spawnfile 0.1.33 → 0.1.35

package/dist/runtime/daimon/training/native/receipt/schema.js

@@ -1,138 +0,0 @@
-import { DAIMON_BROKER_ENGINE_ID, DAIMON_PORTABLE_ENGINE_ID, DAIMON_GROK_BROKER_MODELS, DAIMON_GROK_BROKER_REASONING_EFFORTS, daimonTrainingDeclaration } from '../../../index.js';
-import { compatibleWireLiteral } from '../../../../../training/index.js';
-import { isAbsolute, posix } from 'node:path';
-import { z } from 'zod';
-import { nativeTaskClockSchema } from './task-clock.js';
-const absolute = z.string().min(1).refine(value => isAbsolute(value) && !value.includes(','), 'Expected absolute bind-safe path');
-const nativePath = absolute.refine(value => posix.isAbsolute(value) && posix.normalize(value) === value, 'Expected canonical Linux path');
-const digest = z.string().regex(/^[a-f0-9]{64}$/u);
-const identity = z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u);
-const relative = z.string().min(1).refine(value => !posix.isAbsolute(value) && posix.normalize(value) === value &&
-    value !== '..' && !value.startsWith('..') && !value.includes('\\'), 'Expected contained relative path');
-const reason = z.string().trim().min(1).max(2048);
-const positive = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-/** Engines a launch receipt can select. v1 receipts are always Codex. */
-export const nativeEngines = z.enum(daimonTrainingDeclaration.engines);
-/** Daimon's closed Grok broker lists; the launch records the declaration, never a default. */
-export const grokModels = DAIMON_GROK_BROKER_MODELS;
-export const grokReasoningEfforts = DAIMON_GROK_BROKER_REASONING_EFFORTS;
-/** Evaluator roots every Grok slot must deny to its worker uid (R4). */
-export const grokEvaluatorRoles = ['run-root', 'context', 'sealed-inputs', 'judge-home', 'slot-ledger'];
-const common = {
-    delivery: z.enum(['direct', 'transport']).optional(),
-    taskClock: nativeTaskClockSchema.optional(),
-    image: z.string().regex(/^(?:sha256:[a-f0-9]{64}|[^\s]+@sha256:[a-f0-9]{64})$/u),
-    config: absolute,
-    configSha256: digest,
-    sourceConfigSha256: digest,
-    tokenFile: absolute,
-    controlRoot: absolute,
-    workerRoot: absolute,
-    envFile: absolute,
-    host: z.strictObject({ bindHost: z.literal('127.0.0.1'), port: z.number().int().min(1024).max(65535) }),
-    instructions: z.strictObject({ relativePath: relative, sha256: digest,
-        rendering: z.strictObject({ kind: z.literal('trim-surround'), prefix: z.string().max(262144), suffix: z.string().max(262144), nativeSha256: digest }) }),
-    workspace: z.strictObject({ source: absolute, target: nativePath }),
-    projections: z.array(z.strictObject({ role: z.enum(['home', 'memory', 'transport', 'state', 'subscription']), source: absolute, target: nativePath })).min(1).max(24),
-    bootstrap: z.strictObject({ root: absolute, entrypoint: relative }).optional(),
-    limits: z.strictObject({ maxTokens: z.number().int().positive(), wakeTokenCeiling: z.number().int().positive() }),
-    overrides: z.strictObject({
-        schedule: z.strictObject({ before: z.record(z.string(), z.unknown()), after: z.strictObject({ kind: z.literal('disabled') }), reason }),
-        selection: z.strictObject({ before: z.array(identity).min(1).max(64), after: z.array(identity).length(1), reason }),
-    }),
-};
-const credential = z.strictObject({ source: absolute, target: nativePath });
-const codexAgent = z.strictObject({ id: identity, engine: z.literal(DAIMON_PORTABLE_ENGINE_ID), model: z.string().trim().min(1).max(256) });
-const grokAgent = z.strictObject({ id: identity, engine: z.literal(DAIMON_BROKER_ENGINE_ID), model: z.enum(grokModels), reasoningEffort: z.enum(grokReasoningEfforts) });
-/**
- * The inputs Daimon's `resolveOrganizationGrokBrokerProjection` needs, plus the
- * digest the slot supervisor bound and the supervisor's receipt location.
- *
- * `denyPaths` and `profileSha256` are the provisioner's own values, carried
- * verbatim: the projection digest binds the sandbox profile bytes the root
- * supervisor actually wrote, so a party that recomputed the deny list from
- * anything else (for instance from `evaluatorPaths`, which is a subset used for
- * the canary requirement) would fork the digest and fail closed here. Every
- * party that recomputes this projection passes these same values.
- */
-export const grokBrokerLaunchSchema = z.strictObject({
-    projectionVersion: z.literal('noopolis.daimon.grok-broker-projection.v3'),
-    workerConfigVariant: z.enum(['unclocked', 'clocked']),
-    projectionSha256: digest,
-    slot: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-    workerUid: z.number().int().min(2200).max(4_294_967_294),
-    workerHomePath: nativePath,
-    architecture: z.enum(['arm64', 'x64']),
-    usageLedgerPath: nativePath,
-    seccompProfileSha256: digest,
-    profileSha256: digest,
-    denyPaths: z.array(nativePath).min(1).max(64),
-    limits: z.strictObject({ maxRequests: positive, maxTokens: positive, timeoutMs: positive }),
