Modal node rejects result staging through its Volume mount alias after completion

Summary

On release/v0.1.0 (9b0bc8cab2e681bbffeee385c1f80f85a47087d3), a Modal cloud node can complete its selected task and verifier and record a durable completed checkpoint, then fail before publishing its result bundle with:

cloud publication destination is unsafe

The worker canonicalizes the accepted durable workspace root during initialization, but later builds .result-publishing-*, the publication lock, and final result paths from the original lexical --data-root. Modal Volume paths may be regular directories at the lexical mount path while resolving to an internal canonical Volume path. assertSafeDirectoryTarget() consequently rejects the worker's own staging tree.

Generic reproduction

This target-independent reproduction uses a file-descriptor directory alias to model the same regular-directory / different-realpath condition:

import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { copySafeTree } from "./packages/modal/src/node-worker.ts";

const root = fs.mkdtempSync(path.join(os.tmpdir(), "ultrafuzz-modal-alias-"));
const mount = path.join(root, "mount");
fs.mkdirSync(mount);
const fd = fs.openSync(root, "r");
try {
  const source = path.join(root, "source");
  fs.mkdirSync(source);
  fs.writeFileSync(path.join(source, "proof.txt"), "ok\n");

  const alias = path.join(`/proc/self/fd/${fd}`, "mount");
  const lexical = path.join(alias, "result-publishing", "bundle", "artifacts");
  fs.mkdirSync(path.dirname(lexical), { recursive: true });

  copySafeTree(source, lexical);
} finally {
  fs.closeSync(fd);
  fs.rmSync(root, { recursive: true, force: true });
}

The alias itself reports as a directory, not a symlink, but copySafeTree() throws cloud publication destination is unsafe. Replacing the alias prefix with fs.realpathSync(alias) succeeds.

Expected behavior

Once the worker has validated and adopted its durable data root, result staging and atomic publication should consistently use that canonical root. The existing strict destination checks should remain in place so actual symlinked or special-file destinations are still rejected.

Impact

An otherwise successful cloud node is reported as failed after inference and verification. Its durable Volume contains both completed and later failed checkpoints, but the controller cannot adopt the completed work because result.json and artifacts.tgz were never published.

Start in packages/modal/src/node-worker.ts, especially copySafeTree() and the worker initialization that validates the durable data root. Run the file-descriptor alias reproduction to observe the failure, then trace how staging, locking, and final result paths are built. Done means canonical-root paths work while strict checks still reject symlinked or special-file destinations.