spawnfile 0.1.33 → 0.1.35

package/dist/compiler/containerDaimonBrokerRender.d.ts

@@ -1,5 +1,5 @@
 import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
-import { type DaimonGrokRegistration, type DaimonGrokServiceConfigOptions } from "./containerDaimonGrokWorkerRender.js";
+import { type DaimonGrokRegistration } from "./containerDaimonGrokWorkerRender.js";
 import { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
 export { DAIMON_BROKER_UID, DAIMON_FIRST_WORKER_UID, DAIMON_ORGANIZATION_UID };
 export declare const DAIMON_BROKER_EXECUTABLE = "/opt/daimon/bin/daimon-engine-broker";
@@ -59,56 +59,11 @@ export declare const renderDaimonWorkspaceResourceSecurity: (resources: Workspac
  * `EPERM` the moment root no longer owns the path.
  */
 export declare const renderDaimonUsageLedgerProvisioning: () => string[];
-/**
- * Empties a directory without touching a mount point inside it.
- *
- * `rm -rf` and `find -delete` both fail `EBUSY` on a mount point — it is
- * another filesystem's root, and its entry cannot be unlinked while it is
- * mounted. A deployment that mounts a tmpfs below a directory it later clears
- * would otherwise abort provisioning on a bare `find` failure, which is exactly
- * how a live training launch died. Mount points are left in place and descended
- * into; anything else that cannot be removed is reported by name.
- *
- * Mount points come from `/proc/self/mountinfo` field 5. The kernel
- * octal-escapes space, tab, newline and backslash there; every path this
- * compiler provisions is free of all four, and a path that is not would simply
- * fail to match and be treated as an ordinary directory.
- */
-export declare const MOUNT_AWARE_CLEAR_HELPER: string[];
 export declare const renderDaimonBrokerProvisioning: (plans: RuntimeTargetPlan[]) => string[];
 /**
  * The root broker provisioning program itself, over already-resolved
- * registrations and workspace resources.
- *
- * Production reaches it through {@link renderDaimonBrokerProvisioning}; the
- * broker-capable training container reaches it directly for its single fixed
- * slot, with `serviceOptions` pointing the turn store at per-slot tmpfs and
- * declaring the evaluator inference ledger. Both callers get byte-identical
- * credential, registration, worker-home, temp and spill provisioning — the
- * whole point of sharing it rather than writing a second root program.
- *
- * It is re-runnable: the shell wrapper removes `/etc/daimon-engine-broker` and
- * `/run/daimon-engine-broker` first, so a slot recycle replays exactly the
- * audited start-up path, credential-journal recovery included.
- */
-export declare const renderDaimonBrokerProvisioningProgram: (registrations: readonly DaimonGrokRegistration[], workspaceResources: WorkspaceSecurityResource[], serviceOptions?: DaimonGrokServiceConfigOptions, 
-/**
- * How the broker's `/etc` and `/run` roots are reset before provisioning.
- * A production organization owns both as ordinary image directories and
- * removes them outright. The training container mounts each as its own
- * tmpfs, which cannot be unlinked, so it empties them instead — the same
- * end state, reached the only way a mount point allows.
- */
-rootReset?: "remove" | "clear", 
-/** Deny targets the worker provisioning creates when absent; see `renderDaimonGrokWorkerProvisioning`. */
-optionalDenyPaths?: readonly string[], 
-/**
- * Where the broker and relay get their private `TMPDIR`. Production keeps it
- * inside the control root, which it removes and recreates exactly once. A
- * deployment that re-provisions that root — the training slot recycle — must
- * pass a path outside it: a `tmp/` inside a cleared root is a mount point in
- * the training launch, and clearing a mount point fails `EBUSY`.
+ * registrations and workspace resources. The auth gateway owns the Grok login,
+ * so the broker home is a plain turn-state folder and no bootstrap, authority or
+ * journal is staged here.
  */
-brokerTmpdir?: string, 
-/** Root-owned training deny targets, created after root reset and before worker attestation. */
-beforeWorkerProvisioning?: readonly string[]) => string[];
+export declare const renderDaimonBrokerProvisioningProgram: (registrations: readonly DaimonGrokRegistration[], workspaceResources: WorkspaceSecurityResource[]) => string[];

package/dist/compiler/containerDaimonBrokerRender.js

@@ -51,49 +51,22 @@ export const renderDaimonWorkspaceResourceSecurity = (resources, owners = { link
  * `EPERM` the moment root no longer owns the path.
  */
 export const renderDaimonUsageLedgerProvisioning = () => {
-    const { directoryPath } = DAIMON_GROK_TURN_USAGE_LEDGER;
+    const { directoryPath, filePath } = DAIMON_GROK_TURN_USAGE_LEDGER;
+    // The ledger file itself is shared too: the broker uid appends Grok rows and
+    // the organization uid appends Codex/AGY rows, and Daimon's wake fuse creates
+    // it empty as the organization uid at 0640 when absent, which leaves the
+    // broker unable to append and every Grok usage row silently lost. Root owns
+    // it first (it holds no CAP_DAC_OVERRIDE or CAP_FOWNER), then hands it to
+    // broker:organization at 0660, on every start so a reattached volume heals.
+    const owner = `${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID}`;
     return [
-        `chown 0:0 ${directoryPath} && chmod 0770 ${directoryPath} && chown ${DAIMON_BROKER_UID}:${DAIMON_ORGANIZATION_UID} ${directoryPath}`,
+        `chown 0:0 ${directoryPath} && chmod 0770 ${directoryPath}`,
+        `if [ -L ${filePath} ] || { [ -e ${filePath} ] && [ ! -f ${filePath} ]; }; then echo "usage ledger ${filePath} is not a regular file" >&2; exit 1; fi`,
+        `if [ -e ${filePath} ]; then chown 0:0 ${filePath}; else (umask 077 && : > ${filePath}); fi && chmod 0660 ${filePath} && chown ${owner} ${filePath}`,
+        `chown ${owner} ${directoryPath}`,
         `setpriv --clear-groups --reuid ${DAIMON_ORGANIZATION_UID} --regid ${DAIMON_ORGANIZATION_UID} --inh-caps=-all --ambient-caps=-all --bounding-set=-all -- bash -ceu 'probe=${directoryPath}/.daimon-usage-probe; umask 007; : > "$probe"; rm "$probe"'`
     ];
 };
-/**
- * Empties a directory without touching a mount point inside it.
- *
- * `rm -rf` and `find -delete` both fail `EBUSY` on a mount point — it is
- * another filesystem's root, and its entry cannot be unlinked while it is
- * mounted. A deployment that mounts a tmpfs below a directory it later clears
- * would otherwise abort provisioning on a bare `find` failure, which is exactly
- * how a live training launch died. Mount points are left in place and descended
- * into; anything else that cannot be removed is reported by name.
- *
- * Mount points come from `/proc/self/mountinfo` field 5. The kernel
- * octal-escapes space, tab, newline and backslash there; every path this
- * compiler provisions is free of all four, and a path that is not would simply
- * fail to match and be treated as an ordinary directory.
