@jr2/cli 0.2.1 → 0.4.1

package/src/commands/up.ts

@@ -1,15 +1,23 @@
 // `jr2 up [--yes] [--force] [-n <ns>] [--context <ctx>]` (ADR-0019): idempotently converge the target
 // namespace to this instance — every layer, loudly narrated, safe to re-run. Layers in order:
-// typecheck → the Machine walk → ownership → image resolution → operator → kit images → instance
-// image → Sandbox Images → Secret (+ preflight of referenced Secrets) → apply + rollout → the cache
-// agent (ADR-0051: a DaemonSet converged when a registered Machine composes a Sandbox, deleted when
-// none does) → Instance Harness (ADR-0031: converged by convention when a carried definition
-// declares `workspace: "none"`, deleted when none does) → a report of live workspaces still on an
-// older image. The Orchestrator creates a Repo resource per Repo the walk found bound, at boot, and
-// the cache agent clones it onto a node on first need (ADR-0051); a configured custom provider is
-// preflighted from inside the cluster. A bound ssh url asks where its deploy key comes from
-// (ADR-0047), and a converge that GENERATED one ends by saying so — the key is dead until a human
-// registers it.
+// typecheck → the Machine walk → staging the Assembly (ADR-0069) → the Kubernetes floor (ADR-0037)
+// → ownership → image resolution → operator → Kit images (the Harness, the Orchestrator) → Sandbox
+// Images → Secret (+ preflight of referenced Secrets) → apply + rollout → the cache agent
+// (ADR-0051: a DaemonSet converged when a registered Machine composes a Sandbox, deleted when none
+// does) → Instance Harness (ADR-0031: converged by convention when a carried definition declares
+// `workspace: "none"`, deleted when none does) → Instance Effector → publishing the Assembly to the
+// running Orchestrator (ADR-0069) → a report of live workspaces still on an older image.
+//
+// The Assembly is staged EARLY and published LAST (ADR-0069). Early, so its refusals (a second copy
+// of a Kit package, a Kit version mismatch, a tree that names its staging path) come before any
+// cluster spend. Last, because the door's own checks are true only once the cluster work is done:
+// the image map holds every `file:` digest, the Secrets exist, and the Orchestrator runs the Kit
+// version the Assembly names. A Machine edit therefore rolls nothing: it is a new Assembly, not a
+// new pod template. The Orchestrator creates a Repo resource per
+// Repo the walk found bound, at boot and at each publish, and the cache agent clones it onto a node on first need
+// (ADR-0051); a configured custom provider is preflighted from inside the cluster. A bound ssh url
+// asks where its deploy key comes from (ADR-0047), and a converge that GENERATED one ends by saying
+// so — the key is dead until a human registers it.
 //
 // The typecheck is FIRST and is a gate (ADR-0050): a Machine names its Agents, its composed
 // Machines, and its Repo Slots by string, and since ADR-0049 those strings are typed, so a wrong
@@ -24,11 +32,12 @@
 // `--platform` passed explicitly on every build. The cluster's schedulable nodes choose that set
 // (`platforms` in the config overrides absolutely), so the daemon default and
 // `DOCKER_DEFAULT_PLATFORM` steer nothing any more. In a kit CHECKOUT the built set includes the
-// Harness, Adapter, and operator; installed from npm those sources do not resolve and the published
+// Harness, the operator and the Orchestrator (ADR-0069); installed from npm those sources do not resolve and the published
 // `<kitversion>` refs are used with no docker at all (they are multi-arch manifest lists, so they
 // take no suffix and never had this hole). There is no `images` config block and no env escape
 // hatch — nobody gets to point a real cluster at a hand-picked Harness (ADR-0027's no-eject-hatch,
-// enforced rather than stated).
+// enforced rather than stated). An installed Instance with no `workspace()` therefore needs no
+// docker at all: it builds nothing, and its Workflows ride the Assembly (ADR-0069).
 // The converged name→ref map is stamped on the Orchestrator Deployment and diffed on the next run,
 // so a steady-state converge spends directory walks and no docker. When that record is silent (a
 // fresh namespace), the host daemon's labeled listing answers the BUILD question instead
@@ -45,43 +54,80 @@
 // labeled objects found → converge silently (it's home); nothing → confirm first-time setup
 // (`--yes` for CI); objects labeled as a DIFFERENT instance → refuse.
 
