@jr2/cli 0.5.1 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jr2/cli",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "The jr2 CLI: init, up, run — the interface to a jr2 Instance.",
   "license": "MIT",
   "private": false,
@@ -39,14 +39,14 @@
     "ts-blank-space": "^0.9.0"
   },
   "peerDependencies": {
-    "@jr2/orchestrator": "0.5.1"
+    "@jr2/orchestrator": "0.6.0"
   },
   "devDependencies": {
     "@anthropic-ai/sdk": "0.91.1",
     "@types/node": "^26.0.1",
     "xstate": "^5.18.0",
     "zod": "^4.4.3",
-    "@jr2/orchestrator": "0.5.1"
+    "@jr2/orchestrator": "0.6.0"
   },
   "files": [
     "bin",

package/src/client.ts

@@ -53,6 +53,9 @@ export type RunStatus = {
   /** The runs this run's `dispatch` Effects started, oldest first: the slot, the run, and when its
    * ledger row was written (ADR-0071). Absent when it started none. */
   dispatched?: Array<{ slot: string; run: string; at: string }>;
+  /** The Worktrees this run's cuts made, oldest first: the Repo Slot, the path, and the branch,
+   * `null` when detached (ADR-0075). Absent when it cut none. */
+  worktrees?: Array<{ slot: string; path: string; branch: string | null }>;
 };
 
 /** Where a Workflow came from (ADR-0070): a Machine in the Assembly, a Chart file in the Assembly, or

package/src/commands/status.ts

@@ -20,6 +20,9 @@
 // started: `dispatched: <run> (<slot>)`. The result itself carries `dispatchedBy`, `dispatched`
 // and, once the run is no longer live, its `output`, as the Orchestrator sends them.
 //
+// A run that cut a Worktree (ADR-0075) says each one beside the result, one line per cut:
+// `worktree: <path> (<slot>), branch <branch>`, or `, detached`. The result carries `worktrees`.
+//
 // A failed run (ADR-0073) says its reason beside the result: `failed: <reason>`. The result's
 // `output` holds the whole Failure, `{ reason, detail? }`.
 
@@ -51,7 +54,13 @@ export async function status(args: string[], io: Io): Promise<number> {
       return 1;
     }
     result(io, s);
-    const notes = [failureActivity(s), dispatchedActivity(s), ...dispatchedLines(s), boundActivity(s)];
+    const notes = [
+      failureActivity(s),
+      dispatchedActivity(s),
+      ...dispatchedLines(s),
+      boundActivity(s),
+      ...worktreeLines(s),
+    ];
     for (const note of notes) if (note) activity(io, note);
     return 0;
   } finally {
@@ -83,6 +92,13 @@ export function dispatchedLines(s: RunStatus): string[] {
   ];
 }
 
+/** The `worktree:` lines for the Worktrees this run's cuts made (ADR-0075), oldest first. */
+export function worktreeLines(s: RunStatus): string[] {
+  return (s.worktrees ?? []).map(
+    (w) => `worktree: ${w.path} (${w.slot}), ${w.branch === null ? "detached" : `branch ${w.branch}`}`,
+  );
+}
+
 /** The `dispatched by:` line for a run a `dispatch` Effect started (ADR-0071), or undefined for a
  * run nobody dispatched. A foreign caller is named by its Orchestrator, as that one sent it: opaque
  * text, which this Orchestrator could not verify. */

package/src/commands/up.ts

@@ -100,7 +100,6 @@ import {
   harnessTokenDigest,
   formatCpu,
   formatMemory,
-  sandboxToken,
   type CarriedEffect,
   type CarriedImage,
   type CarriedRepo,
@@ -142,6 +141,8 @@ import {
   INSTANCE_HARNESS_PVC,
   INSTANCE_HARNESS_SERVICE,
   instanceHarnessObjects,
+  INSTANCE_HARNESS_CREDENTIALS,
+  podCredentials,
   instanceEffectorObjects,
   effectorDigest,
   storedValueDigest,
@@ -189,6 +190,7 @@ import {
   type PodEnd,
   type RolloutTarget,
 } from "../kube.ts";
+import { awaitCacheAgent } from "../landlock.ts";
 import { anyNodeHolds, buildNodes, sandboxNodes, type NodeObject } from "../nodes.ts";
 import { activity, chooseOrBail, confirmOrBail, promptLine, readSecretInput, type Io } from "../output.ts";
 import { kindCluster, sweepImages } from "../sweep.ts";
@@ -714,12 +716,10 @@ export async function up(args: string[], io: Io): Promise<number> {
     JR2_INSTANCE_TOKEN: instanceToken,
     JR2_PUBLISH_TOKEN: publishToken,
     JR2_SIGNING_KEY: signingKey,
-    // The Instance Harness Custodian's credential (ADR-0013/0031): a sandbox-style token signed
-    // for the placement's name — it may deliver only to Turns hosted THERE (tokens.ts), so the
-    // Instance token never enters that pod. Derived from the kept key, so re-runs converge to
-    // the same value; live Custodians keep verifying.
-    JR2_INSTANCE_HARNESS_TOKEN: sandboxToken(Buffer.from(signingKey, "base64"), INSTANCE_HARNESS_SERVICE),
   };
+  // The Instance Harness Custodian's credentials are not here (ADR-0076): its control token and
+  // its secret Stand-ins ride its own Secret (`INSTANCE_HARNESS_CREDENTIALS`), whose Stand-ins its
+  // Harness container mounts — so it must never be this one.
   // Git tokens (ADR-0051, ADR-0068): each entry's token, from `.env`, goes into that entry's own clone
   // Secret (`jr2-git-<hash>`, Flux's key names), which the cache agent reads — never into this
   // Secret, the Orchestrator's env. The Orchestrator names the Secret on a Repo and holds no git token.
@@ -843,6 +843,7 @@ export async function up(args: string[], io: Io): Promise<number> {
     trust: trustData(caPem, held.bundles),
     harnessEnvData,
     priorityClassName: priorityClassNames(config.priorityClasses).sandbox,
+    signingKey: Buffer.from(signingKey, "base64"),
   });
 