-    evaluatorPaths: z.array(z.strictObject({ role: z.enum(grokEvaluatorRoles), path: nativePath })).min(grokEvaluatorRoles.length).max(64),
-    /** Root slot supervisor output (`noopolis.daimon.grok-slot-preflight.v2`), written after provisioning or recycle. */
-    slotPreflightReceipt: nativePath,
-    /** The 32-byte hex nonce Training sent with this trial's recycle request; the receipt must echo it. */
-    expectedNonce: digest,
-    /** One above the last generation Training accepted for this slot (1 for an unseen slot). */
-    minGeneration: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
-});
-const launchV1 = z.strictObject({ schema: compatibleWireLiteral('spawnfile.training.daimon-native.launch.v1'), ...common, agent: codexAgent, credentials: z.array(credential).max(1) });
-const codexLaunchV2 = z.strictObject({ schema: compatibleWireLiteral('spawnfile.training.daimon-native.launch.v2'), ...common, agent: codexAgent, credentials: z.array(credential).max(1) });
-const grokLaunchV2 = z.strictObject({ schema: compatibleWireLiteral('spawnfile.training.daimon-native.launch.v2'), ...common, agent: grokAgent,
-    credentials: z.array(credential).max(0), broker: grokBrokerLaunchSchema });
-export const nativeLaunchSchema = z.union([launchV1, codexLaunchV2, grokLaunchV2]);
-export const containerPaths = { config: '/run/spawnfile-training/config.json', control: '/run/spawnfile-training/control',
-    token: '/run/spawnfile-training/token', receipt: '/run/spawnfile-training/launch.json', worker: '/opt/training/native',
-    bootstrap: '/opt/training/bootstrap' };
-export function isGrokLaunch(launch) {
-    return launch.agent.engine === DAIMON_BROKER_ENGINE_ID;
-}
-const nested = (parent, child) => child === parent || child.startsWith(parent === '/' ? '/' : `${parent}/`);
-export function parseNativeLaunch(value) {
-    const launch = nativeLaunchSchema.parse(value);
-    if (launch.overrides.selection.after[0] !== launch.agent.id || !launch.overrides.selection.before.includes(launch.agent.id)) {
-        throw new Error('Native selection override must retain exactly the selected declared agent');
-    }
-    if (launch.projections.filter(row => row.role === 'home').length !== 1)
-        throw new Error('Exactly one fresh native home projection is required');
-    if (launch.limits.wakeTokenCeiling > launch.limits.maxTokens)
-        throw new Error('Native wake token ceiling exceeds its admitted token budget');
-    if (isGrokLaunch(launch))
-        assertGrokBroker(launch);
-    return launch;
-}
-function assertGrokBroker(launch) {
-    const { broker } = launch;
-    if (launch.taskClock && broker.workerConfigVariant !== 'clocked')
-        throw new Error('Grok taskClock requires workerConfigVariant: clocked');
-    // A Grok slot has exactly two writable subject roots, and the projection digest binds both:
-    // `workspacePath` and `runtimeHomePath`. Any further projection would be a writable root no
-    // digest covers, so the union is closed here rather than filtered later.
-    if (launch.projections.length !== 1)
-        throw new Error('A Grok launch projects exactly the slot workspace and its runtime home');
-    const paths = broker.evaluatorPaths.map(row => row.path);
-    if (new Set(paths).size !== paths.length)
-        throw new Error('Grok evaluator paths must be unique');
-    if (new Set(broker.denyPaths).size !== broker.denyPaths.length)
-        throw new Error('Grok deny paths must be unique');
-    // The deny list is the provisioner's verbatim set the digest binds; the evaluator roots are the
-    // subset the slot receipt must show as denied canaries. A root outside the deny list would be
-    // certified as denied while the sandbox never masked it.
-    const denied = new Set(broker.denyPaths);
-    const uncovered = paths.filter(path => !denied.has(path));
-    if (uncovered.length)
-        throw new Error(`Grok evaluator roots missing from the deny list: ${uncovered.join(', ')}`);
-    const missing = grokEvaluatorRoles.filter(role => !broker.evaluatorPaths.some(row => row.role === role));
-    if (missing.length)
-        throw new Error(`Grok launch omits required evaluator roots: ${missing.join(', ')}`);
-    if (broker.evaluatorPaths.some(row => row.role === 'slot-ledger' && row.path !== posix.dirname(broker.usageLedgerPath))) {
-        throw new Error('The Grok slot-ledger evaluator root must be the usage ledger directory');
-    }
-    const subject = [launch.workspace.target, ...launch.projections.map(row => row.target)];
-    if (paths.some(path => subject.some(target => nested(path, target) || nested(target, path)))) {
-        throw new Error('Grok evaluator roots cannot overlap subject workspace or projections');
-    }
-    if (broker.limits.maxTokens > launch.limits.wakeTokenCeiling)
-        throw new Error('Grok broker token limit exceeds the launch wake ceiling');
-}
-//# sourceMappingURL=schema.js.map

