feat: run Daimon Grok 1.0.34 workers lean and isolated - #32

Merged

apresmoi merged 22 commits into

mainfrom

feat/grok-lean-worker

Sep 18, 2026

Commits on Sep 17, 2026

feat: vendor the Daimon Grok 1.0.34 broker contract manifest and pin the Grok CLI from it
apresmoi
committed
ba4c77c
feat: require a declared xAI model and reasoning effort for brokered Daimon Grok agents
apresmoi
committed
1f3e3b7
feat: emit no workspace skill roots for brokered Daimon Grok agents and warn on declared skills
apresmoi
committed
a960505
feat: vendor Daimon's Grok worker config renderer bytes and mirror its sandbox profile renderer
apresmoi
committed
efac063
feat: provision brokered Grok workers from Daimon's pinned config bytes with a non-empty deny list and service.json v2
apresmoi
committed
bfaec6e
feat: run Grok organizations under the pinned bubblewrap seccomp profile and preflight host user namespaces
apresmoi
committed
038bef0
feat: dedupe Daimon usage rows by turn and surface broker limit, model, and estimated usage fields
apresmoi
committed
3d1d3cd
docs: describe Grok 1.0.34 brokered workers, container security, and deduped usage accounting
apresmoi
committed
211b754
test: add the opt-in live check for a one-agent brokered Grok 1.0.34 organization
apresmoi
committed
4bbd016
docs: record the vendored Daimon Grok contract files in the Daimon adapter guide
apresmoi
committed
c86c5f7
fix: deny Grok workers every Moltnet, memory, mount, instance, and peer resource path the container provisions
apresmoi
committed
4ee37c9
fix: require the declared model and effort pin for provisioned Grok worker config bytes
apresmoi
committed
fc3cc4d
fix: mark estimated tokens in the usage engine rollup
apresmoi
committed
151e416
fix: report differing usage rows under one turn key as a partial-coverage conflict
apresmoi
committed
cd6e88d
test: probe Moltnet and memory denies and the /var/run alias in the Grok live check
apresmoi
committed
8ef468a
feat: re-vendor the Daimon Grok contract with worker temp, spill, inference grant, and slot receipt v2 terms
apresmoi
committed
aa1e9a6
feat: provision Grok worker private temp, closed shared temp, setgid spill directories, and a private broker TMPDIR
apresmoi
committed
e6af844
fix: refuse Grok worker deny entries equal to or above a base sandbox profile grant
apresmoi
committed
9c9e026
test: prove an added ancestor covering a Daimon deny entry is refused
apresmoi
committed
3888748
fix: write and validate canonical Grok registration paths within the 255-byte registration bound
apresmoi
committed
eefa9fb
test: assert Grok temp, spill, and broker TMPDIR provisioning in the live check
apresmoi
committed
408848b
docs: describe Grok worker temp, spill, and deny-grant rules
apresmoi
committed
051a5ce