@jr2/cli 0.5.1 → 0.7.0

package/src/commands/up.ts

@@ -65,6 +65,9 @@ import { homedir } from "node:os";
 import { basename, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
+  callerTokenDigest,
+  callerTokenSecret,
+  storedValueSha256,
   custodianBootstrap,
   custodianRef,
   custodianScript,
@@ -82,8 +85,6 @@ import {
   doorCompat,
   matchCredential,
   packAssembly,
-  configMapDigest,
-  MOUNTED_CONFIGMAPS,
   partsOf,
   LABEL_EFFECTOR_POD,
   LABEL_GIT_PUSH,
@@ -95,12 +96,12 @@ import {
   type SandboxEffectorPlan,
   secretPlacementsOf,
   storedValueLength,
+  isStdioServer,
   effectorKey,
   targetText,
   harnessTokenDigest,
   formatCpu,
   formatMemory,
-  sandboxToken,
   type CarriedEffect,
   type CarriedImage,
   type CarriedRepo,
@@ -111,10 +112,13 @@ import {
   PROVIDER_KEY_NAME,
   type PlacementWalk,
   type SandboxPlacement,
+  type StandingView,
   workspaceHeldPod,
   type JR2Config,
+  memoryBytes,
 } from "@jr2/orchestrator/internal";
 import { stageAssembly, stagedCopyOf } from "../assembly.ts";
+import { awaitMounts, digestSecretsOf, mountedDigests, staleLine } from "../mount-wait.ts";
 import { caFits, fingerprint, issueCa, issueLeaf, leafFits, trustBundles, type Pem } from "../held-pki.ts";
 import {
   assertEmulation,
@@ -142,6 +146,8 @@ import {
   INSTANCE_HARNESS_PVC,
   INSTANCE_HARNESS_SERVICE,
   instanceHarnessObjects,
+  INSTANCE_HARNESS_CREDENTIALS,
+  podCredentials,
   instanceEffectorObjects,
   effectorDigest,
   storedValueDigest,
@@ -160,6 +166,8 @@ import {
   priorityClassNames,
   priorityClassObjects,
   REPO_CACHE,
+  STATE_PVC,
+  stateVolumePlan,
   trustObject,
   holdsAny,
   LABEL_HELD_POD,
@@ -173,6 +181,7 @@ import {
   CHECK_CONTAINER,
 } from "../deploy.ts";
 import { syncAgentsMd } from "../agents-md.ts";
+import { planCallerTokens } from "../caller-tokens.ts";
 import { resolveRoot } from "../instance.ts";
 import { resolvePackage } from "../kit-version.ts";
 import { effectorImagePaths, effectorImageRefusal, STOCK_HARNESS_IMAGE, type PushForm } from "../effector-image.ts";
@@ -189,10 +198,12 @@ import {
   type PodEnd,
   type RolloutTarget,
 } from "../kube.ts";
+import { awaitCacheAgent } from "../landlock.ts";
 import { anyNodeHolds, buildNodes, sandboxNodes, type NodeObject } from "../nodes.ts";
 import { activity, chooseOrBail, confirmOrBail, promptLine, readSecretInput, type Io } from "../output.ts";
 import { kindCluster, sweepImages } from "../sweep.ts";
 import { chartFilesIn, checkInstance } from "../instance-check.ts";
+import { standingLine } from "./status.ts";
 import { parseCommand } from "../command-table.ts";
 
 /** How many times one converge rebuilds a host image a sweep took before it uses it (ADR-0039).
@@ -323,6 +334,69 @@ export async function up(args: string[], io: Io): Promise<number> {
     activity(io, `  pick a different namespace (-n) or context (--context)`);
     return 1;
   }
+  // --- the state volume (ADR-0065): its size before anything is applied ---------------------------
+  // A claim never shrinks, and grows only where its StorageClass allows expansion: a size that the
+  // cluster would refuse is refused here, naming the class, before the namespace is touched. Both
+  // reads THROW on a failure (`listJson`, not `getJson`): a claim that reads as absent when the API
+  // could not be read would be applied over at another size. The claim is read even when the
+  // namespace read gave nothing: `getJson` reads a failure as absent, and a list in a namespace
+  // that is not there is empty, so only a real failure refuses.
