spawnfile 0.1.33 → 0.1.35

package/dist/compiler/training/execution.d.ts

@@ -1,8 +1,6 @@
 import { z } from "zod";
 import { type TrainingPlan } from "./plan/contract.js";
 import type { LoadedTrainingProject } from "./plan/types.js";
-export declare const TRAINING_EXECUTION_FILE = "/run/spawnfile-training/execution.json";
-export { TRAINING_EXECUTION_CAPABILITY_LABEL, TRAINING_EXECUTION_VERSION } from "./contract.js";
 export declare const trainingExecutionSchema: z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.training-execution.v1">;
     authoring: z.ZodObject<{
@@ -151,10 +149,8 @@ export interface LowerTrainingExecutionOptions {
     project: LoadedTrainingProject;
     plan: TrainingPlan;
     args: readonly string[];
-    trainingConfig?: string;
-    trainingImage?: string;
 }
-/** Resolve local declaration and authoring defaults; no writes, auth reads or execution. */
+/** Resolve authoring defaults into training CLI arguments; no writes, auth reads or execution. */
 export declare const lowerTrainingExecution: (options: LowerTrainingExecutionOptions) => Promise<{
     execution: {
         version: "spawnfile.training-execution.v1";
@@ -287,129 +283,6 @@ export declare const lowerTrainingExecution: (options: LowerTrainingExecutionOpt
         args: string[];
         output: string;
     };
-    trainingConfig: string;
-    trainingImage: string | undefined;
-    declaration: {
-        version: "spawnfile.training-container.v1" | "spawnfile.training-container.v3" | "spawnfile.training-container.v4";
-        slots: number;
-        dockerContext: string;
-        inputs: {
-            source: string;
-            destination: string;
-        }[];
-        output: {
-            source: string;
-            destination: "/run/training/output";
-        };
-        auth: {
-            source: string;
-            provider: "codex" | "claude";
-        }[];
-        evaluatorRoutes?: {
-            purpose: "decisions" | "extraction" | "proposals";
-            provider: "codex-subscription" | "typesafe";
-            model: string;
-            maxRequests: number;
-            maxSpendUsd?: number | undefined;
-        }[] | undefined;
-        evaluatorSecrets?: {
-            provider: "typesafe";
-            source: string;
-        }[] | undefined;
-        subjectIsolation?: "codex-native-sandbox" | undefined;
-        broker?: {
-            engine: "grok";
-            realmVolume: string;
-            bootstrap: string;
-            declaration: string;
-        } | undefined;
-    } | {
-        version: "spawnfile.training-container.v3" | "spawnfile.training-container.v4" | "spawnfile.training-container.v2";
-        slots: number;
-        dockerContext: string;
-        image: {
-            ref: string;
-        } | {
-            build: {
-                recipe: "daimon-dspy.v1";
-                nativeImage: string;
-                pythonImage: string;
-                platform: "linux/amd64" | "linux/arm64";
-                claude: string;
-                integration: {
-                    source: string;
-                    entry: string;
-                    execution?: "spawnfile.training-execution.v1" | undefined;
-                };
-                compiler?: string | undefined;
-                grok?: {
-                    source: string;
-                    sha256: string;
-                } | undefined;
-                bootstrap?: string | undefined;
-            };
-        };
-        integration: {
-            settings: {
-                input: string;
-                path: string;
-            };
-        };
-        inputs: {
-            id: string;
-            source: string;
-            destination: string;
-            include?: string[] | undefined;
-            git?: {
-                revision: string;
-                overlays: {
-                    source: string;
-                    path: string;
-                    sha256: string;
-                }[];
-            } | undefined;
-        }[];
-        output: {
-            source: string;
-            destination: "/run/training/output";
-        };
-        auth: {
-            source: string;
-            provider: "codex" | "claude";
-        }[];
-        evaluatorRoutes?: {
-            purpose: "decisions" | "extraction" | "proposals";
-            provider: "codex-subscription" | "typesafe";
-            model: string;
-            maxRequests: number;
-            maxSpendUsd?: number | undefined;
-        }[] | undefined;
-        evaluatorSecrets?: {
-            provider: "typesafe";
-            source: string;
-        }[] | undefined;
-        subjectIsolation?: "codex-native-sandbox" | undefined;
-        broker?: {
-            maxRunRequests: number;
-            engine: "grok";
-            agentId: string;
-            model: "grok-4.6" | "grok-4.5" | "grok-build";
-            reasoningEffort: "low" | "medium" | "high";
-            architecture: "arm64" | "x64";
-            limits: {
-                maxRequests: number;
-                maxTokens: number;
-                timeoutMs: number;
-            };
-            realmVolume: string;
-            bootstrap: string;
-            unenforcedBindPolicy?: "refuse" | "profile-only" | undefined;
-        } | undefined;
-    };
 }>;
 /** Allocation is separate so dry-run never creates a directory, and aliases fail before writes. */
 export declare const allocateTrainingOutputParent: (output: string) => Promise<void>;
-/** Preserve identities and all dataset roles while projecting only filesystem addresses. */
-export declare const mapTrainingExecution: (execution: TrainingExecution, map: (file: string) => string) => TrainingExecution;
-/** Resume changes position/presence of --resume, not the experiment's effective inputs. */
-export declare const trainingExecutionIdentity: (execution: TrainingExecution) => unknown;

