feat: run Daimon Grok 1.0.34 workers lean and isolated

fixtures/grok-lean-worker/AGENTS.md

@@ -0,0 +1,3 @@
+# Grok lean worker live check
+
+You are a test agent. When woken, answer with the single word OK and call no tools.

fixtures/grok-lean-worker/Spawnfile

@@ -0,0 +1,22 @@
+spawnfile_version: "0.1"
+kind: agent
+name: grok-lean-worker
+description: "One brokered Daimon Grok agent for the Grok 1.0.34 lean-worker live check"
+
+runtime:
+  name: daimon
+  options:
+    engine: grok
+
+execution:
+  model:
+    primary:
+      provider: xai
+      name: grok-4.6
+      auth:
+        method: grok
+      reasoning_effort: low
+
+workspace:
+  docs:
+    system: AGENTS.md

package.json

@@ -35,6 +35,7 @@
     "audit:generate": "tsx src/audit/auditCli.ts",
     "build:local-moltnet": "node --experimental-strip-types ./scripts/build-local-moltnet.ts",
     "build:local-daimon": "node --experimental-strip-types ./scripts/build-local-daimon-runtime.ts",
+    "vendor:daimon-contract": "node --import tsx ./scripts/vendor-daimon-grok-contract.ts",
     "bundle:source-provenance": "node --experimental-strip-types ./scripts/create-source-provenance-bundle.ts",
     "prepare:linux-amd64-closure": "node --experimental-strip-types ./scripts/create-linux-amd64-dependency-closure.ts",
     "prepare:linux-amd64-go-closure": "node --experimental-strip-types ./scripts/create-linux-amd64-go-closure.ts",
@@ -63,7 +64,8 @@
     "test:e2e:distribution-image": "tsx src/e2e/cli.ts distribution-image",
     "test:e2e:distribution-roundtrip": "tsx src/e2e/cli.ts distribution-roundtrip",
     "test:e2e:daimon-org": "tsx src/e2e/cli.ts daimon-org",
-    "test:scripts": "node --experimental-strip-types --test scripts/build-local-daimon-runtime.test.ts scripts/build-local-moltnet.test.ts scripts/compile-explicit-test-mcp.test.ts scripts/native-helper-workflows.test.ts scripts/typescript-policy.test.ts",
+    "test:live:grok-lean-worker": "node --experimental-strip-types ./scripts/grok-lean-worker-live-check.ts",
+    "test:scripts": "node --experimental-strip-types --test scripts/build-local-daimon-runtime.test.ts scripts/grok-lean-worker-live-check.test.ts scripts/build-local-moltnet.test.ts scripts/compile-explicit-test-mcp.test.ts scripts/native-helper-workflows.test.ts scripts/typescript-policy.test.ts",
     "test:unit": "npm run test:vitest; vitest_status=$?; npm run test:verdict; verdict_status=$?; npm run test:coverage-verdict; coverage_status=$?; npm run test:node; node_status=$?; failed_lanes=''; if [ \"$verdict_status\" -eq 2 ]; then failed_lanes='vitest test failures'; fi; if [ \"$node_status\" -eq 2 ]; then if [ -n \"$failed_lanes\" ]; then failed_lanes=\"$failed_lanes; node:test suite\"; else failed_lanes='node:test suite'; fi; fi; result_status=0; if [ -n \"$failed_lanes\" ]; then echo \"FAIL(tests): $failed_lanes\"; result_status=1; fi; if [ \"$verdict_status\" -ne 0 ] && [ \"$verdict_status\" -ne 2 ]; then echo 'FAIL(vitest-verdict): could not determine the vitest result'; result_status=1; fi; if [ \"$node_status\" -ne 0 ] && [ \"$node_status\" -ne 2 ]; then echo 'FAIL(node-lane): could not determine the node:test result'; result_status=1; fi; if [ \"$result_status\" -ne 0 ]; then exit 1; elif [ \"$vitest_status\" -ne 0 ]; then echo \"FAIL(vitest): exited $vitest_status with no test failure\"; exit 1; elif [ \"$coverage_status\" -eq 2 ]; then echo 'FAIL(coverage): thresholds not met (tests all passed)'; exit 2; elif [ \"$coverage_status\" -ne 0 ]; then echo 'FAIL(coverage-verdict): could not evaluate coverage (tests all passed)'; exit 1; else echo 'PASS'; fi",
     "test": "npm run test:unit && npm run test:scripts"
   },

