spawnfile 0.1.33 → 0.1.35

package/dist/runtime/daimon/training/native/container/preflight.d.ts

@@ -1,15 +0,0 @@
-import type { VerifiedNativeLaunch } from '../receipt/index.js';
-import type { DockerCommand } from './docker.js';
-/** Same namespace compatibility policy as Spawnfile's strict native Codex launch. */
-export declare const codexSandboxContainerSecurity: readonly ["--security-opt", "seccomp=unconfined", "--security-opt", "apparmor=unconfined"];
-/** Separate-container Grok needs a broker, realm and root slot supervisor this adapter does not own. */
-export declare const grokContainerUnsupported = "Separate-container Grok native trials are unsupported: run Grok through child-process execution in the broker-capable training container";
-/** Codex's bubblewrap needs unconfined outer profiles; no other engine inherits them. */
-export declare function containerSecurityOptions(launch: VerifiedNativeLaunch): readonly string[];
-export declare const sandboxPreflightSchema = "spawnfile.training.daimon-native.sandbox-preflight.v1";
-export declare const sandboxChecks: readonly ["namespace", "workspaceRead", "workspaceWrite", "runDenied", "authDenied", "ingressDenied", "networkDenied"];
-/** Shared verbatim by the emitted command and transition tests. A timeout proves nothing. */
-export declare const sandboxNetworkProbeScript = "\nlet settled=false;\nconst socket=net.connect({host:'127.0.0.1',port});\nconst fail=message=>{if(settled)return;settled=true;socket.destroy();process.stderr.write(message);process.exitCode=1;};\nsocket.once('connect',()=>fail('Sandbox network reachable'));\nsocket.once('error',()=>{if(settled)return;settled=true;socket.destroy();fs.writeFileSync('complete','SANDBOX_CHECKS_PASSED');});\nsocket.setTimeout(750,()=>fail('Sandbox network probe timed out'));";
-/** Runs only local sandbox commands with non-secret canaries and a fresh Codex home. */
-export declare const sandboxPreflightScript: string;
-export declare function verifyNativeSandbox(run: DockerCommand, name: string, launch: VerifiedNativeLaunch, trialId: string, signal?: AbortSignal): Promise<void>;