package/dist/compiler/training/execution.js

@@ -5,11 +5,6 @@ import { z } from "zod";
 import { defaultTrainingOutputRoot } from "./output.js";
 import { SpawnfileError } from "../../shared/index.js";
 import { trainingPlanSchema, trainingPlanOptimizerSchema } from "./plan/contract.js";
-import { trainingPreparationSchema } from "./preparation/contract.js";
-import { readBoundedJson } from "./preparation/inputs.js";
-import { trainingContainerConfigSchema, trainingImageSchema } from "./container/contract.js";
-export const TRAINING_EXECUTION_FILE = "/run/spawnfile-training/execution.json";
-export { TRAINING_EXECUTION_CAPABILITY_LABEL, TRAINING_EXECUTION_VERSION } from "./contract.js";
 export const trainingExecutionSchema = z.object({
     version: z.literal("spawnfile.training-execution.v1"),
     authoring: trainingPlanSchema,
@@ -34,32 +29,11 @@ const exists = async (file) => {
         throw error;
     }
 };
-/** Resolve local declaration and authoring defaults; no writes, auth reads or execution. */
+/** Resolve authoring defaults into training CLI arguments; no writes, auth reads or execution. */
 export const lowerTrainingExecution = async (options) => {
     const { project, plan } = options;
     if (!plan.targets.length || !plan.optimizer)
         return invalid(`Agent ${plan.agent.id} has no executable training targets`);
-    const agent = project.compilePlan.nodes.find(node => node.id === plan.agent.id);
-    const agentDirectory = path.dirname(agent.value.kind === "agent" ? agent.value.sourcePath ?? agent.value.source : agent.value.source);
-    const candidates = [...new Set([agentDirectory, project.root].map(root => path.join(root, "training/container.json")))];
-    let trainingConfig = options.trainingConfig === undefined ? undefined : path.resolve(options.trainingConfig);
-    if (trainingConfig === undefined)
-        for (const file of candidates)
-            if (await exists(file)) {
-                trainingConfig = file;
-                break;
-            }
-    if (trainingConfig === undefined)
-        return invalid(`Training requires a container declaration at ${candidates.join(" or ")}, or --training-config`);
-    trainingConfig = await realpath(trainingConfig);
-    const raw = await readBoundedJson(trainingConfig);
-    const preparation = raw.version === "spawnfile.training-container.v2" ||
-        (["spawnfile.training-container.v3", "spawnfile.training-container.v4"].includes(String(raw.version)) && raw.image !== undefined);
-    const declaration = preparation ? trainingPreparationSchema.parse(raw) : trainingContainerConfigSchema.parse(raw);
-    const trainingImage = options.trainingImage === undefined ? undefined : trainingImageSchema.parse(options.trainingImage);
-    if (!preparation && trainingImage === undefined) {
-        return invalid("A lowered container launch configuration requires --training-image; use a v2/v4 preparation declaration for a declared image");
-    }
     const args = [...options.args];
     if (!args.includes("--experiment-timeout-ms") && !args.includes("--timeout-ms")) {
         args.push("--experiment-timeout-ms", String(plan.deadlines?.experiment_ms ?? 43_200_000));
@@ -84,11 +58,6 @@ export const lowerTrainingExecution = async (options) => {
         args.push("--optimizer-model", plan.optimizer.model);
     if (args.includes("--resume") && option(args, "--out") === undefined)
         return invalid("--resume requires --out identifying the exact prior experiment");
-    const output = path.resolve(option(args, "--out") ?? path.join(defaultTrainingOutputRoot(project.root, declaration.inputs.map(input => path.resolve(path.dirname(trainingConfig), input.source))), encodeURIComponent(plan.agent.id), `${new Date().toISOString().replace(/[:.]/gu, "-")}-${randomUUID().slice(0, 8)}`));
-    if (!args.includes("--out"))
-        args.push("--out", output);