- */
-export const MOUNT_AWARE_CLEAR_HELPER = [
-    "spawnfile_mount_points=$(awk '{print $5}' /proc/self/mountinfo)",
-    "spawnfile_is_mount() { printf '%s\\n' \"$spawnfile_mount_points\" | grep -qxF \"$1\"; }",
-    "spawnfile_holds_mount() { printf '%s\\n' \"$spawnfile_mount_points\" | grep -qE \"^$(printf '%s' \"$1\" | sed 's/[][\\.*^$/]/\\\\&/g')(/|$)\"; }",
-    "spawnfile_clear_tree() {",
-    "  spawnfile_root=$1",
-    "  [ -d \"$spawnfile_root\" ] || return 0",
-    "  for spawnfile_entry in \"$spawnfile_root\"/* \"$spawnfile_root\"/.[!.]* \"$spawnfile_root\"/..?*; do",
-    "    if [ ! -e \"$spawnfile_entry\" ] && [ ! -L \"$spawnfile_entry\" ]; then continue; fi",
-    "    if spawnfile_is_mount \"$spawnfile_entry\"; then continue; fi",
-    "    if spawnfile_holds_mount \"$spawnfile_entry\"; then spawnfile_clear_tree \"$spawnfile_entry\"; continue; fi",
-    "    rm -rf \"$spawnfile_entry\" || { echo \"cannot clear $spawnfile_entry: it is in use; a mount below a provisioned root must be declared outside it\" >&2; return 1; }",
-    "  done",
-    "}",
-    // Removes the target outright, unless it is or contains a mount point: then its contents go and the
-    // mount points and the directories holding them stay, because neither can be unlinked while mounted.
-    "spawnfile_remove_tree() {",
-    "  if [ ! -e \"$1\" ] && [ ! -L \"$1\" ]; then return 0; fi",
-    "  if spawnfile_holds_mount \"$1\"; then spawnfile_clear_tree \"$1\"; return $?; fi",
-    "  rm -rf \"$1\" || { echo \"cannot remove $1: it is in use\" >&2; return 1; }",
-    "}"
-];
 export const renderDaimonBrokerProvisioning = (plans) => {
     const registrations = resolveDaimonGrokRegistrations(plans);
     if (registrations.length === 0)
@@ -115,40 +88,11 @@ export const renderDaimonBrokerProvisioning = (plans) => {
 };
 /**
  * The root broker provisioning program itself, over already-resolved
- * registrations and workspace resources.
- *
- * Production reaches it through {@link renderDaimonBrokerProvisioning}; the
- * broker-capable training container reaches it directly for its single fixed
- * slot, with `serviceOptions` pointing the turn store at per-slot tmpfs and
- * declaring the evaluator inference ledger. Both callers get byte-identical
- * credential, registration, worker-home, temp and spill provisioning — the
- * whole point of sharing it rather than writing a second root program.
- *
- * It is re-runnable: the shell wrapper removes `/etc/daimon-engine-broker` and
- * `/run/daimon-engine-broker` first, so a slot recycle replays exactly the
- * audited start-up path, credential-journal recovery included.
- */
-export const renderDaimonBrokerProvisioningProgram = (registrations, workspaceResources, serviceOptions = {}, 
-/**
- * How the broker's `/etc` and `/run` roots are reset before provisioning.
- * A production organization owns both as ordinary image directories and
- * removes them outright. The training container mounts each as its own
- * tmpfs, which cannot be unlinked, so it empties them instead — the same
- * end state, reached the only way a mount point allows.
- */
-rootReset = "remove", 
-/** Deny targets the worker provisioning creates when absent; see `renderDaimonGrokWorkerProvisioning`. */
-optionalDenyPaths, 
-/**
- * Where the broker and relay get their private `TMPDIR`. Production keeps it
- * inside the control root, which it removes and recreates exactly once. A
- * deployment that re-provisions that root — the training slot recycle — must
- * pass a path outside it: a `tmp/` inside a cleared root is a mount point in
- * the training launch, and clearing a mount point fails `EBUSY`.
+ * registrations and workspace resources. The auth gateway owns the Grok login,
+ * so the broker home is a plain turn-state folder and no bootstrap, authority or
+ * journal is staged here.
  */
-brokerTmpdir = DAIMON_BROKER_TMPDIR, 
-/** Root-owned training deny targets, created after root reset and before worker attestation. */
-beforeWorkerProvisioning = []) => {
+export const renderDaimonBrokerProvisioningProgram = (registrations, workspaceResources) => {
     const program = [
         "const crypto = require('node:crypto'); const fs = require('node:fs');",
         `const registrations = ${JSON.stringify(registrations.map(({ agentId, home, slot, uid, workspace }) => ({ agentId, home, slot, uid, workspace })))};`,
@@ -161,32 +105,17 @@ beforeWorkerProvisioning = []) => {
         "fs.writeFileSync('/etc/daimon-engine-broker/registrations.bin', Buffer.concat(records), { mode: 0o400, flag: 'wx' });",
         "fs.chownSync('/etc/daimon-engine-broker/registrations.bin', 0, 0); fs.chmodSync('/etc/daimon-engine-broker/registrations.bin', 0o400);",
         `fs.mkdirSync('${DAIMON_BROKER_REALM}', { recursive: true, mode: 0o700 }); fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700);`,
-        // The usage ledger directory itself is provisioned unconditionally by
-        // `renderDaimonUsageLedgerProvisioning` (every Daimon organization writes
-        // here, not just Grok ones) before this script's caller reaches the
-        // broker startup this function guards; this script only ever reads the
-        // path below, for the sandbox denylist.