+  type StateClaim = { spec?: { storageClassName?: string; resources?: { requests?: { storage?: string } } } };
+  let stateClaim: StateClaim | undefined;
+  try {
+    stateClaim = (
+      await kube.listJson<StateClaim>({
+        kind: "persistentvolumeclaim",
+        fieldSelector: `metadata.name=${STATE_PVC}`,
+        namespace,
+        ...ctx,
+      })
+    )[0];
+  } catch (e) {
+    activity(
+      io,
+      `refusing: cannot read the state volume claim ${STATE_PVC} in namespace "${namespace}" (${(e as Error).message}). Nothing was applied.`,
+    );
+    return 1;
+  }
+  const claimSize = stateClaim?.spec?.resources?.requests?.storage;
+  const claimClass = stateClaim?.spec?.storageClassName;
+  const wantVolume = config.runs?.volume;
+  const grows = claimSize !== undefined && wantVolume !== undefined && memoryBytes(wantVolume) > memoryBytes(claimSize);
+  let claimClassObject: { allowVolumeExpansion?: boolean } | undefined;
+  if (grows && claimClass) {
+    try {
+      claimClassObject = (
+        await kube.listJson<{ allowVolumeExpansion?: boolean }>({
+          kind: "storageclass",
+          fieldSelector: `metadata.name=${claimClass}`,
+          ...ctx,
+        })
+      )[0];
+    } catch (e) {
+      activity(
+        io,
+        `refusing: runs.volume is ${wantVolume}, larger than the state volume claim ${STATE_PVC} (${claimSize}), and jr2 cannot read StorageClass "${claimClass}" to see if it allows expansion (${(e as Error).message}). Nothing was applied.`,
+      );
+      return 1;
+    }
+  }
+  const volumePlan = stateVolumePlan(
+    wantVolume,
+    claimSize === undefined
+      ? undefined
+      : {
+          size: claimSize,
+          ...(claimClass ? { storageClass: claimClass } : {}),
+          ...(grows ? { expandable: claimClassObject?.allowVolumeExpansion === true } : {}),
+        },
+  );
+  if ("refused" in volumePlan) {
+    activity(io, `refusing: ${volumePlan.refused}. Nothing was applied.`);
+    return 1;
+  }
+  if (volumePlan.line) activity(io, volumePlan.line);
+
   if (!ns || !owner) {
     const what = ns ? `adopt existing namespace "${namespace}"` : `create namespace "${namespace}"`;
     const ok =
@@ -714,12 +788,14 @@ export async function up(args: string[], io: Io): Promise<number> {
     JR2_INSTANCE_TOKEN: instanceToken,
     JR2_PUBLISH_TOKEN: publishToken,
     JR2_SIGNING_KEY: signingKey,
-    // The Instance Harness Custodian's credential (ADR-0013/0031): a sandbox-style token signed
-    // for the placement's name — it may deliver only to Turns hosted THERE (tokens.ts), so the
-    // Instance token never enters that pod. Derived from the kept key, so re-runs converge to
-    // the same value; live Custodians keep verifying.
-    JR2_INSTANCE_HARNESS_TOKEN: sandboxToken(Buffer.from(signingKey, "base64"), INSTANCE_HARNESS_SERVICE),
   };
+  // The named Caller tokens (ADR-0078): each declared name keeps the value its Secret holds, and a
+  // name with none gets one now. The Orchestrator gets only their digests. Read here and written
+  // with the instance objects below, so a converge that stops before the apply writes no value.
+  const callerTokens = await planCallerTokens(kube, Object.keys(config.callers?.tokens ?? {}), namespace, ctx);
+  // The Instance Harness Custodian's credentials are not here (ADR-0076): its control token and
+  // its secret Stand-ins ride its own Secret (`INSTANCE_HARNESS_CREDENTIALS`), whose Stand-ins its
+  // Harness container mounts — so it must never be this one.
   // Git tokens (ADR-0051, ADR-0068): each entry's token, from `.env`, goes into that entry's own clone
   // Secret (`jr2-git-<hash>`, Flux's key names), which the cache agent reads — never into this
   // Secret, the Orchestrator's env. The Orchestrator names the Secret on a Repo and holds no git token.
@@ -770,6 +846,9 @@ export async function up(args: string[], io: Io): Promise<number> {
   // Instance Effector — so a value edited in the user's Secret rolls them at the next `jr2 up`.
   const referenced = new Map<string, Map<string, number> | undefined>();
   const valueDigests = new Map<string, string>();
+  // The plain sha-256 of each stored value, for a `token` Hook's secret alone (ADR-0078): the door
+  // compares a delivery's token with it, so it cannot be keyed as `valueDigests` are.
+  const valueShas = new Map<string, string>();
   for (const entry of config.secrets ?? []) {
     const ref = entry.valueFrom?.secretKeyRef.name;
     if (ref === undefined || referenced.has(ref)) continue;
@@ -785,6 +864,7 @@ export async function up(args: string[], io: Io): Promise<number> {
     );
     for (const [k, b64] of Object.entries(found?.data ?? {})) {
       valueDigests.set(`${ref}/${k}`, storedValueDigest(Buffer.from(signingKey, "base64"), ref, k, b64));
+      valueShas.set(`${ref}/${k}`, storedValueSha256(b64));
     }
   }
   const valueDigest = (secret: string, key: string) => valueDigests.get(`${secret}/${key}`);
@@ -800,6 +880,13 @@ export async function up(args: string[], io: Io): Promise<number> {
   const placements = secretPlacementsOf(config, placementWalk, { secretKeys, valueLength });
   for (const line of placements.report) activity(io, line);
   for (const warning of placements.warnings) activity(io, `warning: ${warning}`);
+  // The `token` Hooks' digests (ADR-0078): the sha-256 of each value, which the Orchestrator mounts
+  // in `jr2-hook-digests`. The value itself never leaves this host or the user's Secret.
+  const hookDigests: Record<string, string> = {};
+  for (const t of placements.hookTokens) {
+    const digest = "value" in t ? callerTokenDigest(t.value) : valueShas.get(`${t.secret}/${t.key}`);
+    if (digest !== undefined) hookDigests[t.name] = digest;
+  }
   const held = await resolveHeld(io, kube, {
     pods: placements.held,
     claimed: placements.claimed,
@@ -828,6 +915,17 @@ export async function up(args: string[], io: Io): Promise<number> {
       `provider: ${custom.baseUrl} configured, but no carried Agent names a "${custom.id}/…" model — skipped`,
     );
   }
+  // Each Agent's allowlist of each remote MCP server it names (ADR-0079): the check pods list the
+  // servers' tools, and each list is held to these.