package/dist/runtime/daimon/training/native/container/preflight.js

@@ -1,79 +0,0 @@
-import { canonicalWireId } from '../../../../../training/index.js';
-import { writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { verifyPreparedNativeSandbox } from './native-preflight.js';
-/** Same namespace compatibility policy as Spawnfile's strict native Codex launch. */
-export const codexSandboxContainerSecurity = ['--security-opt', 'seccomp=unconfined', '--security-opt', 'apparmor=unconfined'];
-/** Separate-container Grok needs a broker, realm and root slot supervisor this adapter does not own. */
-export const grokContainerUnsupported = 'Separate-container Grok native trials are unsupported: run Grok through child-process execution in the broker-capable training container';
-/** Codex's bubblewrap needs unconfined outer profiles; no other engine inherits them. */
-export function containerSecurityOptions(launch) {
-    if (launch.agent.engine !== 'codex')
-        throw new Error(grokContainerUnsupported);
-    return codexSandboxContainerSecurity;
-}
-export const sandboxPreflightSchema = 'spawnfile.training.daimon-native.sandbox-preflight.v1';
-export const sandboxChecks = ['namespace', 'workspaceRead', 'workspaceWrite', 'runDenied', 'authDenied', 'ingressDenied', 'networkDenied'];
-/** Shared verbatim by the emitted command and transition tests. A timeout proves nothing. */
-export const sandboxNetworkProbeScript = `
-let settled=false;
-const socket=net.connect({host:'127.0.0.1',port});
-const fail=message=>{if(settled)return;settled=true;socket.destroy();process.stderr.write(message);process.exitCode=1;};
-socket.once('connect',()=>fail('Sandbox network reachable'));
-socket.once('error',()=>{if(settled)return;settled=true;socket.destroy();fs.writeFileSync('complete','SANDBOX_CHECKS_PASSED');});
-socket.setTimeout(750,()=>fail('Sandbox network probe timed out'));`;
-/** Runs only local sandbox commands with non-secret canaries and a fresh Codex home. */
-export const sandboxPreflightScript = `
-import {execFile} from 'node:child_process';
-import {promisify} from 'node:util';
-import {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';
-import {join} from 'node:path';
-import {createServer} from 'node:net';
-const execute=promisify(execFile);
-const input=JSON.parse(await new Promise(resolve=>{let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',v=>s+=v);process.stdin.on('end',()=>resolve(s));}));
-const scratch=await mkdtemp(join(input.workspace,'.spawnfile-training-sandbox-preflight-'));
-let controls; let server;
-try {
-  controls=await mkdtemp(join(input.controlRoot,'.sandbox-preflight-'));
-  const home=join(scratch,'home'), workspace=join(scratch,'workspace'), ingress=join(home,'.daimon-inbound');
-  await mkdir(join(home,'.codex'),{recursive:true,mode:448}); await mkdir(workspace,{mode:448}); await mkdir(ingress,{mode:448});
-  const auth=join(home,'.codex','auth.json'), inbound=join(ingress,'canary'), control=join(controls,'canary');
-  await writeFile(auth,'{}',{mode:384}); await writeFile(inbound,'non-secret ingress canary',{mode:384}); await writeFile(control,'non-secret control canary',{mode:384});
-  await writeFile(join(workspace,'input'),'read-proof',{mode:384});
-  for (const file of [auth,inbound,control]) if (!(await readFile(file)).length) throw Error('Missing outside-sandbox canary');
-  server=createServer(socket=>socket.destroy());
-  await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(0,'127.0.0.1',resolve);});
-  const port=server.address().port;
-  const env={PATH:process.env.PATH,HOME:home,CODEX_HOME:join(home,'.codex'),TMPDIR:'/tmp',LANG:'C.UTF-8'};
-  await execute('bwrap',['--unshare-user','--uid','0','--gid','0','--ro-bind','/','/','--proc','/proc','--dev','/dev','--','/bin/true'],{env,timeout:10000,maxBuffer:65536});
-  const profile='permissions={preflight={extends=":workspace",filesystem={":workspace_roots"={"."="write"},"/run"="deny","/proc"="deny",'+JSON.stringify(auth)+'="deny",'+JSON.stringify(ingress)+'="deny"},network={enabled=false}}}';
-  const command=\`const fs=require('node:fs'),net=require('node:net');
-if(fs.readFileSync('input','utf8')!=='read-proof')throw Error('Workspace read failed');
-fs.writeFileSync('output','write-proof');
-for(const file of \${JSON.stringify([control,auth,inbound])}) { let denied=false; try{fs.readFileSync(file);}catch{denied=true;} if(!denied)throw Error('Protected canary is readable'); }
-const port=\${port};
-${sandboxNetworkProbeScript}\`;
-  await execute('codex',['sandbox','-P','preflight','-C',workspace,'-c',profile,'--','/usr/local/bin/node','-e',command],{env,timeout:12000,maxBuffer:65536});
-  if(await readFile(join(workspace,'complete'),'utf8')!=='SANDBOX_CHECKS_PASSED'||await readFile(join(workspace,'output'),'utf8')!=='write-proof')throw Error('Sandbox did not complete its actual command');
-  process.stdout.write(JSON.stringify({schema:'${sandboxPreflightSchema}',modelCallsMade:0,checks:Object.fromEntries(${JSON.stringify(sandboxChecks)}.map(key=>[key,true]))}));
-} finally {
-  if(server)await new Promise(resolve=>server.close(resolve));
-  if(controls)await rm(controls,{recursive:true,force:true});
-  await rm(scratch,{recursive:true,force:true});
-}
-`;
-export async function verifyNativeSandbox(run, name, launch, trialId, signal) {
-    const result = await run(['exec', '-i', name, '/usr/local/bin/node', '--input-type=module', '-e', sandboxPreflightScript], {
-        signal, timeoutMs: 25_000, stdin: JSON.stringify({ path: 'sandbox-preflight', workspace: launch.workspace.target, controlRoot: '/run/spawnfile-training/control' }),
-    });
-    if (result.code !== 0)
-        throw new Error(`Native sandbox preflight failed before cognition: ${result.stderr.slice(-3000)}`);
-    const proof = JSON.parse(result.stdout);
-    if (canonicalWireId(proof.schema) !== sandboxPreflightSchema || proof.modelCallsMade !== 0 || sandboxChecks.some(check => proof.checks?.[check] !== true)) {
-        throw new Error('Native sandbox preflight omitted substantive enforcement evidence');
-    }
-    const nativePolicy = await verifyPreparedNativeSandbox(run, name, launch, trialId, signal);
-    await writeFile(join(dirname(launch.receiptFile), 'sandbox-preflight.json'), `${JSON.stringify({ ...proof, trialId,
-        image: launch.image, configSha256: launch.configSha256, nativePolicy, outerCompatibility: [...codexSandboxContainerSecurity] }, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
-}
-//# sourceMappingURL=preflight.js.map