package/dist/runtime/daimon/training/native/receipt/schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/receipt/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,oCAAoC,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACnL,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAC;AAClI,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,+BAA+B,CAAC,CAAC;AAC1I,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACpF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;IAC7G,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,kCAAkC,CAAC,CAAC;AAC1G,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE1E,yEAAyE;AACzE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACvE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AACzE,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,CAAU,CAAC;AAEjH,MAAM,MAAM,GAAG;IACb,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uDAAuD,CAAC;IAChF,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,MAAM;IACpB,kBAAkB,EAAE,MAAM;IAC1B,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACvG,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;QACnE,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAC1J,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrK,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9E,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjH,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC;QACxB,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACvI,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KACpH,CAAC;CACH,CAAC;AACF,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5I,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;AAEzK;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC;IACzE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACrD,gBAAgB,EAAE,MAAM;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IACxD,cAAc,EAAE,UAAU;IAC1B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,eAAe,EAAE,UAAU;IAC3B,oBAAoB,EAAE,MAAM;IAC5B,aAAa,EAAE,MAAM;IACrB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC3F,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtI,qHAAqH;IACrH,oBAAoB,EAAE,UAAU;IAChC,uGAAuG;IACvG,aAAa,EAAE,MAAM;IACrB,4FAA4F;IAC5F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,4CAA4C,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACxL,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,4CAA4C,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7L,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,4CAA4C,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,SAAS;IAC5I,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AAOnF,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,iCAAiC;IACvH,KAAK,EAAE,+BAA+B,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,sBAAsB;IACtH,SAAS,EAAE,yBAAyB,EAAW,CAAC;AAElD,MAAM,UAAU,YAAY,CAAyB,MAAS;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,uBAAuB,CAAC;AACzD,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAW,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAErI,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5H,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAChJ,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC7I,IAAI,YAAY,CAAC,MAAM,CAAC;QAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAwB;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1I,4FAA4F;IAC5F,4FAA4F;IAC5F,yEAAyE;IACzE,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACjG,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAClH,gGAAgG;IAChG,8FAA8F;IAC9F,yDAAyD;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClH,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAC3I,CAAC"}