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes } from "node:crypto";
 import { open, readdir, readFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { basename, join } from "node:path";
+import { basename, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import {
-  customizeLine,
+  custodianBootstrap,
+  custodianRef,
+  custodianScript,
+  CUSTODIAN_PROGRAM,
   defaultImageContext,
+  heldSecretsOf,
+  HELD_CA_SECRET,
+  HELD_TLS_SECRET,
+  INSTANCE_CUSTODIAN_CONFIGMAP,
+  INSTANCE_HARNESS_HELD_POD,
+  ORCHESTRATOR_PORT,
   imageContextDigest,
   isSshUrl,
   loadConfig,
+  loadCharts,
   loadWorkflows,
+  chartFileRefusals,
+  machineBodies,
   matchCredential,
+  openPartRefusals,
+  packAssembly,
+  configMapDigest,
+  MOUNTED_CONFIGMAPS,
   partsOf,
+  placementWalkOf,
+  refuseEffectSecrets,
+  LABEL_EFFECTOR_POD,
+  LABEL_GIT_PUSH,
+  LABEL_GIT_CLONE,
+  gitCloneSecretsOf,
+  gitPushPlansOf,
+  repoIdentity,
+  type GitPushManifest,
+  type SandboxEffectorPlan,
+  secretPlacementsOf,
+  storedValueLength,
+  effectorKey,
+  targetText,
   harnessTokenDigest,
+  formatCpu,
+  formatMemory,
+  resolveSize,
   sandboxToken,
-  type CarriedAgent,
+  seatLine,
+  serializeMachine,
+  splitSize,
   type CarriedImage,
   type CarriedRepo,
+  type HeldManifest,
+  type HeldPodPlan,
   type ImageRefs,
   type JR2Config,
+  type ResolvedSize,
 } from "@jr2/orchestrator";
+import { stageAssembly, stagedCopyOf } from "../assembly.ts";
+import { caFits, fingerprint, issueCa, issueLeaf, leafFits, trustBundles, type Pem } from "../held-pki.ts";
 import {
   assertEmulation,
   buildSandboxImage,
   choosePlatforms,
   detectKitCheckout,
-  instanceImageLabels,
   kitImageBuild,
   kitImageRefs,
   normalizeRef,
-  platformSuffix,
   pnpmDockerBuild,
   publishedKitRefs,
   sandboxImageTag,
-  stageInstanceBundle,
-  INSTANCE_DOCKERFILE,
   KIT_IMAGE_HOME,
   type BuildPort,
   type KitImageName,
@@ -90,29 +136,50 @@ import {
 import {
   ANNOTATION_IMAGES,
   compareVersions,
+  INSTANCE_HARNESS_DRAIN_SECONDS,
+  INSTANCE_HARNESS_PODS_SERVICE,
+  INSTANCE_HARNESS_PVC,
   INSTANCE_HARNESS_SERVICE,
   instanceHarnessObjects,
+  instanceEffectorObjects,
+  effectorDigest,
+  storedValueDigest,
+  type ValueDigest,
+  effectorGraceSeconds,
+  INSTANCE_EFFECTOR,
   instanceObjects,
   KIT_VERSION,
-  LABEL_HASH,
   LABEL_INSTANCE,
   LABEL_VERSION,
   OPERATOR_DEPLOYMENT,
   OPERATOR_NAMESPACE,
   OPERATOR_SELECTOR,
   operatorManifest,
+  priorityClassNames,
+  priorityClassObjects,
   REPO_CACHE,
+  trustObject,
+  holdsAny,
+  LABEL_HELD_POD,
+  type HeldObjects,
+  type CustodianFiles,
+  type HeldPodObjects,
 } from "../deploy.ts";
 import { resolveRoot } from "../instance.ts";
+import { effectorImagePaths, effectorImageRefusal, STOCK_HARNESS_IMAGE, type PushForm } from "../effector-image.ts";
 import {
+  kubeFloorRefusal,
+  podResourcesProbe,
   kubectlAdmin,
+  kubectlKube,
   rolloutFailure,
+  KUBE_FLOOR,
   ORCHESTRATOR_SERVICE,
   type KubeAdmin,
   type KubeObject,
   type RolloutTarget,
 } from "../kube.ts";
-import { buildNodes, sandboxNodes, type NodeObject } from "../nodes.ts";
+import { anyNodeHolds, buildNodes, sandboxNodes, type NodeObject } from "../nodes.ts";
 import { activity, chooseOrBail, confirmOrBail, promptLine, readSecretInput, type Io } from "../output.ts";
 import { kindCluster, sweepImages } from "../sweep.ts";
 import { tscTypecheck } from "../typecheck.ts";
@@ -174,42 +241,233 @@ export async function up(args: string[], io: Io): Promise<number> {
   // The Machine is named by where it sits under the registered root — the slot chain a
   // `customize()` walks — and the fix line nests the same way, so it pastes into
   // `workflows/<name>.ts` with the imported Machine and the url filled in.
-  // The two kinds of Open part are refused in ONE listing, in walk order within each kind: a
-  // composer fixing a packaged Machine fixes both in the same edit, and a converge that refused
-  // the Repo Slot, then the Agent one run later, would cost them two rounds to learn one thing.
+  // Every Open part is refused in ONE listing, in walk order within each kind: a composer fixing a
+  // packaged Machine fixes all of them in the same edit, and a converge that refused the Repo Slot,
+  // then the Agent one run later, would cost them two rounds to learn one thing. The listing is the
+  // door's own (ADR-0069): the Orchestrator refuses a publish with the same lines, so the host walk
+  // and the door's walk cannot drift.
+  const open = openPartRefusals(workflows);
+  if (open.length) {
+    for (const line of open) activity(io, `refusing: ${line}`);
+    return 1;
+  }
+  // Each Chart file is admitted HERE by the door's own check (ADR-0070), so a Chart file the
+  // Orchestrator would refuse is refused at the same command as `tsc`'s errors, before any
+  // cluster work, with the lines the publish would answer.
+  const chartRefusals = chartFileRefusals(
+    await loadCharts(root, (line) => activity(io, `warning: ${line}`)),
+    workflows,
+  );
+  if (chartRefusals.length) {
+    for (const line of chartRefusals) activity(io, `refusing: ${line}`);
+    return 1;
+  }
+  // What each registered Machine runs outside itself (ADR-0067, ADR-0068): every Effect slot, with
+  // the plain data it carries — a command's argv, its timeout, the Repo Slot it runs in; an http
+  // Effect's method, its fixed target and the secrets it names — read, never run.
   for (const w of workflows) {
-    const walked = partsOf([w.machine]);
-    const opened = [
-      ...walked.openSlots.map((o) => ({
-        ...o,
-        part: "repo" as const,
-        // An Open MAP names no slot — the composer does — so it is refused as "the Repo Slots".
-        what: o.slot === undefined ? "its Repo Slots" : `Repo Slot "${o.slot}"`,
-        adr: "ADR-0051",
-      })),
-      ...walked.openAgents.map((o) => ({ ...o, part: "agent" as const, what: `Agent "${o.slot}"`, adr: "ADR-0054" })),
-    ];
-    for (const { slot, path, part, what, adr } of opened) {
-      if (path === undefined) {
+    const effects = partsOf([w.machine]).effects;
+    if (!effects.length) continue;
+    activity(io, `effects: workflow "${w.name}" — what it runs outside itself (ADR-0067)`);
+    for (const e of effects) {
+      const where = e.path?.length ? ` (on ${e.path.map((k) => `"${k}"`).join(" → ")})` : "";
+      const slot = e.slot !== undefined ? `, in Repo Slot "${e.slot}"` : "";
+      if (e.kind === "http") {
+        const names = e.secrets.length ? `, secrets ${e.secrets.map((n) => `"${n}"`).join(", ")}` : "";
+        // Its body decides where it runs (ADR-0067): a Worktree file needs its Workspace's Sandbox Effector.
+        const where2 = e.file
+          ? `in the Sandbox Effector, a Worktree file as its body${slot}`
+          : "in the Instance Effector";
         activity(
           io,
-          `refusing: workflow "${w.name}" leaves ${what} open on a Machine invoked inline — no ` +
-            "customize() reaches an actor without a slot key; declare that Machine under setup({ actors }) and " +
-            `bind it there  (ADR-0049, ${adr})`,
+          `  ${e.name}${where}: http ${e.method} ${e.target ? targetText({ target: e.target }) : "<open>"} — ${e.timeoutMs / 1000}s, ` +
+            `${where2}${names}${e.idempotent ? ", idempotent" : ""}`,
         );
-        return 1;
+        continue;
+      }
+      if (e.kind === "push") {
+        const opts = (["pin", "sign", "squash", "force"] as const).filter((k) => e[k]);
+        activity(
+          io,
+          `  ${e.name}${where}: push${opts.length ? ` (${opts.join(", ")})` : ""} — ${e.timeoutMs / 1000}s, ` +
+            `in the Sandbox Effector${slot}`,
+        );
+        continue;
       }
-      const where = path.length ? ` (on the Machine composed as ${path.map((k) => `"${k}"`).join(" → ")})` : "";
+      if (!("argv" in e)) continue;
+      const names = e.secrets?.length ? `, secrets ${e.secrets.map((n) => `"${n}"`).join(", ")}` : "";
+      const seat = e.secrets?.length ? `the Sandbox Effector${e.pin ? ", pinned" : ""}` : "the Harness";
       activity(
         io,
-        `refusing: workflow "${w.name}" leaves ${what} open${where} — bind it where the Machine is ` +
-          `registered: export const machine = ${customizeLine("<import>", path, slot, part)}  (${adr})`,
+        `  ${e.name}${where}: ${e.kind} ${JSON.stringify(e.argv)} — ${e.timeoutMs / 1000}s, in ${seat}${slot}${names}`,
       );
-      return 1;
+    }
+  }
+  // An Effect that names a secret the `secrets` list does not hold, and a literal Effect secret too
+  // short to scrub (ADR-0068), are refused HERE, off the walk and the config alone — before anything is
+  // built or applied (ADR-0050, ADR-0068). A secret read from the user's Secret is placed below,
+  // once the cluster is reached.
+  // What names each secret, read off the walk (ADR-0059, ADR-0068): every Effect, every Workspace's
+  // pod — its `workspace()`'s `secrets` and the models of the Agents whose Turns run there — and the
+  // models of the `"none"` Agents the Instance Harness hosts.
+  // An Open body that allows "none" needs the Instance Harness, holding a key for each model it
+  // allows (ADR-0070), as a "none" Agent does. The door's walk says both, so `jr2 up` and the
+  // publish door place the same set.
+  const placementWalk = placementWalkOf(workflows);
+  refuseEffectSecrets(config, placementWalk);
+  // Who may send what, per state (ADR-0015): the audience rule's answer for each registered
+  // Machine and every Machine it composes, as its doc carries it — so an author reads who holds a
+  // pick before a run finds out. Then what the build found legal and suspect: a warning, never a
+  // refusal (the refusals threw when the Machine loaded).
+  for (const w of workflows) {
+    const bodies = machineBodies(serializeMachine(w.name, w.machine));
+    const seats = bodies.flatMap((body) => body.seats.map(seatLine));
+    if (seats.length) {
+      activity(io, `seats: workflow "${w.name}" — who may send what, per state (ADR-0015)`);
+      for (const line of seats) activity(io, `  ${line}`);
+    }
+    for (const body of bodies) {
+      for (const warning of body.warnings) activity(io, `warning: workflow "${w.name}": ${warning}  (ADR-0015)`);
+    }
+  }
+  // The Size (ADR-0060): every `workspace()` a registered Machine composes, resolved down its chain
+  // (the Machine's, then `sandbox.resources`, then the kit's) and split inside the pod, exactly as
+  // the provision will. A split that leaves the Harness below its floor is refused HERE, naming the
+  // Machine and the number to change, rather than at the first provision of a run. The resolved
+  // Sizes are kept for the Sandbox-node warning below.
+  const sizes: Array<{ workflow: string; size: ResolvedSize }> = [];
+  for (const w of workflows) {
+    for (const { path, resources, user } of partsOf([w.machine]).sizes) {
+      try {
+        const size = resolveSize(resources, config.sandbox?.resources);
+        splitSize(size, user);
+        sizes.push({ workflow: w.name, size });
+      } catch (e) {
+        const where =
+          path !== undefined && path.length
+            ? ` (on the Machine composed as ${path.map((k) => `"${k}"`).join(" → ")})`
+            : "";
+        const fix =
+          path === undefined
+            ? ""
+            : `; a composer retunes it where the Machine is registered: export const machine = ${sizeLine(path)}`;
+        activity(io, `refusing: workflow "${w.name}"${where}: ${(e as Error).message}${fix}`);
+        return 1;
+      }
     }
   }
   const agentNames = [...new Set(agents.map((a) => a.name))].join(", ") || "(none)";
   activity(io, `agents: ${agentNames} (carried by ${workflows.length} workflow machine(s))`);
+  // Each Chart wrapper (ADR-0070): what its Open body lends a Chart, how many models a Chart's own
+  // Agents may name (each gets its key placed below), and the Chart files the Assembly carries for
+  // it. The walk reads the Open body's declaration, so the keys and the Instance Harness a Chart
+  // could need are placed before any run.
+  const chartFiles = await chartFilesIn(root);
+  for (const w of workflows) {
+    const bodies = partsOf([w.machine]).openBodies.filter((b) => b.path !== undefined && b.path.length === 0);
+    if (!bodies.length) continue;
+    const lends = [
+      ...new Set(
+        bodies.flatMap(({ declaration: { lends } }) => [
+          ...(lends.agents ?? []),
+          ...(lends.effects ?? []),
+          ...(lends.machines ?? []),
+          ...(lends.guards ?? []),
+          ...(lends.actions ?? []),
+          ...(lends.delays ?? []),
+        ]),
+      ),
+    ];
+    const models = new Set(bodies.flatMap((b) => b.declaration.allows.models));
+    const files = chartFiles.filter((n) => n.startsWith(`${w.name}/`)).length;
+    activity(
+      io,
+      `chart wrapper "${w.name}": lends ${lends.join(", ") || "nothing"}; allows ${models.size} model(s); ${files} Chart file(s)`,
+    );
+  }
+
+  // --- the Assembly (ADR-0069): staged here, published last ---------------------------------------
+  // Staged BEFORE any cluster spend, so its refusals cost nothing: a second copy of a Kit package
+  // (ADR-0054's silent-empty-Menus failure), a Kit version other than this CLI's (ADR-0056), a tree
+  // that names its own staging path (ADR-0038). Packed at once and the scratch tree removed: the
+  // archive is what the door receives, and no later layer reads the tree.
+  const build = io.build ?? pnpmDockerBuild;
+  activity(io, "assembly: staging");
+  const staged = await stageAssembly(build, root);
+  let assembly: { hash: string; kitVersion: string; workflows: string[]; tar: Buffer };
+  // The scaffolded `images/default` is a PATH CONVENTION, not discovery (ADR-0049/0050): exactly
+  // one path is checked, and it is keyed `default` rather than by digest, because that reserved
+  // key IS the middle leg of the resolution chain a `workspace()` that names no image lands on.
+  const fallback = await defaultImageContext(root);
+  // Every `file:` context is keyed by the digest of its STAGED copy (ADR-0037, ADR-0069): the
+  // bytes the door checks against the image map and a provision resolves, which the Instance
+  // folder's own copy need not equal (staging drops `node_modules`, `.git`, `.env`, `.npmrc` at
+  // every depth). The build below still reads the folder; only the key comes from here. A context
+  // the Assembly does not carry is refused now, before any cluster spend.
+  let contextDigests: Map<string, string>;
+  // The Chart files the staged Assembly carries (ADR-0070): Workflows the door registers too.
+  let stagedCharts: string[] = [];
+  try {
+    assembly = {
+      hash: staged.hash,
+      kitVersion: staged.kitVersion,
+      workflows: staged.workflows,
+      tar: await packAssembly(staged.dir),
+    };
+    contextDigests = await stagedContextDigests(staged.dir, root, [
+      ...(fallback ? [fallback] : []),
+      ...contexts.map((image: CarriedImage) => image.dir),
+    ]);
+    stagedCharts = await chartFilesIn(staged.dir);
+  } finally {
+    await staged.dispose();
+  }
+  // The walk above loaded the Instance folder; the door loads the Assembly (ADR-0069). The two must
+  // hold the same Workflows, or a Workflow the walk built and placed for is absent at the door, and
+  // `jr2 run` names it unknown after a converge that said it succeeded.
+  // A Chart file is a Workflow too (ADR-0070), `<wrapper>/<name>`, at `workflows/<wrapper>/<name>.chart.json`.
+  const walked = [...workflows.map((w) => w.name), ...chartFiles];
+  const inAssembly = [...assembly.workflows, ...stagedCharts];
+  const absent = walked.filter((n) => !inAssembly.includes(n));
+  const extra = inAssembly.filter((n) => !walked.includes(n));
+  const fileOf = (n: string) => (n.includes("/") ? `workflows/${n}.chart.json` : `workflows/${n}.ts`);
+  if (absent.length || extra.length) {
+    activity(
+      io,
+      `refusing: the staged Assembly does not hold the Workflows this folder holds (ADR-0069)` +
+        (absent.length ? `; absent from the Assembly: ${absent.map(fileOf).join(", ")}` : "") +
+        (extra.length ? `; only in the Assembly: ${extra.map(fileOf).join(", ")}` : "") +
+        ` — the Assembly holds what the Instance's install keeps; check the \`files:\` list in package.json`,
+    );
+    return 1;
+  }
+  activity(
+    io,
+    `assembly: ${assembly.hash} (kit v${assembly.kitVersion}; ${assembly.workflows.length} workflow(s): ` +
+      `${assembly.workflows.join(", ") || "(none)"})`,
+  );
+
+  // --- the Kubernetes floor (ADR-0037) ----------------------------------------------------------
+  // Every Sandbox mounts jr2's runtime as an `image` volume, and there is no fallback below the
+  // version that turns them on — so a cluster under it is refused HERE, naming what it runs and the
+  // floor (ADR-0046), rather than converging and leaving every Sandbox Pending on a volume type its
+  // kubelet does not know. Before ownership, so first contact never asks to deploy somewhere that
+  // cannot host it. Unconditional: the floor is the Instance's, not one Machine's. The container
+  // runtime owes image volumes too (containerd ≥ 2.1, CRI-O ≥ 1.31); that is not cheaply visible
+  // from here, so an older one fails at the first provision, in the pod's own events.
+  let serverVersion: string;
+  try {
+    serverVersion = await kube.serverVersion(ctx);
+  } catch (e) {
+    activity(io, `refusing: cannot reach the API server of ${context} (${(e as Error).message}). Nothing was applied.`);
+    return 1;
+  }
+  const belowFloor = kubeFloorRefusal(serverVersion);
+  if (belowFloor) {
+    activity(io, `refusing: ${context} ${belowFloor}. Nothing was applied.`);
+    return 1;
+  }
+  activity(io, `kubernetes: ${serverVersion} (floor ${KUBE_FLOOR.major}.${KUBE_FLOOR.minor}, ADR-0037)`);
 