package/dist/runtime/daimon/training/native/container/preflight.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEpE,qFAAqF;AACrF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,qBAAqB,CAAU,CAAC;AACxI,wGAAwG;AACxG,MAAM,CAAC,MAAM,wBAAwB,GAAG,0IAA0I,CAAC;AAEnL,yFAAyF;AACzF,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/E,OAAO,6BAA6B,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,uDAAuD,CAAC;AAC9F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,CAAU,CAAC;AAEpJ,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;oEAM2B,CAAC;AAErE,wFAAwF;AACxF,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BpC,yBAAyB;;;iDAGsB,sBAAsB,gDAAgD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;CAMnJ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAkB,EAAE,IAAY,EAAE,MAA4B,EACtG,OAAe,EAAE,MAAoB;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,IAAI,EAAE,sBAAsB,CAAC,EAAE;QACzH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;KACpK,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAmF,CAAC;IAC1H,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,sBAAsB,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1J,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3F,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO;QAChH,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,GAAG,6BAA6B,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/K,CAAC"}

package/dist/runtime/daimon/training/native/container/slot.d.ts

@@ -1,4 +0,0 @@
-import type { TrialSlot } from '../../../../../training/index.js';
-import { type NativeLaunch } from '../receipt/index.js';
-/** Verify the project-written receipt before copying it to the owned child. */
-export declare function assertLeasedLaunch(launch: NativeLaunch, slot: TrialSlot): void;

package/dist/runtime/daimon/training/native/container/slot.js

@@ -1,58 +0,0 @@
-import { isGrokLaunch } from '../receipt/index.js';
-/** Verify the project-written receipt before copying it to the owned child. */
-export function assertLeasedLaunch(launch, slot) {
-    if (slot.isolation === 'shared-uid') {
-        if (isGrokLaunch(launch) || slot.workerUid !== process.geteuid?.()) {
-            throw new Error('Native launch does not belong to the leased shared-uid slot');
-        }
-        if (!Number.isSafeInteger(slot.ports.base) || slot.ports.base < 1024 ||
-            !Number.isSafeInteger(slot.ports.count) || slot.ports.count < 1 || slot.ports.base + slot.ports.count > 65536) {
-            throw new Error('Invalid native leased port block');
-        }
-        if (!Number.isSafeInteger(launch.host.port))
-            throw new Error('Native control port must be an integer');
-        if (launch.host.port < slot.ports.base || launch.host.port >= slot.ports.base + slot.ports.count) {
-            throw new Error('Native control port escapes the leased slot');
-        }
-        const paths = {
-            workspace: [launch.workspace],
-            controlRoot: [{ source: launch.controlRoot, target: launch.controlRoot }],
-        };
-        for (const row of launch.projections) {
-            const name = row.role === 'home' ? 'runtimeHome' : row.role;
-            (paths[name] ??= []).push(row);
-        }
-        for (const [name, root] of Object.entries(slot.roots)) {
-            const matches = paths[name];
-            const declared = matches?.[0];
-            if (matches?.length !== 1 || !declared || declared.source !== root || declared.target !== root) {
-                throw new Error(`Native launch differs from leased slot root: ${name}`);
-            }
-        }
-        return;
-    }
-    if (!isGrokLaunch(launch))
-        throw new Error('Leased native launch requires broker slot evidence');
-    if (launch.broker.slot !== slot.index || launch.broker.workerUid !== slot.workerUid) {
-        throw new Error('Native launch does not belong to the leased slot identity');
-    }
-    const paths = {
-        workspace: launch.workspace.source,
-        runtimeHome: launch.projections.find(row => row.role === 'home').source,
-        workerHome: launch.broker.workerHomePath,
-        usageLedger: launch.broker.usageLedgerPath,
-        preflightReceipt: launch.broker.slotPreflightReceipt,
-        controlRoot: launch.controlRoot,
-    };
-    for (const [name, path] of Object.entries(paths)) {
-        if (slot.roots[name] !== path)
-            throw new Error(`Native launch differs from leased slot root: ${name}`);
-    }
-    if (!Number.isSafeInteger(launch.host.port))
-        throw new Error('Native control port must be an integer');
-    if (launch.workspace.target !== paths.workspace || launch.projections[0].target !== paths.runtimeHome ||
-        launch.host.port < slot.ports.base || launch.host.port >= slot.ports.base + slot.ports.count) {
-        throw new Error('Native launch paths or control port escape the leased slot');
-    }
-}
-//# sourceMappingURL=slot.js.map

package/dist/runtime/daimon/training/native/container/slot.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"slot.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/container/slot.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAqB,MAAM,qBAAqB,CAAC;AAEtE,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,IAAe;IACtE,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACpC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI;YAChE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACvG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,GAAyD;YAClE,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;YAC7B,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;SAC1E,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAC5D,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,OAAO,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC/F,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC,MAAM;QACxE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc;QACxC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe;QAC1C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB;QACpD,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW;QAClG,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/runtime/daimon/training/native/external.d.ts