-    else
-        args[args.indexOf("--out") + 1] = output;
     const datasetPins = [...new Set(plan.targets.flatMap(target => Object.values(target.datasets)
             .filter(dataset => dataset !== null).map(dataset => dataset.sourcePath)))].map(sourcePath => {
         const loaded = project.datasets[sourcePath];
@@ -96,9 +65,14 @@ export const lowerTrainingExecution = async (options) => {
             return invalid(`Authored dataset was not captured during plan loading: ${sourcePath}`);
         return { sourcePath, sha256: loaded.sha256 };
     });
+    const output = path.resolve(option(args, "--out") ?? path.join(defaultTrainingOutputRoot(project.root, datasetPins.map(pin => pin.sourcePath)), encodeURIComponent(plan.agent.id), `${new Date().toISOString().replace(/[:.]/gu, "-")}-${randomUUID().slice(0, 8)}`));
+    if (!args.includes("--out"))
+        args.push("--out", output);
+    else
+        args[args.indexOf("--out") + 1] = output;
     const execution = trainingExecutionSchema.parse({ version: "spawnfile.training-execution.v1", authoring: plan, datasetPins,
         optimizer: { ...plan.optimizer, model: option(args, "--optimizer-model") }, args, output });
-    return { execution, trainingConfig, trainingImage, declaration };
+    return { execution };
 };
 /** Allocation is separate so dry-run never creates a directory, and aliases fail before writes. */
 export const allocateTrainingOutputParent = async (output) => {
@@ -123,38 +97,3 @@ export const allocateTrainingOutputParent = async (output) => {
             invalid("Training output parent must be a canonical directory");
     }
 };
-/** Preserve identities and all dataset roles while projecting only filesystem addresses. */
-export const mapTrainingExecution = (execution, map) => {
-    const source = (value) => ({ ...value, sourcePath: map(value.sourcePath) });
-    const args = [...execution.args];
-    for (let index = 0; index < args.length; index++) {
-        if (["--train", "--validation", "--test", "--out", "--cost-config"].includes(args[index]))
-            args[++index] = map(args[index]);
-        else if (args[index] === "--resource") {
-            const value = args[++index], split = value.indexOf("=");
-            args[index] = `${value.slice(0, split)}=${map(value.slice(split + 1))}`;
-        }
-    }
-    return trainingExecutionSchema.parse({ ...execution, datasetPins: execution.datasetPins.map(source), args, output: map(execution.output), authoring: {
-            ...execution.authoring,
-            ...(execution.authoring.preparation ? { preparation: { ...execution.authoring.preparation,
-                    ...(execution.authoring.preparation.history ? { history: map(execution.authoring.preparation.history) } : {}) } } : {}),
-            project: { root: map(execution.authoring.project.root), manifest: map(execution.authoring.project.manifest) },
-            graders: execution.authoring.graders.map(source),
-            targets: execution.authoring.targets.map(target => ({ ...target, files: target.files.map(source), datasets: {
-                    train: source(target.datasets.train), test: source(target.datasets.test),
-                    validation: target.datasets.validation === null ? null : source(target.datasets.validation)
-                } }))
-        } });
-};
-/** Resume changes position/presence of --resume, not the experiment's effective inputs. */
-export const trainingExecutionIdentity = (execution) => {
-    const flags = [];
-    for (let index = 0; index < execution.args.length; index++) {
-        const flag = execution.args[index];
-        if (flag === "--resume")
-            continue;
-        flags.push(flag === "--dry-run" ? [flag] : [flag, execution.args[++index]]);
-    }
-    return { ...execution, args: flags.sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0) };
-};