   // --- ownership: the cluster is the record (ADR-0019) -------------------------------------------
   const ns = await kube.getJson({ kind: "namespace", name: namespace, ...ctx });
@@ -238,8 +496,23 @@ export async function up(args: string[], io: Io): Promise<number> {
     ...ctx,
   });
 
+  // --- pod-level resources (ADR-0060): the whole Size is one pod-level ceiling (KEP-2837) ------
+  // A server with the PodLevelResources gate off drops `spec.resources` silently, and every
+  // Sandbox runs Burstable. A server-side dry-run shows it; it needs the namespace, so it runs here.
+  try {
+    const admitted = await kube.dryRunCreate({ manifest: JSON.stringify(podResourcesProbe(namespace)), ...ctx });
+    if (admitted.spec?.resources === undefined) {
+      activity(
+        io,
+        `refusing: ${context} (Kubernetes ${serverVersion}) drops pod-level resources — the PodLevelResources feature gate is off, and a Workspace's Size cannot hold (ADR-0060). Enable the gate on the API server and kubelets. The namespace was created; nothing else was applied.`,
+      );
+      return 1;
+    }
+  } catch (e) {
+    activity(io, `warning: could not confirm pod-level resources on ${context}: ${(e as Error).message}`);
+  }
+
   // --- image resolution (ADR-0038): decide every ref BEFORE any layer spends a build -----------
-  const build = io.build ?? pnpmDockerBuild;
   const registry = config.registry;
   const cluster = kindCluster(context);
 
@@ -295,6 +568,22 @@ export async function up(args: string[], io: Io): Promise<number> {
           "`sandbox: { nodeSelector, tolerations }` in jr2.config.ts (raw pod-spec shapes, ADR-0052).",
       );
     }
+    // A Size no Sandbox node could hold today WARNS (ADR-0060, the ADR-0052 stance): the node set
+    // moves, and an autoscaler may bring a bigger node for the Pending pod. A node that reports no
+    // allocatable is an unknown, never a no. One line per distinct Size, naming its workflows.
+    const unheld = new Map<string, string[]>();
+    for (const { workflow, size } of sizes) {
+      if (candidates.length === 0 || anyNodeHolds(candidates, size) !== false) continue;
+      const key = `memory ${formatMemory(size.memory.bytes)}, cpu ${formatCpu(size.cpu.millis)}`;
+      unheld.set(key, [...new Set([...(unheld.get(key) ?? []), workflow])]);
+    }
+    for (const [key, names] of unheld) {
+      activity(
+        io,
+        `warning: no Sandbox node right now has the allocatable for a Size of ${key} ` +
+          `(workflow ${names.map((n) => `"${n}"`).join(", ")}) — its Sandbox stays Pending until one does`,
+      );
+    }
   }
   // A multi-platform build is `docker buildx build --push`: it delivers by pushing, and there is
   // nowhere to push without a registry. By CONSTRUCTION this never fires — a mixed-arch cluster is
@@ -323,19 +612,29 @@ export async function up(args: string[], io: Io): Promise<number> {
   activity(
     io,
     kitRoot
-      ? `images: kit checkout at ${kitRoot} — building the Harness, Adapter, and operator from source`
-      : `images: installed kit — the published v${KIT_VERSION} Harness, Adapter, and operator, pulled from ` +
+      ? `images: kit checkout at ${kitRoot} — building the Harness, operator and Orchestrator from source`
+      : `images: installed kit — the published v${KIT_VERSION} Harness, operator and Orchestrator, pulled from ` +
           `${config.kitRegistry ? `${config.kitRegistry} (kitRegistry)` : KIT_IMAGE_HOME}`,
   );
+  // The Custodian's image is deployed and never built, in either world (ADR-0038, ADR-0059): the
+  // pinned upstream Envoy, re-homed onto `kitRegistry` like a Kit image when one is set.
+  const custodianImage = custodianRef(config.kitRegistry);
+  activity(io, `custodian image: ${custodianImage} (pinned, deployed — never built)`);
 
-  // Read the Orchestrator Deployment ONCE: it carries both convergence records — the instance
-  // image's content hash (a label) and the previous name→ref map (an annotation, ADR-0038).
+  // Read the Orchestrator Deployment ONCE: it carries the convergence record — the previous
+  // name→ref map (an annotation, ADR-0038), the Orchestrator's own Kit ref included (ADR-0069).
   const orch = await kube.getJson({ kind: "deployment", name: ORCHESTRATOR_SERVICE, namespace, ...ctx });
   const previous = previousImages(orch);
-  const converged: ConvergedImages = { harness: refs.harness, adapter: refs.adapter, sandbox: {}, sandboxUser: {} };
+  const converged: ConvergedImages = {
+    harness: refs.harness,
+    custodian: custodianImage,
+    orchestrator: refs.orchestrator,
+    sandbox: {},
+    sandboxUser: {},
+  };
 
-  // ONE transport branch for every image (ADR-0038), so instance, kit, and Sandbox Images cannot
-  // drift into three delivery stories.
+  // ONE transport branch for every image (ADR-0038), so Kit images and Sandbox Images cannot
+  // drift into two delivery stories.
   const deliver = async (tag: string): Promise<void> => {
     // A multi-platform build already pushed (ADR-0045): `docker buildx build --push` IS the
     // delivery, and pushing again would push a tag the daemon never held. Sound at every call site
@@ -419,6 +718,17 @@ export async function up(args: string[], io: Io): Promise<number> {
     return ref;
   };
 
+  // --- priority (per-cluster, shared, ADR-0060) --------------------------------------------------
+  // The two PriorityClasses, beside the CRDs and before anything that names them: a pod whose class
+  // does not exist is refused at admission. Unconditional on `operator.manage` — the Instance's own
+  // pods name them too — and skipped per key the Instance's `priorityClasses` names.
+  const classes = priorityClassObjects(config.priorityClasses);
+  for (const manifest of classes) await kube.apply({ manifest, ...ctx });
+  const named = Object.entries(config.priorityClasses ?? {}).filter(([, v]) => v !== undefined);
+  if (named.length) {
+    activity(io, `priority: the Instance's own — ${named.map(([tier, cls]) => `${tier} "${cls}"`).join(", ")}`);
+  }
+
   // --- operator (per-cluster, shared) ------------------------------------------------------------
   // The operator IMAGE is resolved whenever anything this converge deploys runs it: the operator
   // layer itself, or the data plane's cache agent, which is the same binary (`/manager repo-cache`,
@@ -445,7 +755,10 @@ export async function up(args: string[], io: Io): Promise<number> {
       activity(io, `operator: leaving v${deployed} (newer than this kit's v${KIT_VERSION} — never downgraded)`);
     } else {
       activity(io, `operator: applying v${KIT_VERSION} (${image})${deployed ? ` over v${deployed}` : ""}`);
-      await kube.apply({ manifest: await operatorManifest(image), ...ctx });
+      await kube.apply({
+        manifest: await operatorManifest(image, priorityClassNames(config.priorityClasses).control),
+        ...ctx,
+      });
       await kube.label({
         kind: "deployment",
         name: OPERATOR_DEPLOYMENT,
@@ -474,60 +787,20 @@ export async function up(args: string[], io: Io): Promise<number> {
   }
 
   // --- the kit's own runtime images (ADR-0038) ---------------------------------------------------
-  // Built here rather than lazily beside their consumers. The Harness is the injection source
-  // (ADR-0037): the pod's `runtime` init step copies `/opt/jr2` out of this exact ref onto the
-  // volume the Sandbox Image mounts. The Adapter is deployed into every Sandbox this instance
-  // provisions. Neither is a hash input for a Sandbox Image — the runtime rides the pod's volume,
-  // so a kit edit re-images future pods and re-tags nothing of the user's.
+  // Built here rather than lazily beside its consumers. The Harness is the injection source
+  // (ADR-0037): every Sandbox mounts this exact ref as an `image` volume, its `/opt/jr2` read-only
+  // at `/opt/jr2` in the Sandbox Image. It is not a hash input for a Sandbox Image — the runtime rides
+  // the pod's volume, so a kit edit re-images future pods and re-tags nothing of the user's.
   await ensureKitImage("harness");
-  await ensureKitImage("adapter");
-
-  // --- instance image (content-addressed by the bundle) ------------------------------------------
-  // Stage first, THEN decide: the hash is over the materialized bundle — the actual image inputs,
-  // kit included — so the tag is a content address rather than a guess about what changed.
-  const staged = await stageInstanceBundle(build, root);
-  // The content address covers (inputs × platform set), ADR-0045 — so the platform rides the HASH
-  // this layer records, not just the tag composed from it. That is what keeps the staleness key and
-  // the tag one fact: a converge whose platform set moved must not read the recorded hash as fresh,
-  // skip the build, and then apply a tag nothing ever delivered.
-  const hash = `${staged.hash}${platformSuffix(platforms)}`;
-  const tag = registry ? `${registry}/jr2-instance-${name}:${hash}` : `jr2-instance-${name}:${hash}`;
-  try {
-    if (orch?.metadata.labels?.[LABEL_HASH] === hash && values.force !== true) {
-      // Safe to skip only because the rolled-out pod is verified against `tag` below: this decides
-      // whether to spend a docker build, not whether the cluster is already correct.
-      activity(io, `image: ${tag} (fresh — build skipped; --force to rebuild anyway)`);
-    } else {
-      assertDeliverable();
-      if (await hostBuilt(tag)) {
-        activity(io, `image: ${tag} (host-built — build skipped, delivering; --force to rebuild)`);
-        await deliver(tag);
-      } else {
-        activity(io, `image: building ${tag}${values.force === true ? " (--force)" : ""}`);
-        await ensureEmulation();
-        await build.build({
-          tag,
-          platforms,
-          context: staged.dir,
-          dockerfileContent: INSTANCE_DOCKERFILE,
-          labels: instanceImageLabels(name),
-        });
-        await deliver(tag);
-      }
-    }
-  } finally {
-    await staged.dispose();
-  }
+  // The Orchestrator is a Kit image too (ADR-0069): the engine and its closure, nothing of this
+  // Instance. A Machine edit moves the Assembly, never this ref, so it never rolls the pod.
+  await ensureKitImage("orchestrator");
 