   // --- operator (per-cluster, shared): after the provider preflight ------------------------------
@@ -1015,14 +1016,17 @@ export async function up(args: string[], io: Io): Promise<number> {
   // over from a Machine that dropped its `workspace()` is deleted with its RBAC: the layer
   // converges toward the Machines like the Instance Harness does.
   if (carried.composesSandbox) {
+    // The agent is also the Landlock detector (ADR-0077): on a Sandbox node without Landlock it
+    // exits at start with the reason, and the converge refuses, naming each such node.
     activity(io, "repo cache: waiting for the cache agent on every Sandbox node");
-    await awaitRollout(kube, {
+    const cacheTarget: RolloutTarget = {
       kind: "daemonset",
       name: REPO_CACHE,
       namespace,
       selector: `app=${REPO_CACHE}`,
       ...ctx,
-    });
+    };
+    await awaitCacheAgent(kube, cacheTarget, () => awaitRollout(kube, cacheTarget));
     await verifyRunningImage(io, kube, {
       layer: "repo cache",
       namespace,
@@ -1078,6 +1082,13 @@ export async function up(args: string[], io: Io): Promise<number> {
         held: instance.manifest,
         custodian: instance.custodian,
         heldDigest: heldDigest(Buffer.from(signingKey, "base64"), held.objects, instance, valueDigest),
+        // Its control token and secret Stand-ins (ADR-0076, ADR-0059): minted here, as the pod's
+        // maker, from the kept key — so a re-run converges to the same values.
+        credentials: podCredentials(Buffer.from(signingKey, "base64"), {
+          placement: INSTANCE_HARNESS_SERVICE,
+          heldPod: INSTANCE_HARNESS_HELD_POD,
+          manifest: instance.manifest,
+        }),
         harness: config.harness,
         caBundle: caPem !== undefined,
         // The wire's gate (ADR-0058): the digest of the bearer the Orchestrator derives for this
@@ -1112,8 +1123,10 @@ export async function up(args: string[], io: Io): Promise<number> {
     await kube.deleteObject({ kind: "persistentvolumeclaim", name: INSTANCE_HARNESS_PVC, namespace, ...ctx });
     await kube.deleteObject({ kind: "service", name: INSTANCE_HARNESS_SERVICE, namespace, ...ctx });
     await kube.deleteObject({ kind: "service", name: INSTANCE_HARNESS_PODS_SERVICE, namespace, ...ctx });
-    // Its Custodian's files go with the pod they were rendered for (ADR-0059).
+    // Its Custodian's files and its credentials go with the pod they were made for (ADR-0059,
+    // ADR-0076).
     await kube.deleteObject({ kind: "configmap", name: INSTANCE_CUSTODIAN_CONFIGMAP, namespace, ...ctx });
+    await kube.deleteObject({ kind: "secret", name: INSTANCE_HARNESS_CREDENTIALS, namespace, ...ctx });
   }
 
   // --- Instance Effector (ADR-0068): converged when an Effect is placed there, absent otherwise ---
@@ -1480,6 +1493,8 @@ async function resolveHeld(
     models: opts.models,
   });
   for (const warning of warnings) activity(io, `warning: ${warning}`);
+  const r14 = envFromHeldRefusal(config, manifest, opts.envFromKeys);
+  if (r14) throw new Error(r14);
   // Each pod's own: the bindings of the names it holds and their literal values. Its Custodian's
   // files are rendered by whoever makes the pod — here for the Instance Harness alone; the
   // Orchestrator at provision for a Sandbox, from the same manifest (ADR-0059).
@@ -1496,7 +1511,7 @@ async function resolveHeld(
   const orchestrator = { host: `${ORCHESTRATOR_SERVICE}.${namespace}.svc`, port: ORCHESTRATOR_PORT };
   const instance: CustodianFiles | undefined = instancePod && {
     bootstrap: JSON.stringify(custodianBootstrap(instancePod.manifest, orchestrator)),
-    script: custodianScript(instancePod.manifest),
+    script: custodianScript(instancePod.manifest, { fetch: false }),
   };
   if (manifest.secrets.length === 0) return { objects: { pods, ...(instance && { instance }), leaves: {} } };
   for (const s of manifest.secrets) {
@@ -1531,6 +1546,36 @@ async function resolveHeld(
   };
 }
 