+  const mcpUses: McpUse[] = workflows.flatMap((w) =>
+    partsOf([w.machine]).mcpAgents.flatMap((a) =>
+      a.mcp.flatMap((e) => {
+        const server = config.mcp?.[e.server];
+        if (server === undefined || isStdioServer(server)) return [];
+        return [{ workflow: w.name, slot: a.slot, server: e.server, tools: e.tools ?? "*" }];
+      }),
+    ),
+  );
   await preflightProviders(io, kube, {
     checkPods,
     skip: values["skip-provider-preflight"] === true,
@@ -843,6 +941,9 @@ export async function up(args: string[], io: Io): Promise<number> {
     trust: trustData(caPem, held.bundles),
     harnessEnvData,
     priorityClassName: priorityClassNames(config.priorityClasses).sandbox,
+    signingKey: Buffer.from(signingKey, "base64"),
+    ...(config.mcp ? { mcp: config.mcp } : {}),
+    mcpUses,
   });
 
   // --- operator (per-cluster, shared): after the provider preflight ------------------------------
@@ -929,10 +1030,14 @@ export async function up(args: string[], io: Io): Promise<number> {
   const instanceList = instanceObjects({
     name,
     namespace,
+    stateVolume: volumePlan.size,
     image: refs.orchestrator,
     secretData,
+    callerTokens: callerTokens.values,
+    hookDigests,
     harnessEnvData,
     harness: config.harness,
+    ...(config.mcp ? { mcp: config.mcp } : {}),
     held: held.objects,
     imageRefs: converged,
     repoCache: carried.composesSandbox ? { image: operatorImage!, placement: config.sandbox } : undefined,
@@ -943,6 +1048,20 @@ export async function up(args: string[], io: Io): Promise<number> {
   });
   activity(io, `orchestrator: applying (image ${refs.orchestrator})`);
   await kube.apply({ manifest: instanceList, warn: (line) => activity(io, line), ...ctx });
+  // After the apply, so the line names a value that exists. It works only when the Orchestrator has
+  // loaded its digest, which the publish below waits for (ADR-0078); `converged` says so.
+  for (const n of callerTokens.made) {
+    activity(
+      io,
+      `caller token "${n}": made — \`jr2 caller token ${n}\` prints it, and it works when \`jr2 up\` says converged`,
+    );
+  }
+  // A name that the config no longer declares loses its Secret, so its value stops working
+  // (ADR-0078). Its digest went with the digests Secret above.
+  for (const n of callerTokens.undeclared) {
+    await kube.deleteObject({ kind: "secret", name: callerTokenSecret(n), namespace, ...ctx });
+    activity(io, `caller token "${n}": deleted — callers.tokens no longer declares it`);
+  }
   // An entry whose clone Secret this converge did not write loses it: a dropped entry, a token
   // unset, or nothing left that clones.
   const cloneSecrets = new Set(gitClone.map((s) => s.name));
@@ -1015,14 +1134,17 @@ export async function up(args: string[], io: Io): Promise<number> {
   // over from a Machine that dropped its `workspace()` is deleted with its RBAC: the layer
   // converges toward the Machines like the Instance Harness does.
   if (carried.composesSandbox) {
+    // The agent is also the Landlock detector (ADR-0077): on a Sandbox node without Landlock it
+    // exits at start with the reason, and the converge refuses, naming each such node.
     activity(io, "repo cache: waiting for the cache agent on every Sandbox node");
-    await awaitRollout(kube, {
+    const cacheTarget: RolloutTarget = {
       kind: "daemonset",
       name: REPO_CACHE,
       namespace,
       selector: `app=${REPO_CACHE}`,
       ...ctx,
-    });
+    };
+    await awaitCacheAgent(kube, cacheTarget, () => awaitRollout(kube, cacheTarget));
     await verifyRunningImage(io, kube, {
       layer: "repo cache",
       namespace,
@@ -1078,7 +1200,15 @@ export async function up(args: string[], io: Io): Promise<number> {
         held: instance.manifest,
         custodian: instance.custodian,
         heldDigest: heldDigest(Buffer.from(signingKey, "base64"), held.objects, instance, valueDigest),
+        // Its control token and secret Stand-ins (ADR-0076, ADR-0059): minted here, as the pod's
+        // maker, from the kept key — so a re-run converges to the same values.
+        credentials: podCredentials(Buffer.from(signingKey, "base64"), {
+          placement: INSTANCE_HARNESS_SERVICE,
+          heldPod: INSTANCE_HARNESS_HELD_POD,
+          manifest: instance.manifest,
+        }),
         harness: config.harness,
+        ...(config.mcp ? { mcp: config.mcp } : {}),
         caBundle: caPem !== undefined,
         // The wire's gate (ADR-0058): the digest of the bearer the Orchestrator derives for this
         // placement from the kept key — the same shape it stamps onto every Sandbox at provision.