   // --- Sandbox Images (ADR-0037/0049): the contexts the Machines carry, plus `images/default` -----
   // Gated on the data-plane switch (ADR-0012/0031/0051): an instance none of whose Machines
   // composes a Sandbox has no Sandboxes, so it must not pay a docker build for an image it can
   // never use. Said out loud, because a silent skip of a folder you just wrote reads as a bug.
   if (carried.composesSandbox) {
-    // The scaffolded `images/default` is a PATH CONVENTION, not discovery (ADR-0049/0050): exactly
-    // one path is checked, and it is keyed `default` rather than by digest, because that reserved
-    // key IS the middle leg of the resolution chain a `workspace()` that names no image lands on.
-    const fallback = await defaultImageContext(root);
     const built: Array<{ dir: string; name: string; reserved?: "default" }> = [
       ...(fallback ? [{ dir: fallback, name: "default", reserved: "default" as const }] : []),
       ...contexts.map((image: CarriedImage) => ({ dir: image.dir, name: image.name })),
@@ -536,20 +809,13 @@ export async function up(args: string[], io: Io): Promise<number> {
       activity(io, "sandbox images: none carried (a workspace() names one, or scaffold images/default)");
     }
     for (const image of built) {
-      // A `file:` URL that names no folder fails HERE, at converge (ADR-0037) — the one moment a
-      // context's existence is checkable at all, since the pod only ever resolves a digest.
-      const digest = await imageContextDigest(image.dir).catch((err: NodeJS.ErrnoException) => {
-        throw new Error(
-          `the Sandbox Image context ${image.dir} cannot be read (${err.code ?? "read failed"}) — a ` +
-            '`workspace()` names its image with `import.meta.resolve("./<dir>")`, so that directory must exist ' +
-            "beside the Machine's own module (ADR-0037/0049).",
-        );
-      });
-      // Every carried context is keyed by that digest, which is how the baked Orchestrator finds
-      // this ref again from the `file:` URL its own copy of the module carries — no path table on
-      // either side (ADR-0049). The TAG carries the digest either way, so a Machine that names
+      // The digest of the context's staged copy, taken above with the Assembly: every carried
+      // context is keyed by it, which is how the Orchestrator finds this ref again from the
+      // `file:` URL the Assembly's copy of the module carries — no path table on either side
+      // (ADR-0049, ADR-0069). The TAG carries the digest either way, so a Machine that names
       // `images/default` by URL lands on the same tag as the reserved key: two records, one build
       // (the host-held check below spends nothing the second time).
+      const digest = contextDigests.get(image.dir)!;
       const key = image.reserved ?? digest;
       const ref = sandboxImageTag(name, image.name, digest, { platforms, registry });
       // A record is only worth skipping on when it is COMPLETE: the ref AND the seat the image
@@ -558,7 +824,7 @@ export async function up(args: string[], io: Io): Promise<number> {
       // as stale here and the image is re-inspected (the host skip below then spends no build).
       const remembered = previous?.sandboxUser?.[key];
       if (previous?.sandbox?.[key] === ref && remembered !== undefined && values.force !== true) {
-        // Unlike the instance image there is no rollout to verify a Sandbox Image against, so a
+        // Unlike a Kit image there is no rollout to verify a Sandbox Image against, so a
         // recorded-but-absent ref only shows up as ImagePullBackOff at the next provision —
         // `--force` rebuilds and re-delivers it. The seat is carried forward from the same record:
         // the tag is a content address, so the image the record names declares what it declared.
@@ -609,75 +875,205 @@ export async function up(args: string[], io: Io): Promise<number> {
   const keep = (key: string, mint: () => string): string =>
     secret?.data?.[key] ? Buffer.from(secret.data[key], "base64").toString("utf8") : mint();
   const instanceToken = keep("JR2_INSTANCE_TOKEN", () => randomBytes(24).toString("hex"));
+  // The publish token (ADR-0069): publishing an Assembly imports code into the process that holds
+  // the ServiceAccount, so it costs what deploying an image cost — cluster write access. It lives
+  // here beside the Instance token, and the publish below reads it from THIS Secret alone: no env
+  // var, flag or `--url` path can supply it, so an ingress-exposed Instance exposes no publish door.
+  const publishToken = keep("JR2_PUBLISH_TOKEN", () => randomBytes(24).toString("hex"));
   const signingKey = keep("JR2_SIGNING_KEY", () => randomBytes(32).toString("base64"));
   const secretData: Record<string, string> = {
     JR2_INSTANCE_TOKEN: instanceToken,
+    JR2_PUBLISH_TOKEN: publishToken,
     JR2_SIGNING_KEY: signingKey,
-    // The Instance Harness Adapter's credential (ADR-0013/0031): a sandbox-style token signed
+    // The Instance Harness Custodian's credential (ADR-0013/0031): a sandbox-style token signed
     // for the placement's name — it may deliver only to Turns hosted THERE (tokens.ts), so the
     // Instance token never enters that pod. Derived from the kept key, so re-runs converge to
-    // the same value; live Adapters keep verifying.
+    // the same value; live Custodians keep verifying.
     JR2_INSTANCE_HARNESS_TOKEN: sandboxToken(Buffer.from(signingKey, "base64"), INSTANCE_HARNESS_SERVICE),
   };
-  // Git tokens (ADR-0019/0051): every env var a `git.credentials` entry names, materialized from
-  // `.env` when set. They ride the ORCHESTRATOR's Secret — never the harness one — because the
-  // Orchestrator is what derives each Repo's credential Secret from them at boot; a Sandbox never
-  // holds one.
-  for (const entry of config.git?.credentials ?? []) {
-    if (entry.token !== undefined && io.env[entry.token]) secretData[entry.token] = io.env[entry.token]!;
-  }
+  // Git tokens (ADR-0051, ADR-0068): each entry's token, from `.env`, goes into that entry's own clone
+  // Secret (`jr2-git-<hash>`, Flux's key names), which the cache agent reads — never into this
+  // Secret, the Orchestrator's env. The Orchestrator names the Secret on a Repo and holds no git token.
+  // Only when a registered Machine composes a Sandbox: nothing else clones.
+  const gitClone = carried.composesSandbox ? gitCloneSecretsOf(config.git?.credentials ?? [], (n) => io.env[n]) : [];
+  for (const s of gitClone) activity(io, `git.credentials "${s.match}": clone Secret ${s.name}`);
 
   // The HARNESS containers' env — a separate Secret (ADR-0013): Agent code executes where these
   // land, so the Instance token/signing key above must be unreachable from it. Values declared in
-  // config (usually read off process.env/.env) materialize here (ADR-0019); so does the provider
-  // key — the ConfigMap'd harness config carries the provider MINUS this (ADR-0018).
+  // config (usually read off process.env/.env) materialize here (ADR-0019). The provider key does
+  // NOT: it is a held secret (ADR-0059), and the Agent can read everything in this Secret.
   const harnessEnvData: Record<string, string> = {};
   for (const v of config.harness?.env ?? []) if (v.value !== undefined) harnessEnvData[v.name] = v.value;
-  if (config.harness?.provider?.apiKey) harnessEnvData.JR2_PROVIDER_API_KEY = config.harness.provider.apiKey;
 
   // Preflight referenced-but-unmanaged Secrets: turn the CreateContainerConfigError hang into an
-  // immediate, named error (ADR-0019). Sealed/External Secrets ride this seam untouched.
+  // immediate, named error (ADR-0019). Sealed/External Secrets ride this seam untouched. The read
+  // keeps each one's key NAMES (never a value), which the held-secret rules check for a model key.
+  const envFromKeys = new Map<string, string[]>();
   for (const ref of config.harness?.envFrom ?? []) {
-    const refName = ref.secretRef?.name;
+    const refName = ref.secretRef?.name ?? ref.configMapRef?.name;
     if (!refName) continue;
-    if (!(await kube.getJson({ kind: "secret", name: refName, namespace, ...ctx }))) {
+    const kind = ref.secretRef ? "secret" : "configmap";
+    const found = await kube.getJson<KubeObject & { data?: Record<string, string> }>({
+      kind,
+      name: refName,
+      namespace,
+      ...ctx,
+    });
+    if (!found && kind === "secret") {
       throw new Error(
         `harness.envFrom references Secret "${refName}", which does not exist in namespace "${namespace}" — ` +
           `create it first: kubectl -n ${namespace} create secret generic ${refName} --from-literal=KEY=...`,
       );
     }
+    envFromKeys.set(`${kind}/${refName}`, Object.keys(found?.data ?? {}));
   }
 
   // --- private-CA bundle (ADR-0020): read HERE, host-side — the in-cluster config eval never
   // touches the file (the path may not exist there); consumers get the ConfigMap.
   const caPem = await readCaBundle(root, config);
 
+  // --- secrets (ADR-0059, ADR-0068): resolved HERE, host-side, where `.env` exists --------------
+  // R10: a Secret an entry references must exist with its key. Read once per Secret — each key's
+  // NAME, the LENGTH of its value, and a keyed digest of it, never the value — for both
+  // placements. The length is ADR-0068's: an Effect secret shorter than 8 characters is refused
+  // wherever its value is kept (ADR-0068). The digest goes into the template digest of each
+  // long-lived pod that reads the value once at start — the Instance Harness's Custodian and the
+  // Instance Effector — so a value edited in the user's Secret rolls them at the next `jr2 up`.
+  const referenced = new Map<string, Map<string, number> | undefined>();
+  const valueDigests = new Map<string, string>();
+  for (const entry of config.secrets ?? []) {
+    const ref = entry.valueFrom?.secretKeyRef.name;
+    if (ref === undefined || referenced.has(ref)) continue;
+    const found = await kube.getJson<KubeObject & { data?: Record<string, string> }>({
+      kind: "secret",
+      name: ref,
+      namespace,
+      ...ctx,
+    });
+    referenced.set(
+      ref,
+      found ? new Map(Object.entries(found.data ?? {}).map(([k, b64]) => [k, storedValueLength(b64)])) : undefined,
+    );
+    for (const [k, b64] of Object.entries(found?.data ?? {})) {
+      valueDigests.set(`${ref}/${k}`, storedValueDigest(Buffer.from(signingKey, "base64"), ref, k, b64));
+    }
+  }
+  const valueDigest = (secret: string, key: string) => valueDigests.get(`${secret}/${key}`);
+  const secretKeys = (secret: string) => {
+    const keys = referenced.get(secret);
+    return keys && [...keys.keys()];
+  };
+  const valueLength = (secret: string, key: string) => referenced.get(secret)?.get(key);
+  // Where each secret goes (ADR-0059, ADR-0068): read off the list and what names it, never
+  // declared — each Harness pod gets the Held secrets something in it names, the Instance Effector
+  // what its Effects name. The walk's refusals ran above; a `valueFrom` the user's Secrets do not
+  // hold is refused here, before the instance objects are applied.
+  const placements = secretPlacementsOf(config, placementWalk, { secretKeys, valueLength });
+  for (const line of placements.report) activity(io, line);
+  for (const warning of placements.warnings) activity(io, `warning: ${warning}`);
+  const held = await resolveHeld(io, kube, {
+    pods: placements.held,
+    claimed: placements.claimed,
+    config,
+    name,
+    namespace,
+    ctx,
+    envFromKeys,
+    secretKeys,
+    // Every bound Agent's model, and every model an Open body allows a Chart's own Agents (ADR-0070).
+    models: carried.models,
+    caBundle: caPem,
+  });
+
   // --- git over ssh: where the key comes from (ADR-0019, ADR-0047) -------------------------------
   // Runs BEFORE the apply, because a missing key source is a converge that must not start, and the
   // notice it hands back is owed to the END of the converge — a generated key is dead until a human
   // registers it, and by then this line has scrolled away.
   const gitSsh = await ensureGitSsh(io, kube, config, carried.repos, namespace, ctx, values.yes === true);
 
+  // --- what each Sandbox Effector's image owes its pushes (ADR-0068) ------------------------
+  // Before anything is applied: an image that lacks a push form's tools, or the passwd entry ssh
+  // needs, is refused here with the fix, not at the first push in a pod.
+  await checkEffectorImages(build, config, placements.sandbox, converged, platforms, contextDigests);
+
+  // --- push credentials (ADR-0051): one Secret per git.credentials entry, never per pod ----
+  // After the deploy keys exist (a generated one included), before anything else is applied: a
+  // static Binding whose entry cannot push is refused here.
+  const gitPush = await resolveGitPush(io, kube, config, placements.sandbox, namespace, ctx);
+
   // --- provider preflight (ADR-0019): probe the endpoint FROM INSIDE the cluster ----------------
-  await preflightProvider(io, kube, config, agents, namespace, ctx, caPem);
+  await preflightProvider(io, kube, config, carried.models, namespace, ctx, caPem);
 