@@ -1,37 +0,0 @@
-import type { ObservationCoverage, Usage } from '../../../../training/index.js';
-import type { NativeLaunch } from './receipt/index.js';
-import { type ExternalInputSource, type TerminalEvidence } from './worker/index.js';
-import { type PreparedTransportDelivery } from './transport/index.js';
-export interface NativeExternalInput {
-    id: string;
-    text: string;
-    source: ExternalInputSource;
-    transport?: PreparedTransportDelivery;
-}
-export interface NativeExternalInputs {
-    maxDeliveries: number;
-    next(context: {
-        trialId: string;
-        turnId: string;
-        containerName: string;
-        launch: NativeLaunch;
-        terminal: TerminalEvidence;
-    }, signal: AbortSignal): Promise<NativeExternalInput | null>;
-}
-export interface NativeChildExternalInputs {
-    maxDeliveries: number;
-    next(context: {
-        trialId: string;
-        turnId: string;
-        executionId: string;
-        launch: NativeLaunch;
-        terminal: TerminalEvidence;
-    }, signal: AbortSignal): Promise<NativeExternalInput | null>;
-}
-/** A callback may supply evidence; it cannot extend the task deadline or invent a retry. */
-export declare function nextExternalInput<T>(policy: {
-    next(context: T, signal: AbortSignal): Promise<NativeExternalInput | null>;
-}, context: T, deadline: number, signal: AbortSignal): Promise<NativeExternalInput | null>;
-export declare function sumNativeUsage(rows: readonly (Usage | null)[]): Usage | null;
-/** Missing coverage in any wake cannot be repaired by a later complete wake. */
-export declare function weakestNativeCoverage(rows: readonly (readonly ObservationCoverage[] | undefined)[]): ObservationCoverage[];

package/dist/runtime/daimon/training/native/external.js

@@ -1,75 +0,0 @@
-import { verifyExternalSource } from './worker/index.js';
-import { verifyPreparedTransport } from './transport/index.js';
-/** A callback may supply evidence; it cannot extend the task deadline or invent a retry. */
-export async function nextExternalInput(policy, context, deadline, signal) {
-    if (signal.aborted)
-        throw new Error('External input cancelled');
-    const remaining = deadline - Date.now();
-    if (remaining <= 0)
-        throw new Error('Native trial deadline exceeded awaiting external input');
-    const controller = new AbortController();
-    let timer;
-    let abort;
-    const interrupted = new Promise((_resolve, reject) => {
-        abort = () => { controller.abort(); reject(new Error('External input cancelled')); };
-        signal.addEventListener('abort', abort, { once: true });
-        timer = setTimeout(() => { controller.abort(); reject(new Error('Native trial deadline exceeded awaiting external input')); }, remaining);
-    });
-    try {
-        const input = await Promise.race([policy.next(context, controller.signal), interrupted]);
-        if (signal.aborted)
-            throw new Error('External input cancelled');
-        if (input !== null) {
-            const keys = Object.keys(input).sort().join(',');
-            if ((keys !== 'id,source,text' && keys !== 'id,source,text,transport') ||
-                !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(input.id) || !input.text.trim() || Buffer.byteLength(input.text) > 16384)
-                throw new Error('Invalid external input');
-            verifyExternalSource(input.source, input.text);
-            if (keys.endsWith(',transport'))
-                verifyPreparedTransport(input.transport, true);
-        }
-        return input;
-    }
-    finally {
-        clearTimeout(timer);
-        signal.removeEventListener('abort', abort);
-        controller.abort();
-    }
-}
-export function sumNativeUsage(rows) {
-    if (!rows.length || rows.some(row => row === null))
-        return null;
-    const sum = (key) => {
-        const values = rows.map(row => row[key]);
-        if (values.some(value => value === null))
-            return null;
-        const total = values.reduce((sum, value) => sum + value, 0);
-        if (!Number.isSafeInteger(total) || total < 0)
-            throw new Error('Invalid aggregate native usage');
-        return total;
-    };
-    const totals = { inputTokens: sum('inputTokens'), cachedInputTokens: sum('cachedInputTokens'), outputTokens: sum('outputTokens') };
-    // Optional members appear only when a wake reported them, so Codex aggregates keep their exact shape.
-    const extra = {};
-    if (rows.some(row => row.cacheWriteInputTokens !== undefined))
-        extra.cacheWriteInputTokens = rows.some(row => row.cacheWriteInputTokens == null) ? null
-            : rows.reduce((total, row) => total + row.cacheWriteInputTokens, 0);
-    if (rows.some(row => row.notionalUsd !== undefined))
-        extra.notionalUsd = rows.some(row => row.notionalUsd == null) ? null
-            : rows.reduce((total, row) => total + row.notionalUsd, 0);
-    return rows.length === 1 ? { ...rows[0], ...totals }
-        : { ...totals, ...extra, reasoningTokens: null, source: 'noopolis.daimon.turn-usage.v1' };
-}
-/** Missing coverage in any wake cannot be repaired by a later complete wake. */
-export function weakestNativeCoverage(rows) {
-    const channels = new Set(rows.flatMap(row => row?.map(item => item.channel) ?? []));
-    return [...channels].map(channel => {
-        const values = rows.map(row => row?.find(item => item.channel === channel));
-        const completeness = values.some(value => !value || value.completeness === 'absent') ? 'absent'
-            : values.some(value => value?.completeness === 'partial') ? 'partial' : 'complete';
-        const ordering = values.every(value => value?.ordering === 'causal') ? 'causal'
-            : values.every(value => value && value.ordering !== 'none') ? 'source' : 'none';
-        return { channel, completeness, ordering };
-    });
-}
-//# sourceMappingURL=external.js.map