+/**
+ * R14 (ADR-0059): a held secret's name that is also a key of a Secret `harness.envFrom` loads. The
+ * Stand-ins are files, not env (ADR-0076), so no Stand-in hides that key: the Secret's real value
+ * would reach the Harness container's env under the held secret's own name, and the Harness uses a
+ * held secret but never holds it. The key is compared as the kubelet writes it, `prefix` first.
+ * The message names the Secret, the key and the held secret, and never a value. Exported for its
+ * test.
+ */
+export function envFromHeldRefusal(
+  config: JR2Config,
+  manifest: HeldManifest,
+  envFromKeys: ReadonlyMap<string, readonly string[]>,
+): string | undefined {
+  const held = new Set(manifest.secrets.map((s) => s.name));
+  for (const [i, ref] of (config.harness?.envFrom ?? []).entries()) {
+    const secret = ref.secretRef?.name;
+    if (secret === undefined) continue;
+    for (const key of envFromKeys.get(`secret/${secret}`) ?? []) {
+      const name = (ref.prefix ?? "") + key;
+      if (!held.has(name)) continue;
+      return (
+        `harness.envFrom[${i}] loads Secret "${secret}", whose key "${key}" is the env var ${name} — and ${name} is ` +
+        `a held secret. Its Stand-in is a file, so nothing hides that key, and its value would reach the ` +
+        `Harness's env. Drop the key from Secret "${secret}", or rename the held secret (ADR-0059, R14)`
+      );
+    }
+  }
+  return undefined;
+}
+
 /** The Instance Harness's held objects and its Custodian's files — the walk always places it when
  * it converges. */
 function instanceHeld(held: HeldObjects): HeldPodObjects & { custodian: CustodianFiles } {
@@ -2460,6 +2505,8 @@ async function preflightProviders(
     trust: Record<string, string>;
     harnessEnvData: Record<string, string>;
     priorityClassName: string;
+    /** The signing key, for each check pod's own Stand-ins (ADR-0019, ADR-0059). */
+    signingKey: Buffer;
   },
 ): Promise<void> {
   const { namespace, ctx } = opts;
@@ -2521,9 +2568,16 @@ async function preflightProviders(
       trust: opts.trust,
       custodian: {
         bootstrap: JSON.stringify(custodianBootstrap(checkPod.manifest, orchestrator)),
-        script: custodianScript(checkPod.manifest),
+        script: custodianScript(checkPod.manifest, { fetch: false }),
       },
-      token: randomBytes(24).toString("hex"),
+      // Its own credentials (ADR-0019, ADR-0076): a control token the Orchestrator never signed,
+      // and secret Stand-ins minted for this pod alone.
+      credentials: podCredentials(opts.signingKey, {
+        placement: object,
+        heldPod: object,
+        manifest: checkPod.manifest,
+        controlToken: "unsigned",
+      }),
       harnessEnvData: opts.harnessEnvData,
       models,
       ...(checkPod.placement ? { placement: checkPod.placement } : {}),
@@ -2666,7 +2720,7 @@ async function removeCheckLeftovers(
       if (!(since(finished ?? p.metadata.creationTimestamp) > CHECK_ENDED_MARGIN_SECONDS)) continue;
       await removeCheckPod(io, kube, p.metadata.name, namespace, ctx);
     }
-    for (const kind of ["configmap", "secret"]) {
+    for (const kind of ["configmap", "secret", "networkpolicy"]) {
       for (const o of await kube.listJson<CheckObject>({ kind, selector, namespace, ...ctx })) {
         const owner = o.metadata.name.replace(/-(ca|tls|env)$/, "");
         if (named.has(owner) || !(since(o.metadata.creationTimestamp) > CHECK_LEFTOVER_SECONDS)) continue;

package/src/deploy.ts

@@ -3,7 +3,7 @@
 // namespace are constants (namespace is the identity); every object carries the instance label so
 // ownership is derivable from the cluster — there is no local target state.
 
-import { createHmac } from "node:crypto";
+import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import {
@@ -19,6 +19,11 @@ import {
   CUSTODIAN_PROGRAM,
   CUSTODIAN_PROGRAM_KEY,
   CUSTODIAN_SCRIPT_KEY,
+  CREDENTIAL_KEYS,
+  controlStandIn,
+  controlToken,
+  heldStandIn,
+  heldStandInKey,
   INSTANCE_CUSTODIAN_CONFIGMAP,
   GIT_SSH_SECRET,
   HELD_CA_SECRET,
@@ -60,6 +65,7 @@ import {
   type GitPushManifest,
   type HarnessConfig,
   type HeldManifest,
+  markHarnessEnv,
   type PriorityClasses,
   type SandboxPlacement,
 } from "@jr2/orchestrator/internal";
@@ -93,6 +99,39 @@ export const ANNOTATION_HELD_DIGEST = "jr2.dev/held-digest";
  * same reason: a group every container is granted, which the Custodian's values are readable by. */
 const INSTANCE_HARNESS_FS_GROUP = 2000;
 