   // --- apply + rollout ---------------------------------------------------------------------------
-  activity(io, `orchestrator: applying (image ${tag})`);
-  await kube.apply({
-    manifest: instanceObjects({
-      name,
-      namespace,
-      image: tag,
-      hash,
-      secretData,
-      harnessEnvData,
-      harness: config.harness,
-      caBundle: caPem,
-      imageRefs: converged,
-      repoCache: carried.composesSandbox ? { image: operatorImage!, placement: config.sandbox } : undefined,
-    }),
-    ...ctx,
+  // The trust bundles first, and server-side: every pod that mounts them must find them, and they
+  // carry every root certificate — past what client-side apply's annotation can hold.
+  const trust = trustObject({ name, namespace, caBundle: caPem, bundles: held.bundles });
+  if (trust) await kube.apply({ manifest: trust, serverSide: true, ...ctx });
+  activity(io, `orchestrator: applying (image ${refs.orchestrator})`);
+  const instanceList = instanceObjects({
+    name,
+    namespace,
+    image: refs.orchestrator,
+    secretData,
+    harnessEnvData,
+    harness: config.harness,
+    held: held.objects,
+    imageRefs: converged,
+    repoCache: carried.composesSandbox ? { image: operatorImage!, placement: config.sandbox } : undefined,
+    ...(config.priorityClasses ? { priorityClasses: config.priorityClasses } : {}),
+    sandboxEffectors: placements.sandbox,
+    gitPush,
+    gitClone,
   });
+  await kube.apply({ manifest: instanceList, ...ctx });
+  // An entry whose clone Secret this converge did not write loses it: a dropped entry, a token
+  // unset, or nothing left that clones.
+  const cloneSecrets = new Set(gitClone.map((s) => s.name));
+  for (const secret of await kube.listJson<KubeObject>({
+    kind: "secret",
+    selector: LABEL_GIT_CLONE,
+    namespace,
+    ...ctx,
+  })) {
+    if (cloneSecrets.has(secret.metadata.name)) continue;
+    await kube.deleteObject({ kind: "secret", name: secret.metadata.name, namespace, ...ctx });
+  }
+  // An entry whose push Secret this converge did not write loses it: a dropped entry, a token
+  // unset, or no push left anywhere.
+  const pushSecrets = new Set(gitPush.secrets.map((s) => s.name));
+  for (const secret of await kube.listJson<KubeObject>({
+    kind: "secret",
+    selector: LABEL_GIT_PUSH,
+    namespace,
+    ...ctx,
+  })) {
+    if (pushSecrets.has(secret.metadata.name)) continue;
+    await kube.deleteObject({ kind: "secret", name: secret.metadata.name, namespace, ...ctx });
+  }
+  // A Workspace whose body no longer places an Effect in its Sandbox Effector loses its Secret;
+  // its manifest went with the ConfigMap's data above, so the next provision adds no container.
+  const effectorPods = new Set(placements.sandbox.map((p) => p.pod));
+  for (const secret of await kube.listJson<KubeObject>({
+    kind: "secret",
+    selector: LABEL_EFFECTOR_POD,
+    namespace,
+    ...ctx,
+  })) {
+    if (effectorPods.has(secret.metadata.labels?.[LABEL_EFFECTOR_POD] ?? "")) continue;
+    await kube.deleteObject({ kind: "secret", name: secret.metadata.name, namespace, ...ctx });
+  }
+  // A pod's literal values go when it holds none any more, or when the pod is gone; with no secret
+  // held anywhere, the leaves go too. The CA stays (`jr2-held-ca`), so a later converge that holds
+  // one again issues leaves under the same CA.
+  const literalPods = new Set(held.objects.pods.filter((p) => Object.keys(p.values).length).map((p) => p.pod));
+  const stale = await kube.listJson<KubeObject>({ kind: "secret", selector: LABEL_HELD_POD, namespace, ...ctx });
+  for (const secret of stale) {
+    if (literalPods.has(secret.metadata.labels?.[LABEL_HELD_POD] ?? "")) continue;
+    await kube.deleteObject({ kind: "secret", name: secret.metadata.name, namespace, ...ctx });
+  }
+  if (!holdsAny(held.objects)) {
+    await kube.deleteObject({ kind: "secret", name: HELD_TLS_SECRET, namespace, ...ctx });
+  }
   activity(io, "orchestrator: waiting for rollout");
   await awaitRollout(kube, {
     name: ORCHESTRATOR_SERVICE,
@@ -689,7 +1085,7 @@ export async function up(args: string[], io: Io): Promise<number> {
     layer: "orchestrator",
     namespace,
     selector: `app=${ORCHESTRATOR_SERVICE}`,
-    image: tag,
+    image: refs.orchestrator,
     ...ctx,
   });
 
@@ -719,8 +1115,8 @@ export async function up(args: string[], io: Io): Promise<number> {
     });
   } else {
     // The Repo resources are NOT deleted here: eviction is reachability plus age (ADR-0051), and
-    // the orchestrator this converge just rolled out binds nothing, so its boot unlabels every one
-    // of them (server.ts) and `jr2 gc` takes them at the TTL. The bare clones under
+    // the Assembly this converge publishes binds nothing, so the Orchestrator's Repo pass at that
+    // publish unlabels every one of them (server.ts, ADR-0069) and `jr2 gc` takes them at the TTL. The bare clones under
     // `/var/lib/jr2/<ns>/repos` outlive the agent that would evict them — inert, like the ones
     // `jr2 down` leaves (down.ts), and swept by the agent's own walk if a `workspace()` ever
     // returns here.
@@ -733,34 +1129,54 @@ export async function up(args: string[], io: Io): Promise<number> {
   // The scan is the Machine walk above, and it is DEFINITION-level (the line ADR-0018 drew:
   // workflow internals are not statically recoverable) — a carried-but-never-invoked `"none"`
   // Agent over-deploys, erring toward "the convention works when you need it". No `"none"`
-  // definitions → nothing, and a stale Deployment from a definition that dropped its `"none"` is
-  // deleted: the layer converges toward the Machines like every other layer converges toward the
-  // config.
+  // definitions → nothing, and a stale StatefulSet from a definition that dropped its `"none"` is
+  // deleted with its conversations: the layer converges toward the Machines like every other layer
+  // converges toward the config.
   const menuOnly = [...new Set(agents.filter((a) => a.definition.workspace === "none").map((a) => a.name))];
-  if (menuOnly.length > 0) {
-    activity(
-      io,
-      `instance harness: converging (${menuOnly.join(", ")} declare${menuOnly.length === 1 ? "s" : ""} workspace: "none")`,
-    );
+  // A Chart wrapper whose Open body allows "none" needs it too: a Chart's own Agent may be Menu-only (ADR-0070).
+  const noneWrappers = workflows
+    .filter((w) => partsOf([w.machine]).openBodies.some((b) => b.declaration.allows.workspace.includes("none")))
+    .map((w) => w.name);
+  if (carried.instanceHarness !== undefined) {
+    const why = [
+      ...(menuOnly.length
+        ? [`${menuOnly.join(", ")} declare${menuOnly.length === 1 ? "s" : ""} workspace: "none"`]
+        : []),
+      ...(noneWrappers.length
+        ? [
+            `chart wrapper${noneWrappers.length === 1 ? "" : "s"} ${noneWrappers.map((n) => `"${n}"`).join(", ")} allow${noneWrappers.length === 1 ? "s" : ""} workspace: "none"`,
+          ]
+        : []),
+    ];
+    activity(io, `instance harness: converging (${why.join("; ")})`);
     const harnessImage = refs.harness;
+    const instance = instanceHeld(held.objects);
     await kube.apply({
       manifest: instanceHarnessObjects({
         name,
         namespace,
         harnessImage,
-        adapterImage: refs.adapter,
+        custodianImage,
+        held: instance.manifest,
+        custodian: instance.custodian,
+        heldDigest: heldDigest(Buffer.from(signingKey, "base64"), held.objects, instance, valueDigest),
         harness: config.harness,
         caBundle: caPem !== undefined,
         // The wire's gate (ADR-0058): the digest of the bearer the Orchestrator derives for this
         // placement from the kept key — the same shape it stamps onto every Sandbox at provision.
         bearerSha256: harnessTokenDigest(Buffer.from(signingKey, "base64"), INSTANCE_HARNESS_SERVICE),
+        ...(config.priorityClasses ? { priorityClasses: config.priorityClasses } : {}),
       }),
       ...ctx,
     });
     await awaitRollout(kube, {
+      kind: "statefulset",
       name: INSTANCE_HARNESS_SERVICE,
       namespace,
       selector: `app=${INSTANCE_HARNESS_SERVICE}`,
+      // A rollout waits out the old pod's drain (ADR-0031): up to a Turn's worst case, then the
+      // new pod's start.
+      timeoutSeconds: INSTANCE_HARNESS_DRAIN_SECONDS + 180,
       ...ctx,
     });
     await verifyRunningImage(io, kube, {
@@ -772,12 +1188,83 @@ export async function up(args: string[], io: Io): Promise<number> {
       ...ctx,
     });
   } else {
-    await kube.deleteObject({ kind: "deployment", name: INSTANCE_HARNESS_SERVICE, namespace, ...ctx });
+    await kube.deleteObject({ kind: "statefulset", name: INSTANCE_HARNESS_SERVICE, namespace, ...ctx });
+    // The claim's retention policy deletes it with the StatefulSet; deleted here too, so the
+    // conversations go even from a StatefulSet the controller never got to.
+    await kube.deleteObject({ kind: "persistentvolumeclaim", name: INSTANCE_HARNESS_PVC, namespace, ...ctx });
     await kube.deleteObject({ kind: "service", name: INSTANCE_HARNESS_SERVICE, namespace, ...ctx });
+    await kube.deleteObject({ kind: "service", name: INSTANCE_HARNESS_PODS_SERVICE, namespace, ...ctx });
+    // Its Custodian's files go with the pod they were rendered for (ADR-0059).
+    await kube.deleteObject({ kind: "configmap", name: INSTANCE_CUSTODIAN_CONFIGMAP, namespace, ...ctx });
   }
 