package/dist/runtime/daimon/training/native/external.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"external.js","sourceRoot":"","sources":["../../../../../src/runtime/daimon/training/native/external.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAmD,MAAM,mBAAmB,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAkC,MAAM,sBAAsB,CAAC;AAe/F,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAI,MAAsF,EAAE,OAAU,EAC3I,QAAgB,EAAE,MAAmB;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,IAAI,KAAkB,CAAC;IACvB,MAAM,WAAW,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QAC1D,KAAK,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5I,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,0BAA0B,CAAC;gBAClE,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACrK,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,uBAAuB,CAAC,KAAK,CAAC,SAAU,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAA+B;IAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,GAAyD,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAS,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAM,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACjG,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;IACnI,sGAAsG;IACtG,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;QAAE,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACvJ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,GAAI,CAAC,qBAAsB,EAAE,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAI,CAAC,WAAW,KAAK,SAAS,CAAC;QAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAI,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACzH,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,GAAI,CAAC,WAAY,EAAE,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,EAAE,GAAG,MAAM,EAAE;QACnD,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;AAC9F,CAAC;AAGD,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,IAA6D;IACjG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;YAC7F,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ;YAC7E,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/daimon/training/native/grants/authority.d.ts

@@ -1,36 +0,0 @@
-import { type GrokClientConfigInput, type GrokInferenceGrant, type GrokInferenceGrantAuthority } from '../../providers/grok-broker/index.js';
-/** Structural slice of `@noopolis/daimon/runtime` this binding uses. */
-export interface DaimonGrantModule {
-    EngineBrokerControlClient: new (socketPath: string) => {
-        requestInferenceGrant(request: {
-            model: string;
-            reasoningEffort: string;
-            purpose: string;
-        }): Promise<GrokInferenceGrant>;
-        releaseInferenceGrant(grantId: string): Promise<boolean>;
-    };
-    EngineBrokerInferenceGrantRefused: new (...args: never[]) => Error & {
-        code: string;
-    };
-    renderGrokInferenceClientConfig(input: GrokClientConfigInput): string;
-    GROK_INFERENCE_CLIENT_MODEL_ID: string;
-    GROK_INFERENCE_GRANT_ENV: string;
-    GROK_INFERENCE_PROXY_BASE_URL: string;
-    GROK_ENGINE_BROKER: {
-        inferenceGrants: {
-            maxLiveGrants: number;
-            failureCodes: readonly string[];
-            client: {
-                modelId: string;
-                envKey: string;
-                configSha256: unknown;
-            };
-        };
-    };
-}
-export { grokBrokerControlSocketEnv, grokGrantHomeRootEnv } from '../../providers/grok-broker/index.js';
-/**
- * Daimon-backed grant authority over the control socket the training container
- * supplies. Every precondition failure throws; nothing falls back to a desktop login.
- */
-export declare function loadDaimonGrokGrantAuthority(socketPath: string | undefined, load?: () => Promise<unknown>): Promise<GrokInferenceGrantAuthority>;