package/dist/compiler/training/index.d.ts

@@ -3,14 +3,6 @@ export * from "./context.js";
 export * from "./plan/index.js";
 export * from "./rewind/index.js";
 export type { ResolvedTraining, ResolvedTrainingGrader } from "./resolution.js";
-export { parseTrainingMappedPreparation, trainingPreparationSchema } from "./preparation/contract.js";
-export { prepareTrainingEvaluators } from "./container/evaluators.js";
-export type { TrainingMappedPreparation } from "./preparation/contract.js";
-export { TRAINING_SLOTS_FILE, TRAINING_SLOTS_VERSION, trainingSlotPaths, trainingSlotDescriptors, trainingSlotsDocument, type TrainingSlotsDocument, type TrainingSlotPaths, type TrainingSlotDescriptor } from "./broker/paths.js";
 export * from "./execution.js";
 export * from "./moments.js";
 export * from "./compiledAgent.js";
-export { TRAINING_FAKETIME_LIBRARY_PATH } from "./container/contract.js";
-export * from "./subjectLease.js";
-export * from "./subjectDeclaration.js";
-export { recycleTrainingSlot, type RecycleTrainingSlotOptions, type TrainingSlotRecycleReceipt } from "./broker/recycleClient.js";

package/dist/compiler/training/index.js

@@ -2,13 +2,6 @@ export * from "./contract.js";
 export * from "./context.js";
 export * from "./plan/index.js";
 export * from "./rewind/index.js";
-export { parseTrainingMappedPreparation, trainingPreparationSchema } from "./preparation/contract.js";
-export { prepareTrainingEvaluators } from "./container/evaluators.js";
-export { TRAINING_SLOTS_FILE, TRAINING_SLOTS_VERSION, trainingSlotPaths, trainingSlotDescriptors, trainingSlotsDocument } from "./broker/paths.js";
 export * from "./execution.js";
 export * from "./moments.js";
 export * from "./compiledAgent.js";
-export { TRAINING_FAKETIME_LIBRARY_PATH } from "./container/contract.js";
-export * from "./subjectLease.js";
-export * from "./subjectDeclaration.js";
-export { recycleTrainingSlot } from "./broker/recycleClient.js";

package/dist/compiler/training/output.d.ts

@@ -1,2 +1,3 @@
+export declare const within: (root: string, file: string) => boolean;
 /** Durable default namespace disjoint from every declared input, even a project ancestor. */
 export declare const defaultTrainingOutputRoot: (projectRoot: string, inputs?: readonly string[]) => string;

package/dist/compiler/training/output.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import path from "node:path";
-import { within } from "./preparation/files.js";
+export const within = (root, file) => file === root || file.startsWith(root + path.sep);
 /** Durable default namespace disjoint from every declared input, even a project ancestor. */
 export const defaultTrainingOutputRoot = (projectRoot, inputs = []) => {
     const sources = [projectRoot, ...inputs].map(source => path.resolve(source));

package/dist/compiler/training/rewind/contract.d.ts

@@ -17,9 +17,9 @@ export declare const materializedInputSchema: z.ZodObject<{
     id: z.ZodString;
     declaredBy: z.ZodString;
     kind: z.ZodEnum<{
-        moltnet: "moltnet";
-        memory: "memory";
         volume: "volume";
+        memory: "memory";
+        moltnet: "moltnet";
         git: "git";
         feed: "feed";
         bundle: "bundle";
@@ -81,9 +81,9 @@ export declare const materializedMomentSchema: z.ZodObject<{
         id: z.ZodString;
         declaredBy: z.ZodString;
         kind: z.ZodEnum<{
-            moltnet: "moltnet";
-            memory: "memory";
             volume: "volume";
+            memory: "memory";
+            moltnet: "moltnet";
             git: "git";
             feed: "feed";
             bundle: "bundle";
@@ -228,9 +228,9 @@ export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaP
         id: z.ZodString;
         declaredBy: z.ZodString;
         kind: z.ZodEnum<{
-            moltnet: "moltnet";
-            memory: "memory";
             volume: "volume";
+            memory: "memory";
+            moltnet: "moltnet";
             git: "git";
             feed: "feed";
             bundle: "bundle";