-        `const bootstrap = '/var/lib/spawnfile/daimon/grok-bootstrap-auth', authority = '${DAIMON_BROKER_REALM}/auth.json';`,
-        "const readSecure = (file, owner, label) => { const before = fs.lstatSync(file); if (!before.isFile() || before.isSymbolicLink() || (owner !== undefined && (before.uid !== owner || before.gid !== owner)) || (before.mode & 0o777) !== 0o600 || before.nlink !== 1 || before.size < 2 || before.size > 65536) throw new Error(`unsafe broker credential ${label}`); const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK); try { const opened = fs.fstatSync(fd); if (opened.dev !== before.dev || opened.ino !== before.ino) throw new Error(`unsafe broker credential ${label}`); const bytes = Buffer.alloc(opened.size); let offset = 0; while (offset < bytes.length) { const count = fs.readSync(fd, bytes, offset, bytes.length - offset, offset); if (count < 1) throw new Error(`unsafe broker credential ${label}`); offset += count; } return bytes; } finally { fs.closeSync(fd); } };",
-        `const atomicOwned = (target, bytes) => { const temporary = \`${"${target}"}.\${process.pid}.\${crypto.randomUUID()}.tmp\`; try { const output = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600); try { let written = 0; while (written < bytes.length) written += fs.writeSync(output, bytes, written, bytes.length - written, written); fs.fchmodSync(output, 0o600); fs.fchownSync(output, 2100, 2100); fs.fsyncSync(output); } finally { fs.closeSync(output); } fs.renameSync(temporary, target); const directory = fs.openSync(require('node:path').dirname(target), fs.constants.O_RDONLY | fs.constants.O_DIRECTORY); try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); } } catch (error) { try { fs.unlinkSync(temporary); } catch {} throw error; } };`,
-        "let existing; try { existing = fs.lstatSync(authority); } catch (error) { if (error.code !== 'ENOENT') throw error; } const bootstrapBytes = readSecure(bootstrap, undefined, 'bootstrap'); let bootstrapRecord; try { const root = JSON.parse(bootstrapBytes.toString('utf8')), rows = root && typeof root === 'object' && !Array.isArray(root) ? Object.entries(root).filter(([key, value]) => /^https:\\/\\/auth\\.x\\.ai::/.test(key) && value && typeof value === 'object' && !Array.isArray(value)).map(([, value]) => value) : []; if (rows.length !== 1 || typeof rows[0].key !== 'string' || !rows[0].key.trim() || typeof rows[0].refresh_token !== 'string' || !rows[0].refresh_token.trim() || typeof rows[0].expires_at !== 'string' || !Number.isFinite(Date.parse(rows[0].expires_at))) throw new Error(); bootstrapRecord = true; } catch { bootstrapBytes.fill(0); throw new Error('invalid broker credential bootstrap'); } if (!bootstrapRecord) throw new Error('invalid broker credential bootstrap'); const bootstrapDigest = crypto.createHash('sha256').update(bootstrapBytes).digest('hex');",
-        `const journalRoot = '${DAIMON_BROKER_REALM}/.daimon-broker'; let journalRootExists = false; try { const info = fs.lstatSync(journalRoot); if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== 2100 || info.gid !== 2100 || (info.mode & 0o777) !== 0o700) throw new Error('unsafe broker credential journal directory'); fs.chownSync(journalRoot, 0, 0); fs.chmodSync(journalRoot, 0o700); journalRootExists = true; } catch (error) { if (error.code !== 'ENOENT') throw error; }`,
-        "const credentialExpiry = (bytes) => { try { const rows = Object.entries(JSON.parse(bytes.toString('utf8'))).filter(([key]) => /^https:\\/\\/auth\\.x\\.ai::/.test(key)).map(([, value]) => value); const expiry = rows.length === 1 && typeof rows[0]?.expires_at === 'string' ? Date.parse(rows[0].expires_at) : NaN; if (!Number.isFinite(expiry)) throw new Error(); return expiry; } catch { throw new Error('invalid broker credential expiry'); } };",
-        `try { const journalPath = '${DAIMON_BROKER_REALM}/.daimon-broker/credential-journal.json'; let journal; try { const raw = readSecure(journalPath, 2100, 'recovery journal'); journal = JSON.parse(raw.toString('utf8')); raw.fill(0); } catch (error) { if (error.code !== 'ENOENT') throw error; } const stale = journal?.version === 'noopolis.daimon.broker-credential-journal.v1' && journal.state === 'stale'; const recover = () => { if (!stale || !Number.isSafeInteger(journal.generation) || journal.generation < 0 || !/^[a-f0-9]{64}$/.test(journal.sourceDigest) || journal.sourceDigest !== journal.promotedDigest || bootstrapDigest === journal.sourceDigest) throw new Error('unsafe broker credential recovery'); atomicOwned(authority, bootstrapBytes); const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } }; if (!existing) { if (journal) throw new Error('broker credential authority missing; refusing bootstrap rollback'); else atomicOwned(authority, bootstrapBytes); } else { const authorityBytes = readSecure(authority, 2100, 'authority'); try { const authorityDigest = crypto.createHash('sha256').update(authorityBytes).digest('hex'); if (stale) { if (authorityDigest !== journal.sourceDigest && authorityDigest !== bootstrapDigest) throw new Error('unsafe broker credential recovery'); if (authorityDigest === bootstrapDigest && bootstrapDigest === journal.sourceDigest) throw new Error('unsafe broker credential recovery'); if (authorityDigest !== bootstrapDigest && credentialExpiry(bootstrapBytes) <= credentialExpiry(authorityBytes)) throw new Error('older broker bootstrap cannot recover newer realm'); if (authorityDigest === bootstrapDigest) { const recovered = Buffer.from(\`${"${JSON.stringify({ version: 'noopolis.daimon.broker-credential-journal.v1', state: 'promoted', generation: journal.generation + 1, sourceDigest: journal.sourceDigest, promotedDigest: bootstrapDigest })}"}\\n\`); try { atomicOwned(journalPath, recovered); } finally { recovered.fill(0); } } else recover(); } } finally { authorityBytes.fill(0); } } } finally { bootstrapBytes.fill(0); if (journalRootExists) { fs.chownSync(journalRoot, 0, 0); fs.chmodSync(journalRoot, 0o700); fs.chownSync(journalRoot, 2100, 2100); } fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700); fs.chownSync('${DAIMON_BROKER_REALM}', 2100, 2100); }`,
         ...renderDaimonWorkspaceResourceSecurity(workspaceResources),
-        ...renderDaimonGrokWorkerProvisioning(registrations, serviceOptions, ...(optionalDenyPaths ? [optionalDenyPaths] : [])),
+        ...renderDaimonGrokWorkerProvisioning(registrations),
         `fs.chownSync('${DAIMON_BROKER_REALM}', 0, 0); fs.chmodSync('${DAIMON_BROKER_REALM}', 0o700); fs.chownSync('${DAIMON_BROKER_REALM}', 2100, 2100);`,
         "fs.chmodSync('/etc/daimon-engine-broker', 0o555);"
     ].join("\n");
     return [
         "if [ -d /etc/daimon-engine-broker ]; then chmod u+rwx /etc/daimon-engine-broker; fi",
         "if [ -d /run/daimon-engine-broker ]; then chmod u+rwx /run/daimon-engine-broker; fi",
-        ...(rootReset === "remove"
-            ? ["rm -rf /etc/daimon-engine-broker /run/daimon-engine-broker"]
-            : [...MOUNT_AWARE_CLEAR_HELPER, "for broker_root in /etc/daimon-engine-broker /run/daimon-engine-broker; do spawnfile_clear_tree \"$broker_root\"; done"]),
+        "rm -rf /etc/daimon-engine-broker /run/daimon-engine-broker",
         `install -d -o root -g ${DAIMON_BROKER_UID} -m 0731 /run/daimon-engine-broker`,
-        `install -d -o ${DAIMON_BROKER_UID} -g ${DAIMON_BROKER_UID} -m 0700 ${brokerTmpdir}`,
-        ...beforeWorkerProvisioning,
+        `install -d -o ${DAIMON_BROKER_UID} -g ${DAIMON_BROKER_UID} -m 0700 ${DAIMON_BROKER_TMPDIR}`,
         "node <<'SPAWNFILE_DAIMON_BROKER_PROVISION'",
         program,
         "SPAWNFILE_DAIMON_BROKER_PROVISION"

package/dist/compiler/containerDaimonGatewayRender.d.ts

@@ -0,0 +1,50 @@
+import type { RuntimeTargetPlan } from "./containerArtifactsTypes.js";
+import { type DaimonGatewayedDescriptor } from "../runtime/daimon/gateway.js";
+import { DAIMON_GATEWAY_UID } from "../runtime/daimon/runtimeIdentity.js";
+export { DAIMON_GATEWAY_UID };
+export declare const DAIMON_GATEWAY_STARTUP_TIMEOUT_SECONDS = 60;
+/** Gatewayed engines this container's Daimon organization runs; empty means no gateway. */
+export declare const resolveDaimonGatewayEngines: (plans: readonly RuntimeTargetPlan[]) => DaimonGatewayedDescriptor[];
+/** Persistent realm volumes the gateway, not the organization uid, owns. */
+export declare const resolveDaimonGatewayRealmPaths: (plans: readonly RuntimeTargetPlan[]) => string[];
+/**
+ * Root provisioning of the gateway's private state, before any engine process
+ * starts: the digest-only key table and config under `root:<gateway> 0440`,
+ * each realm re-owned to the gateway uid at `0700`, and a gateway-owned copy of
+ * each bootstrap leaf, whose bind mount sits under a root-only directory the
+ * organization uid cannot reach. Reads the key from `$daimon_gateway_key`.
+ * Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_FOWNER`, so
+ * every chmod happens while root owns the path. Shared by the in-container
+ * placement and the training sidecar (`host` is the only difference).
+ */
+export declare const renderDaimonGatewayStateProvisioning: (descriptors: readonly DaimonGatewayedDescriptor[], host?: string) => string[];
+/**
+ * The organization's gateway placement, decided at boot. With
+ * `DAIMON_GATEWAY_URL` (and its key) in the container environment, an external
+ * gateway (the training sidecar) serves this organization: nothing is
+ * provisioned, no gateway starts and no realm is mounted. Otherwise root
+ * generates a fresh 32-byte key per start (so no key exists in the image or the
+ * compile output) and provisions the in-container gateway. Either way the
+ * runtime gets the same two variables: one agent contract.
+ */
+export declare const renderDaimonGatewayProvisioning: (plans: readonly RuntimeTargetPlan[]) => string[];
+/**
+ * Starts the gateway as its own uid with no capabilities, after proving the
+ * organization uid (and a broker uid) cannot read any gateway-held path, then waits for its uid,
+ * bounding set and loopback port. Uses the shared startup supervision helpers.
+ */
+export declare const renderDaimonGatewayLaunch: (plans: readonly RuntimeTargetPlan[], runtimeRoot: string) => string[];
+/** Env assignments prefixed onto the organization runtime launch; empty without a gateway. */
+export declare const renderDaimonGatewayRuntimeEnv: (plans: readonly RuntimeTargetPlan[]) => string;
+/** The training sidecar answers on its run's private network under this alias. */
+export declare const DAIMON_GATEWAY_SIDECAR_ALIAS = "daimon-gateway";
+export declare const DAIMON_GATEWAY_SIDECAR_URL = "http://daimon-gateway:43200";
+/** Env name carrying the run's 64-hex gateway key into the sidecar's root shell; unset before anything else starts. */
+export declare const DAIMON_GATEWAY_SIDECAR_KEY_ENV = "SPAWNFILE_DAIMON_GATEWAY_KEY";
+/**
+ * Root script for the sidecar placement: the same binary, state provisioning
+ * and uid as the in-container gateway, bound to the run's private network
+ * instead of loopback, with the run's key supplied rather than generated.
+ * Trials reach it at {@link DAIMON_GATEWAY_SIDECAR_URL} with that key.
+ */
+export declare const renderDaimonGatewaySidecarScript: (engines: readonly string[], runtimeRoot: string) => string;

package/dist/compiler/containerDaimonGatewayRender.js

@@ -0,0 +1,161 @@
+import path from "node:path";
+import { DAIMON_GATEWAY_BOOTSTRAP_ROOT, DAIMON_GATEWAY_CONFIG, DAIMON_GATEWAY_ETC, DAIMON_GATEWAY_KEY_ENV, DAIMON_GATEWAY_KEY_TABLE, DAIMON_GATEWAY_KEY_TABLE_VERSION, DAIMON_GATEWAY_PORT, DAIMON_GATEWAY_PRINCIPAL, DAIMON_GATEWAY_RUN, DAIMON_GATEWAY_URL, DAIMON_GATEWAY_URL_ENV, DAIMON_GATEWAY_HOST, daimonGatewayBootstrapCopyPath, daimonGatewayBootstrapMountPath, daimonGatewayedEngines, daimonGatewayRealmPath, daimonGatewayRefreshScratchPath, renderDaimonGatewayConfig } from "../runtime/daimon/gateway.js";
+import { DAIMON_BROKER_UID, DAIMON_GATEWAY_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
+export { DAIMON_GATEWAY_UID };
+export const DAIMON_GATEWAY_STARTUP_TIMEOUT_SECONDS = 60;
+/** Root-shell variable holding this start's key; never exported, passed only to the runtime launch. */
+const KEY_VARIABLE = "daimon_gateway_key";
+/** Root-shell variable holding the gateway URL this start hands the runtime. */
+const URL_VARIABLE = "daimon_gateway_url";
+/** `1` when an external gateway was supplied at boot. */
+const EXTERNAL_VARIABLE = "daimon_gateway_external";
+const drop = (uid) => `setpriv --clear-groups --reuid ${uid} --regid ${uid} --inh-caps=-all --ambient-caps=-all --bounding-set=-all --`;
+/** Gatewayed engines this container's Daimon organization runs; empty means no gateway. */
+export const resolveDaimonGatewayEngines = (plans) => daimonGatewayedEngines(plans.filter((plan) => plan.runtimeName === "daimon")
+    .flatMap((plan) => Object.values(plan.engineByNodeId ?? {})));
+/** Persistent realm volumes the gateway, not the organization uid, owns. */
+export const resolveDaimonGatewayRealmPaths = (plans) => resolveDaimonGatewayEngines(plans).map(daimonGatewayRealmPath);
+/**
+ * Root provisioning of the gateway's private state, before any engine process
+ * starts: the digest-only key table and config under `root:<gateway> 0440`,
+ * each realm re-owned to the gateway uid at `0700`, and a gateway-owned copy of
+ * each bootstrap leaf, whose bind mount sits under a root-only directory the
+ * organization uid cannot reach. Reads the key from `$daimon_gateway_key`.
+ * Root holds `CAP_CHOWN` and `CAP_DAC_READ_SEARCH` but not `CAP_FOWNER`, so
+ * every chmod happens while root owns the path. Shared by the in-container
+ * placement and the training sidecar (`host` is the only difference).