runtime-images/daimon/Dockerfile

@@ -139,10 +139,14 @@ RUN test -n "${GROK_CLI_VERSION}" \
   && test -x ${RUNTIME_ROOT}/node_modules/@openai/codex/bin/codex.js \
   && test -f ${RUNTIME_ROOT}/node_modules/@noopolis/daimon/dist/runtime/cli.js \
   && case "${TARGETARCH}" in \
-       amd64) broker_arch=x64; broker_sha=e3fe2738fc8a979861085b4003bf2d5d7c284874897cb6ec2e2e2383211768bd ;; \
-       arm64) broker_arch=arm64; broker_sha=ad44e02c38e6a3207ac4a3d5fd98b6d2e55341ce42dfd2f07204bbe54a7a653d ;; \
+       amd64) broker_arch=x64 ;; \
+       arm64) broker_arch=arm64 ;; \
        *) echo "Unsupported Daimon engine-broker architecture: ${TARGETARCH}" >&2; exit 1 ;; \
      esac \
+  && package_manifest=${RUNTIME_ROOT}/node_modules/@noopolis/daimon/dist/runtime/contract-manifest.json \
+  && test "$(sha256sum "${package_manifest}" | awk '{print "sha256:" $1}')" = "${DAIMON_MANIFEST_SHA256}" \
+  && broker_sha="$(node -e 'const m=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")).grokEngineBroker; const v=m?.artifacts?.[process.argv[2]+"Sha256"]; if(typeof v!=="string"||!/^[a-f0-9]{64}$/.test(v))process.exit(1); process.stdout.write(v)' "${package_manifest}" "${broker_arch}")" \
+  && node -e 'const m=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8")).grokEngineBroker, a=m?.grokCliArtifacts?.[process.argv[2]]; if(!a||m.grokCliVersion!==process.argv[3]||a.url!==process.argv[4]||a.sha256!==process.argv[5].replace(/^sha256:/,"")){console.error("Grok CLI pin does not match the Daimon contract manifest ("+(m?.grokCliVersion)+")");process.exit(1)}' "${package_manifest}" "${broker_arch}" "${GROK_CLI_VERSION}" "${GROK_CLI_URL}" "${GROK_CLI_SHA256}" \
   && broker_source=${RUNTIME_ROOT}/node_modules/@noopolis/daimon/dist/runtime/native/daimon-engine-broker \
   && test -x "${broker_source}" \
   && test "$(sha256sum "${broker_source}" | awk '{print $1}')" = "${broker_sha}" \

scripts/AGENTS.md

@@ -24,6 +24,14 @@ tools live in `../archive/legacy-worktree-tools/` and are not active helpers.
 - Daimon builds accept only explicit versions, credential-free HTTPS URLs, and
   executable/archive digest pins. Reject URLs with credentials, queries, or
   fragments before Docker runs.
+- Daimon builds also accept only the Grok CLI build the vendored Daimon
+  contract manifest pins for the target architecture (`readPinnedGrokCli`).
+- `vendor-daimon-grok-contract.ts` (run with `node --import tsx`) is the only
+  way Daimon's contract enters Spawnfile: it reads a Daimon checkout as data and
+  writes `src/runtime/daimon/contract-manifest.{json,sha256}` plus
+  `grokWorkerConfigBytes.ts` (Daimon's own worker `config.toml` renderer bytes
+  and sandbox-profile samples). `--check` fails on drift. It never builds or
+  writes inside Daimon.
 - The local builder pushes only to the fixed loopback development repository.
   Its generated immutable manifest/receipt identity is ignored and never
   edits `runtimes.yaml`. Clean-source builds select the native Docker