+  // --- Instance Effector (ADR-0068): converged when an Effect is placed there, absent otherwise ---
+  // The placement is read off the Machines: an `http` Effect runs there. Its objects carry only the
+  // secrets those Effects name, and the placement's key, derived from the kept signing key — the
+  // key the Orchestrator derives again to sign every call and verify every answer.
+  const effectorPlan = placements.instance;
+  if (effectorPlan) {
+    const names = effectorPlan.secrets.map((s) => `\`${s.name}\``).join(", ") || "none";
+    activity(
+      io,
+      `instance effector: converging (${effectorPlan.effects.join(", ")}; secrets ${names}; grace ` +
+        `${effectorGraceSeconds(effectorPlan)}s)`,
+    );
+    const signing = Buffer.from(signingKey, "base64");
+    const key = effectorKey(signing, "instance");
+    await kube.apply({
+      manifest: instanceEffectorObjects({
+        name,
+        namespace,
+        harnessImage: refs.harness,
+        plan: effectorPlan,
+        key,
+        digest: effectorDigest(signing, effectorPlan, key, valueDigest),
+        caBundle: caPem !== undefined,
+        ...(config.priorityClasses ? { priorityClasses: config.priorityClasses } : {}),
+      }),
+      ...ctx,
+    });
+    await awaitRollout(kube, {
+      name: INSTANCE_EFFECTOR,
+      namespace,
+      selector: `app=${INSTANCE_EFFECTOR}`,
+      // A rollout waits out the old replica's drain: the longest Effect, and its read.
+      timeoutSeconds: effectorGraceSeconds(effectorPlan) + 180,
+      ...ctx,
+    });
+    await verifyRunningImage(io, kube, {
+      layer: "instance effector",
+      namespace,
+      selector: `app=${INSTANCE_EFFECTOR}`,
+      image: refs.harness,
+      container: "effector",
+      ...ctx,
+    });
+  } else {
+    activity(io, "instance effector: none (no Effect is placed there)");
+    for (const kind of ["deployment", "service", "networkpolicy", "secret"]) {
+      await kube.deleteObject({ kind, name: INSTANCE_EFFECTOR, namespace, ...ctx });
+    }
+  }
+
+  // --- the Assembly (ADR-0069): published last of the layers, before the sweep -------------------
+  // After every layer, because the door's checks are true only once the cluster work is done: the
+  // image map names every `file:` digest, the Secrets exist, and the rollout above put the Kit
+  // version the Assembly names in front of the door. A refusal leaves the previous Assembly
+  // current, and the converge fails before the sweep, so nothing it still needs is collected.
+  const published = await publishAssembly(io, {
+    namespace,
+    ctx,
+    assembly,
+    token: publishToken,
+    force: values.force === true,
+    mounts: mountedDigests(instanceList),
+  });
+  if (!published) return 1;
+
   await reportOlderWorkspaces(io, kube, namespace, ctx, converged);
-  await sweepAfterConverge(io, { build, kube, context, ctx, converged, instanceImage: tag, previous });
+  await sweepAfterConverge(io, { build, kube, context, ctx, converged, previous });
   noteDeferred(io, carried.repos);
   activity(io, `converged — \`jr2 run <workflow>\` when ready`);
   // LAST, after the success line (ADR-0047): the converge succeeded and the Repos still cannot be
@@ -787,8 +1274,8 @@ export async function up(args: string[], io: Io): Promise<number> {
 }
 
 /**
- * Every image ref one converge resolved. The Orchestrator reads `harness`/`adapter`/`sandbox` from
- * the mounted map (`ImageRefs`); `operator` rides the same JSON because the record `jr2 up` diffs
+ * Every image ref one converge resolved. The Orchestrator reads `harness`/`custodian`/`sandbox` from
+ * the mounted map (`ImageRefs`); `operator` and `orchestrator` ride the same JSON because the record `jr2 up` diffs
  * must cover every image it builds, and one map is what keeps the record it diffs and the map pods
  * read from ever disagreeing (ADR-0038).
  *
@@ -802,7 +1289,7 @@ export async function up(args: string[], io: Io): Promise<number> {
  * never inspected, never in this map — so it runs as whatever its own `USER` says, and one that
  * would run as root fails the Harness container's `runAsNonRoot` at provision.
  */
-type ConvergedImages = ImageRefs & { operator?: string; sandboxUser: Record<string, string> };
+type ConvergedImages = ImageRefs & { operator?: string; orchestrator?: string; sandboxUser: Record<string, string> };
 
 /** The map the LAST converge recorded, off the Orchestrator Deployment's annotation. Anything
  * unreadable (absent, hand-edited, a foreign shape) reads as "no record", which costs a rebuild —
@@ -820,11 +1307,177 @@ function previousImages(orch?: KubeObject): Partial<ConvergedImages> | undefined
 
 /** Every ref one image map names, flattened — the kit's own plus each Sandbox Image. */
 function mapRefs(map: Partial<ConvergedImages>): string[] {
-  return [map.harness, map.adapter, map.operator, ...Object.values(map.sandbox ?? {})].filter(
+  return [map.harness, map.custodian, map.operator, map.orchestrator, ...Object.values(map.sandbox ?? {})].filter(
     (ref): ref is string => typeof ref === "string",
   );
 }
 
+/** What `GET /assembly` answers (ADR-0069), read loosely: this is the CLI's view of the door.
+ * `mounts` is the digest of each ConfigMap the process reads through a mount. */
+type AssemblyView = { current?: { hash?: string; kitVersion?: string } | null; mounts?: Record<string, string> };
+
+/** The digest of each mounted ConfigMap's data in the List this converge applied (ADR-0069), by
+ * name: what the Orchestrator must read from its mounts before the publish. */
+function mountedDigests(list: string): Record<string, string> {
+  const items = (JSON.parse(list) as { items: Array<KubeObject & { data?: Record<string, string> }> }).items;
+  const out: Record<string, string> = {};
+  for (const item of items) {
+    if (item.kind === "ConfigMap" && item.metadata.name in MOUNTED_CONFIGMAPS) {
+      out[item.metadata.name] = configMapDigest(item.data ?? {});
+    }
+  }
+  return out;
+}
+
+/**
+ * The key of each `file:` Sandbox Image context (ADR-0037, ADR-0049, ADR-0069): the digest of its
+ * copy in the staged Assembly at `stagedDir`, by the host directory the walk named. A context the
+ * Assembly does not carry is refused by name: a `file:` URL that names no folder, or a folder the
+ * Instance's install leaves out, is checkable HERE and nowhere later, since the pod only ever
+ * resolves a digest.
+ */
+async function stagedContextDigests(stagedDir: string, root: string, dirs: string[]): Promise<Map<string, string>> {
+  const digests = new Map<string, string>();
+  for (const dir of new Set(dirs)) {
+    const copy = await stagedCopyOf(stagedDir, root, dir);
+    const shown = relative(root, dir).startsWith("..") ? dir : relative(root, dir);
+    if (copy === undefined) {
+      throw new Error(
+        `the Sandbox Image context ${shown} is not in the staged Assembly — a \`workspace()\` names its image with ` +
+          '`import.meta.resolve("./<dir>")`, so that directory must exist beside the Machine\'s own module and ' +
+          "travel with it: check that it exists, and that the package's `files:` list keeps it (ADR-0037/0049, ADR-0069)",
+      );
+    }
+    digests.set(dir, await imageContextDigest(copy));
+  }
+  return digests;
+}
+
+/** What `PUT /assembly` answers, read loosely: the 200 body, or a refusal with its report. */
+type PublishBody = {
+  hash?: string;
+  workflows?: string[];
+  unchanged?: boolean;
+  error?: string;
+  report?: string[];
+  kitVersion?: unknown;
+};
+
+/**
+ * How long a publish waits for the Orchestrator to read the ConfigMaps this converge wrote
+ * (ADR-0038, ADR-0069). `jr2-images` and `jr2-held` are mounts, and the kubelet refreshes a mount
+ * on its own period (about a minute by default). A publish rolls no pod, so until the refresh the
+ * door's checks and the next provision read the previous data. The publish waits until the digests
+ * `GET /assembly` reports are the ones this converge applied. Exported so a test can shorten it.
+ */
+export const MAP_PROPAGATION = { budgetMs: 150_000, stepMs: 5_000 };
+
+/**
+ * Publish the staged Assembly to the running Orchestrator (ADR-0069), over a port-forward of its
+ * Service, as `resolveTarget` reaches it. `GET /assembly` first: when the current Assembly is this
+ * one, at this Kit version, nothing is sent, so a steady-state converge publishes nothing. Then
+ * `PUT /assembly` with the publish token from the Instance Secret — never from the environment.
+ * Before the PUT, it waits until the Orchestrator reads the mounted ConfigMaps this converge wrote.
+ * `--force` sends the PUT even when the hashes agree; the door answers `unchanged` and replaces
+ * nothing, because the hash names the bytes it already holds.
+ *
+ * Returns false after it has said why, when the door refused: the previous Assembly is still
+ * current, and the converge fails.
+ */
+async function publishAssembly(
+  io: Io,
+  opts: {
+    namespace: string;
+    ctx: { context?: string };
+    assembly: { hash: string; kitVersion: string; workflows: string[]; tar: Buffer };
+    token: string;
+    force: boolean;
+    /** The digest of each mounted ConfigMap this converge applied, by name. */
+    mounts: Record<string, string>;
+  },
+): Promise<boolean> {
+  const { namespace, ctx, assembly, token, force } = opts;
+  const fetchImpl = io.fetch ?? globalThis.fetch;
+  const fwd = await (io.kube ?? kubectlKube).portForward({
+    namespace,
+    service: ORCHESTRATOR_SERVICE,
+    port: ORCHESTRATOR_PORT,
+    ...ctx,
+  });
+  try {
+    const base = fwd.url.replace(/\/+$/, "");
+    const view = async (): Promise<AssemblyView> => {
+      const seen = await fetchImpl(`${base}/assembly`);
+      if (!seen.ok) throw new Error(`the Orchestrator answered GET /assembly with HTTP ${seen.status}`);
+      return (await seen.json()) as AssemblyView;
+    };
+    let seen = await view();
+    const current = seen.current ?? null;
+    if (!force && current?.hash === assembly.hash && current.kitVersion === assembly.kitVersion) {
+      activity(io, `assembly: ${assembly.hash} (current — publish skipped)`);
+      return true;
+    }
+    // The mounts first (ADR-0069): the door checks a `file:` digest against `jr2-images`, and a
+    // provision after the converge reads `jr2-held`. A process that reports no mounts is not
+    // deployed, and has nothing to wait for.
+    const stale = (v: AssemblyView): string[] =>
+      v.mounts ? Object.keys(opts.mounts).filter((name) => v.mounts![name] !== opts.mounts[name]) : [];
+    const deadline = Date.now() + MAP_PROPAGATION.budgetMs;
+    let said = false;
+    for (let names = stale(seen); names.length; names = stale(seen)) {
+      if (Date.now() >= deadline) {
+        activity(
+          io,
+          `refusing: after ${Math.round(MAP_PROPAGATION.budgetMs / 1000)}s the Orchestrator still reads an older ` +
+            `${names.join(", ")} from its mount — the kubelet has not refreshed it; nothing was published, and ` +
+            `the previous Assembly is still current. Run \`jr2 up\` again`,
+        );
+        return false;
+      }
+      if (!said) activity(io, `assembly: waiting for the kubelet to deliver ${names.join(", ")} to the Orchestrator`);
+      said = true;
+      await new Promise((ok) => setTimeout(ok, MAP_PROPAGATION.stepMs));
+      seen = await view();
+    }
+    activity(
+      io,
+      `assembly: publishing ${assembly.hash} (${current?.hash ? `current is ${current.hash}` : "no current Assembly"})` +
+        (force ? " (--force)" : ""),
+    );
+    const res = await fetchImpl(`${base}/assembly`, {
+      method: "PUT",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/x-tar",
+        "jr2-kit-version": assembly.kitVersion,
+        "jr2-assembly-hash": assembly.hash,
+      },
+      body: new Uint8Array(assembly.tar),
+    });
+    const body = (await res.json().catch(() => ({}))) as PublishBody;
+    if (res.ok) {
+      const names = body.workflows ?? assembly.workflows;
+      activity(
+        io,
+        `assembly: ${body.hash ?? assembly.hash} is current${body.unchanged ? " (unchanged)" : ""} — ` +
+          `workflows: ${names.join(", ") || "(none)"}`,
+      );
+      return true;
+    }
+    const report = body.report ?? [];
+    activity(
+      io,
+      `refusing: the Orchestrator refused Assembly ${assembly.hash} (HTTP ${res.status}): ` +
+        `${body.error ?? "no reason given"}` +
+        (res.status >= 500 ? "" : " — the previous Assembly is still current"),
+    );
+    for (const line of report) activity(io, `  ${line}`);
+    return false;
+  } finally {
+    fwd.close();
+  }
+}
+
 /**
  * Collect (ADR-0039) — and only here, at the end of a converge that fully succeeded: the annotation
  * is applied and every rollout is verified, which is the moment the root set moved, and moving the
@@ -850,11 +1503,10 @@ async function sweepAfterConverge(
     context: string;
     ctx: { context?: string };
     converged: ConvergedImages;
-    instanceImage: string;
     previous?: Partial<ConvergedImages>;
   },
 ): Promise<void> {
-  const { build, kube, context, ctx, converged, instanceImage, previous } = opts;
+  const { build, kube, context, ctx, converged, previous } = opts;
   try {
     await sweepImages({
       io,
@@ -862,9 +1514,9 @@ async function sweepAfterConverge(
       kube,
       context,
       ctx,
-      // The instance image rides `extraKeep` explicitly: it is the one ref this converge resolved
-      // that the image map does not carry (it is the Deployment's own, ADR-0038).
-      extraKeep: [instanceImage, ...mapRefs(converged)],
+      // The map carries every ref this converge resolved, the Orchestrator's own Kit ref included
+      // (ADR-0069), so it is the whole of what this converge adds to the keep set.
+      extraKeep: mapRefs(converged),
       grace: previous ? mapRefs(previous) : [],
     });
   } catch (err) {
@@ -872,6 +1524,131 @@ async function sweepAfterConverge(
   }
 }
 
