherIndex) => otherIndex !== index && (entry === other || entry.startsWith(`${other}/`))))) {
-        context.addIssue({ code: "custom", message: "Input destinations must not overlap" });
-    }
-    if (new Set(value.auth.map((entry) => entry.provider)).size !== value.auth.length)
-        context.addIssue({ code: "custom", message: "Duplicate auth provider" });
-    if ((value.version === "spawnfile.training-container.v4") !== (value.broker !== undefined)) {
-        context.addIssue({ code: "custom", message: "Only spawnfile.training-container.v4 declares broker slots; migrate v3 by setting version to v4 and slots to 1" });
-    }
-});

package/dist/compiler/training/container/evaluators.d.ts

@@ -1,48 +0,0 @@
-import { z } from "zod";
-export declare const TRAINING_EVALUATOR_ROUTES_FILE = "/run/spawnfile-training/evaluator-routes.json";
-export declare const TRAINING_TYPESAFE_SECRET_FILE = "/run/spawnfile-training/secrets/typesafe";
-export declare const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/spawnfile-training/secret-ingress/typesafe";
-export declare const trainingEvaluatorRouteSchema: z.ZodObject<{
-    purpose: z.ZodEnum<{
-        decisions: "decisions";
-        extraction: "extraction";
-        proposals: "proposals";
-    }>;
-    provider: z.ZodEnum<{
-        "codex-subscription": "codex-subscription";
-        typesafe: "typesafe";
-    }>;
-    model: z.ZodString;
-    maxRequests: z.ZodNumber;
-    maxSpendUsd: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>;
-export declare const trainingEvaluatorRoutesSchema: z.ZodArray<z.ZodObject<{
-    purpose: z.ZodEnum<{
-        decisions: "decisions";
-        extraction: "extraction";
-        proposals: "proposals";
-    }>;
-    provider: z.ZodEnum<{
-        "codex-subscription": "codex-subscription";
-        typesafe: "typesafe";
-    }>;
-    model: z.ZodString;
-    maxRequests: z.ZodNumber;
-    maxSpendUsd: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>>;
-/** Only a reference is declared. Secret bytes are never read by the compiler or launcher. */
-export declare const trainingEvaluatorSecretsSchema: (source: z.ZodString) => z.ZodArray<z.ZodObject<{
-    provider: z.ZodLiteral<"typesafe">;
-    source: z.ZodString;
-}, z.core.$strict>>;
-export declare const prepareTrainingEvaluators: (root: string, config: {
-    evaluatorRoutes?: z.infer<typeof trainingEvaluatorRoutesSchema>;
-    evaluatorSecrets?: {
-        provider: "typesafe";
-        source: string;
-    }[];
-    subjectIsolation?: "codex-native-sandbox";
-}, mappedArgs: readonly string[]) => Promise<{
-    mounts: string[];
-    env: string[];
-}>;

package/dist/compiler/training/container/evaluators.js

@@ -1,50 +0,0 @@
-import { writeFile } from "node:fs/promises";
-import path from "node:path";
-import { z } from "zod";
-export const TRAINING_EVALUATOR_ROUTES_FILE = "/run/spawnfile-training/evaluator-routes.json";
-export const TRAINING_TYPESAFE_SECRET_FILE = "/run/spawnfile-training/secrets/typesafe";
-export const TRAINING_TYPESAFE_SECRET_INGRESS = "/run/spawnfile-training/secret-ingress/typesafe";
-export const trainingEvaluatorRouteSchema = z.object({
-    purpose: z.enum(["extraction", "proposals", "decisions"]),
-    provider: z.enum(["codex-subscription", "typesafe"]),
-    model: z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/u),
-    maxRequests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-    maxSpendUsd: z.number().finite().nonnegative().optional()
-}).strict().superRefine((route, context) => {
-    if (route.provider === "codex-subscription" ? route.purpose === "decisions" || route.maxSpendUsd !== undefined
-        : route.purpose !== "decisions" || route.maxSpendUsd === undefined) {
-        context.addIssue({ code: "custom", message: "Evaluator provider/purpose mismatch or missing TypeSafe spend budget" });
-    }
-});
-export const trainingEvaluatorRoutesSchema = z.array(trainingEvaluatorRouteSchema).min(1).max(64)
-    .refine(routes => new Set(routes.map(route => JSON.stringify([route.purpose, route.provider, route.model]))).size === routes.length, "Duplicate evaluator route");
-/** Only a reference is declared. Secret bytes are never read by the compiler or launcher. */
-export const trainingEvaluatorSecretsSchema = (source) => z.array(z.object({
-    provider: z.literal("typesafe"), source
-}).strict()).min(1).max(1);
-export const prepareTrainingEvaluators = async (root, config, mappedArgs) => {
-    const mounts = [], env = [];
-    if (config.evaluatorRoutes) {
-        const outputs = mappedArgs.flatMap((arg, index) => arg === "--out" ? [mappedArgs[index + 1]] : []);
-        const output = outputs[0];
-        if (outputs.length !== 1 || !output || path.posix.normalize(output) !== output ||
-            !(output === "/run/training/output" || output.startsWith("/run/training/output/"))) {
-            throw Error("Evaluator receipts require one mapped training --out directory");
-        }
-        const source = path.join(root, "evaluator-routes.json");
-        await writeFile(source, JSON.stringify({ version: "spawnfile.training.evaluator-routes.v1", routes: config.evaluatorRoutes,
-            receiptPath: path.posix.join(output, "evaluator-requests.jsonl") }), { mode: 0o444, flag: "wx" });
-        mounts.push(`type=bind,src=${source},dst=${TRAINING_EVALUATOR_ROUTES_FILE},readonly`);
-        env.push(`SPAWNFILE_TRAINING_EVALUATOR_ROUTES_FILE=${TRAINING_EVALUATOR_ROUTES_FILE}`);
-    }
-    for (const secret of config.evaluatorSecrets ?? []) {
-        // The host-uid v1 launcher cannot stage a root-owned copy; bind the canonical leaf at the consumer path.
-        if (config.subjectIsolation === "codex-native-sandbox") {
-            mounts.push(`type=bind,src=${secret.source},dst=${TRAINING_TYPESAFE_SECRET_FILE},readonly`);
-        }
-        else
-            mounts.push(`type=bind,src=${secret.source},dst=${TRAINING_TYPESAFE_SECRET_INGRESS},readonly`);
-        env.push(`SPAWNFILE_TRAINING_TYPESAFE_SECRET_FILE=${TRAINING_TYPESAFE_SECRET_FILE}`);
-    }
-    return { mounts, env };
-};