package/dist/runtime/daimon/training/native/receipt/subscription.d.ts

@@ -1,13 +0,0 @@
-import type { NativeLaunch } from './schema.js';
-/** The caller supplies one persistent account directory, never a per-trial auth copy. */
-export declare function nativeCodexAccount(launch: NativeLaunch): {
-    realm: {
-        role: "transport" | "subscription" | "state" | "home" | "memory";
-        source: string;
-        target: string;
-    };
-    bootstrap: {
-        source: string;
-        target: string;
-    };
-} | undefined;

package/dist/runtime/daimon/training/native/receipt/subscription.js

@@ -1,13 +0,0 @@
-/** The caller supplies one persistent account directory, never a per-trial auth copy. */
-export function nativeCodexAccount(launch) {
-    if (launch.agent.engine !== 'codex')
-        return undefined;
-    const rows = launch.projections.filter(row => row.role === 'subscription');
-    if (rows.length !== 1)
-        throw new Error('Codex requires exactly one shared subscription realm projection');
-    if (launch.credentials.length !== 1) {
-        throw new Error('Codex requires one shared subscription bootstrap ingress');
-    }
-    return { realm: rows[0], bootstrap: launch.credentials[0] };
-}
-//# sourceMappingURL=subscription.js.map

package/dist/runtime/daimon/training/native/receipt/subscription.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"subscription.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/receipt/subscription.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC1G,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,EAAE,CAAC;AAChE,CAAC"}

package/dist/runtime/daimon/training/native/receipt/task-clock.d.ts

@@ -1,19 +0,0 @@
-import { z } from 'zod';
-/** Daimon's documented environment contract; the optional runtime owns clocked child launches. */
-export declare const nativeTaskClockSchema: z.ZodObject<{
-    origin: z.ZodString;
-    anchorEpochMs: z.ZodNumber;
-    libfaketimePath: z.ZodString;
-}, z.core.$strict>;
-export type NativeTaskClock = z.infer<typeof nativeTaskClockSchema>;
-export interface NativeTaskClockEvidence {
-    version: 'noopolis.task-clock.v1';
-    origin: string;
-    anchorEpochMs: number;
-}
-/**
- * Call inside the already-running worker before creating Daimon's host. Setting
- * LD_PRELOAD here supplies Daimon's child gate; it never preloads this worker.
- * Daimon derives tool-only FAKETIME and strips clocks from engine/auth launches.
- */
-export declare function configureNativeTaskClock(taskClock: NativeTaskClock | undefined, timeoutMs: number, environment?: NodeJS.ProcessEnv, now?: () => number): NativeTaskClockEvidence | undefined;