+ */
+export const renderDaimonGatewayStateProvisioning = (descriptors, host = DAIMON_GATEWAY_HOST) => {
+    const realms = descriptors.map((descriptor) => ({
+        bootstrap: daimonGatewayBootstrapMountPath(descriptor.auth.realm),
+        copy: daimonGatewayBootstrapCopyPath(descriptor.auth.realm),
+        durable: daimonGatewayRealmPath(descriptor),
+        maxBytes: descriptor.auth.realm.maxCredentialBytes,
+        scratch: daimonGatewayRefreshScratchPath(descriptor) ?? null
+    }));
+    const program = [
+        "const crypto = require('node:crypto'); const fs = require('node:fs'); const { constants } = fs;",
+        `const gateway = ${DAIMON_GATEWAY_UID}; const realms = ${JSON.stringify(realms)};`,
+        `const key = process.env.SPAWNFILE_DAIMON_GATEWAY_KEY ?? ''; if (!/^[0-9a-f]{64}$/.test(key)) throw new Error('gateway key generation failed');`,
+        "const privateWrite = (target, bytes, mode, uid, gid) => { const fd = fs.openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600); try { let written = 0; while (written < bytes.length) written += fs.writeSync(fd, bytes, written, bytes.length - written, written); fs.fchmodSync(fd, mode); fs.fchownSync(fd, uid, gid); fs.fsyncSync(fd); } finally { fs.closeSync(fd); } };",
+        `const table = { version: '${DAIMON_GATEWAY_KEY_TABLE_VERSION}', keys: { [crypto.createHash('sha256').update(key, 'utf8').digest('hex')]: { agent_id: '${DAIMON_GATEWAY_PRINCIPAL}', engines: ${JSON.stringify(descriptors.map(({ id }) => id))} } } };`,
+        `privateWrite('${DAIMON_GATEWAY_KEY_TABLE}', Buffer.from(JSON.stringify(table) + '\\n'), 0o440, 0, gateway);`,
+        `privateWrite('${DAIMON_GATEWAY_CONFIG}', Buffer.from(${JSON.stringify(renderDaimonGatewayConfig(descriptors, host))}), 0o440, 0, gateway);`,
+        "for (const realm of realms) {",
+        "  const info = fs.lstatSync(realm.durable); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('gateway realm is not a directory');",
+        "  fs.chownSync(realm.durable, 0, 0); fs.chmodSync(realm.durable, 0o700);",
+        // Re-own the whole tree: a migrated broker realm also holds its legacy journal and turn directories.
+        "  const reown = (target) => { for (const name of fs.readdirSync(target)) { const entry = `${target}/${name}`, stat = fs.lstatSync(entry); if (stat.isDirectory()) { fs.chownSync(entry, 0, 0); fs.chmodSync(entry, stat.mode & 0o700); reown(entry); } else if (!stat.isFile() || stat.nlink !== 1) throw new Error('gateway realm holds an unsafe entry'); else { fs.chownSync(entry, 0, 0); fs.chmodSync(entry, stat.mode & 0o700); } fs.chownSync(entry, gateway, gateway); } };",
+        "  reown(realm.durable); fs.chownSync(realm.durable, gateway, gateway);",
+        "  if (realm.scratch !== null) { fs.mkdirSync(realm.scratch, { mode: 0o700 }); fs.chownSync(realm.scratch, gateway, gateway); }",
+        "  let source; try { source = fs.lstatSync(realm.bootstrap); } catch (error) { if (error.code !== 'ENOENT') throw error; }",
+        "  if (source === undefined) continue;",
+        "  if (!source.isFile() || source.size < 2 || source.size > realm.maxBytes) throw new Error('gateway bootstrap leaf is unsafe');",
+        "  const fd = fs.openSync(realm.bootstrap, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); let bytes; try { const opened = fs.fstatSync(fd); if (opened.dev !== source.dev || opened.ino !== source.ino) throw new Error('gateway bootstrap leaf changed'); bytes = fs.readFileSync(fd); } finally { fs.closeSync(fd); }",
+        "  try { privateWrite(realm.copy, bytes, 0o600, gateway, gateway); } finally { bytes.fill(0); }",
+        "}"
+    ].join("\n");
+    return [
+        `if [ -d ${DAIMON_GATEWAY_ETC} ]; then chmod u+rwx ${DAIMON_GATEWAY_ETC}; fi`,
+        `if [ -d ${DAIMON_GATEWAY_RUN} ]; then chmod u+rwx ${DAIMON_GATEWAY_RUN}; fi`,
+        `rm -rf ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN}`,
+        `install -d -o root -g root -m 0700 ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN}`,
+        `if [ ! -d ${DAIMON_GATEWAY_BOOTSTRAP_ROOT} ]; then install -d -o root -g root -m 0700 ${DAIMON_GATEWAY_BOOTSTRAP_ROOT}; fi`,
+        `test -d ${DAIMON_GATEWAY_BOOTSTRAP_ROOT} && test ! -L ${DAIMON_GATEWAY_BOOTSTRAP_ROOT}`,
+        `chown 0:0 ${DAIMON_GATEWAY_BOOTSTRAP_ROOT} && chmod 0700 ${DAIMON_GATEWAY_BOOTSTRAP_ROOT}`,
+        `SPAWNFILE_DAIMON_GATEWAY_KEY="$${KEY_VARIABLE}" node <<'SPAWNFILE_DAIMON_GATEWAY_PROVISION'`,
+        program,
+        "SPAWNFILE_DAIMON_GATEWAY_PROVISION",
+        `chmod 0750 ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN} && chown 0:${DAIMON_GATEWAY_UID} ${DAIMON_GATEWAY_ETC} ${DAIMON_GATEWAY_RUN}`
+    ];
+};
+/**
+ * The organization's gateway placement, decided at boot. With
+ * `DAIMON_GATEWAY_URL` (and its key) in the container environment, an external
+ * gateway (the training sidecar) serves this organization: nothing is
+ * provisioned, no gateway starts and no realm is mounted. Otherwise root
+ * generates a fresh 32-byte key per start (so no key exists in the image or the
+ * compile output) and provisions the in-container gateway. Either way the
+ * runtime gets the same two variables: one agent contract.
+ */
+export const renderDaimonGatewayProvisioning = (plans) => {
+    const descriptors = resolveDaimonGatewayEngines(plans);
+    if (descriptors.length === 0)
+        return [];
+    return [
+        `if [ -n "\${${DAIMON_GATEWAY_URL_ENV}:-}" ]; then`,
+        `  ${EXTERNAL_VARIABLE}=1 ${URL_VARIABLE}=$${DAIMON_GATEWAY_URL_ENV}`,
+        `  ${KEY_VARIABLE}=\${${DAIMON_GATEWAY_KEY_ENV}:?${DAIMON_GATEWAY_KEY_ENV} must accompany ${DAIMON_GATEWAY_URL_ENV}}`,
+        // Only the runtime and broker launches below get them, as with the in-container gateway.
+        `  export -n ${DAIMON_GATEWAY_URL_ENV} ${DAIMON_GATEWAY_KEY_ENV}`,
+        // Empty root-only placeholders: a brokered worker's sandbox masks these paths and refuses one that is missing.