package/dist/compiler/training/trial/boot.d.ts

@@ -0,0 +1,72 @@
+import type { ResolvedAuthProfile } from "../../../auth/index.js";
+import { type DaimonControlCall } from "../../../runtime/daimon/control.js";
+import { type UsageRecord } from "../../../runtime/usageLedger.js";
+import { type TrialDocker } from "./docker.js";
+import type { TrainingGatewayAccess } from "./gateway.js";
+/**
+ * Lineage namespace for training trials: every trial derives its own durable
+ * volume names, so no trial ever attaches production's, dev's or another
+ * trial's state (see `deploymentLineage.ts`).
+ */
+export declare const TRAINING_TRIAL_LINEAGE_NAMESPACE = "training";
+export interface TrialOptions {
+    agentManifestPath: string;
+    instructions: string;
+    trialId: string;
+    /** Fresh per trial; holds the trial project, compile output and boot env file. */
+    directory: string;
+    docker?: TrialDocker;
+    control?: DaimonControlCall;
+}
+export interface TrialWake {
+    state: "completed" | "failed" | "stopped" | "timeout";
+    acceptanceId: string;
+    executionId: string | null;
+    code: string | null;
+    text: string;
+    /** Usage ledger rows this wake appended; empty means none were written, never zero spend. */
+    usage: UsageRecord[];
+    /** The engine's own newest session record, bounded; null when none exists. */
+    transcript: string | null;
+    /** Per model request of this wake, the tool-call names its response carried; null where the runtime could not say. */
+    requestToolCalls: (readonly string[] | null)[];
+}
+export interface BootedTrial {
+    container: string;
+    wake(text: string, options: {
+        deliveryId: string;
+        timeoutMs: number;
+        signal?: AbortSignal;
+    }): Promise<TrialWake>;
+    /** Credential-shaped files anywhere in the trial container (expected: none). */
+    scanCredentials(): Promise<string[]>;
+    teardown(): Promise<void>;
+}
+export interface PreparedTrial {
+    image: string;
+    runtimeRoot: string;
+    engines: string[];
+    agentId: string;
+    /**
+     * Boots the organization. `gateway` is null for an organization on no
+     * gatewayed engine; `realms` is a profile view holding only the
+     * volume-held logins (`spawnfile auth login`) this organization mounts.
+     */
+    boot(gateway: TrainingGatewayAccess | null, options?: {
+        readyTimeoutMs?: number;
+        realms?: ResolvedAuthProfile;
+    }): Promise<BootedTrial>;
+    /** Runs the organization's own `auth <engine> login` attached to the operator's terminal, or returns its argv on `dryRun`. */
+    login(realms: ResolvedAuthProfile, options?: {
+        dryRun?: boolean;
+    }): Promise<readonly string[]>;
+    dispose(): Promise<void>;
+}
+/**
+ * Readable and collision-free: trial ids may share long prefixes. The cut can
+ * land just after a hyphen, so it is trimmed: the slug names a kebab-case
+ * deployment, which refuses a doubled hyphen.
+ */
+export declare const trialSlug: (trialId: string) => string;
+/** Compiles and builds the trial's one-agent organization under its own lineage, as production does. */
+export declare const prepareTrial: (options: TrialOptions) => Promise<PreparedTrial>;