package/dist/runtime/daimon/training/native/receipt/task-clock.js

@@ -1,49 +0,0 @@
-import { posix } from 'node:path';
-import { z } from 'zod';
-/** Daimon's documented environment contract; the optional runtime owns clocked child launches. */
-export const nativeTaskClockSchema = z.strictObject({
-    origin: z.string().refine(validOrigin, 'Expected valid task clock ISO instant with Z or an explicit offset in UTC years 1970..9999'),
-    anchorEpochMs: z.number().int('Expected task clock anchorEpochMs to be a safe integer'),
-    libfaketimePath: z.string().min(1).refine(value => !/[\s:\0]/u.test(value) &&
-        /^libfaketime[^/]*\.so[^/]*$/u.test(posix.basename(value)), 'Expected a single libfaketime*.so* library path'),
-});
-/**
- * Call inside the already-running worker before creating Daimon's host. Setting
- * LD_PRELOAD here supplies Daimon's child gate; it never preloads this worker.
- * Daimon derives tool-only FAKETIME and strips clocks from engine/auth launches.
- */
-export function configureNativeTaskClock(taskClock, timeoutMs, environment = process.env, now = Date.now) {
-    if (taskClock === undefined) {
-        delete environment.NOOPOLIS_TASK_CLOCK;
-        delete environment.LD_PRELOAD;
-        return undefined;
-    }
-    const clock = nativeTaskClockSchema.parse(taskClock);
-    const realNow = now();
-    if (!Number.isSafeInteger(realNow))
-        throw new Error('Native task clock validation requires a safe integer real timestamp');
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)
-        throw new Error('Native task clock requires a positive safe integer trial timeout');
-    const { anchorEpochMs } = clock;
-    // One caller-owned anchor synchronizes the transport and runtime. Permit only
-    // 1 s of clock skew; preparation cannot reuse a previous deadline window.
-    if (anchorEpochMs - realNow > 1000)
-        throw new Error('Native task clock anchorEpochMs is more than 1000 ms in the future');
-    if (realNow - anchorEpochMs > timeoutMs)
-        throw new Error('Native task clock anchorEpochMs is older than the trial deadline window');
-    const evidence = { version: 'noopolis.task-clock.v1', origin: clock.origin, anchorEpochMs };
-    environment.NOOPOLIS_TASK_CLOCK = JSON.stringify(evidence);
-    environment.LD_PRELOAD = clock.libfaketimePath;
-    return evidence;
-}
-function validOrigin(value) {
-    const match = /^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):([0-5]\d):([0-5]\d)(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):?[0-5]\d)$/u.exec(value);
-    const epoch = Date.parse(value);
-    if (!match || !Number.isSafeInteger(epoch) || epoch < 0 || epoch > 253_402_300_799_999)
-        return false;
-    const year = Number(match[1]), month = Number(match[2]), day = Number(match[3]);
-    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-    const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-    return month >= 1 && month <= 12 && day >= 1 && day <= days[month - 1];
-}
-//# sourceMappingURL=task-clock.js.map

package/dist/runtime/daimon/training/native/receipt/task-clock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"task-clock.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/receipt/task-clock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,4FAA4F,CAAC;IACpI,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,wDAAwD,CAAC;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACxE,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,iDAAiD,CAAC;CACjH,CAAC,CAAC;AASH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAsC,EAAE,SAAiB,EACzD,cAAiC,OAAO,CAAC,GAAG,EAAE,MAAoB,IAAI,CAAC,GAAG;IAE1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,WAAW,CAAC,mBAAmB,CAAC;QACvC,OAAO,WAAW,CAAC,UAAU,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAC3H,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC5I,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAChC,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,aAAa,GAAG,OAAO,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1H,IAAI,OAAO,GAAG,aAAa,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACpI,MAAM,QAAQ,GAA4B,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;IACrH,WAAW,CAAC,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,WAAW,CAAC,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC;IAC/C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,8GAA8G,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACrG,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;AAC1E,CAAC"}