package/dist/runtime/daimon/training/native/grants/authority.js

@@ -1,49 +0,0 @@
-import { lstat } from 'node:fs/promises';
-import path from 'node:path';
-import { isDeepStrictEqual } from 'node:util';
-import { GrokGrantRefusal, grokGrantRefusalCodes } from '../../providers/grok-broker/index.js';
-import { daimonGrokInferenceClientPin as PIN } from './pins.js';
-import { grokBrokerControlSocketEnv } from '../../providers/grok-broker/index.js';
-export { grokBrokerControlSocketEnv, grokGrantHomeRootEnv } from '../../providers/grok-broker/index.js';
-const loadRuntime = async () => {
-    const packageName = '@noopolis/daimon/runtime';
-    return import(packageName);
-};
-/**
- * Daimon-backed grant authority over the control socket the training container
- * supplies. Every precondition failure throws; nothing falls back to a desktop login.
- */
-export async function loadDaimonGrokGrantAuthority(socketPath, load = loadRuntime) {
-    if (socketPath === undefined || !path.isAbsolute(socketPath))
-        throw new Error(`${grokBrokerControlSocketEnv} must name the broker control socket`);
-    const socket = await lstat(socketPath).catch(() => undefined);
-    if (socket === undefined || !socket.isSocket())
-        throw new Error('Grok broker control socket is unavailable');
-    let daimon;
-    try {
-        daimon = await load();
-    }
-    catch (error) {
-        throw new Error('Install optional @noopolis/daimon with its public /runtime export for broker-grant inference', { cause: error });
-    }
-    const grants = daimon.GROK_ENGINE_BROKER?.inferenceGrants;
-    if (typeof daimon.EngineBrokerControlClient !== 'function' || typeof daimon.EngineBrokerInferenceGrantRefused !== 'function' ||
-        typeof daimon.renderGrokInferenceClientConfig !== 'function' || grants === undefined)
-        throw new Error('Installed Daimon lacks evaluator inference grants');
-    if (daimon.GROK_INFERENCE_CLIENT_MODEL_ID !== PIN.modelId || daimon.GROK_INFERENCE_GRANT_ENV !== PIN.envKey || daimon.GROK_INFERENCE_PROXY_BASE_URL !== PIN.proxyBaseUrl ||
-        grants.maxLiveGrants !== PIN.maxLiveGrants || !isDeepStrictEqual([...grants.failureCodes], PIN.failureCodes) || grants.client.modelId !== PIN.modelId ||
-        grants.client.envKey !== PIN.envKey || !isDeepStrictEqual(grants.client.configSha256, PIN.configSha256)) {
-        throw new Error('Installed Daimon inference client contract differs from the Training pin');
-    }
-    const client = new daimon.EngineBrokerControlClient(socketPath);
-    const refusal = (error) => error instanceof daimon.EngineBrokerInferenceGrantRefused && grokGrantRefusalCodes.includes(error.code)
-        ? new GrokGrantRefusal(error.code) : error;
-    return Object.freeze({
-        clientModelId: PIN.modelId, envKey: PIN.envKey, maxLiveGrants: PIN.maxLiveGrants,
-        request: input => client.requestInferenceGrant(input).catch((error) => { throw refusal(error); }),
-        release: grantId => client.releaseInferenceGrant(grantId).catch((error) => { throw refusal(error); }),
-        renderClientConfig: input => daimon.renderGrokInferenceClientConfig(input),
-        pinnedClientConfigSha256: (model, reasoningEffort) => PIN.configSha256[model]?.[reasoningEffort],
-    });
-}
-//# sourceMappingURL=authority.js.map

package/dist/runtime/daimon/training/native/grants/authority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/grants/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EACZ,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,4BAA4B,IAAI,GAAG,EAAE,MAAM,WAAW,CAAC;AAgBhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAExG,MAAM,WAAW,GAAG,KAAK,IAAsB,EAAE;IAC/C,MAAM,WAAW,GAAG,0BAA0B,CAAC;IAC/C,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,UAA8B,EAAE,OAA+B,WAAW;IAC3H,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,0BAA0B,sCAAsC,CAAC,CAAC;IACnJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC7G,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,IAAI,EAAuB,CAAC;IAAC,CAAC;IACnD,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,8FAA8F,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IACpJ,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,yBAAyB,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,iCAAiC,KAAK,UAAU;QAC1H,OAAO,MAAM,CAAC,+BAA+B,KAAK,UAAU,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7J,IAAI,MAAM,CAAC,8BAA8B,KAAK,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,wBAAwB,KAAK,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,6BAA6B,KAAK,GAAG,CAAC,YAAY;QACtK,MAAM,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;QACrJ,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,YAAY,MAAM,CAAC,iCAAiC,IAAK,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACzK,CAAC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAA4B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa;QAChF,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1G,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,+BAA+B,CAAC,KAAK,CAAC;QAC1E,wBAAwB,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,CAAE,GAAG,CAAC,YAAyE,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC;KACzH,CAAC,CAAC;AAC3C,CAAC"}

package/dist/runtime/daimon/training/native/grants/index.d.ts

@@ -1,2 +0,0 @@
-export { grokBrokerControlSocketEnv, grokGrantHomeRootEnv, loadDaimonGrokGrantAuthority, type DaimonGrantModule } from './authority.js';
-export { daimonGrokInferenceClientPin } from './pins.js';

package/dist/runtime/daimon/training/native/grants/index.js

@@ -1,3 +0,0 @@
-export { grokBrokerControlSocketEnv, grokGrantHomeRootEnv, loadDaimonGrokGrantAuthority } from './authority.js';
-export { daimonGrokInferenceClientPin } from './pins.js';
-//# sourceMappingURL=index.js.map