@@ -1112,21 +1242,25 @@ export async function up(args: string[], io: Io): Promise<number> {
     await kube.deleteObject({ kind: "persistentvolumeclaim", name: INSTANCE_HARNESS_PVC, namespace, ...ctx });
     await kube.deleteObject({ kind: "service", name: INSTANCE_HARNESS_SERVICE, namespace, ...ctx });
     await kube.deleteObject({ kind: "service", name: INSTANCE_HARNESS_PODS_SERVICE, namespace, ...ctx });
-    // Its Custodian's files go with the pod they were rendered for (ADR-0059).
+    // Its Custodian's files and its credentials go with the pod they were made for (ADR-0059,
+    // ADR-0076).
     await kube.deleteObject({ kind: "configmap", name: INSTANCE_CUSTODIAN_CONFIGMAP, namespace, ...ctx });
+    await kube.deleteObject({ kind: "secret", name: INSTANCE_HARNESS_CREDENTIALS, namespace, ...ctx });
   }
 
-  // --- Instance Effector (ADR-0068): converged when an Effect is placed there, absent otherwise ---
-  // The placement is read off the Machines: an `http` Effect runs there. Its objects carry only the
-  // secrets those Effects name, and the placement's key, derived from the kept signing key — the
-  // key the Orchestrator derives again to sign every call and verify every answer.
+  // --- Instance Effector (ADR-0068): converged when an Effect is placed there or a Hook needs it,
+  // absent otherwise ---
+  // The placement is read off the Machines and the Hooks: an `http` Effect runs there, a `mac`
+  // Hook's check and a Hook kind's follow-up too. Its objects carry only the secrets those name,
+  // and the placement's key, derived from the kept signing key — the key the Orchestrator derives
+  // again to sign every call and verify every answer.
   const effectorPlan = placements.instance;
   if (effectorPlan) {
     const names = effectorPlan.secrets.map((s) => `\`${s.name}\``).join(", ") || "none";
+    const serves = [...effectorPlan.effects, ...effectorPlan.hooks.map((h) => `hook ${h}`)].join(", ");
     activity(
       io,
-      `instance effector: converging (${effectorPlan.effects.join(", ")}; secrets ${names}; grace ` +
-        `${effectorGraceSeconds(effectorPlan)}s)`,
+      `instance effector: converging (${serves}; secrets ${names}; grace ${effectorGraceSeconds(effectorPlan)}s)`,
     );
     const signing = Buffer.from(signingKey, "base64");
     const key = effectorKey(signing, "instance");
@@ -1161,7 +1295,7 @@ export async function up(args: string[], io: Io): Promise<number> {
       ...ctx,
     });
   } else {
-    activity(io, "instance effector: none (no Effect is placed there)");
+    activity(io, "instance effector: none (no Effect is placed there, and no Hook needs it)");
     for (const kind of ["deployment", "service", "networkpolicy", "secret"]) {
       await kube.deleteObject({ kind, name: INSTANCE_EFFECTOR, namespace, ...ctx });
     }
@@ -1178,7 +1312,7 @@ export async function up(args: string[], io: Io): Promise<number> {
     assembly,
     token: publishToken,
     force: values.force === true,
-    mounts: mountedDigests(instanceList),
+    mounts: mountedDigests((JSON.parse(instanceList) as { items: KubeObject[] }).items),
   });
   if (!published) return 1;
 
@@ -1232,21 +1366,12 @@ function mapRefs(map: Partial<ConvergedImages>): string[] {
 }
 
 /** What `GET /assembly` answers (ADR-0069), read loosely: this is the CLI's view of the door.
- * `mounts` is the digest of each ConfigMap the process reads through a mount. */
-type AssemblyView = { current?: { hash?: string; kitVersion?: string } | null; mounts?: Record<string, string> };
-
-/** The digest of each mounted ConfigMap's data in the List this converge applied (ADR-0069), by
- * name: what the Orchestrator must read from its mounts before the publish. */
-function mountedDigests(list: string): Record<string, string> {
-  const items = (JSON.parse(list) as { items: Array<KubeObject & { data?: Record<string, string> }> }).items;
-  const out: Record<string, string> = {};
-  for (const item of items) {
-    if (item.kind === "ConfigMap" && item.metadata.name in MOUNTED_CONFIGMAPS) {
-      out[item.metadata.name] = configMapDigest(item.data ?? {});
-    }
-  }
-  return out;
-}
+ * `mounts` is the digest of each object the process reads through a mount (`MountsView`). */
+type AssemblyView = {
+  current?: { hash?: string; kitVersion?: string } | null;
+  mounts?: Record<string, string>;
+  standing?: StandingView[];
+};
 
 /**
  * The key of each `file:` Sandbox Image context (ADR-0037, ADR-0049, ADR-0069): the digest of its
@@ -1280,23 +1405,18 @@ type PublishBody = {
   error?: string;
   report?: string[];
   kitVersion?: unknown;
+  /** Each standing Workflow's state after the publish (ADR-0017). */
+  standing?: StandingView[];
 };
 
-/**
- * How long a publish waits for the Orchestrator to read the ConfigMaps this converge wrote
- * (ADR-0038, ADR-0069). `jr2-images` and `jr2-held` are mounts, and the kubelet refreshes a mount
- * on its own period (about a minute by default). A publish rolls no pod, so until the refresh the
- * door's checks and the next provision read the previous data. The publish waits until the digests
- * `GET /assembly` reports are the ones this converge applied. Exported so a test can shorten it.
