chore: sync current Daimon v0.1.2 state

.github/AGENTS.md

@@ -0,0 +1,9 @@
+# GitHub Automation Guide
+
+This folder contains repository automation for Daimon.
+
+## Rules
+
+- Keep workflows explicit and easy to debug.
+- Publish npm releases only from matching `v*` tags.
+- Do not add co-author attributions, sign-off lines, or AI credit.

.github/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

.github/workflows/AGENTS.md

@@ -0,0 +1,9 @@
+# Workflow Guide
+
+This folder contains GitHub Actions workflows for Daimon.
+
+## Rules
+
+- CI must typecheck, test, and build the package.
+- Release must verify the tag matches `package.json` before publishing.
+- Keep workflow triggers narrow and intentional.

.github/workflows/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

.github/workflows/ci.yml

@@ -38,48 +38,39 @@ jobs:
       - name: Check out
         uses: actions/checkout@v4
 
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: package-lock.json
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Read package version
-        id: package
-        shell: bash
-        run: |
-          set -euo pipefail
-          version="$(node -p "require('./package.json').version")"
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
+      - name: Install dependencies
+        run: npm ci
 
-      - name: Wait for npm packages
+      - name: Build runtime artifact image from release-shaped packages
         shell: bash
         run: |
           set -euo pipefail
+          context="$(mktemp -d)"
+          trap 'rm -rf "$context"' EXIT
 
-          version="${{ steps.package.outputs.version }}"
-          for attempt in $(seq 1 24); do
-            if npm view "@noopolis/daimon@${version}" version >/dev/null 2>&1 \
-              && npm view "@noopolis/mneme@0.1.0" version >/dev/null 2>&1; then
-              exit 0
-            fi
-            echo "Waiting for npm registry propagation (${attempt}/24)."
-            sleep 5
-          done
-
-          npm view "@noopolis/daimon@${version}" version
-          npm view "@noopolis/mneme@0.1.0" version
+          daimon_tarball="$(npm pack --pack-destination "$context" --silent)"
+          mneme_tarball="$(npm pack @noopolis/mneme@0.1.1 --pack-destination "$context" --silent)"
+          mv "$context/$daimon_tarball" "$context/daimon.tgz"
+          mv "$context/$mneme_tarball" "$context/mneme.tgz"
+          cp Dockerfile.runtime "$context/Dockerfile.runtime"
 
-      - name: Build runtime artifact image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile.runtime
-          load: true
-          tags: noopolis/spawnfile-runtime-daimon:ci
-          build-args: |
-            DAIMON_VERSION=${{ steps.package.outputs.version }}
-            MNEME_VERSION=0.1.0
-            PI_VERSION=0.79.10
-          cache-from: type=gha,scope=daimon-runtime-image
-          cache-to: type=gha,scope=daimon-runtime-image,mode=max
+          docker buildx build \
+            --file "$context/Dockerfile.runtime" \
+            --target local-runtime \
+            --tag noopolis/spawnfile-runtime-daimon:ci \
+            --build-arg PI_VERSION=0.79.10 \
+            --load \
+            "$context"
 
       - name: Verify runtime artifact contents
         shell: bash

.github/workflows/runtime-image.yml

@@ -25,7 +25,7 @@ concurrency:
 
 env:
   IMAGE_NAME: noopolis/spawnfile-runtime-daimon
-  MNEME_VERSION: 0.1.0
+  MNEME_VERSION: 0.1.1
   PI_VERSION: 0.79.10
 
 jobs:

AGENTS.md

@@ -0,0 +1,27 @@
+# Daimon Package Guide
+
+This repository contains Daimon, the Noopolis-native per-agent runtime harness.
+
+It must stay detached from the Spawnfile compiler implementation. Spawnfile owns
+teams, org graphs, Moltnet wiring, schedules, workspace compilation, and
+deployment. Daimon owns only the per-agent runtime boundary.
+
+## Structure
+
+- `src/core/` defines per-agent harness contracts.
+- `src/pi/` implements the contract using Pi's SDK.
+- `src/observability/` records local agent/org activity traces.
+- `src/examples/` contains runnable local examples and E2E checks.
+
+## Rules
+
+- Keep runtime credentials out of git. Generated runtime state belongs under
+  `.runtime/`, which is ignored.
+- Keep teams/orgs out of this package. A caller may start many harnessed agents,
+  but the harness API should only know about one agent at a time.
+- Keep the public contract independent of Pi-specific types.
+- Memory behavior belongs in the sibling `@noopolis/mneme` package. Daimon may
+  adapt Mneme into Pi custom tools, but must not reimplement Mneme storage,
+  policy, recall, or MCP.
+- Pi-specific logic belongs under `src/pi/`.
+- Examples should be runnable with `npm run e2e:pi-agent`.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