scripts/README.md

@@ -7,6 +7,8 @@ in the npm package. Scripts run as native TypeScript on Node 22.19+.
 | Entrypoint | Caller | Purpose / prerequisites |
 | --- | --- | --- |
 | `build-local-daimon-runtime.ts` | `npm run build:local-daimon` | Build a locally sourced runtime; explicit artifact pins, Docker, and loopback registry required |
+| `vendor-daimon-grok-contract.ts` | `npm run vendor:daimon-contract [-- --check]` | Vendor Daimon's contract manifest and Grok worker renderer bytes from a Daimon checkout (`SPAWNFILE_DAIMON_SOURCE_DIR`) |
+| `grok-lean-worker-live-check.ts` | `SPAWNFILE_GROK_LIVE_CHECK=1 npm run test:live:grok-lean-worker` | Opt-in live check: one brokered Grok 1.0.34 agent, worker-home/deny/service attestation dump, one cheap wake, one deduped broker usage row; Docker, a local Daimon identity, and a dedicated Grok login required |
 | `build-local-moltnet.ts` | `npm run build:local-moltnet` | Build and stamp release binaries from an explicit source checkout |
 | `create-source-provenance-bundle.ts` | `npm run bundle:source-provenance` | Create deterministic archives with manifests and credential exclusions |
 | `create-linux-amd64-dependency-closure.ts` | `npm run prepare:linux-amd64-closure` | Prepare reviewed npm dependencies/cache in the pinned build container |

scripts/build-local-daimon-runtime.test.ts

@@ -5,8 +5,10 @@ import path from "node:path";
 import test from "node:test";
 
 import {
+  assertPinnedGrokCli,
   createLocalDaimonCapabilityReceipt,
   readDaimonCliArtifactPins,
+  readPinnedGrokCli,
   resolveDaimonSourceMode,
   resolveLocalBuildArchitecture,
   resolveLocalImageTag,
@@ -355,3 +357,23 @@ test("Daimon Dockerfile stage graph preserves cache and offline-network boundari
   assert.deepEqual(stagesContaining(/\bapt-get\b/u), ["base_registry"]);
   assert.deepEqual(stagesContaining(/\bcurl\s+-/u), ["agy_source_registry", "grok_source_registry"]);
 });
+
+test("local Daimon builds accept only the Grok CLI build the vendored contract manifest pins", () => {
+  const amd64 = readPinnedGrokCli("amd64"), arm64 = readPinnedGrokCli("arm64");
+  assert.equal(amd64.version, "1.0.34");
+  assert.equal(amd64.url, "https://storage.googleapis.com/grok-build-public-artifacts/cli/grok-1.0.34-linux-x86_64");
+  assert.equal(amd64.sha256, "sha256:be5905e107d2b8b5f3c142d21ecfe4c8fd32a913d2fd551b788707930c4dc80d");
+  assert.equal(arm64.sha256, "sha256:39ab87666877d64ef3a40aa60fbe0c3b6a6acd7001b78fe60e2c76bb6cfc4a94");
+  const pinned = { executable_sha256: amd64.sha256, url: amd64.url, version: amd64.version };
+  assert.doesNotThrow(() => assertPinnedGrokCli(pinned, amd64));
+  assert.throws(() => assertPinnedGrokCli(pinned, arm64), /pinned Grok CLI 1\.0\.34/u);
+  assert.throws(() => assertPinnedGrokCli({ ...pinned, version: "1.0.13" }, amd64), /pinned Grok CLI/u);
+  assert.throws(() => assertPinnedGrokCli({ ...pinned, url: "https://example.invalid/grok" }, amd64), /pinned Grok CLI/u);
+});
+
+test("the runtime image derives broker and Grok pins from the attested Daimon manifest instead of literals", () => {
+  const dockerfile = readFileSync(new URL("../runtime-images/daimon/Dockerfile", import.meta.url), "utf8");
+  assert.doesNotMatch(dockerfile, /broker_sha=[a-f0-9]{64}/u);
+  assert.match(dockerfile, /grokCliArtifacts\?\.\[process\.argv\[2\]\]/u);
+  assert.match(dockerfile, /m\.grokCliVersion!==process\.argv\[3\]/u);
+});

scripts/build-local-daimon-runtime.ts

@@ -146,6 +146,30 @@ export const readDaimonCliArtifactPins = (env: Record<string, string | undefined
   }
 });
 