- */
-export const MAP_PROPAGATION = { budgetMs: 150_000, stepMs: 5_000 };
-
 /**
  * Publish the staged Assembly to the running Orchestrator (ADR-0069), over a port-forward of its
  * Service, as `resolveTarget` reaches it. `GET /assembly` first: when the current Assembly is this
  * one, at this Kit version, nothing is sent, so a steady-state converge publishes nothing. Then
  * `PUT /assembly` with the publish token from the Instance Secret — never from the environment.
- * Before the PUT, it waits until the Orchestrator reads the mounted ConfigMaps this converge wrote.
+ * Before the PUT, it waits until the Orchestrator reads the mounted ConfigMaps and the digests
+ * Secrets this converge wrote (`awaitMounts`). When nothing is sent, it still waits for the digests
+ * Secrets, so that `converged` means a Caller token or Hook secret that this converge wrote works.
  * `--force` sends the PUT even when the hashes agree; the door answers `unchanged` and replaces
  * nothing, because the hash names the bytes it already holds.
  *
@@ -1311,7 +1431,7 @@ async function publishAssembly(
     assembly: { hash: string; kitVersion: string; workflows: string[]; tar: Buffer };
     token: string;
     force: boolean;
-    /** The digest of each mounted ConfigMap this converge applied, by name. */
+    /** The digest of each mounted object this converge applied, by name (`mountedDigests`). */
     mounts: Record<string, string>;
   },
 ): Promise<boolean> {
@@ -1330,34 +1450,32 @@ async function publishAssembly(
       if (!seen.ok) throw new Error(`the Orchestrator answered GET /assembly with HTTP ${seen.status}`);
       return (await seen.json()) as AssemblyView;
     };
-    let seen = await view();
-    const current = seen.current ?? null;
-    if (!force && current?.hash === assembly.hash && current.kitVersion === assembly.kitVersion) {
+    const first = await view();
+    const current = first.current ?? null;
+    const skip = !force && current?.hash === assembly.hash && current.kitVersion === assembly.kitVersion;
+    // The mounts first (ADR-0069): the door checks a `file:` digest against `jr2-images`, and a
+    // provision after the converge reads `jr2-held`. With no publish, only the digests Secrets
+    // (ADR-0078): a token that this converge wrote works only when the Orchestrator holds its digest.
+    const waited = await awaitMounts(io, {
+      seen: first,
+      view,
+      want: skip ? digestSecretsOf(opts.mounts) : opts.mounts,
+      prefix: "assembly",
+    });
+    if (waited.stale.length) {
+      const tokens = Object.keys(digestSecretsOf(opts.mounts)).some((n) => waited.stale.includes(n));
+      const consequence = [
+        ...(skip ? [] : ["nothing was published, and the previous Assembly is still current"]),
+        ...(tokens ? ["a Caller token or Hook secret that this converge wrote does not work yet"] : []),
+      ];
+      activity(io, `refusing: ${staleLine(waited.stale)}; ${consequence.join("; ")}. Run \`jr2 up\` again`);
+      return false;
+    }
+    if (skip) {
       activity(io, `assembly: ${assembly.hash} (current — publish skipped)`);
+      for (const s of Array.isArray(waited.seen.standing) ? waited.seen.standing : []) activity(io, standingLine(s));
       return true;
     }
-    // The mounts first (ADR-0069): the door checks a `file:` digest against `jr2-images`, and a
-    // provision after the converge reads `jr2-held`. A process that reports no mounts is not
-    // deployed, and has nothing to wait for.
-    const stale = (v: AssemblyView): string[] =>
-      v.mounts ? Object.keys(opts.mounts).filter((name) => v.mounts![name] !== opts.mounts[name]) : [];
-    const deadline = Date.now() + MAP_PROPAGATION.budgetMs;
-    let said = false;
-    for (let names = stale(seen); names.length; names = stale(seen)) {
-      if (Date.now() >= deadline) {
-        activity(
-          io,
-          `refusing: after ${Math.round(MAP_PROPAGATION.budgetMs / 1000)}s the Orchestrator still reads an older ` +
-            `${names.join(", ")} from its mount — the kubelet has not refreshed it; nothing was published, and ` +
-            `the previous Assembly is still current. Run \`jr2 up\` again`,
-        );
-        return false;
-      }
-      if (!said) activity(io, `assembly: waiting for the kubelet to deliver ${names.join(", ")} to the Orchestrator`);
-      said = true;
-      await new Promise((ok) => setTimeout(ok, MAP_PROPAGATION.stepMs));
-      seen = await view();
-    }
     activity(
       io,
       `assembly: publishing ${assembly.hash} (${current?.hash ? `current is ${current.hash}` : "no current Assembly"})` +
@@ -1381,6 +1499,8 @@ async function publishAssembly(
         `assembly: ${body.hash ?? assembly.hash} is current${body.unchanged ? " (unchanged)" : ""} — ` +
           `workflows: ${names.join(", ") || "(none)"}`,
       );
+      // Each standing Workflow's state after the publish (ADR-0017), from the publish's answer.