+        ...(descriptors.some((descriptor) => descriptor.broker !== null)
+            ? [DAIMON_GATEWAY_ETC, DAIMON_GATEWAY_RUN, DAIMON_GATEWAY_BOOTSTRAP_ROOT, ...descriptors.map(daimonGatewayRealmPath)] : [])
+            .map((target) => `  if [ ! -e ${target} ]; then install -d -o root -g root -m 0700 ${target}; fi`),
+        "else",
+        `  ${EXTERNAL_VARIABLE}=0 ${URL_VARIABLE}=${DAIMON_GATEWAY_URL}`,
+        // Rotated every start: 32 random bytes as lowercase hex, held only in this root shell.
+        `  ${KEY_VARIABLE}=$(od -An -vtx1 -N32 /dev/urandom | tr -d ' \\n')`,
+        ...renderDaimonGatewayStateProvisioning(descriptors),
+        "fi"
+    ];
+};
+/**
+ * Starts the gateway as its own uid with no capabilities, after proving the
+ * organization uid (and a broker uid) cannot read any gateway-held path, then waits for its uid,
+ * bounding set and loopback port. Uses the shared startup supervision helpers.
+ */
+export const renderDaimonGatewayLaunch = (plans, runtimeRoot) => {
+    const descriptors = resolveDaimonGatewayEngines(plans);
+    if (descriptors.length === 0)
+        return [];
+    const realmPaths = descriptors.map(daimonGatewayRealmPath);
+    const hidden = [...realmPaths, DAIMON_GATEWAY_BOOTSTRAP_ROOT, DAIMON_GATEWAY_ETC, DAIMON_GATEWAY_RUN];
+    // Neither the organization uid nor a broker (which reaches the gateway only by key) may read the login.
+    const outsiders = [DAIMON_ORGANIZATION_UID, ...(descriptors.some((descriptor) => descriptor.broker !== null) ? [DAIMON_BROKER_UID] : [])];
+    return [
+        `if [ "$${EXTERNAL_VARIABLE}" = 0 ]; then`,
+        ...outsiders.flatMap((uid) => hidden.map((target) => `${drop(uid)} bash -ceu '! test -r ${target} && ! test -x ${target}'`)),
+        ...realmPaths.map((target) => `${drop(DAIMON_GATEWAY_UID)} bash -ceu 'probe=${target}/.daimon-gateway-probe; umask 077; : > "$probe"; rm "$probe"'`),
+        `${drop(DAIMON_GATEWAY_UID)} env -i PATH="$PATH" HOME=/nonexistent LANG=C.UTF-8 ${path.posix.join(runtimeRoot, "bin/daimon-runtime")} gateway --config ${DAIMON_GATEWAY_CONFIG} &`,
+        "gateway_pid=$!",
+        "startup_children+=(\"$gateway_pid\")",
+        `wait_for_broker_identity "$gateway_pid" ${DAIMON_GATEWAY_UID} 0000000000000000 "auth gateway"`,
+        "until (exec 3<>/dev/tcp/127.0.0.1/" + DAIMON_GATEWAY_PORT + ") 2>/dev/null; do",
+        "  if ! kill -0 \"$gateway_pid\" 2>/dev/null; then echo \"auth gateway exited before readiness\" >&2; exit 1; fi",
+        "  if [ $((SECONDS - broker_startup_started)) -ge \"$broker_startup_timeout_seconds\" ]; then echo \"auth gateway readiness timed out after ${broker_startup_timeout_seconds}s\" >&2; exit 1; fi",
+        "  sleep \"$broker_startup_poll_seconds\"",
+        "done",
+        "fi"
+    ];
+};
+/** Env assignments prefixed onto the organization runtime launch; empty without a gateway. */
+export const renderDaimonGatewayRuntimeEnv = (plans) => resolveDaimonGatewayEngines(plans).length === 0
+    ? ""
+    : `${DAIMON_GATEWAY_URL_ENV}="$${URL_VARIABLE}" ${DAIMON_GATEWAY_KEY_ENV}="$${KEY_VARIABLE}" `;
+/** The training sidecar answers on its run's private network under this alias. */
+export const DAIMON_GATEWAY_SIDECAR_ALIAS = "daimon-gateway";
+export const DAIMON_GATEWAY_SIDECAR_URL = `http://${DAIMON_GATEWAY_SIDECAR_ALIAS}:${DAIMON_GATEWAY_PORT}`;
+/** Env name carrying the run's 64-hex gateway key into the sidecar's root shell; unset before anything else starts. */
+export const DAIMON_GATEWAY_SIDECAR_KEY_ENV = "SPAWNFILE_DAIMON_GATEWAY_KEY";
+/**
+ * Root script for the sidecar placement: the same binary, state provisioning
+ * and uid as the in-container gateway, bound to the run's private network
+ * instead of loopback, with the run's key supplied rather than generated.
+ * Trials reach it at {@link DAIMON_GATEWAY_SIDECAR_URL} with that key.
+ */
+export const renderDaimonGatewaySidecarScript = (engines, runtimeRoot) => {
+    const descriptors = daimonGatewayedEngines(engines);
+    if (descriptors.length === 0)
+        throw new Error("the auth gateway sidecar needs at least one gatewayed engine");
+    return [
+        "set -euo pipefail",
+        `if ! getent group ${DAIMON_GATEWAY_UID} >/dev/null; then groupadd -K GID_MIN=1 --gid ${DAIMON_GATEWAY_UID} daimon-${DAIMON_GATEWAY_UID}; fi`,
+        `if ! getent passwd ${DAIMON_GATEWAY_UID} >/dev/null; then useradd -K UID_MIN=1 --no-create-home --no-log-init --uid ${DAIMON_GATEWAY_UID} --gid ${DAIMON_GATEWAY_UID} --home-dir /nonexistent --shell /usr/sbin/nologin daimon-${DAIMON_GATEWAY_UID}; fi`,
+        `${KEY_VARIABLE}=\${${DAIMON_GATEWAY_SIDECAR_KEY_ENV}:?the gateway sidecar needs its run key}`,
+        `unset ${DAIMON_GATEWAY_SIDECAR_KEY_ENV}`,
+        ...renderDaimonGatewayStateProvisioning(descriptors, "0.0.0.0"),
+        `unset ${KEY_VARIABLE}`,
+        `exec ${drop(DAIMON_GATEWAY_UID)} env -i PATH="$PATH" HOME=/nonexistent LANG=C.UTF-8 ${path.posix.join(runtimeRoot, "bin/daimon-runtime")} gateway --config ${DAIMON_GATEWAY_CONFIG}`
+    ].join("\n") + "\n";
+};

package/dist/compiler/containerDaimonGrokWorkerProvisioning.d.ts

@@ -1,4 +1,4 @@
-import { type DaimonGrokRegistration, type DaimonGrokServiceConfigOptions } from "./containerDaimonGrokWorkerRender.js";
+import { type DaimonGrokRegistration } from "./containerDaimonGrokWorkerRender.js";
 /**
  * Root provisioning for every brokered Grok worker, as lines of the broker's
  * node provisioning program (which already defines `crypto`, `fs`, and
@@ -18,15 +18,7 @@ import { type DaimonGrokRegistration, type DaimonGrokServiceConfigOptions } from
  * the wrong inode. Root chmods only paths it owns at that moment (no
  * `CAP_FOWNER`): reclaim, mode, then hand over.