package/dist/compiler/training/trial/boot.js

@@ -0,0 +1,225 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { DAIMON_GATEWAY_KEY_ENV, DAIMON_GATEWAY_URL_ENV, daimonProfileRealmVolume, getDaimonEngineDescriptor, isDaimonGatewayRealmMountId } from "../../../runtime/daimon/index.js";
+import { daimonHelperControlCall } from "../../../runtime/daimon/control.js";
+import { RUNTIME_INSTALL_ROOT } from "../../../runtime/container.js";
+import { parseUsageLedger } from "../../../runtime/usageLedger.js";
+import { parseUsageRequestLedger } from "../../../runtime/usageRequestLedger.js";
+import { DAIMON_GROK_TURN_USAGE_LEDGER } from "../../../runtime/daimon/contractManifest.js";
+import { SpawnfileError } from "../../../shared/index.js";
+import { buildCompiledProject } from "../../buildProject.js";
+import { compileProject } from "../../compileProject.js";
+import { resolveDeploymentLineage } from "../../deploymentLineage.js";
+import { slugify } from "../../helpers.js";
+import { createDockerRunInvocation, runDockerContainer } from "../../runProject.js";
+import { executeDockerRunWithSupportCleanup } from "../../runProjectLifecycle.js";
+import { createTrialDocker, waitFor } from "./docker.js";
+import { HOME_LOGIN_FILES, saveHomeLogin, seedHomeLogin } from "./homeLogin.js";
+import { writeTrialProject } from "./project.js";
+/**
+ * Lineage namespace for training trials: every trial derives its own durable
+ * volume names, so no trial ever attaches production's, dev's or another
+ * trial's state (see `deploymentLineage.ts`).
+ */
+export const TRAINING_TRIAL_LINEAGE_NAMESPACE = "training";
+const CONTROL_TOKEN_ENV = "SPAWNFILE_DAIMON_CONTROL_TOKEN";
+const WAKE_VERSION = "noopolis.daimon.wake.v2";
+const TERMINAL = new Set(["completed", "failed", "stopped"]);
+const MAX_TRANSCRIPT_BYTES = 1024 * 1024;
+/**
+ * Readable and collision-free: trial ids may share long prefixes. The cut can
+ * land just after a hyphen, so it is trimmed: the slug names a kebab-case
+ * deployment, which refuses a doubled hyphen.
+ */
+export const trialSlug = (trialId) => `${slugify(trialId).slice(0, 32).replace(/-+$/u, "") || "trial"}-${createHash("sha256").update(trialId).digest("hex").slice(0, 8)}`;
+/** Compiles and builds the trial's one-agent organization under its own lineage, as production does. */
+export const prepareTrial = async (options) => {
+    const docker = options.docker ?? createTrialDocker();
+    const slug = trialSlug(options.trialId);
+    const image = `spawnfile-training-trial:${slug}`;
+    const compiled = await (async () => {
+        const project = await writeTrialProject(options.agentManifestPath, options.instructions, path.join(options.directory, "project"));
+        const compiled = await compileProject(project, {
+            deploymentLineage: resolveDeploymentLineage(slug, TRAINING_TRIAL_LINEAGE_NAMESPACE),
+            outputDirectory: path.join(options.directory, "out")
+        });
+        await buildCompiledProject(project, compiled, { imageTag: image });
+        return compiled;
+    })().catch(async (error) => {
+        await rm(options.directory, { recursive: true, force: true });
+        throw error;
+    });
+    const instance = compiled.report.container?.runtime_instances.find((entry) => entry.runtime === "daimon");
+    const agents = Object.entries(instance?.engine_by_node_id ?? {});
+    if (!instance || agents.length !== 1)
+        throw new SpawnfileError("validation_error", "A production-booted trial compiles exactly one Daimon agent");
+    const [agentId, engine] = agents[0];
+    const home = instance.agent_paths?.[agentId]?.home_path;
+    // The engine writes its own session records under its home inside the agent's runtime home.
+    const engineHome = getDaimonEngineDescriptor(engine)?.homeDirectory;
+    const sessionsPath = home && engineHome !== undefined ? path.posix.join(home, engineHome, "sessions") : null;
+    const lineageVolumes = (realms) => (compiled.report.container?.persistent_mounts ?? [])
+        .filter((mount) => !isDaimonGatewayRealmMountId(mount.id) && daimonProfileRealmVolume(mount.id, realms) === undefined)
+        .map((mount) => mount.volume_name);
+    /**
+     * The profile's home login (`spawnfile auth login`) for this organization's
+     * fresh runtime home: seeded into it before the container starts, written
+     * back after it stops. Only the engine's login files cross; the home itself
+     * is the trial's own and is removed with it.
+     */
+    const homeLoginFor = (realms) => {
+        const files = HOME_LOGIN_FILES[engine];
+        const loginVolume = realms?.realms?.[engine]?.homeVolume;
+        if (!files || !loginVolume)
+            return undefined;
+        const mount = (compiled.report.container?.persistent_mounts ?? []).find((entry) => entry.mount_path === home);
+        if (!mount)
+            throw new SpawnfileError("validation_error", `The ${engine} runtime home of ${agentId} is not a persistent mount; its login cannot be seeded`);