package/dist/runtime/daimon/training/native/grants/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/grants/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,4BAA4B,EAA0B,MAAM,gBAAgB,CAAC;AACxI,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC"}

package/dist/runtime/daimon/training/native/grants/pins.d.ts

@@ -1,30 +0,0 @@
-/**
- * Training's pin of Daimon's evaluator inference client contract
- * (`GROK_ENGINE_BROKER.inferenceGrants` in runtime-contract-manifest v4, Grok CLI 1.0.34).
- * These inference-only bytes are unchanged by the clocked subject worker config.
- * Independent of the installed Daimon so drift in either side fails closed.
- */
-export declare const daimonGrokInferenceClientPin: Readonly<{
-    modelId: "daimon-inference-grok";
-    envKey: "DAIMON_INFERENCE_GRANT";
-    proxyBaseUrl: "http://127.0.0.1:43123/v1";
-    maxLiveGrants: 8;
-    failureCodes: string[];
-    configSha256: {
-        'grok-4.6': {
-            low: string;
-            medium: string;
-            high: string;
-        };
-        'grok-4.5': {
-            low: string;
-            medium: string;
-            high: string;
-        };
-        'grok-build': {
-            low: string;
-            medium: string;
-            high: string;
-        };
-    };
-}>;

package/dist/runtime/daimon/training/native/grants/pins.js

@@ -1,20 +0,0 @@
-import { grokGrantEnvKey } from '../../providers/grok-broker/index.js';
-/**
- * Training's pin of Daimon's evaluator inference client contract
- * (`GROK_ENGINE_BROKER.inferenceGrants` in runtime-contract-manifest v4, Grok CLI 1.0.34).
- * These inference-only bytes are unchanged by the clocked subject worker config.
- * Independent of the installed Daimon so drift in either side fails closed.
- */
-export const daimonGrokInferenceClientPin = Object.freeze({
-    modelId: 'daimon-inference-grok',
-    envKey: grokGrantEnvKey,
-    proxyBaseUrl: 'http://127.0.0.1:43123/v1',
-    maxLiveGrants: 8,
-    failureCodes: ['auth_stale', 'grant_limit', 'invalid_request', 'unavailable'],
-    configSha256: {
-        'grok-4.6': { low: '79314d039f787e4ebfec7dacf57adc969086b948f564dec008f0ed6367e6062f', medium: '6f538de0547c0c4e6a3f04ae08595ceadadabb06b75f6b6ee4c428744bb95cd8', high: '5652656effa82f0c4f09cf8226b16e6140332a5a358b571194bb5563312367ac' },
-        'grok-4.5': { low: 'a07f7436f1268bb399ec233c65d3b3d8fb99a11a1f175f8da1ca133c9367bc74', medium: '1f4c0d4dad1f3b09419b5739db6423a09e0049abc091594c64123a75dd53dfb9', high: 'ffbc33728b821e9854fbc7c93601e599225da421ecfd6ebf10d314afcc28d6f2' },
-        'grok-build': { low: 'ca15c6a562a008227d39c51d3a3a83715663089b3784e8b46debb1fb67b3c4a1', medium: '01783fb6beadcf6f8486fff0836820ad43fab5662b812a907fe9cfdb83e9804d', high: '98d16f2b7d12f4eb540d625c853e51d227933e204923e43e8b9b4176f10aca2c' },
-    },
-});
-//# sourceMappingURL=pins.js.map

package/dist/runtime/daimon/training/native/grants/pins.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pins.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/grants/pins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAsD,MAAM,sCAAsC,CAAC;AAE3H;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,uBAAuB;IAChC,MAAM,EAAE,eAAe;IACvB,YAAY,EAAE,2BAA2B;IACzC,aAAa,EAAE,CAAC;IAChB,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAC;IAC7E,YAAY,EAAE;QACZ,UAAU,EAAE,EAAE,GAAG,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAE,IAAI,EAAE,kEAAkE,EAAE;QAC7O,UAAU,EAAE,EAAE,GAAG,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAE,IAAI,EAAE,kEAAkE,EAAE;QAC7O,YAAY,EAAE,EAAE,GAAG,EAAE,kEAAkE,EAAE,MAAM,EAAE,kEAAkE,EAAE,IAAI,EAAE,kEAAkE,EAAE;KACrK;CAC7E,CAAC,CAAC"}

package/dist/runtime/daimon/training/native/grants/test-socket.d.ts

@@ -1,6 +0,0 @@
-/** Test-only broker control socket speaking Daimon's length-prefixed JSON frames with scripted answers. */
-export declare function scriptedBrokerSocket(answer: (request: Record<string, unknown>) => Record<string, unknown> | undefined): Promise<{
-    socketPath: string;
-    received: Record<string, unknown>[];
-    close: () => Promise<void>;
-}>;