+/**
+ * The Instance Harness's credentials Secret (ADR-0076, ADR-0059): what a Sandbox's `<sandbox>-token`
+ * is to a Sandbox. It holds the pod's control token (`controlToken`, for the placement's name), its
+ * secret control Stand-in and one secret Stand-in per held secret of the pod, under
+ * `CREDENTIAL_KEYS` and `heldStandInKey`. `jr2 up` mints it, as the pod's maker. The Custodian
+ * mounts the token and the Stand-ins; the Harness container mounts the Stand-ins alone, as files
+ * under `/run/jr2/` (`custodianComposition`). A Secret of its own, never `jr2-instance`: the
+ * Instance token and the signing key share no Secret with anything the Harness container mounts.
+ */
+export const INSTANCE_HARNESS_CREDENTIALS = `${INSTANCE_HARNESS_SERVICE}-token`;
+
+/**
+ * One pod's credentials Secret data (ADR-0076, ADR-0059), minted by `jr2 up` as that pod's maker:
+ * the control token, the secret control Stand-in, and one secret Stand-in per held secret of
+ * `manifest` (`heldStandIn`, under the pod key `heldPod`). The Instance Harness's control token is
+ * signed for the placement's name, so it speaks only for the Turns hosted there; a check pod's
+ * (`controlToken: "unsigned"`) is a value the Orchestrator never signed — it reads no Menu
+ * (ADR-0019). No pod here serves a fetch, so neither holds a fetch token. Never logged: the values
+ * reach a Secret and nothing else.
+ */
+export function podCredentials(
+  key: Buffer,
+  opts: { placement: string; heldPod: string; manifest: HeldManifest; controlToken?: "signed" | "unsigned" },
+): Record<string, string> {
+  const data: Record<string, string> = {
+    [CREDENTIAL_KEYS.controlToken]:
+      opts.controlToken === "unsigned" ? randomBytes(24).toString("hex") : controlToken(key, opts.placement),
+    [CREDENTIAL_KEYS.controlStandIn]: controlStandIn(key, opts.placement),
+  };
+  for (const s of opts.manifest.secrets) data[heldStandInKey(s.name)] = heldStandIn(key, opts.heldPod, s.name);
+  return data;
+}
+
 /** How long the Instance Harness pod is given to stop (ADR-0031's drain): on SIGTERM it stops
  * admitting and finishes the Turns it holds, so the grace is a Turn's worst case. `jr2 up` waits
  * out a rollout that long, and no longer. */
@@ -110,6 +149,48 @@ export const INSTANCE_HARNESS_PODS_SERVICE = `${INSTANCE_HARNESS_SERVICE}-pods`;
 /** The two ingress NetworkPolicies (ADR-0058) — see `harnessIngressPolicies`. */
 export const SANDBOX_INGRESS_POLICY = "jr2-sandbox-ingress";
 export const INSTANCE_HARNESS_INGRESS_POLICY = "jr2-instance-harness-ingress";
+/** The two egress NetworkPolicies (ADR-0076) — see `metadataEgress`. */
+export const SANDBOX_EGRESS_POLICY = "jr2-sandbox-egress";
+export const INSTANCE_HARNESS_EGRESS_POLICY = "jr2-instance-harness-egress";
+
+/**
+ * The cloud metadata addresses that a Harness pod does not reach (ADR-0076): where a node's
+ * metadata service answers pods, it gives the node's own cloud credential, which no `workspace()`
+ * grants. AWS's IMDS (IPv4 and IPv6), ECS's and EKS Pod Identity's credential agents, the
+ * metadata service of GCP and Azure (the same 169.254.169.254), and Alibaba's. Each is a single
+ * address: all of 169.254.0.0/16 would cut NodeLocal DNSCache (169.254.20.10). The list is not
+ * complete for every provider, so the shared-cluster guide tells the admin to check theirs.
+ */
+export const METADATA_ADDRESSES_V4 = [
+  "169.254.169.254/32",
+  "169.254.170.2/32",
+  "169.254.170.23/32",
+  "100.100.100.200/32",
+] as const;
+export const METADATA_ADDRESSES_V6 = ["fd00:ec2::254/128"] as const;
+
+/**
+ * The egress of a Harness pod (ADR-0076): everything, except the cloud metadata addresses.
+ * NetworkPolicy has no deny rule, so the rule allows every address but those, and every pod of the
+ * cluster as a peer of its own. A CNI that matches an `ipBlock` against a pod's address too (Cilium)
+ * would otherwise cut DNS, the Orchestrator and each Service. The policy needs a CNI that enforces
+ * NetworkPolicy; on one that does not, nothing is blocked.
+ */
+export function metadataEgress(podSelector: Record<string, unknown>): Record<string, unknown> {
+  return {
+    podSelector,
+    policyTypes: ["Egress"],
+    egress: [
+      {
+        to: [
+          { ipBlock: { cidr: "0.0.0.0/0", except: [...METADATA_ADDRESSES_V4] } },
+          { ipBlock: { cidr: "::/0", except: [...METADATA_ADDRESSES_V6] } },
+          { namespaceSelector: {} },
+        ],
+      },
+    ],
+  };
+}
 
 /** The operator's install location — per-cluster, shared by every instance (ADR-0019). */
 export const OPERATOR_NAMESPACE = "jr2-system";
@@ -579,6 +660,7 @@ export function instanceObjects(opts: {
       },
     },
     ...harnessIngressPolicies(opts.name, meta),
+    ...harnessEgressPolicies(meta),
     ...(opts.repoCache
       ? repoCacheObjects({
           ...opts.repoCache,
@@ -610,7 +692,7 @@ const SANDBOX_POD_LABEL = "sandbox.jr2.dev/name";
  *
  * - The Orchestrator is not selected. Every route there is token-gated, and a Custodian in any
  *   Harness pod must reach it; a policy could not tell the Custodian's packets from the Agent's.
- * - No egress. What a Sandbox may reach is its own decision (ADR-0058 records it open).
+ * - No egress. That is `harnessEgressPolicies`: open, except the cloud metadata addresses (ADR-0076).
  * - No port. The Orchestrator speaks only the Harness wire to these pods, and a port here would
  *   have to track the CR's `port`; `kubectl port-forward` (the CLI, a human's shell into the User
  *   Container — ADR-0005) and kubelet probes never cross a policy at all.
@@ -631,6 +713,26 @@ function harnessIngressPolicies(instance: string, meta: (name: string) => KubeMa
   ];
 }
 