+/**
+ * Held secrets, resolved (ADR-0059): the rules (`heldSecretsOf`, over the names some pod claims, fed
+ * what only the cluster knows), each pod's own manifest, values and Custodian config, the
+ * per-Instance CA (kept, or minted on first need), one leaf per bound target (reused while it still
+ * fits), and the trust bundles. Narrated one line per secret — its name, its hosts, its source — and
+ * never a value.
+ */
+async function resolveHeld(
+  io: Io,
+  kube: KubeAdmin,
+  opts: {
+    /** Each Harness pod and the names it holds (`secretPlacementsOf`). */
+    pods: readonly HeldPodPlan[];
+    claimed: ReadonlySet<string>;
+    config: JR2Config;
+    name: string;
+    namespace: string;
+    ctx: { context?: string };
+    envFromKeys: Map<string, string[]>;
+    /** R10's read of the user's Secrets: key NAMES, never values. */
+    secretKeys: (secret: string) => readonly string[] | undefined;
+    models: string[];
+    /** The user's `caBundle` (ADR-0020): trusted upstream, and by the Harness beside the jr2 CA. */
+    caBundle?: string;
+  },
+): Promise<{ objects: HeldObjects; bundles?: { extra: string; bundle: string; upstream: string } }> {
+  const { config, namespace, ctx } = opts;
+  type Data = KubeObject & { data?: Record<string, string> };
+  const decode = (data: Record<string, string> | undefined, key: string): string | undefined =>
+    data?.[key] === undefined ? undefined : Buffer.from(data[key], "base64").toString("utf8");
+
+  const { manifest, values, warnings } = heldSecretsOf(config, opts.claimed, {
+    envFromKeys: opts.envFromKeys,
+    secretKeys: opts.secretKeys,
+    models: opts.models,
+  });
+  for (const warning of warnings) activity(io, `warning: ${warning}`);
+  // Each pod's own: the bindings of the names it holds and their literal values. Its Custodian's
+  // files are rendered by whoever makes the pod — here for the Instance Harness alone; the
+  // Orchestrator at provision for a Sandbox, from the same manifest (ADR-0059).
+  const pods: HeldPodObjects[] = opts.pods.map((plan) => {
+    const own: HeldManifest = { version: 1, secrets: manifest.secrets.filter((b) => plan.names.includes(b.name)) };
+    const literals = Object.fromEntries(
+      own.secrets.filter((b) => b.source.kind === "literal").map((b) => [b.name, values[b.name] as string]),
+    );
+    return { pod: plan.pod, manifest: own, values: literals };
+  });
+  // The Instance Harness, when the walk placed one: the one pod `jr2 up` makes, so the one whose
+  // Custodian files it renders.
+  const instancePod = pods.find((p) => p.pod === INSTANCE_HARNESS_HELD_POD);
+  const orchestrator = { host: `${ORCHESTRATOR_SERVICE}.${namespace}.svc`, port: ORCHESTRATOR_PORT };
+  const instance: CustodianFiles | undefined = instancePod && {
+    bootstrap: JSON.stringify(custodianBootstrap(instancePod.manifest, orchestrator)),
+    script: custodianScript(instancePod.manifest),
+  };
+  if (manifest.secrets.length === 0) return { objects: { pods, ...(instance && { instance }), leaves: {} } };
+  for (const s of manifest.secrets) {
+    const where = s.hosts.map((h) => (h.port === 443 ? h.host : `${h.host}:${h.port}`)).join(", ");
+    const source = s.source.kind === "literal" ? "literal" : `secret ${s.source.secret}/${s.source.key}`;
+    activity(io, `held secret ${s.name} → ${where} (${source})`);
+  }
+
+  // The CA: kept whenever the cluster holds a usable one — a live pod's Harness trusts it from its
+  // start, so a leaf a restarted Custodian reads must still chain to it. A human rotates it by
+  // deleting the Secret.
+  const stored = await kube.getJson<Data>({ kind: "secret", name: HELD_CA_SECRET, namespace, ...ctx });
+  const kept = { cert: decode(stored?.data, "ca.crt") ?? "", key: decode(stored?.data, "ca.key") ?? "" };
+  const ca: Pem = stored && caFits(kept) ? kept : issueCa(opts.name);
+  if (ca !== kept) activity(io, `held secrets: minted the Instance's CA into ${HELD_CA_SECRET}`);
+
+  const tls = await kube.getJson<Data>({ kind: "secret", name: HELD_TLS_SECRET, namespace, ...ctx });
+  const leaves: Record<string, Pem> = {};
+  for (const s of manifest.secrets) {
+    for (const h of s.hosts) {
+      if (leaves[h.leaf]) continue;
+      const existing = {
+        cert: decode(tls?.data, `${h.leaf}.crt`) ?? "",
+        key: decode(tls?.data, `${h.leaf}.key`) ?? "",
+      };
+      leaves[h.leaf] = leafFits(existing, ca, h.host) ? existing : issueLeaf(ca, h.host);
+    }
+  }
+  return {
+    objects: { pods, ...(instance && { instance }), ca, leaves },
+    bundles: trustBundles(ca.cert, opts.caBundle),
+  };
+}
+
+/** The Instance Harness's held objects and its Custodian's files — the walk always places it when
+ * it converges. */
+function instanceHeld(held: HeldObjects): HeldPodObjects & { custodian: CustodianFiles } {
+  const pod = held.pods.find((p) => p.pod === INSTANCE_HARNESS_HELD_POD);
+  if (!pod || !held.instance)
+    throw new Error("jr2 up placed no held secrets for the Instance Harness it converges — a jr2 defect");
+  return { ...pod, custodian: held.instance };
+}
+
+/** The Instance Harness's `jr2.dev/held-digest` (ADR-0059): an HMAC over its pod's held-secret
+ * inputs — a literal's value, a `valueFrom`'s reference and the digest of its value — keyed with
+ * the signing key so the annotation reveals nothing about a value. Its Custodian reads each value
+ * once at start, so a value edited in the user's Secret must roll it — and so must an edit to its
+ * two rendered files or the program they load. `program` is the kit's program; it is an input
+ * only so that its test can change it. Exported for its test alone. */
+export function heldDigest(
+  key: Buffer,
+  all: HeldObjects,
+  held: HeldPodObjects & { custodian: CustodianFiles },
+  valueDigest: ValueDigest,
+  program: string = CUSTODIAN_PROGRAM,
+): string {
+  const mac = createHmac("sha256", key);
+  mac.update(JSON.stringify(held.manifest));
+  const stems = new Set(held.manifest.secrets.flatMap((s) => s.hosts.map((h) => h.leaf)));
+  for (const stem of [...stems].sort()) mac.update(`${stem}:${fingerprint(all.leaves[stem]!.cert)}`);
+  for (const name of Object.keys(held.values).sort()) mac.update(`${name}=${held.values[name]}`);
+  for (const s of held.manifest.secrets) {
+    if (s.source.kind === "secret") mac.update(`${s.name}<-${valueDigest(s.source.secret, s.source.key) ?? ""}`);
+  }
+  // Its Custodian's files, and the program they load: Envoy reads all three once at start.
+  mac.update(held.custodian.bootstrap);
+  mac.update(held.custodian.script);
+  mac.update(program);
+  return mac.digest("base64url").slice(0, 32);
+}
+
 /** The one delivery failure that is a configuration error rather than a docker one (ADR-0019). */
 function undeliverable(context: string): Error {
   return new Error(
@@ -926,9 +1703,15 @@ async function reportOlderWorkspaces(
  * evidence gathering that hid inside the kubectl port could never be exercised without a cluster.
  */
 async function awaitRollout(kube: KubeAdmin, target: RolloutTarget): Promise<void> {
-  const { kind, name, namespace, context } = target;
+  const { kind, name, namespace, context, timeoutSeconds } = target;
   try {
-    await kube.waitRollout({ ...(kind ? { kind } : {}), name, namespace, ...(context ? { context } : {}) });
+    await kube.waitRollout({
+      ...(kind ? { kind } : {}),
+      name,
+      namespace,
+      ...(context ? { context } : {}),
+      ...(timeoutSeconds ? { timeoutSeconds } : {}),
+    });
   } catch (err) {
     throw await rolloutFailure(kube, err, target);
   }
@@ -941,7 +1724,7 @@ async function awaitRollout(kube: KubeAdmin, target: RolloutTarget): Promise<voi
  * template never moved (stale image, no rollout) printed `converged` while running old code.
  *
  * Tag equality is the whole check, which is only sound because the tag IS the content address (see
- * `stageInstanceBundle`): on the `kind load` path a pod's `imageID` is containerd's manifest digest
+ * `kitImageRefs`): on the `kind load` path a pod's `imageID` is containerd's manifest digest
  * under a rewritten `import-<date>` repo, comparable to nothing the host holds.
  */
 async function verifyRunningImage(
@@ -955,7 +1738,7 @@ async function verifyRunningImage(
   // thing serving — the question is what the cluster runs now, not what it is done running.
   const live = pods.filter((p) => !p.metadata.deletionTimestamp);
   // `container` narrows a multi-container pod to the one this layer's image claim is about
-  // (the Instance Harness pod also carries the Adapter, which is not this check's business).
+  // (the Instance Harness pod also carries the Custodian, which is not this check's business).
   const stale = live.filter((p) =>
     p.spec.containers.some((c) => (container === undefined || c.name === container) && c.image !== image),
   );
@@ -984,6 +1767,192 @@ type PodObject = {
  * does. A supplied key produces none of this — it is registered already. */
 type GitSshNotice = { secret: string; publicKey: string; urls: string[] };
 