  */
-export declare const renderDaimonGrokWorkerProvisioning: (registrations: readonly DaimonGrokRegistration[], serviceOptions?: DaimonGrokServiceConfigOptions, 
-/**
- * Deny targets this program creates root-owned `0700` when they are absent,
- * so every mask always has an inode. The default is the production
- * container's set; the training container passes its own, because its roots
- * are tmpfs mounts and `/run/secrets` and the shared state roots do not
- * exist there at all.
- */
-optionalDenyPaths?: readonly string[], scope?: "container" | "slot") => string[];
+export declare const renderDaimonGrokWorkerProvisioning: (registrations: readonly DaimonGrokRegistration[]) => string[];
 /**
  * Grok 1.0.34 runs every sandbox profile inside bubblewrap, which needs
  * unprivileged user namespaces. Ubuntu 24.04+ hosts (and Colima's default VM)

package/dist/compiler/containerDaimonGrokWorkerProvisioning.js

@@ -1,6 +1,5 @@
-import { renderDaimonGrokTaskClockProvisioning } from "./containerDaimonGrokTaskClock.js";
 import { DAIMON_GROK_ENGINE_BROKER } from "../runtime/daimon/contractManifest.js";
-import { resolveDaimonGrokClockedWorkerConfig, resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
+import { resolveDaimonGrokWorkerConfig } from "../runtime/daimon/grokWorkerContract.js";
 import { DAIMON_BROKER_UID, DAIMON_ORGANIZATION_UID } from "../runtime/daimon/runtimeIdentity.js";
 import { DAIMON_GROK_DENIED_STATE_ROOTS, DAIMON_GROK_OPTIONAL_DENY_PATHS, DAIMON_GROK_WORKER_READ_ONLY_FILES, DAIMON_WORKER_ROOT, renderDaimonGrokServiceConfig } from "./containerDaimonGrokWorkerRender.js";
 /** Only the bytes the program writes; everything else it needs is recomputed or checked in place. */
@@ -64,22 +63,12 @@ const renderDaimonGrokWorkerSkillsProvisioning = (registrations) => registration
  * the wrong inode. Root chmods only paths it owns at that moment (no
  * `CAP_FOWNER`): reclaim, mode, then hand over.
  */
-export const renderDaimonGrokWorkerProvisioning = (registrations, serviceOptions = {}, 
-/**
- * Deny targets this program creates root-owned `0700` when they are absent,
- * so every mask always has an inode. The default is the production
- * container's set; the training container passes its own, because its roots
- * are tmpfs mounts and `/run/secrets` and the shared state roots do not
- * exist there at all.
- */
-optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS], scope = "container") => [
+export const renderDaimonGrokWorkerProvisioning = (registrations) => [
     `const grokWorkers = ${JSON.stringify(registrations.map(programRegistration))};`,
-    `const optionalDenyPaths = new Set(${JSON.stringify([...optionalDenyPaths])});`,
+    // Deny targets created root-owned `0700` when absent, so every mask always has an inode.
+    `const optionalDenyPaths = new Set(${JSON.stringify([...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_STATE_ROOTS])});`,
     // Derive each expected hash from manifest-validated bytes, never from the registration's digest.
-    // Clocked templates are pinned at slot zero, then specialized by the contract resolver.
-    `const pinnedConfigSha256 = ${JSON.stringify(registrations.map(entry => (entry.configVariant === "clocked"
-        ? resolveDaimonGrokClockedWorkerConfig(entry.model, entry.reasoningEffort, entry.slot)
-        : resolveDaimonGrokWorkerConfig(entry.model, entry.reasoningEffort)).sha256))};`,
+    `const pinnedConfigSha256 = ${JSON.stringify(registrations.map(entry => resolveDaimonGrokWorkerConfig(entry.model, entry.reasoningEffort).sha256))};`,
     "const sha256Hex = (value) => crypto.createHash('sha256').update(value).digest('hex');",
     "for (const [index, entry] of grokWorkers.entries()) { if (sha256Hex(entry.config) !== entry.configSha256 || pinnedConfigSha256[index] !== entry.configSha256 || sha256Hex(entry.profile) !== entry.profileSha256 || entry.denyPaths.length === 0) throw new Error(`Grok worker contract bytes for ${entry.agentId} do not match their pins`); }",
     // Root holds no CAP_FOWNER: every mode change reclaims the inode, sets the mode, then restores or hands over ownership.
@@ -92,19 +81,18 @@ optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_S
     "const ensureDirectory = (target, uid, gid, mode) => { fs.mkdirSync(target, { recursive: true, mode: 0o700 }); const info = fs.lstatSync(target); if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('unsafe worker runtime directory'); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); fs.chownSync(target, uid, gid); };",
     "const ensureExactFile = (target, content, mode) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, content, { mode, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) throw new Error('unsafe worker runtime file'); if (fs.readFileSync(target, 'utf8') !== content) throw new Error(`worker runtime file identity mismatch: ${target}`); fs.chownSync(target, 0, 0); fs.chmodSync(target, mode); };",
     `const ensureEventsFile = (target, uid) => { let info; try { info = fs.lstatSync(target); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.writeFileSync(target, '', { mode: 0o640, flag: 'wx' }); info = fs.lstatSync(target); } if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || (info.uid !== uid && info.uid !== 0) || ![0, uid, ${DAIMON_BROKER_UID}].includes(info.gid) || ![0o600, 0o640, 0o644].includes(info.mode & 0o777)) throw new Error('unsafe worker attestation events'); fs.chownSync(target, 0, 0); fs.chmodSync(target, 0o640); fs.chownSync(target, uid, ${DAIMON_BROKER_UID}); };`,
-    ...(scope === "slot" ? [] : renderDaimonGrokTaskClockProvisioning(registrations)),
-    ...(scope === "slot" ? [] : [`fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`]),
+    `fs.mkdirSync('${DAIMON_WORKER_ROOT}', { recursive: true, mode: 0o711 }); fs.chownSync('${DAIMON_WORKER_ROOT}', 0, 0); fs.chmodSync('${DAIMON_WORKER_ROOT}', 0o711); assertCanonical('${DAIMON_WORKER_ROOT}', 'worker root');`,
     // Pass 1: every workspace and home exists, root-held, before any deny list is checked.