+      for (const st of Array.isArray(body.standing) ? body.standing : []) activity(io, standingLine(st));
       return true;
     }
     const report = body.report ?? [];
@@ -1480,6 +1600,8 @@ async function resolveHeld(
     models: opts.models,
   });
   for (const warning of warnings) activity(io, `warning: ${warning}`);
+  const r14 = envFromHeldRefusal(config, manifest, opts.envFromKeys);
+  if (r14) throw new Error(r14);
   // Each pod's own: the bindings of the names it holds and their literal values. Its Custodian's
   // files are rendered by whoever makes the pod — here for the Instance Harness alone; the
   // Orchestrator at provision for a Sandbox, from the same manifest (ADR-0059).
@@ -1496,7 +1618,7 @@ async function resolveHeld(
   const orchestrator = { host: `${ORCHESTRATOR_SERVICE}.${namespace}.svc`, port: ORCHESTRATOR_PORT };
   const instance: CustodianFiles | undefined = instancePod && {
     bootstrap: JSON.stringify(custodianBootstrap(instancePod.manifest, orchestrator)),
-    script: custodianScript(instancePod.manifest),
+    script: custodianScript(instancePod.manifest, { fetch: false }),
   };
   if (manifest.secrets.length === 0) return { objects: { pods, ...(instance && { instance }), leaves: {} } };
   for (const s of manifest.secrets) {
@@ -1531,6 +1653,36 @@ async function resolveHeld(
   };
 }
 
+/**
+ * R14 (ADR-0059): a held secret's name that is also a key of a Secret `harness.envFrom` loads. The
+ * Stand-ins are files, not env (ADR-0076), so no Stand-in hides that key: the Secret's real value
+ * would reach the Harness container's env under the held secret's own name, and the Harness uses a
+ * held secret but never holds it. The key is compared as the kubelet writes it, `prefix` first.
+ * The message names the Secret, the key and the held secret, and never a value. Exported for its
+ * test.
+ */
+export function envFromHeldRefusal(
+  config: JR2Config,
+  manifest: HeldManifest,
+  envFromKeys: ReadonlyMap<string, readonly string[]>,
+): string | undefined {
+  const held = new Set(manifest.secrets.map((s) => s.name));
+  for (const [i, ref] of (config.harness?.envFrom ?? []).entries()) {
+    const secret = ref.secretRef?.name;
+    if (secret === undefined) continue;
+    for (const key of envFromKeys.get(`secret/${secret}`) ?? []) {
+      const name = (ref.prefix ?? "") + key;
+      if (!held.has(name)) continue;
+      return (
+        `harness.envFrom[${i}] loads Secret "${secret}", whose key "${key}" is the env var ${name} — and ${name} is ` +
+        `a held secret. Its Stand-in is a file, so nothing hides that key, and its value would reach the ` +
+        `Harness's env. Drop the key from Secret "${secret}", or rename the held secret (ADR-0059, R14)`
+      );
+    }
+  }
+  return undefined;
+}
+
 /** The Instance Harness's held objects and its Custodian's files — the walk always places it when
  * it converges. */
 function instanceHeld(held: HeldObjects): HeldPodObjects & { custodian: CustodianFiles } {
@@ -2297,11 +2449,29 @@ export type CheckPod = {
   /** The bindings of the checked keys: each a part of a held pod's manifest. */
   manifest: HeldManifest;
   providers: CheckedProvider[];
+  /** The remote MCP servers that an Agent of this class names, by name, sorted (ADR-0079): the
+   * check lists each one's tools through the Custodian, with the Stand-in of its secret. */
+  mcp: CheckedMcpServer[];
 };
 
-/** One Harness pod as the walk places it: its held pod key, its class, the models it runs, and
- * the bindings it holds (none: its HTTPS goes direct, with no proxy). */
-type Seat = { pod: string; sandbox: boolean; models: readonly string[]; held: HeldManifest["secrets"] };
+/** One remote MCP server a check pod lists (ADR-0079). */
+export type CheckedMcpServer = {
+  server: string;
+  url: string;
+  /** Its secret, which the check pod holds as a pod of the class holds it; absent: no credential. */
+  secret?: string;
+};
+
+/** One Harness pod as the walk places it: its held pod key, its class, the models it runs, the
+ * MCP servers its Agents name, and the bindings it holds (none: its HTTPS goes direct, with no
+ * proxy). */
+type Seat = {
+  pod: string;
+  sandbox: boolean;
+  models: readonly string[];
+  servers: readonly string[];
+  held: HeldManifest["secrets"];
+};
 
 /**
  * Which providers the preflight checks, and in which pod (ADR-0019, ADR-0059). Every carried model
@@ -2323,7 +2493,8 @@ export function checkPodsOf(config: JR2Config, walk: PlacementWalk, pods: readon
   const seats: Seat[] = [
     ...walk.workspaces.map((ws) => {
       const pod = workspaceHeldPod({ workflow: ws.workflow, route: ws.pod.route });
-      return { pod, sandbox: true, models: ws.pod.models, held: heldOf(pod) };
+      const servers = (ws.pod.mcp ?? []).map((m) => m.entry.server);
+      return { pod, sandbox: true, models: ws.pod.models, servers, held: heldOf(pod) };
     }),
     ...(walk.instanceHarness
       ? [
@@ -2331,6 +2502,7 @@ export function checkPodsOf(config: JR2Config, walk: PlacementWalk, pods: readon
             pod: INSTANCE_HARNESS_HELD_POD,
             sandbox: false,
             models: walk.instanceHarness.models,
+            servers: walk.instanceHarness.servers ?? [],
             held: heldOf(INSTANCE_HARNESS_HELD_POD),
           },
         ]
@@ -2370,6 +2542,7 @@ export function checkPodsOf(config: JR2Config, walk: PlacementWalk, pods: readon
       // Stand-ins) is that of a pod of the class; the keys the class's other pods hold join it below.