+/** What `jr2 up` writes for the push credentials (ADR-0051): each entry's Secret, its data base64, and
+ * the manifest the provision reads. */
+export type GitPushObjects = {
+  secrets: Array<{ name: string; data: Record<string, string> }>;
+  manifest: GitPushManifest;
+};
+
+/**
+ * Each `git.credentials` entry's push Secret (ADR-0051), when any Workspace pushes: the
+ * entry's token from `.env` (Flux's `username`/`password`), and the keys of the Secrets its
+ * `sshKey`, `push.sshKey` and `sign` name, copied as data — base64 to base64, never decoded — so
+ * one Secret holds what the entry pushes and signs with, and the provision names it on the Sandbox
+ * of a push whose url the entry matches. An entry with nothing it can push with is not written,
+ * and says why. A push on a slot the Machine binds to an https url whose entry's token is unset is
+ * refused, with its fix. A key's Secret that is absent, or a signing key's, is a warning, not a
+ * refusal: the Secret may be written after `jr2 up` (ADR-0047's prompt, a scenario, a human), and
+ * the entry's Secret is written without that key, so the provision refuses the push that needs it
+ * until the Secret exists and `jr2 up` runs again.
+ */
+async function resolveGitPush(
+  io: Io,
+  kube: KubeAdmin,
+  config: JR2Config,
+  sandbox: readonly SandboxEffectorPlan[],
+  namespace: string,
+  ctx: { context?: string },
+): Promise<GitPushObjects> {
+  const none: GitPushObjects = { secrets: [], manifest: { version: 1, entries: [] } };
+  if (!sandbox.some((p) => p.pushes.length > 0)) return none;
+  const { plans, skipped } = gitPushPlansOf(config.git?.credentials ?? [], (n) => io.env[n]);
+  const read = new Map<string, Record<string, string> | undefined>();
+  const dataOf = async (secret: string) => {
+    if (!read.has(secret)) {
+      const found = await kube.getJson<KubeObject & { data?: Record<string, string> }>({
+        kind: "secret",
+        name: secret,
+        namespace,
+        ...ctx,
+      });
+      read.set(secret, found ? (found.data ?? {}) : undefined);
+    }
+    return read.get(secret);
+  };
+  const out: GitPushObjects = { secrets: [], manifest: { version: 1, entries: [] } };
+  for (const plan of plans) {
+    const data: Record<string, string> = {};
+    let sshMissing: string | undefined;
+    let signMissing: string | undefined;
+    for (const source of plan.sources) {
+      if ("literal" in source) {
+        data[source.key] = Buffer.from(source.literal).toString("base64");
+        continue;
+      }
+      const held = await dataOf(source.from.secret);
+      const value = held?.[source.from.key];
+      if (value !== undefined) {
+        data[source.key] = value;
+        continue;
+      }
+      if (source.optional) continue;
+      const why =
+        held === undefined
+          ? `the Secret "${source.from.secret}" does not exist in namespace ${namespace}`
+          : `the Secret "${source.from.secret}" holds no key ${source.from.key}`;
+      if (source.key.startsWith("sign.")) signMissing ??= why;
+      else sshMissing ??= why;
+      // Not a refusal: the Secret may be written later (a scenario writes it, a human creates it).
+      // A push under the entry that needs it is refused at provision until `jr2 up` runs again.
+      activity(
+        io,
+        `warning: git.credentials "${plan.entry.match}": ${why} — a push that needs it is refused at provision ` +
+          "until it exists and jr2 up runs again (ADR-0051)",
+      );
+    }
+    const entry = { ...plan.entry };
+    if (sshMissing !== undefined) {
+      entry.push = entry.push.filter((k) => k !== "ssh");
+      for (const k of ["identity", "identity.pub", "known_hosts"]) delete data[k];
+    }
+    if (signMissing !== undefined) {
+      delete entry.sign;
+      for (const k of ["sign.identity", "sign.private.asc"]) delete data[k];
+      const json = JSON.parse(Buffer.from(data["entry.json"]!, "base64").toString("utf8")) as Record<string, unknown>;
+      delete json.sign;
+      data["entry.json"] = Buffer.from(JSON.stringify({ ...json, push: entry.push })).toString("base64");
+    } else if (sshMissing !== undefined) {
+      const json = JSON.parse(Buffer.from(data["entry.json"]!, "base64").toString("utf8")) as Record<string, unknown>;
+      data["entry.json"] = Buffer.from(JSON.stringify({ ...json, push: entry.push })).toString("base64");
+    }
+    if (entry.push.length === 0) continue;
+    out.secrets.push({ name: entry.secret, data });
+    out.manifest.entries.push(entry);
+    activity(
+      io,
+      `git.credentials "${entry.match}": push Secret ${entry.secret} — pushes over ` +
+        `${entry.push.map((k) => (k === "ssh" ? "ssh" : "https")).join(" and ")}` +
+        `${entry.sign ? `; signs with ${entry.sign}` : ""}`,
+    );
+  }
+  for (const [match, why] of skipped) activity(io, `git.credentials "${match}": ${why}`);
+  // A slot the Machine binds to an https url: its token's value is known now. An unset one is
+  // refused, with the fix, as the clone's token is.
+  for (const plan of sandbox) {
+    for (const push of plan.pushes) {
+      if (push.url === undefined || push.match === undefined) continue;
+      if (repoIdentity(push.url).scheme === "ssh") continue;
+      const placed = out.manifest.entries.find((e) => e.match === push.match);
+      const why = skipped.get(push.match);
+      if (!placed?.push.includes("token") && why !== undefined) {
+        throw new Error(
+          `${plan.label}: the push of Repo Slot "${push.slot}" (${push.url}): git.credentials entry ` +
+            `"${push.match}" cannot push — ${why} (ADR-0051)`,
+        );
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * What each Workspace's Sandbox Effector image owes its pushes (ADR-0068), read off the image
+ * this converge built — its effector image, else its Sandbox Image — by the push forms `jr2 up` can
+ * see: a slot the Machine binds (its url's scheme, its entry's `sign`), never one the run or a
+ * `customize()` binds, whose url is the provision's. The stock Harness image — the fallback when the
+ * Workspace names no image and there is no `images/default` — is the kit's, so what it holds is
+ * known, not read (STOCK_HARNESS_IMAGE). An author's image `jr2 up` did not build (a registry ref)
+ * is not read, as its `USER` is not.
+ */
+async function checkEffectorImages(
+  build: BuildPort,
+  config: JR2Config,
+  sandbox: readonly SandboxEffectorPlan[],
+  converged: ConvergedImages,
+  platforms: readonly string[],
+  /** Each `file:` context's key in the map: the digest of its staged copy (ADR-0069). */
+  contextDigests: ReadonlyMap<string, string>,
+): Promise<void> {
+  const list = config.git?.credentials ?? [];
+  for (const plan of sandbox) {
+    const forms: Array<{ form: PushForm; push: string }> = [];
+    for (const push of plan.pushes) {
+      if (push.url === undefined || push.match === undefined) continue;
+      const what = `the push of Repo Slot "${push.slot}" (${push.url})`;
+      if (isSshUrl(push.url)) forms.push({ form: "ssh-transport", push: what });
+      const sign = push.sign ? list.find((e) => e.match === push.match)?.sign : undefined;
+      if (sign) forms.push({ form: "gpgKey" in sign ? "gpg-sign" : "ssh-sign", push: what });
+    }
+    if (forms.length === 0) continue;
+    const image = plan.image ?? plan.sandboxImage;
+    let key = "default";
+    if (image !== undefined) {
+      if (!image.startsWith("file:")) continue;
+      // A Workspace's image is a context the walk carried, so it was keyed with the Assembly.
+      const digest = contextDigests.get(fileURLToPath(image));
+      if (digest === undefined) continue;
+      key = digest;
+    }
+    const ref = converged.sandbox[key];
+    if (ref === undefined) {
+      if (image !== undefined) continue;
+      // No image named and no images/default: the Effector runs in the stock Harness image.
+      const refusal = effectorImageRefusal({
+        label: plan.label,
+        ref: converged.harness,
+        user: STOCK_HARNESS_IMAGE.user,
+        forms,
+        present: new Set(STOCK_HARNESS_IMAGE.present),
+        passwd: STOCK_HARNESS_IMAGE.passwd,
+        stock: true,
+      });
+      if (refusal) throw new Error(refusal);
+      continue;
+    }
+    const files = await build.imageFiles(ref, platforms, effectorImagePaths(forms.map((f) => f.form)));
+    const refusal = effectorImageRefusal({
+      label: plan.label,
+      ref,
+      user: converged.sandboxUser[key] ?? "",
+      forms,
+      present: new Set(files.present),
+      passwd: files.passwd,
+    });
+    if (refusal) throw new Error(refusal);
+  }
+}
+
 /** Where the git ssh key comes from — the three sources ADR-0047 offers, as a pick. */
 type GitSshSource = { kind: "generate" } | { kind: "file"; path: string } | { kind: "paste" };
 
@@ -1312,7 +2281,7 @@ async function preflightProvider(
   io: Io,
   kube: KubeAdmin,
   config: JR2Config,
-  agents: CarriedAgent[],
+  carriedModels: readonly string[],
   namespace: string,
   ctx: { context?: string },
   caPem?: string,
@@ -1327,14 +2296,8 @@ async function preflightProvider(
   // An Open model is nobody's model yet (ADR-0054), so there is nothing to probe for it. The walk
   // already refused the converge above, so this filter is the type's, not the flow's.
   const prefix = `${provider.id}/`;
-  const models = [
-    ...new Set(
-      agents
-        .map((a) => a.definition.model)
-        .filter((m): m is string => typeof m === "string" && m.startsWith(prefix))
-        .map((m) => m.slice(prefix.length)),
-    ),
-  ];
+  // An Open body's allowed models are probed too (ADR-0070): a Chart's own Agent may name one.
+  const models = [...new Set(carriedModels.filter((m) => m.startsWith(prefix)).map((m) => m.slice(prefix.length)))];
   if (models.length === 0) {
     activity(
       io,
@@ -1403,8 +2366,36 @@ function noteDeferred(io: Io, repos: CarriedRepo[]): void {
   if (repos.length) {
     activity(
       io,
-      `repos: ${repos.length} bound Repo(s) — the Orchestrator creates their Repo resources at boot; the cache ` +
+      `repos: ${repos.length} bound Repo(s) — the Orchestrator creates their Repo resources at boot and at each publish (ADR-0069); the cache ` +
         "agent clones on first need (`jr2 status` reports sync state)",
     );
   }
 }
+
+/**
+ * The `customize` line that retunes a composed Machine's Size (ADR-0060), nested through `actors`
+ * the way `customize()` accepts — the Size twin of `customizeLine`, so the refusal pastes.
+ */
+function sizeLine(path: readonly string[]): string {
+  const binds = '{ resources: { limits: { memory: "<memory>" } } }';
+  return `customize(<import>, ${path.reduceRight((parts, key) => `{ actors: { ${key}: ${parts} } }`, binds)})`;
+}
+
+/**
+ * The Chart files under an Assembly root (ADR-0070), as Workflow names `<wrapper>/<name>`: each
+ * `workflows/<wrapper>/<name>.chart.json`, one level below the flat `workflows/*.ts`, in a directory
+ * named after its wrapper. The layout the Orchestrator's discovery reads (charts.ts); a directory
+ * whose name starts with `_` or `.` is not a wrapper's.
+ */
+async function chartFilesIn(root: string): Promise<string[]> {
+  const out: string[] = [];
+  const dir = join(root, "workflows");
+  const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name.startsWith("_") || entry.name.startsWith(".")) continue;
+    const files = await readdir(join(dir, entry.name)).catch(() => [] as string[]);
+    for (const f of files)
+      if (f.endsWith(".chart.json")) out.push(`${entry.name}/${f.slice(0, -".chart.json".length)}`);
+  }
+  return out.sort();
+}