Dockerfile.runtime

@@ -5,8 +5,8 @@ ARG RUNTIME_ROOT=/opt/spawnfile/runtime-installs/daimon
 
 FROM ${NODE_IMAGE} AS build
 
-ARG DAIMON_VERSION=0.1.1
-ARG MNEME_VERSION=0.1.0
+ARG DAIMON_VERSION=0.1.2
+ARG MNEME_VERSION=0.1.1
 ARG PI_VERSION=0.79.10
 ARG RUNTIME_ROOT
 
@@ -31,8 +31,62 @@ RUN mkdir -p "${RUNTIME_ROOT}" \
       -name "*.mdx" \
     \) -delete
 
-FROM scratch AS runtime
+FROM scratch AS registry-runtime
 
 ARG RUNTIME_ROOT
 
 COPY --from=build ${RUNTIME_ROOT} ${RUNTIME_ROOT}
+
+# The local target keeps the default registry target unchanged while replacing
+# only Daimon and Mneme with tarballs supplied in its minimal build context.
+FROM ${NODE_IMAGE} AS local-build
+
+ARG RUNTIME_ROOT
+ARG PI_VERSION=0.79.10
+
+COPY daimon.tgz mneme.tgz /tmp/local-packages/
+
+RUN mkdir -p "${RUNTIME_ROOT}" \
+  && cd "${RUNTIME_ROOT}" \
+  && npm install --omit=dev --no-fund --no-audit \
+    /tmp/local-packages/daimon.tgz \
+    /tmp/local-packages/mneme.tgz \
+    "@earendil-works/pi-coding-agent@${PI_VERSION}" \
+    "@earendil-works/pi-ai@${PI_VERSION}" \
+  && npm cache clean --force \
+  && find node_modules -type d \( \
+      -name docs -o \
+      -name examples -o \
+      -name test -o \
+      -name tests -o \
+      -name __tests__ \
+    \) -prune -exec rm -rf {} + \
+  && find node_modules -type f \( \
+      -name "*.map" -o \
+      -name "*.md" -o \
+      -name "*.mdx" \
+    \) -delete
+
+FROM scratch AS local-runtime
+
+ARG RUNTIME_ROOT
+
+COPY --from=local-build ${RUNTIME_ROOT} ${RUNTIME_ROOT}
+
+# scratch has no shell or Node executable, so the verifier is a temporary
+# Node image containing exactly the local-runtime filesystem.
+FROM ${NODE_IMAGE} AS local-verify
+
+ARG RUNTIME_ROOT
+
+COPY --from=local-runtime ${RUNTIME_ROOT} ${RUNTIME_ROOT}
+COPY verifyRuntimeImage.mjs /usr/local/lib/daimon/verifyRuntimeImage.mjs
+
+CMD ["node", "--no-warnings", "/usr/local/lib/daimon/verifyRuntimeImage.mjs"]
+
+# Keep registry mode as the Dockerfile's default target.
+FROM scratch AS runtime
+
+ARG RUNTIME_ROOT
+
+COPY --from=registry-runtime ${RUNTIME_ROOT} ${RUNTIME_ROOT}

ENGINE-SYSTEM.md

@@ -837,7 +837,7 @@ has relevant context, but the representative asks that agent through Moltnet.
 
 ### Phase 1: Refactor Pi Behind Engine Interface
 
-- Add `src/engine/CLAUDE.md`.
+- Add `src/engine/AGENTS.md` with a `CLAUDE.md` compatibility symlink.
 - Add `src/engine/types.ts`.
 - Move Pi-specific turn execution behind `PiEngine`.
 - Keep current public `PiHarnessAdapter` behavior passing.

README.md

@@ -5,16 +5,28 @@ Daimon is the Noopolis-native per-agent runtime harness.
 It defines a small per-agent contract and currently implements that contract on
 top of Pi. A Daimon runs one harnessed agent inside a caller-prepared workspace.
 
-Spawnfile should own orgs, nested teams, schedules, Moltnet wiring, workspace
-resource compilation, and the app that starts many harnessed agents. This package
-should not know what an org is.
+Spawnfile compiles and deploys orgs, nested teams, member-owned schedules,
+Moltnet wiring, and workspace resources. Daimon executes one agent runtime: it
+accepts a wake selected by that runtime's organization policy and runs one
+turn. It does not know the org graph, schedule other agents, or let Simfile or
+a world service trigger cognition.
+
+For a world-capable `kind: every` wake, the harness starts without a decision
+token and privately calls `world_claim` before exposing any other world tool.
+The claim binds authority to the schedule wake's run/request/wake identity; the
+opaque token stays inside the harness. Subsequent observe/affordance/action
+calls carry it without placing it in the model prompt or tool schema. Optional
+world recommendations are ordinary observation fields discovered after the
+independent wake and claim—they are never Daimon wake inputs.
 