+/**
+ * No Harness pod reaches a cloud metadata address (ADR-0076, `metadataEgress`). A Sandbox runs
+ * Workspace code, and the node's credential is one that no `workspace()` grants. The Instance
+ * Harness runs no Workspace code, but it gets the same rule: a check pod of the provider preflight
+ * stands for every Harness pod (ADR-0019), so a model that only the node's credential reaches must
+ * fail the check, not a Turn. Converged unconditionally, for the reason the ingress policies are.
+ */
+function harnessEgressPolicies(meta: (name: string) => KubeManifest): KubeManifest[] {
+  const policy = (name: string, podSelector: Record<string, unknown>): KubeManifest => ({
+    apiVersion: "networking.k8s.io/v1",
+    kind: "NetworkPolicy",
+    metadata: meta(name),
+    spec: metadataEgress(podSelector),
+  });
+  return [
+    policy(SANDBOX_EGRESS_POLICY, { matchExpressions: [{ key: SANDBOX_POD_LABEL, operator: "Exists" }] }),
+    policy(INSTANCE_HARNESS_EGRESS_POLICY, { matchLabels: { app: INSTANCE_HARNESS_SERVICE } }),
+  ];
+}
+
 /** Where the cache agent's pod sees the node's directory: `--cache-dir`'s default. */
 const REPO_CACHE_MOUNT = "/cache";
 /** The agent's `$HOME` — an emptyDir, where it writes a deploy key for the life of the pod. */
@@ -651,6 +753,10 @@ const REPO_CACHE_HOME = "/home/jr2";
  * (ADR-0052), so an agent lands on exactly the nodes a Sandbox can be placed on. The ServiceAccount token IS mounted: the agent is a client of the Repo resources and
  * of the pods on its node (never of Sandboxes — demand is a pod's mount), unlike a Sandbox, whose
  * north star is never reaching the API.
+ *
+ * Because it lands on exactly the Sandbox nodes, it is also the Landlock detector (ADR-0077): it
+ * probes at start and, on a node without Landlock, exits with the reason, and `jr2 up` refuses to
+ * converge (`landlock.ts`).
  */
 function repoCacheObjects(opts: {
   image: string;
@@ -713,6 +819,11 @@ function repoCacheObjects(opts: {
                 image,
                 imagePullPolicy: "IfNotPresent",
                 command: ["/manager", "repo-cache"],
+                // On a node without Landlock the agent exits at start with a message that names
+                // Landlock, the node and the reason (ADR-0077). The kubelet keeps it in the
+                // container's status, where `jr2 up` reads it; the log line serves if the file
+                // write fails.
+                terminationMessagePolicy: "FallbackToLogsOnError",
                 env: [
                   // The downward API names the node this pod is the writer for, and the namespace
                   // whose Repos and pods it watches (the agent's `--node` / `--namespace`).
@@ -853,6 +964,9 @@ export function instanceHarnessObjects(opts: {
    * Custodian's config), keyed with the signing key so it reveals nothing — on the pod template, so
    * a change to any of them rolls this pod (ADR-0059). */
   heldDigest: string;
+  /** The pod's credentials Secret data (`podCredentials`): its control token and its secret
+   * Stand-ins, applied here as {@link INSTANCE_HARNESS_CREDENTIALS} with the pod they are for. */
+  credentials: Record<string, string>;
   harness?: HarnessConfig;
   /** The instance ships a private-CA bundle (ADR-0020). */
   caBundle?: boolean;
@@ -880,15 +994,16 @@ export function instanceHarnessObjects(opts: {
     seccompProfile: { type: "RuntimeDefault" },
   });
 
-  // The Custodian (ADR-0013, ADR-0059): the placement's Sandbox token — signed for this
-  // placement's name (`up.ts` mints it into the instance Secret), so it speaks only for the Turns
-  // hosted HERE (tokens.ts) — plus the held secrets placed here. Mounted into the Custodian alone;
-  // the Instance token itself never enters this pod.
+  // The Custodian (ADR-0013, ADR-0059, ADR-0076): the placement's control token — signed for this
+  // placement's name, so it speaks only for the Turns hosted HERE (tokens.ts) — and the held secrets
+  // placed here, from the pod's own credentials Secret (`podCredentials`). The tokens are mounted
+  // into the Custodian alone, the Stand-ins into the Custodian and, as files, the Harness; the
+  // Instance token itself never enters this pod. The pod serves no fetch: no Repo is mounted here.
   const custodian = custodianComposition(opts.held, {
     image: opts.custodianImage,
     pod: INSTANCE_HARNESS_HELD_POD,
     config: INSTANCE_CUSTODIAN_CONFIGMAP,
-    token: { secret: INSTANCE_SECRET, key: "JR2_INSTANCE_HARNESS_TOKEN" },
+    credentials: { secret: INSTANCE_HARNESS_CREDENTIALS },
     caBundle: opts.caBundle === true,
     resources: sized(KIT_POD_SIZES.instanceCustodian),
   });
@@ -901,24 +1016,28 @@ export function instanceHarnessObjects(opts: {
     // The same asymmetry the Sandbox pod builds (ADR-0013/0020/0059): the mounted harness config
     // and the instance's valueFrom entries ride `env` (literal values live in the jr2-harness-env
     // Secret), then the Custodian's address and every Stand-in, and no credential ever does.
-    env: [
-      {
-        name: "JR2_HARNESS_JSON",
-        valueFrom: { configMapKeyRef: { name: HARNESS_CONFIGMAP, key: HARNESS_CONFIG_KEY } },
-      },
-      // The placement gate (ADR-0031): every admission carries its own definition (ADR-0049), so
-      // the Harness itself refuses any admission whose definition declares Workspace access —
-      // Menu-only Agents alone run here, which is what makes "no code execution in this pod" true
-      // rather than asserted. The bearer (below) narrows who may try; this decides what.
-      { name: "JR2_MENU_ONLY", value: "1" },
-      ...(opts.harness?.env ?? []).filter((v) => v.valueFrom !== undefined),
-      ...custodian.harnessEnv,
-      // Where the conversations persist (ADR-0031): the claim below. Mechanism, as on a Sandbox.
-      { name: CONVERSATIONS_DIR_ENV, value: CONVERSATIONS_DIR },
-      // The wire's gate (ADR-0058), last — as on a Sandbox — so no `harness.env` entry chooses it.
-      { name: "JR2_HARNESS_TOKEN_SHA256", value: opts.bearerSha256 },
-    ],
-    envFrom: [{ secretRef: { name: HARNESS_ENV_SECRET } }, ...(opts.harness?.envFrom ?? [])],
+    // Marked (ADR-0076, `harness-env.ts`): the stock image's command starts the Harness with
+    // `effector nocore --harness-env`, which gives the Harness process jr2's names alone.
+    ...markHarnessEnv(
+      [
+        {
+          name: "JR2_HARNESS_JSON",
+          valueFrom: { configMapKeyRef: { name: HARNESS_CONFIGMAP, key: HARNESS_CONFIG_KEY } },
+        },
+        // The placement gate (ADR-0031): every admission carries its own definition (ADR-0049), so
+        // the Harness itself refuses any admission whose definition declares Workspace access —
+        // Menu-only Agents alone run here, which is what makes "no code execution in this pod" true
+        // rather than asserted. The bearer (below) narrows who may try; this decides what.
+        { name: "JR2_MENU_ONLY", value: "1" },
+        ...(opts.harness?.env ?? []).filter((v) => v.valueFrom !== undefined),
+        ...custodian.harnessEnv,
+        // Where the conversations persist (ADR-0031): the claim below. Mechanism, as on a Sandbox.
+        { name: CONVERSATIONS_DIR_ENV, value: CONVERSATIONS_DIR },
+        // The wire's gate (ADR-0058), last — as on a Sandbox — so no `harness.env` entry chooses it.
+        { name: "JR2_HARNESS_TOKEN_SHA256", value: opts.bearerSha256 },
+      ],
+      [{ secretRef: { name: HARNESS_ENV_SECRET } }, ...(opts.harness?.envFrom ?? [])],
+    ),
     // The Harness container's alone: the Custodian has no business with an Agent's history.
     volumeMounts: [{ name: CONVERSATIONS_VOLUME, mountPath: CONVERSATIONS_DIR }, ...custodian.harnessMounts],
     // The operator probes a Sandbox's Harness the same way: serving = the socket accepts.
@@ -938,6 +1057,14 @@ export function instanceHarnessObjects(opts: {
   };
 