+type GrokCliPin = { sha256: string; url: string; version: string };
+const vendoredDaimonManifestPath = path.join(repoRoot, "src", "runtime", "daimon", "contract-manifest.json");
+
+/**
+ * The one Grok CLI build the vendored Daimon contract pins for this
+ * architecture. The broker's worker config, lean argv, and client-version
+ * header are only valid for that exact build, so any other executable is
+ * refused before Docker runs rather than failing turn attestation later.
+ */
+export const readPinnedGrokCli = (architecture: DaimonBuildArchitecture, manifestPath = vendoredDaimonManifestPath): GrokCliPin => {
+  const broker = (JSON.parse(readFileSync(manifestPath, "utf8")) as { grokEngineBroker?: { grokCliArtifacts?: Record<string, { sha256?: unknown; url?: unknown }>; grokCliVersion?: unknown } }).grokEngineBroker;
+  const artifact = broker?.grokCliArtifacts?.[architecture === "amd64" ? "x64" : "arm64"];
+  if (typeof broker?.grokCliVersion !== "string" || typeof artifact?.url !== "string" || typeof artifact.sha256 !== "string" || !sha256Digest.test(artifact.sha256)) {
+    throw new Error("Vendored Daimon contract manifest does not pin a Grok CLI artifact");
+  }
+  return { sha256: `sha256:${artifact.sha256}`, url: artifact.url, version: broker.grokCliVersion };
+};
+
+export const assertPinnedGrokCli = (grok: DaimonCliArtifacts["grok"], pin: GrokCliPin): void => {
+  if (grok.version !== pin.version || grok.url !== pin.url || grok.executable_sha256 !== pin.sha256) {
+    throw new Error(`GROK_CLI_VERSION/GROK_CLI_URL/GROK_CLI_SHA256 must be the pinned Grok CLI ${pin.version} (${pin.url}, ${pin.sha256})`);
+  }
+};
+
 export const resolveLocalImageTag = (value: string | undefined): string => {
   const tag = value?.trim();
   const match = tag?.match(/^127\.0\.0\.1:((?:[1-9]\d{0,3}|[1-5]\d{4}|6[0-4]\d{3}|65[0-4]\d{2}|655[0-2]\d|6553[0-5]))\/noopolis\/spawnfile-runtime-daimon:([A-Za-z0-9_][A-Za-z0-9_.-]{0,127})$/u);
@@ -315,6 +339,7 @@ const main = (): void => {
   const imageTag = resolveLocalImageTag(process.env.SPAWNFILE_DAIMON_LOCAL_IMAGE_TAG);
   const architecture = resolveLocalBuildArchitecture(process.arch);
   const artifacts = readDaimonCliArtifactPins();
+  assertPinnedGrokCli(artifacts.grok, readPinnedGrokCli(architecture));
   const packageDirectory = mkdtempSync(path.join(os.tmpdir(), "spawnfile-daimon-package-"));
   try {
     const bundled = sourceMode === "source-bundle" ? stageBundleBuiltDaimon(packageDirectory, artifacts, architecture) : null;

scripts/grok-lean-worker-live-check.test.ts

@@ -0,0 +1,14 @@
+import assert from "node:assert/strict";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { requireLiveCheckEnvironment } from "./grok-lean-worker-live-check.ts";
+
+test("the Grok lean-worker live check is explicit opt-in and refuses the desktop Grok login", () => {
+  const env = { SPAWNFILE_DAIMON_LOCAL_RUNTIME_IDENTITY: "/tmp/identity.json", SPAWNFILE_DAIMON_SOURCE_GROK_AUTH: "/tmp/grok-training/auth.json", SPAWNFILE_GROK_LIVE_CHECK: "1" };
+  assert.deepEqual(requireLiveCheckEnvironment(env), { grokAuth: "/tmp/grok-training/auth.json", identity: "/tmp/identity.json" });
+  assert.throws(() => requireLiveCheckEnvironment({ ...env, SPAWNFILE_GROK_LIVE_CHECK: undefined }), /SPAWNFILE_GROK_LIVE_CHECK=1/u);
+  assert.throws(() => requireLiveCheckEnvironment({ ...env, SPAWNFILE_DAIMON_SOURCE_GROK_AUTH: path.join(os.homedir(), ".grok", "auth.json") }), /desktop/u);
+  assert.throws(() => requireLiveCheckEnvironment({ ...env, SPAWNFILE_DAIMON_LOCAL_RUNTIME_IDENTITY: "relative.json" }), /identity/u);
+});