package/dist/runtime/daimon/training/native/grants/test-socket.js

@@ -1,35 +0,0 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { createServer } from 'node:net';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-/** Test-only broker control socket speaking Daimon's length-prefixed JSON frames with scripted answers. */
-export async function scriptedBrokerSocket(answer) {
-    const dir = await mkdtemp(path.join(tmpdir(), 'training-broker-'));
-    const socketPath = path.join(dir, 'control.sock');
-    const received = [];
-    const server = createServer(connection => {
-        let buffered = Buffer.alloc(0);
-        connection.on('data', chunk => {
-            buffered = Buffer.concat([buffered, chunk]);
-            while (buffered.length >= 4 && buffered.length >= buffered.readUInt32BE(0) + 4) {
-                const length = buffered.readUInt32BE(0);
-                const request = JSON.parse(buffered.subarray(4, 4 + length).toString('utf8'));
-                buffered = buffered.subarray(4 + length);
-                received.push(request);
-                const response = answer(request);
-                if (response === undefined) {
-                    connection.destroy();
-                    return;
-                }
-                const body = Buffer.from(JSON.stringify({ version: request['version'], requestId: request['requestId'], ...response }));
-                const frame = Buffer.alloc(4 + body.length);
-                frame.writeUInt32BE(body.length);
-                body.copy(frame, 4);
-                connection.write(frame);
-            }
-        });
-    });
-    await new Promise(resolve => server.listen(socketPath, resolve));
-    return { socketPath, received, close: async () => { await new Promise(resolve => server.close(resolve)); await rm(dir, { recursive: true, force: true }); } };
-}
-//# sourceMappingURL=test-socket.js.map

package/dist/runtime/daimon/training/native/grants/test-socket.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"test-socket.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/grants/test-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAe,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAiF;IAC1H,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAW,YAAY,CAAC,UAAU,CAAC,EAAE;QAC/C,IAAI,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC5B,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5C,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;gBACzG,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;gBACzC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACxH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChK,CAAC"}

package/dist/runtime/daimon/training/native/grok-fixtures.d.ts

@@ -1,34 +0,0 @@
-import { type GrokBrokerProjection, type GrokSlotPreflight } from './receipt/grok.js';
-import type { GrokNativeLaunch, NativeLaunch } from './receipt/index.js';
-import type { NativeConfig } from './worker/index.js';
-/** Byte-exact outputs from Daimon public projection v3 resolver. */
-export declare const daimonProjectionGolden: GrokBrokerProjection;
-export declare const daimonProjectionGoldenSha256 = "eb9fe5430db97b3e9aea8d3a4ec4b2a4771db15917d7c41594338599d96932f5";
-export declare const daimonClockedProjectionGolden: GrokBrokerProjection;
-export declare const daimonClockedProjectionGoldenSha256 = "c06709c076b4ba1a15c10f0f3f7c1bcd46217355d81e1cfb7d1d2c25194fbd68";
-export declare const fixtureNonce = "5f0e2a1c9b8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f";
-/**
- * The caller-protected paths a Grok trial declares.
- *
- * Always evaluator roots the slot receipt denies to the worker uid — never the
- * subject's own workspace or runtime home, which are the two writable roots.
- */
-export declare const grokProtectedPaths: (root: string) => string[];
-/**
- * Turns a Codex launch fixture into a Grok v2 child launch shaped like the
- * broker-capable training container.
- *
- * The container fixes `<slot>/workspace`, `<slot>/runtime-home` and
- * `<slot>/state` as siblings and keeps every Training control input in the
- * denied `/run/spawnfile-training` root, so the fixture root stands in for the slot root:
- * the trial runtime home is the single writable projection, the control root is
- * its sibling `state/`, and config/token/env move into the denied `training/`
- * evaluator root. Every evaluator root is a real directory under `root`.
- */
-export declare function grokLaunchFrom<T extends NativeLaunch>(launch: T, root: string, runtimeHome?: string): Promise<T & GrokNativeLaunch>;
-/** The training container resolves the slot projection from a one-agent config with no peers and no Mneme projection. */
-export declare function grokConfigFor(config: NativeConfig): NativeConfig;
-/** What Daimon's resolver returns for this launch when its inputs are passed through unchanged. */
-export declare function grokProjectionFor(launch: GrokNativeLaunch, extraDeny?: readonly string[]): GrokBrokerProjection;
-export declare function slotPreflightFor(projection: GrokBrokerProjection, paths?: string[], generation?: number, nonce?: string): GrokSlotPreflight;
-export declare function writeGrokSlotReceipt(launch: GrokNativeLaunch, value?: unknown): Promise<void>;