 ## Install
 
 ```bash
 npm install @noopolis/daimon
 ```
 
+The latest published version is 0.1.1; this README describes the source tree (0.1.2).
+
 For Pi agents with memory enabled, install Mneme too:
 
 ```bash
@@ -37,10 +49,31 @@ Pi-specific exports live under the Pi subpath:
 import { PiHarnessAdapter } from "@noopolis/daimon/pi";
 ```
 
+By default, the in-process Mneme runtime uses the same path as each agent's
+`runtimeHomePath`. If you need agents to keep separate Pi/runtime directories but
+share one memory bank, pass an explicit `memory.runtimeHomePath` in
+`PiHarnessOptions`.
+
+```ts
+const adapter = new PiHarnessAdapter({
+  authPath: "/tmp/daimon-auth.json",
+  memory: {
+    runtimeHomePath: "/shared/memory/bank"
+  }
+});
+```
+
+Pi agents receive Mneme tools in awake mode for normal work. Dream wakes use a
+fresh one-off Pi session under `sessions/dream/<wake-id>-<random>` and inject
+the Mneme dream guidance instead. Daimon does not automatically record every
+turn as memory; agents write memories only by calling Mneme tools such as
+`memory_register`, `memory_summarize`, and `memory_forget`.
+
 ## Tests
 
-The package has a non-live test suite for auth seeding and Pi model config
-generation:
+The package has a non-live test suite covering auth seeding, Pi model config
+generation, the harness contract, memory tool wiring, wake and turn traces, and
+the org observer:
 
 ```bash
 npm test
@@ -68,6 +101,10 @@ upstream-documented dummy `ollama` value.
 The Pi E2E uses the local Codex CLI subscription auth file to seed an ignored Pi
 `auth.json` under `.runtime/`.
 
+These are live runs: they spend real tokens and require local engine auth
+(`~/.codex/auth.json` for Pi/Codex; mixed-engine and triad additionally need
+authenticated `grok` and `agy` CLIs on PATH). They are not part of `npm test`.
+
 ```bash
 npm install
 npm run e2e:pi-agent
@@ -107,8 +144,9 @@ archetype gets consulted.
 ## Design Notes
 
 - `MEMORY-SYSTEM.md` describes the implemented scoped memory runtime.
-- `ENGINE-SYSTEM.md` describes the next engine abstraction plan: Pi, Ollama,
-  API providers, and CLI-backed engines such as `agy`, `grok`, and `gemini`.
+- `ENGINE-SYSTEM.md` describes the engine abstraction plan: Pi, local/API
+  model providers, and CLI-backed engines such as `codex`, `claude`, `grok`,
+  and `agy`.
 - Mneme is a sibling package, `@noopolis/mneme`, published separately and used
   by Daimon in-process for Pi agents. Other runtimes can use Mneme through its
   MCP server. The agent-facing tools stay named `memory_search`,
@@ -117,16 +155,22 @@ archetype gets consulted.
 
 ## Runtime Artifact Image
 
-Daimon can build a local copy-only runtime artifact image for Spawnfile:
+Daimon defines a local copy-only runtime artifact image build for Spawnfile:
 
 ```bash
 npm run image:runtime:local
 ```
 
+Status: this build currently fails against the public npm registry. The
+Dockerfile pins `@noopolis/daimon@0.1.2` and `@noopolis/mneme@0.1.1`, and
+neither is published yet (registry has daimon 0.1.1 and mneme 0.1.0). Works
+only after those versions publish or against a registry that has them. Treat
+as pending publish.
+
 This creates:
 
 ```text
-noopolis/spawnfile-runtime-daimon:0.1.1-local
+noopolis/spawnfile-runtime-daimon:0.1.2-local
 ```
 
 The image is not a full organization image and is not intended to be run
@@ -139,7 +183,7 @@ directly. It contains only:
 Spawnfile can copy that path into generated organization images:
 
 ```bash
-SPAWNFILE_DAIMON_RUNTIME_IMAGE=noopolis/spawnfile-runtime-daimon:0.1.1-local \
+SPAWNFILE_DAIMON_RUNTIME_IMAGE=noopolis/spawnfile-runtime-daimon:0.1.2-local \
   spawnfile build ./agentic-org
 ```