   const items: KubeManifest[] = [
+    // The pod's credentials (ADR-0076): a Secret, never a ConfigMap, env or the pod template.
+    {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: { ...meta(), name: INSTANCE_HARNESS_CREDENTIALS },
+      type: "Opaque",
+      stringData: opts.credentials,
+    },
     // The one pod `jr2 up` makes, so the one whose Custodian files it renders: its bootstrap and
     // its HELD table, from its own manifest, beside the program its volume projects from `jr2-held`.
     {
@@ -1084,6 +1211,7 @@ export const CHECK_CONTAINER = "check";
 export function checkPodObjectNames(object: string): Array<{ kind: string; name: string }> {
   return [
     { kind: "pod", name: object },
+    { kind: "networkpolicy", name: object },
     { kind: "configmap", name: object },
     { kind: "configmap", name: `${object}-ca` },
     { kind: "secret", name: object },
@@ -1100,8 +1228,9 @@ export function checkPodObjectNames(object: string): Array<{ kind: string; name:
  * - `<object>` (ConfigMap): the Custodian's bootstrap and script, the program and the harness config
  *   (`harnessConfigJson`).
  * - `<object>-ca` (ConfigMap): the trust bundles, as `jr2-ca` would carry them.
- * - `<object>` (Secret): the Custodian's token, a value the Orchestrator never signed (the check pod
- *   reads no Menu), and the LITERAL values of the keys it holds, from the host. A `valueFrom` key
+ * - `<object>` (Secret): the Custodian's control token, a value the Orchestrator never signed (the
+ *   check pod reads no Menu), the check pod's own secret Stand-ins (`podCredentials`, ADR-0059), and
+ *   the LITERAL values of the keys it holds, from the host. A `valueFrom` key
  *   stays a reference to the user's Secret. The values are in this Secret for the check pod's life.
  * - `<object>-tls` (Secret): the leaves of the bound hosts. `<object>-env` (Secret): the literal
  *   `harness.env` values, which `jr2-harness-env` would carry.
@@ -1112,6 +1241,9 @@ export function checkPodObjectNames(object: string): Array<{ kind: string; name:
  * container's env, so the call is the one a Turn makes, and the key never enters that container,
  * its argv or its log. The argv is the model specifiers alone.
  *
+ * - `<object>` (NetworkPolicy): the egress of a Harness pod (`metadataEgress`, ADR-0076), so the
+ *   check reaches a provider only as a Turn does. It is in the List before the pod.
+ *
  * The pod has the placement and the priority class of the Harness pods it stands for (ADR-0052,
  * ADR-0060). Its labels are its own and match no Harness pod's: the Instance Harness Service
  * selects by label, and would send Turns to it. The Custodian is a native sidecar with a startup
@@ -1136,7 +1268,9 @@ export function checkPodObjects(opts: {
   trust: Record<string, string>;
   /** The Custodian's two files, rendered from `held`. */
   custodian: CustodianFiles;
-  token: string;
+  /** The check pod's credentials (`podCredentials`, ADR-0076): a control token the Orchestrator
+   * never signed, and its own secret Stand-ins, minted for this pod alone. */
+  credentials: Record<string, string>;
   /** The literal `harness.env` values. */
   harnessEnvData: Record<string, string>;
   /** The `<provider>/<model>` specifiers to check, in order. */
@@ -1161,7 +1295,7 @@ export function checkPodObjects(opts: {
     pod: o,
     reads: { literals: o, tls: `${o}-tls`, trust: `${o}-ca`, program: o },
     config: o,
-    token: { secret: o, key: "token" },
+    credentials: { secret: o },
     caBundle: opts.caBundle === true,
     resources: sized(KIT_POD_SIZES.instanceCustodian),
   });
@@ -1204,11 +1338,17 @@ export function checkPodObjects(opts: {
             "/opt/jr2/src/provider-preflight.ts",
             ...opts.models,
           ],
-          // The Harness container's env, in its order (`instanceHarnessObjects`): no credential.
+          // The Harness container's env, in its order (`instanceHarnessObjects`): no credential. And
+          // the check pod's own Stand-ins (ADR-0019): it runs no Workspace code, so it may hold them
+          // in env, where pi reads a provider's key; each is a `secretKeyRef`, never a value here.
           env: [
             { name: "JR2_HARNESS_JSON", valueFrom: { configMapKeyRef: { name: o, key: HARNESS_CONFIG_KEY } } },
             ...(opts.harness?.env ?? []).filter((v) => v.valueFrom !== undefined),
             ...custodian.harnessEnv,
+            ...opts.held.secrets.map((s) => ({
+              name: s.name,
+              valueFrom: { secretKeyRef: { name: o, key: heldStandInKey(s.name) } },
+            })),
           ],
           envFrom: [{ secretRef: { name: `${o}-env` } }, ...(opts.harness?.envFrom ?? [])],
           volumeMounts: custodian.harnessMounts,
@@ -1254,9 +1394,15 @@ export function checkPodObjects(opts: {
       },
     },
     { apiVersion: "v1", kind: "ConfigMap", metadata: meta(`${o}-ca`), data: opts.trust },
-    secret(o, { token: opts.token, ...literals }),
+    secret(o, { ...opts.credentials, ...literals }),
     secret(`${o}-tls`, leaves),
     secret(`${o}-env`, opts.harnessEnvData),
+    {
+      apiVersion: "networking.k8s.io/v1",
+      kind: "NetworkPolicy",
+      metadata: meta(o),
+      spec: metadataEgress({ matchLabels: { app: PROVIDER_PREFLIGHT, [LABEL_PROVIDER_PREFLIGHT]: opts.run } }),
+    },
     pod,
   ];
   return JSON.stringify({ apiVersion: "v1", kind: "List", items });