+        return { files, homeMountPath: mount.mount_path, homeVolume: mount.volume_name, loginVolume };
+    };
+    const removeVolumes = async (volumes) => {
+        for (const volume of volumes)
+            await docker(["volume", "rm", "-f", volume]).catch(() => undefined);
+    };
+    const dispose = async () => {
+        await docker(["image", "rm", "-f", image]).catch(() => undefined);
+        await rm(options.directory, { recursive: true, force: true });
+    };
+    return {
+        agentId, dispose, image,
+        engines: agents.map(([, engine]) => engine),
+        runtimeRoot: `${RUNTIME_INSTALL_ROOT}/daimon`,
+        login: async (realms, loginOptions = {}) => {
+            const homeLogin = homeLoginFor(realms);
+            const invocation = await createDockerRunInvocation(compiled, image, {
+                authProfile: realms, command: ["auth", engine, "login", "--config", instance.config_path],
+                containerName: `spawnfile-login-${slug}`, interactive: true
+            });
+            if (loginOptions.dryRun) {
+                await rm(invocation.supportDirectory, { recursive: true, force: true });
+                return [invocation.command, ...invocation.args];
+            }
+            try {
+                await executeDockerRunWithSupportCleanup(invocation, runDockerContainer);
+                if (homeLogin)
+                    await saveHomeLogin(docker, image, homeLogin);
+            }
+            finally {
+                await removeVolumes(lineageVolumes(realms));
+            }
+            return [invocation.command, ...invocation.args];
+        },
+        boot: async (gateway, bootOptions = {}) => {
+            const token = randomBytes(32).toString("base64url");
+            const container = `spawnfile-trial-${slug}`;
+            await mkdir(options.directory, { recursive: true });
+            const envFilePath = path.join(options.directory, "boot.env");
+            // The boot inputs: control token, plus the gateway URL and key. No gatewayed login, no
+            // gatewayed realm; only a volume-held login of the selected profile is mounted.
+            const gatewayEnv = gateway ? `${DAIMON_GATEWAY_URL_ENV}=${gateway.url}\n${DAIMON_GATEWAY_KEY_ENV}=${gateway.key}\n` : "";
+            await writeFile(envFilePath, `${CONTROL_TOKEN_ENV}=${token}\n${gatewayEnv}`, { mode: 0o600 });
+            const invocation = await createDockerRunInvocation(compiled, image, {
+                authProfile: bootOptions.realms ?? null, containerName: container, deploymentName: slug, detach: true, envFilePath,
+                ...(gateway ? { network: gateway.network } : {})
+            });
+            const volumes = lineageVolumes(bootOptions.realms);
+            const homeLogin = homeLoginFor(bootOptions.realms);
+            const teardown = async () => {
+                try {
+                    // Stopped, not killed, so the engine finishes any login rewrite before it is saved.
+                    if (homeLogin)
+                        await docker(["stop", "--time", "10", container]).catch(() => undefined);
+                    await docker(["rm", "-f", container]).catch(() => undefined);
+                    if (homeLogin)
+                        await saveHomeLogin(docker, image, homeLogin);
+                }
+                finally {
+                    await removeVolumes(volumes);
+                    await rm(invocation.supportDirectory, { recursive: true, force: true });
+                    await rm(envFilePath, { force: true });
+                }
+            };
+            try {
+                if (homeLogin)
+                    await seedHomeLogin(docker, image, homeLogin);
+                await executeDockerRunWithSupportCleanup(invocation, runDockerContainer);
+                await rm(envFilePath, { force: true });
+                const target = { containerRef: container, dockerArgs: [], dockerCommand: "docker", imageRef: image, token };
+                const call = options.control ?? daimonHelperControlCall;
+                await waitFor(async () => {
+                    // A restart means the organization already exited once (`--restart unless-stopped` hides it).
+                    if (await docker(["inspect", "--format", "{{.State.Running}} {{.RestartCount}}", container]) !== "true 0") {
+                        const logs = await docker(["logs", "--tail", "30", container], { combined: true }).catch(() => "");
+                        throw new SpawnfileError("runtime_error", `trial organization exited before readiness: ${logs.replace(/\s+/gu, " ").slice(-600)}`);
+                    }
+                    return call(target, "GET", "/v2/availability").then((response) => response.status === 200, () => false);
+                }, bootOptions.readyTimeoutMs ?? 180_000, "trial organization readiness", 1_000);