-    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ${scope === "container" ? "ensureDirectory(entry.home, 0, 0, 0o700);" : ""} ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
+    `for (const entry of grokWorkers) { traversable(entry.workspace); secureWorkspace(entry.workspace, entry.uid); assertCanonical(entry.workspace, 'workspace'); ensureDirectory(entry.home, 0, 0, 0o700); ensureDirectory(entry.grokHome, 0, 0, 0o700); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, 0, 0o700); for (const target of [entry.home, entry.grokHome]) assertCanonical(target, 'home'); }`,
     "for (const denied of optionalDenyPaths) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; fs.mkdirSync(denied, { mode: 0o700 }); fs.chownSync(denied, 0, 0); fs.chmodSync(denied, 0o700); } }",
     "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { try { assertCanonical(denied, 'deny path'); } catch (error) { if (error.code === 'ENOENT' && entry.deferredDenyPaths.includes(denied)) continue; if (error.code === 'ENOENT') throw new Error(`Grok worker deny path is missing: ${denied}`); throw error; } }",
     ...renderDaimonGrokWorkerSkillsProvisioning(registrations),
     // Pass 2: exact root-owned read-only files, the events file, then the final sticky modes.
-    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ${scope === "container" ? `ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710);` : ""} for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
+    `for (const entry of grokWorkers) { ensureExactFile(\`\${entry.grokHome}/config.toml\`, entry.config, 0o444); ensureExactFile(entry.profilePath, entry.profile, 0o444); for (const name of ${JSON.stringify(DAIMON_GROK_WORKER_READ_ONLY_FILES.filter((name) => name !== "config.toml" && name !== "sandbox.toml"))}) ensureExactFile(\`\${entry.grokHome}/\${name}\`, '', 0o444); ensureEventsFile(entry.eventsPath, entry.uid); ensureDirectory(\`\${entry.grokHome}/sessions\`, 0, entry.uid, 0o1771); ensureDirectory(entry.grokHome, 0, entry.uid, 0o1771); ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); ensureDirectory(entry.home, entry.uid, ${DAIMON_BROKER_UID}, 0o710); for (const target of [entry.profilePath, entry.eventsPath, \`\${entry.grokHome}/config.toml\`]) assertCanonical(target, 'home file'); }`,
     // Worker-private temp: the launcher compiles TMPDIR=<home>/tmp, the only temp the worker may write. It is
     // created in the pass above, while the home is still root-owned: root here holds no CAP_DAC_OVERRIDE, so
     // once the home is `<worker>:<broker> 0710` root can no longer create anything inside it.
-    `for (const entry of grokWorkers) { ${scope === "container" ? "ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700);" : ""} assertCanonical(entry.privateTmp, 'private temp'); }`,
+    `for (const entry of grokWorkers) { ensureDirectory(entry.privateTmp, entry.uid, entry.uid, 0o700); assertCanonical(entry.privateTmp, 'private temp'); }`,
     // Spills: <runtimeHome>/tool-output 2000:<worker> 2750 (setgid) under a runtime home the worker's group can
     // traverse. Root reclaims the runtime home before creating the spill directory: the compiler lists every
     // organization runtime home as a private directory, so the container's ownership pass has already handed
@@ -113,7 +101,7 @@ optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_S
     // `withMode` still narrows the home to its final `2000:<worker> 0710`, so the end state is unchanged.
     `for (const entry of grokWorkers) { traversable(entry.runtimeHome); fs.mkdirSync(entry.runtimeHome, { recursive: true, mode: 0o700 }); assertCanonical(entry.runtimeHome, 'runtime home'); reclaimForRoot(entry.runtimeHome); try { fs.mkdirSync(entry.spillDirectory, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; } assertCanonical(entry.spillDirectory, 'spill directory'); withMode(entry.spillDirectory, 0o2750, ${DAIMON_ORGANIZATION_UID}, entry.uid); for (const mounted of entry.runtimeHomeMounts) { assertCanonical(mounted, 'runtime home mount'); withMode(mounted, 0o700, ${DAIMON_ORGANIZATION_UID}, ${DAIMON_ORGANIZATION_UID}); } withMode(entry.runtimeHome, 0o710, ${DAIMON_ORGANIZATION_UID}, entry.uid); }`,
     // Shared temp: Grok refuses a profile denying /tmp or /var/tmp, so modes close them: root:<org group> 1774 lets workers list names only.
-    ...(scope === "slot" ? [] : [`for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`]),
+    `for (const shared of ${JSON.stringify(DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.paths)}) { fs.mkdirSync(shared, { recursive: true, mode: 0o1777 }); assertCanonical(shared, 'shared temp'); withMode(shared, 0o${DAIMON_GROK_ENGINE_BROKER.worker.home.sharedTmp.mode.toString(8)}, 0, ${DAIMON_ORGANIZATION_UID}); }`,
     // Deny-path placement, asserted once every mode above is final. A resource backing the organization
     // entrypoint only materializes later is created here, empty and root-owned, rather than skipped: the
     // engine broker starts before that entrypoint runs and its own placement preflight refuses a deny target
@@ -131,9 +119,9 @@ optionalDenyPaths = [...DAIMON_GROK_OPTIONAL_DENY_PATHS, ...DAIMON_GROK_DENIED_S
     "const searches = (info, uid, gid) => info.uid === uid ? (info.mode & 0o100) !== 0 : info.gid === gid ? (info.mode & 0o010) !== 0 : (info.mode & 0o001) !== 0;",
     "const assertPlaceable = (denied, uid, gid) => { const parts = denied.split('/').slice(1); let at = ''; for (const part of parts.slice(0, -1)) { at += `/${part}`; let info; try { info = fs.lstatSync(at); } catch (error) { throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} could not be read (${error.code})`); } if (!info.isDirectory() || info.isSymbolicLink()) throw new Error(`Grok worker deny path ${denied} is not placeable: ${at} is not a directory`); if (!searches(info, uid, gid)) throw new Error(`Grok worker deny path ${denied} is not placeable: worker uid ${uid} cannot search ${at} (${(info.mode & 0o7777).toString(8)} ${info.uid}:${info.gid}); deny that directory itself instead`); } };",
     "for (const entry of grokWorkers) for (const denied of entry.denyPaths) { if (entry.deferredDenyPaths.includes(denied)) { try { fs.lstatSync(denied); } catch (error) { if (error.code !== 'ENOENT') throw error; createDeferredDenyTarget(denied); } } assertPlaceable(denied, entry.uid, entry.uid); }",
-    ...(scope === "slot" ? [] : [`const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations, serviceOptions))};`,
-        "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.slot === registration.slot); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
-        `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`])
+    `const service = ${JSON.stringify(renderDaimonGrokServiceConfig(registrations))};`,
+    "for (const registration of service.registrations) { const entry = grokWorkers.find((worker) => worker.slot === registration.slot); if (!entry || registration.profileSha256 !== sha256Hex(fs.readFileSync(entry.profilePath, 'utf8'))) throw new Error('Grok broker service registration does not match its provisioned profile'); }",
+    `fs.writeFileSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', \`\${JSON.stringify(service)}\\n\`, { mode: 0o440, flag: 'wx' }); fs.chownSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0, ${DAIMON_BROKER_UID}); fs.chmodSync('${DAIMON_GROK_ENGINE_BROKER.serviceConfigPath}', 0o440);`
 ];
 const shellQuote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
 /**