package/src/instance-check.ts

@@ -131,7 +131,7 @@ export async function checkInstance(io: Io, root: string, config: JR2Config): Pr
     return undefined;
   }
   // What each registered Machine runs outside itself (ADR-0067, ADR-0068): every Effect slot, with
-  // the plain data it carries — a command's argv, its timeout, the Repo Slot it runs in; an http
+  // the plain data it carries — a command's argv and its timeout; an http
   // Effect's method, its fixed target and the secrets it names — read, never run.
   for (const w of workflows) {
     const effects = partsOf([w.machine]).effects;
@@ -139,13 +139,10 @@ export async function checkInstance(io: Io, root: string, config: JR2Config): Pr
     activity(io, `effects: workflow "${w.name}" — what it runs outside itself (ADR-0067)`);
     for (const e of effects) {
       const where = e.path?.length ? ` (on ${e.path.map((k) => `"${k}"`).join(" → ")})` : "";
-      const slot = "slot" in e && e.slot !== undefined ? `, in Repo Slot "${e.slot}"` : "";
       if (e.kind === "http") {
         const names = e.secrets.length ? `, secrets ${e.secrets.map((n) => `"${n}"`).join(", ")}` : "";
         // Its body decides where it runs (ADR-0067): a Worktree file needs its Workspace's Sandbox Effector.
-        const where2 = e.file
-          ? `in the Sandbox Effector, a Worktree file as its body${slot}`
-          : "in the Instance Effector";
+        const where2 = e.file ? "in the Sandbox Effector, a Worktree file as its body" : "in the Instance Effector";
         activity(
           io,
           `  ${e.name}${where}: http ${e.method} ${e.target ? targetText({ target: e.target }) : "<open>"} — ${e.timeoutMs / 1000}s, ` +
@@ -167,6 +164,7 @@ export async function checkInstance(io: Io, root: string, config: JR2Config): Pr
       }
       if (e.kind === "push") {
         const opts = (["pin", "sign", "squash", "force"] as const).filter((k) => e[k]);
+        const slot = e.slot !== undefined ? `, in Repo Slot "${e.slot}"` : "";
         activity(
           io,
           `  ${e.name}${where}: push${opts.length ? ` (${opts.join(", ")})` : ""} — ${e.timeoutMs / 1000}s, ` +
@@ -175,11 +173,17 @@ export async function checkInstance(io: Io, root: string, config: JR2Config): Pr
         continue;
       }
       if (!("argv" in e)) continue;
+      if (e.cut) {
+        // A cut is a kit program: its argv is the kit's business, and its one choice is `expect`.
+        const expect = e.cut.expect ? ` (expect ${e.cut.expect})` : "";
+        activity(io, `  ${e.name}${where}: worktree${expect} — ${e.timeoutMs / 1000}s, in the Harness`);
+        continue;
+      }
       const names = e.secrets?.length ? `, secrets ${e.secrets.map((n) => `"${n}"`).join(", ")}` : "";
       const seat = e.secrets?.length ? `the Sandbox Effector${e.pin ? ", pinned" : ""}` : "the Harness";
       activity(
         io,
-        `  ${e.name}${where}: ${e.kind} ${JSON.stringify(e.argv)} — ${e.timeoutMs / 1000}s, in ${seat}${slot}${names}`,
+        `  ${e.name}${where}: ${e.kind} ${JSON.stringify(e.argv)} — ${e.timeoutMs / 1000}s, in ${seat}${names}`,
       );
     }
   }