       manifest: { version: 1, secrets: [...group.seats[0]!.held] },
       providers: [],
+      mcp: [],
     };
     for (const model of models) {
       const slash = model.indexOf("/");
@@ -2408,7 +2581,23 @@ export function checkPodsOf(config: JR2Config, walk: PlacementWalk, pods: readon
         ...(gateway ? { gateway } : {}),
       });
     }
-    if (checkPod.providers.length) checkPods.push(checkPod);
+    // Each remote MCP server that an Agent of the class names (ADR-0079), with its secret's binding
+    // from a pod of the class that holds it: the check reads the list as a Turn there reads it. A
+    // stdio server is Workspace code, and the check pod runs none.
+    const servers = [...new Set(group.seats.flatMap((s) => s.servers))].sort();
+    for (const name of servers) {
+      const declared = config.mcp?.[name];
+      if (declared === undefined || isStdioServer(declared)) continue;
+      const secret = declared.secret;
+      if (secret !== undefined) {
+        const binding = group.seats.map((s) => s.held.find((b) => b.name === secret)).find((b) => b !== undefined);
+        if (binding && !checkPod.manifest.secrets.some((h) => h.name === secret)) {
+          checkPod.manifest.secrets.push(binding);
+        }
+      }
+      checkPod.mcp.push({ server: name, url: declared.url, ...(secret !== undefined ? { secret } : {}) });
+    }
+    if (checkPod.providers.length || checkPod.mcp.length) checkPods.push(checkPod);
   }
   return checkPods;
 }
@@ -2422,6 +2611,9 @@ const CHECK_START_SECONDS = 300;
  * `@jr2/harness`'s `preflight-line.ts`, which a test holds this to), so one slow model never uses
  * the time of the others. Exported for that test. */
 export const CHECK_MODEL_SECONDS = 360;
+/** Each MCP server's bound in the pod: its own budget in the check (`PREFLIGHT_MCP_BUDGET_SECONDS`
+ * in `preflight-line.ts`, which a test holds this to). Exported for that test. */
+export const CHECK_MCP_SECONDS = 60;
 const CHECK_RUN_MARGIN_SECONDS = 30;
 /** A leftover a run left with no pod, older than this, is a dead run's, not a live one's. */
 const CHECK_LEFTOVER_SECONDS = 3600;
@@ -2460,6 +2652,12 @@ async function preflightProviders(
     trust: Record<string, string>;
     harnessEnvData: Record<string, string>;
     priorityClassName: string;
+    /** The signing key, for each check pod's own Stand-ins (ADR-0019, ADR-0059). */
+    signingKey: Buffer;
+    /** The config's `mcp` block, for the check pod's harness config (ADR-0079). */
+    mcp?: JR2Config["mcp"];
+    /** Each Agent's allowlist of each remote server it names: what each listing is held to. */
+    mcpUses: readonly McpUse[];
   },
 ): Promise<void> {
   const { namespace, ctx } = opts;
@@ -2469,10 +2667,12 @@ async function preflightProviders(
     // Never silent: a converge that checked nothing must not read as one that checked. A model that
     // two check pods would check is named once.