package/dist/compiler/training/container/grokWriteback.d.ts

@@ -1,8 +0,0 @@
-type DockerCall = (args: string[], cleanup: boolean) => Promise<{
-    code: number;
-    stdout: string;
-    stderr: string;
-}>;
-/** Called only for an ownership-verified container, before removal, including failure/cancellation. */
-export declare const persistTrainingGrokCredential: (id: string, profile: string, scratch: string, call: DockerCall) => Promise<void>;
-export {};

package/dist/compiler/training/container/grokWriteback.js

@@ -1,26 +0,0 @@
-import path from "node:path";
-import { writeBackTrainingGrokCredential } from "../../../auth/index.js";
-import { DAIMON_GROK_ENGINE_BROKER } from "../../../runtime/daimon/contractManifest.js";
-/** Called only for an ownership-verified container, before removal, including failure/cancellation. */
-export const persistTrainingGrokCredential = async (id, profile, scratch, call) => {
-    const state = await call(["inspect", "--format", "{{json .State}}", id], true);
-    if (state.code !== 0)
-        throw Error("Cannot verify training credential writer state");
-    if (JSON.parse(state.stdout).Running === true) {
-        const stopped = await call(["stop", "--time", "5", id], true);
-        if (stopped.code !== 0)
-            throw Error("Cannot stop training credential writer");
-    }
-    const terminal = await call(["inspect", "--format", "{{json .State}}", id], true);
-    if (terminal.code !== 0 || JSON.parse(terminal.stdout).Running !== false)
-        throw Error("Training credential writer is still active");
-    const realm = DAIMON_GROK_ENGINE_BROKER.credentialHomePath;
-    const candidate = path.join(scratch, "grok-auth.json"), journal = path.join(scratch, "grok-journal.json");
-    // Docker writes directly into a host-private directory: no credential bytes in stdout, logs or arguments.
-    const copied = await call(["cp", `${id}:${realm}/auth.json`, candidate], true);
-    if (copied.code !== 0)
-        throw Error("Cannot export training Grok credential");
-    const journalCopy = await call(["cp", `${id}:${realm}/.daimon-broker/credential-journal.json`, journal], true);
-    // A realm that never rotated has no journal. The auth owner accepts only unchanged bytes in that case.
-    await writeBackTrainingGrokCredential(profile, candidate, journalCopy.code === 0 ? journal : `${journal}.absent`);
-};

package/dist/compiler/training/container/index.d.ts

@@ -1,5 +0,0 @@
-export { TRAINING_FAKETIME_LIBRARY_PATH, trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
-export type { TrainingContainerConfig } from "./contract.js";
-export { launchTrainingContainer } from "./launch.js";
-export type { LaunchTrainingContainerOptions } from "./launch.js";
-export { trainingEvaluatorRouteSchema, trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema, TRAINING_EVALUATOR_ROUTES_FILE, TRAINING_TYPESAFE_SECRET_FILE } from "./evaluators.js";

package/dist/compiler/training/container/index.js

@@ -1,3 +0,0 @@
-export { TRAINING_FAKETIME_LIBRARY_PATH, trainingContainerConfigSchema, trainingImageSchema } from "./contract.js";
-export { launchTrainingContainer } from "./launch.js";
-export { trainingEvaluatorRouteSchema, trainingEvaluatorRoutesSchema, trainingEvaluatorSecretsSchema, TRAINING_EVALUATOR_ROUTES_FILE, TRAINING_TYPESAFE_SECRET_FILE } from "./evaluators.js";

package/dist/compiler/training/container/launch.d.ts

@@ -1,21 +0,0 @@
-import { type TrainingExecution } from "../execution.js";
-import type { TrainingContext } from "../contract.js";
-import { type TrainingDockerProcess } from "./process.js";
-export declare const TRAINING_INPUTS_GID = 2000;
-export interface LaunchTrainingContainerOptions {
-    image: string;
-    configPath: string;
-    context: TrainingContext;
-    args: readonly string[];
-    timeoutMs: number;
-    signal?: AbortSignal;
-    streams: {
-        stdout(line: string): void;
-        stderr(line: string): void;
-    };
-    process?: TrainingDockerProcess;
-    execution?: TrainingExecution;
-    preparationPath?: string;
-    repairPath?: string;
-}
-export declare const launchTrainingContainer: (options: LaunchTrainingContainerOptions) => Promise<number>;