+                return createBootedTrial({ agentId, call, container, docker, sessionsPath, target, teardown });
+            }
+            catch (error) {
+                // The boot failure is the error to report, not a teardown that follows it.
+                await teardown().catch(() => undefined);
+                throw error;
+            }
+        }
+    };
+};
+/** Daimon's per-request stream sits beside the usage ledger. */
+const REQUEST_LEDGER = path.posix.join(path.posix.dirname(DAIMON_GROK_TURN_USAGE_LEDGER.filePath), "requests.jsonl");
+const readRequestToolCalls = async (docker, container, agentId, deliveryId) => {
+    const text = await docker(["exec", container, "cat", REQUEST_LEDGER]).catch(() => "");
+    return parseUsageRequestLedger(text).filter((row) => row.agent === agentId && row.wake === deliveryId).map((row) => row.tool_calls ?? null);
+};
+const readLedger = async (docker, container) => {
+    const text = await docker(["exec", container, "cat", DAIMON_GROK_TURN_USAGE_LEDGER.filePath]).catch(() => "");
+    return parseUsageLedger(text);
+};
+const createBootedTrial = (input) => {
+    let seenRows = 0;
+    return {
+        container: input.container,
+        teardown: input.teardown,
+        scanCredentials: async () => {
+            const found = await input.docker(["exec", input.container, "find", "/", "-xdev", "(", "-name", "auth.json", "-o", "-name", "*token*", "-o", "-name", "*bootstrap-auth*", ")",
+                "-not", "-path", "/proc/*", "-not", "-path", "/sys/*", "-not", "-path", "/usr/*", "-not", "-path", "/opt/spawnfile/runtime-installs/*"], { timeoutMs: 60_000 }).catch((error) => error.message);
+            return found.split("\n").filter(Boolean);
+        },
+        wake: async (text, options) => {
+            const body = { agent_id: input.agentId, delivery_id: options.deliveryId,
+                event: { version: WAKE_VERSION, kind: "manual", text, occurred_at: new Date().toISOString() } };
+            const accepted = await input.call(input.target, "POST", "/v2/wakes", body);
+            const acceptance = JSON.parse(accepted.body);
+            if (accepted.status !== 202 || acceptance.state !== "accepted" || !acceptance.acceptance_id) {
+                throw new SpawnfileError("runtime_error", `trial wake was not accepted (HTTP ${accepted.status}${acceptance.code ? `, ${acceptance.code}` : ""})`);
+            }
+            const id = acceptance.acceptance_id;
+            let receipt = {};
+            const deadline = Date.now() + options.timeoutMs;
+            while (!TERMINAL.has(receipt.state ?? "") && Date.now() < deadline && !options.signal?.aborted) {
+                await new Promise((resolve) => setTimeout(resolve, 1_000));
+                const response = await input.call(input.target, "GET", `/v2/wake-receipts/${id}`);
+                if (response.status === 200)
+                    receipt = JSON.parse(response.body);
+            }
+            const rows = await readLedger(input.docker, input.container);
+            const usage = rows.slice(seenRows).filter((row) => row.agent === input.agentId);
+            seenRows = rows.length;
+            return {
+                acceptanceId: id, code: receipt.code ?? null, executionId: receipt.execution_id ?? null, usage,
+                state: TERMINAL.has(receipt.state ?? "") ? receipt.state : "timeout",
+                text: receipt.text ?? "",
+                requestToolCalls: await readRequestToolCalls(input.docker, input.container, input.agentId, options.deliveryId),
+                transcript: input.sessionsPath === null ? null : await readTranscript(input.docker, input.container, input.sessionsPath)
+            };
+        }
+    };
+};
+/** The engine's newest session record, bounded. */
+const readTranscript = async (docker, container, sessionsPath) => {
+    const newest = await docker(["exec", container, "sh", "-c", 'find "$1" -name "*.jsonl" -type f -printf "%T@ %p\\n" 2>/dev/null | sort -n | tail -1 | cut -d" " -f2-', "sh", sessionsPath]).catch(() => "");
+    if (!newest)
+        return null;
+    const text = await docker(["exec", container, "head", "-c", String(MAX_TRANSCRIPT_BYTES), newest]).catch(() => "");
+    return text || null;
+};

package/dist/compiler/training/trial/docker.d.ts

@@ -0,0 +1,10 @@
+/** Bounded Docker CLI call for trial lifecycle; stdout trimmed, stderr bounded into the error. */
+/** `combined` returns stderr after stdout (container logs write both). */
+export type TrialDocker = (args: readonly string[], options?: {
+    timeoutMs?: number;
+    stdin?: string;
+    combined?: boolean;
+}) => Promise<string>;
+export declare const createTrialDocker: (dockerCommand?: string) => TrialDocker;
+/** Poll `probe` until it resolves true, or fail after `timeoutMs`. */
+export declare const waitFor: (probe: () => Promise<boolean>, timeoutMs: number, label: string, pollMs?: number) => Promise<void>;