package/dist/runtime/daimon/training/native/sealed-usage.d.ts

@@ -1,218 +0,0 @@
-import type { Usage } from '../../../../training/index.js';
-import { type NativeLaunch } from './receipt/index.js';
-import { type NativeGrokUsage, type NativeRequestUsage, type NativeTurnSeal } from './worker/index.js';
-export interface SealedBrokerUsage {
-    usage: Usage | null;
-    rows: NativeGrokUsage[];
-}
-export interface SealedBrokerUsageOptions {
-    attempts?: number;
-    intervalMs?: number;
-}
-/**
- * What a brokered turn spent, when its terminal frame never arrived.
- *
- * A wake that fails spends the same money as one that publishes. The worker's
- * HTTP reply is the only route usage normally takes to this adapter, so a
- * worker that dies mid-turn used to report `usage: null` for a turn whose tool
- * calls had already succeeded — a fabricated zero, byte-identical to a measured
- * one, for spend that really happened. The broker is the single sealed usage
- * writer and it seals a failed turn's partial usage from what its own proxy
- * metered, so the record exists; in child-process execution this adapter shares
- * that filesystem and the launch receipt names the file.
- *
- * Three rules, all of them the ledger's own:
- *
- * - **Absence stays absence.** A missing, unreadable, malformed or empty ledger
- *   returns `null`, never `0`. Reading nothing is not the same as measuring
- *   nothing, and the difference is exactly what a fabricated zero destroys.
- * - **Dedupe by `turn`.** Daimon may append one sealed turn's identical bytes
- *   twice (a replay racing another replay), so every ledger consumer collapses
- *   them; `readSealedGrokUsage` does it and refuses rows that disagree under
- *   one key.
- * - **It cannot fail the trial.** This runs on a path that has already failed,
- *   and an instrumentation fault there would replace a diagnosable failure with
- *   a confusing one. Every fault is swallowed into `null`.
- *
- * The recovered spend is deliberately *not* promoted to complete coverage: the
- * execution it belongs to never closed, so nothing here can prove the ledger
- * holds all of it. It is `partial` — measured, bounded below, and honest about
- * being the broker's account rather than the turn's.
- *
- * The short poll exists because sealing is the broker's reaction to losing its
- * client: the worker dies, its control socket closes, and only then does the
- * broker seal and append. Reading once, immediately, would race that append and
- * report absence for a row written a moment later — which is the same
- * fabricated zero by a different route. The wait is bounded and always
- * terminates; giving up returns absence, not zero.
- */
-export declare function readSealedBrokerUsage(launch: NativeLaunch, options?: SealedBrokerUsageOptions): Promise<SealedBrokerUsage>;
-export declare const BROKER_REQUESTS_SCHEMA = "spawnfile.training.daimon-native.broker-requests.v1";
-/** One proxied request, as timings and counts. Never a body, a prompt, a reply or a credential. */
-export interface BrokerRequestTiming {
-    turn: string;
-    request: number;
-    requests: number;
-    model: string;
-    at: string;
-    startedAt?: string;
-    /** Absent exactly when the proxy never measured an end: the request that was issued and never answered. */
-    endedAt?: string;
-    /** Only when both ends were measured; an unanswered request has no duration to report. */
-    durationMs?: number;
-    usageSource?: NativeRequestUsage['usage_source'];
-    input: number;
-    cachedInput: number;
-    freshInput: number;
-    cacheWrite: number;
-    output: number;
-    total: number;
-}
-/** Why a present ledger could not be read, in a closed vocabulary: an error string could carry ledger bytes. */
-export type BrokerRequestFailure = 'malformed' | 'schema' | 'unreadable';
-export type BrokerRequestLedger = {
-    schema: typeof BROKER_REQUESTS_SCHEMA;
-    outcome: 'read';
-    read: number;
-    published: number;
-    open: number;
-    truncated: boolean;
-    rows: BrokerRequestTiming[];
-} | {
-    schema: typeof BROKER_REQUESTS_SCHEMA;
-    outcome: 'unreadable';
-    failure: BrokerRequestFailure;
-};
-/**
- * When a brokered turn last spoke to the provider, and whether it was answered.
- *
- * A turn killed by its deadline leaves two indistinguishable shapes in the
- * published event stream: a request was issued and never came back, or the
- * worker never issued the next request at all. Nothing on the adapter's side of
- * the wake can separate them — but the broker's proxy writes a second ledger
- * beside the usage one, a row per request with its own `started_at` and
- * `ended_at`, and there the first shape is a row with no end and the second is
- * no row. That file dies with the slot's tmpfs unless the failure path reads
- * it, so this reads it there and publishes it as an operator-only diagnostic.
- *
- * It keeps the rules of the ledger beside it:
- *
- * - **Absence stays absence.** A missing or empty ledger returns `undefined` —
- *   nothing is published. A fabricated empty list would read as "no requests
- *   were made", which is one of the two answers this change exists to
- *   distinguish. A ledger that is present but unreadable publishes a failure