package/src/landlock.ts

@@ -0,0 +1,129 @@
+// jr2 requires Landlock on every Sandbox node (ADR-0077). The Repo cache agent is the detector: its
+// DaemonSet has one pod on each Sandbox node, by the Sandboxes' own placement (ADR-0052), and on a
+// node without Landlock, or with an ABI below 3, the agent exits at start with a termination
+// message that names Landlock, the node and the probe's reason, which states the ABI it found
+// (`operator/internal/repocache/landlock.go`). jr2's minimum is ABI 3: under ABI 1 no confined
+// process can move a file into another folder, and under ABI 2 a confined process can truncate a
+// file of jr2's that it may not write. That pod never gets Ready, so the cache agent's
+// rollout never completes.
+//
+// `jr2 up` reads the DaemonSet's pods within the rollout wait it already makes, and refuses to
+// converge while any of them reports no Landlock. It names each node, the reason, and the fix: keep
+// the node out of the Sandbox nodes with `sandbox.nodeSelector` or a taint, or enable Landlock. There
+// is no check pod, no node label and no flag to skip it. A run after the fix converges.
+
+import { setTimeout as sleep } from "node:timers/promises";
+import type { KubeAdmin, RolloutTarget } from "./kube.ts";
+
+/** The start of the cache agent's termination message on a node without Landlock — the Go side's
+ * `LandlockMessagePrefix`. The two change together. */
+export const LANDLOCK_MESSAGE_PREFIX = "no Landlock on node ";
+
+/** How often `awaitCacheAgent` reads the DaemonSet's pods while the rollout wait runs. */
+const POLL_MS = 3000;
+
+type Terminated = { message?: string };
+type ContainerStatus = {
+  state?: { terminated?: Terminated };
+  lastState?: { terminated?: Terminated };
+};
+/** A cache agent pod, read for the node it runs on and its containers' termination messages. */
+export type CacheAgentPod = {
+  metadata: { name: string; deletionTimestamp?: string };
+  spec?: { nodeName?: string };
+  status?: { containerStatuses?: ContainerStatus[] };
+};
+
+/** One Sandbox node whose cache agent reports no Landlock, and the probe's reason. */
+export type NoLandlock = { node: string; reason: string };
+
+// The node, then the reason up to the sentence the agent ends its message with. Not anchored: with
+// `FallbackToLogsOnError` the message can be the agent's log line, which quotes it.
+const MESSAGE = /no Landlock on node ([^\s:]+): (.+?) — jr2 needs Landlock/;
+
+/** The Sandbox nodes whose cache agent reports no Landlock, each once, in node order. */
+export function nodesWithoutLandlock(pods: readonly CacheAgentPod[]): NoLandlock[] {
+  const found = new Map<string, string>();
+  for (const pod of pods) {
+    if (pod.metadata.deletionTimestamp) continue;
+    for (const s of pod.status?.containerStatuses ?? []) {
+      const message = s.state?.terminated?.message ?? s.lastState?.terminated?.message ?? "";
+      const match = MESSAGE.exec(message);
+      if (!match) continue;
+      const node = pod.spec?.nodeName ?? match[1]!;
+      if (!found.has(node)) found.set(node, match[2]!);
+    }
+  }
+  return [...found].sort(([a], [b]) => a.localeCompare(b)).map(([node, reason]) => ({ node, reason }));
+}
+
+/** The refusal (ADR-0077, ADR-0019): each node, its reason, and the fix. */
+export function landlockRefusal(nodes: readonly NoLandlock[]): Error {
+  return new Error(
+    [
+      `repo cache: ${nodes.length === 1 ? "a Sandbox node has" : `${nodes.length} Sandbox nodes have`} no Landlock, ` +
+        "and jr2 needs it on every Sandbox node (ADR-0077):",
+      ...nodes.map((n) => `  ${n.node}: ${n.reason}`),
+      "Keep each such node out of the Sandbox nodes with sandbox.nodeSelector or a taint (ADR-0052), or enable " +
+        "Landlock ABI 3 or later in its kernel (Linux 6.2 or later, or a kernel with a backport, with landlock in " +
+        "its lsm= list). Then run `jr2 up` again.",
+    ].join("\n"),
+  );
+}
+
+/**
+ * Wait for the cache agent's rollout, and refuse as soon as one of its pods reports no Landlock:
+ * a pod that exits at start never gets Ready, so the wait alone would only time out. `rollout` is
+ * the converge's own rollout wait (with its own diagnosis on failure); while it runs, the
+ * DaemonSet's pods are read every few seconds, one list call each. A failed rollout is read once
+ * more, so a Landlock refusal wins over the generic diagnosis.
+ */
+export async function awaitCacheAgent(
+  kube: KubeAdmin,
+  target: RolloutTarget,
+  rollout: () => Promise<void>,
+  opts: { pollMs?: number } = {},
+): Promise<void> {
+  const read = async (): Promise<NoLandlock[]> => {
+    try {
+      return nodesWithoutLandlock(
+        await kube.listJson<CacheAgentPod>({
+          kind: "pod",
+          selector: target.selector,
+          namespace: target.namespace,
+          ...(target.context ? { context: target.context } : {}),
+        }),
+      );
+    } catch {
+      // A read that fails is no evidence: the rollout wait still decides.
+      return [];
+    }
+  };
+  const stop = new AbortController();
+  const waited = rollout().then(
+    () => ({ ok: true as const }),
+    (err: unknown) => ({ ok: false as const, err }),
+  );
+  const polled = (async (): Promise<NoLandlock[] | undefined> => {
+    for (;;) {
+      try {
+        await sleep(opts.pollMs ?? POLL_MS, undefined, { signal: stop.signal });
+      } catch {
+        return undefined;
+      }
+      const nodes = await read();
+      if (nodes.length > 0) return nodes;
+    }
+  })();
+  const first = await Promise.race([waited, polled.then((nodes) => ({ nodes }))]);
+  stop.abort();
+  if ("nodes" in first) {
+    if (first.nodes) throw landlockRefusal(first.nodes);
+    // The poll stops only when aborted, so the rollout settled first.
+  }
+  const result = await waited;
+  if (result.ok) return;
+  const nodes = await read();
+  if (nodes.length > 0) throw landlockRefusal(nodes);
+  throw result.err;
+}