- *   classification instead, which is neither answer.
- * - **An unanswered row survives as one.** `endedAt` is omitted, never filled,
- *   never normalised, and the bound keeps open rows before any other.
- * - **Timings and counts only**, through an allow-list projection.
- * - **It cannot fail the trial.** Every fault becomes a classification or
- *   absence, and the observer swallows a publish fault.
- *
- * The poll is the usage reader's, for the usage reader's reason: an unanswered
- * request has no row until the broker seals the turn it belongs to, so reading
- * once would race the append and report "never issued" for a request that was.
- */
-export declare function readSealedBrokerRequests(launch: NativeLaunch, options?: SealedBrokerUsageOptions): Promise<BrokerRequestLedger | undefined>;
-export declare const BROKER_SEAL_SCHEMA = "spawnfile.training.daimon-native.broker-seal.v1";
-/** One outstanding MCP tool call: a name and how long it had been unanswered when the turn died. */
-export interface BrokerSealOutstandingCall {
-    name: string;
-    outstandingMs: number;
-}
-/** One GET SSE tunnel still open when the turn died: its age, and whether the mount ever pushed through it. */
-export interface BrokerSealOpenTunnel {
-    openMs: number;
-    delivered: boolean;
-}
-/**
- * The session's standalone GET tunnels. A worker parked reading one is idle in
- * exactly the way every other artifact renders as "doing nothing", so this is
- * what separates a turn that died with its tunnel open from one that closed it
- * first — and `delivered` separates a tunnel carrying frames from one held open
- * in silence.
- */
-export interface BrokerSealTunnels {
-    opened: number;
-    closed: number;
-    delivered: number;
-    open: BrokerSealOpenTunnel[];
-}
-/**
- * One sealed terminal turn, as an allow-list projection.
- *
- * Every member is a number, a name, a timing or a value from a closed set. The
- * one free-form string is `reason`, the worker's own last words, which Daimon
- * redacted with that turn's own capabilities as exact secrets and bounded
- * before it ever reached the ledger — the same discipline, and the same bytes,
- * as the startup diagnostic published beside it.
- */
-export interface BrokerSealRecord {
-    turn: string;
-    wake: string;
-    at: string;
-    model: string;
-    outcome: 'completed' | 'failed';
-    requests: number;
-    limitReason: 'tokens' | 'requests' | 'timeout' | 'none';
-    shellClock?: NativeTurnSeal['shell_clock'];
-    providerClock?: NativeTurnSeal['provider_clock'];
-    code?: string;
-    status?: string;
-    stage?: string;
-    failureClass?: string;
-    exitCode?: number;
-    termSignal?: number;
-    reason?: string;
-    /**
-     * Present exactly when the broker's MCP facade observed this turn. Absent is
-     * "never observed"; `started: 0` is "observed, and it called nothing". The
-     * two are different answers and this record never collapses them.
-     */
-    mcp?: {
-        started: number;
-        answered: number;
-        undecoded: number;
-        outstanding: BrokerSealOutstandingCall[];
-        refusals?: NonNullable<NativeTurnSeal['mcp']>['refusals'];
-        tunnels?: BrokerSealTunnels;
-    };
-}
-export type BrokerSealLedger = {
-    schema: typeof BROKER_SEAL_SCHEMA;
-    outcome: 'read';
-    read: number;
-    outstanding: number;
-    openTunnels: number;
-    rows: BrokerSealRecord[];
-} | {
-    schema: typeof BROKER_SEAL_SCHEMA;
-    outcome: 'unreadable';
-    failure: BrokerRequestFailure;
-};
-/**
- * What the broker sealed about a turn that never answered.
- *
- * A worker that CRASHES still produces a terminal HTTP reply, and its failure
- * code and last words ride that reply here. A worker that HANGS is killed by
- * the trial deadline, so there is no reply at all — and the sealed terminal
- * response, with the MCP call the worker was still blocked on riding on it,
- * is written only into the broker's own turn record, in a `0700` store this
- * uid cannot read, on a control root a training slot puts on tmpfs. Six live
- * runs ended exactly that way: usage recovered, `output: absent`, and no
- * account of what the turn was waiting for.
- *
- * The broker now projects that sealed response into a third stream beside the
- * two ledgers this module already recovers, and this reads it there, on the
- * same bounded poll and for the same reason: the seal is the broker's reaction
- * to losing its client, so reading once would race the append.
- *
- * Same rules as the requests ledger beside it. Absence stays absence — a
- * missing or empty stream publishes nothing, because a fabricated empty record
- * would read as "the turn sealed nothing", which is one of the answers this
- * exists to tell apart, and an `mcp` member is never invented for a turn the
- * facade did not observe. Numbers, names, timings, closed vocabularies and one
- * already-redacted reason. A fault publishes a classification, never a message
- * that could quote the bad line. And it cannot fail the trial: every fault
- * becomes a classification or absence.
- */
-export declare function readSealedBrokerSeal(launch: NativeLaunch, options?: SealedBrokerUsageOptions): Promise<BrokerSealLedger | undefined>;