     const models = [...new Set(opts.checkPods.flatMap((p) => p.providers.flatMap((v) => v.models)))];
+    const servers = [...new Set(opts.checkPods.flatMap((p) => p.mcp.map((m) => m.server)))].sort();
     activity(
       io,
       "warning: provider: preflight skipped (--skip-provider-preflight) — " +
-        (models.length ? `these models were not checked: ${models.join(", ")}` : "no model was checked"),
+        (models.length ? `these models were not checked: ${models.join(", ")}` : "no model was checked") +
+        (servers.length ? `; these MCP servers' tool lists were not checked: ${servers.join(", ")}` : ""),
     );
     return;
   }
@@ -2480,9 +2680,12 @@ async function preflightProviders(
   const run = randomBytes(4).toString("hex");
   const orchestrator = { host: `${ORCHESTRATOR_SERVICE}.${namespace}.svc`, port: ORCHESTRATOR_PORT };
   const faults: string[] = [];
+  /** An MCP result already said: two check pods can list one server, and say it once. */
+  const saidMcp = new Set<string>();
   for (const [n, checkPod] of opts.checkPods.entries()) {
     const object = `${PROVIDER_PREFLIGHT}-${run}-${n}`;
     const models = checkPod.providers.flatMap((p) => p.models);
+    const servers = checkPod.mcp.map((m) => m.server);
     /** The models whose result is already said, while the pod ran, and what it was: a final log
      * read that comes back empty must not turn a result already said into "not checked". */
     const said = new Set<string>();
@@ -2501,12 +2704,27 @@ async function preflightProviders(
           : `with no held key (${why}), direct, as a pod that holds no secret calls it`;
       activity(io, `provider: checking ${p.models.join(", ")} on ${checkPod.where}, ${holds}`);
     }
+    for (const m of checkPod.mcp) {
+      const holds = m.secret
+        ? `through a Custodian that holds ${m.secret}, with its Stand-in`
+        : checkPod.manifest.secrets.length && m.url.startsWith("https:")
+          ? "with no credential, through the Custodian's tunnel"
+          : "with no credential, direct";
+      activity(io, `mcp: listing the tools of "${m.server}" at ${m.url} on ${checkPod.where}, ${holds}`);
+    }
     activity(
       io,
       `provider: the check pod has up to ${CHECK_START_SECONDS / 60} min to start, then up to ` +
-        `${CHECK_MODEL_SECONDS / 60} min for ${models.length === 1 ? "its model" : `each of its ${models.length} models`}`,
+        (models.length
+          ? `${CHECK_MODEL_SECONDS / 60} min for ${models.length === 1 ? "its model" : `each of its ${models.length} models`}`
+          : "") +
+        (models.length && servers.length ? " and " : "") +
+        (servers.length
+          ? `${CHECK_MCP_SECONDS / 60} min for ${servers.length === 1 ? "its MCP server" : `each of its ${servers.length} MCP servers`}`
+          : ""),
     );
-    const runSeconds = CHECK_MODEL_SECONDS * models.length + CHECK_RUN_MARGIN_SECONDS;
+    const runSeconds =
+      CHECK_MODEL_SECONDS * models.length + CHECK_MCP_SECONDS * servers.length + CHECK_RUN_MARGIN_SECONDS;
     // Built before the apply: a fault in jr2 here is jr2's, never the cluster's refusal.
     const manifest = checkPodObjects({
       name: opts.name,
@@ -2521,11 +2739,20 @@ async function preflightProviders(
       trust: opts.trust,
       custodian: {
         bootstrap: JSON.stringify(custodianBootstrap(checkPod.manifest, orchestrator)),
-        script: custodianScript(checkPod.manifest),
+        script: custodianScript(checkPod.manifest, { fetch: false }),
       },
-      token: randomBytes(24).toString("hex"),
+      // Its own credentials (ADR-0019, ADR-0076): a control token the Orchestrator never signed,
+      // and secret Stand-ins minted for this pod alone.
+      credentials: podCredentials(opts.signingKey, {
+        placement: object,
+        heldPod: object,
+        manifest: checkPod.manifest,
+        controlToken: "unsigned",
+      }),
       harnessEnvData: opts.harnessEnvData,
       models,
+      servers,
+      ...(opts.mcp ? { mcp: opts.mcp } : {}),
       ...(checkPod.placement ? { placement: checkPod.placement } : {}),
       priorityClassName: opts.priorityClassName,
       ...(opts.harness ? { harness: opts.harness } : {}),
@@ -2587,10 +2814,140 @@ async function preflightProviders(
         faults.push(providerFault(p, model, checkPod.where, why, checkPod.manifest.secrets.length > 0));
       }
     }
+    const listings = mcpCheckVerdicts(output);
+    const startedMcp = mcpCheckStarts(output);
+    for (const m of checkPod.mcp) {
+      const verdict = listings.get(m.server);
+      const lines = verdict
+        ? mcpVerdictLines(m, verdict, opts.mcpUses, checkPod.where)
+        : {
+            faults: [
+              `mcp: "${m.server}" at ${m.url} was not checked on ${checkPod.where}: ` +
+                (refused ??
+                  (startedMcp.has(m.server)
+                    ? `the check pod stopped while it listed this server: ${podFault(end!, checkPod, opts)}`
+                    : `the check pod stopped before it reached this server: ${podFault(end!, checkPod, opts)}`)),
+            ],
+            said: [],
+          };
+      for (const line of lines.said) {
+        if (saidMcp.has(line)) continue;
+        saidMcp.add(line);
+        activity(io, line);
+      }
+      for (const fault of lines.faults) if (!faults.includes(fault)) faults.push(fault);
+    }
   }
   if (faults.length) throw new Error(faults.join("\n"));
 }
 
+/** One Agent's use of one remote MCP server, as the walk read it: the allowlist, or `"*"`. */
+export type McpUse = { workflow: string; slot: string; server: string; tools: readonly string[] | "*" };
+
+/** One MCP server's result line (`preflight-line.ts` in `@jr2/harness`). */
+type McpCheckVerdict = { kind: "listed"; tools: string[] } | { kind: "refused" | "warn" | "fault"; reason: string };
+
+/** The servers whose listing began (`start` lines). */
+export function mcpCheckStarts(output: string): Set<string> {
+  const started = new Set<string>();
+  for (const line of output.split("\n")) {
+    const m = /^jr2\.preflight mcp=(\S+) start$/.exec(line.trim());
+    if (m) started.add(m[1]!);
+  }
+  return started;
+}
+
+/** Each MCP server's verdict, off the check container's output lines (`preflight-line.ts` in
+ * `@jr2/harness`, held to this parser by a test). A list that is not JSON is the check's fault. */
+export function mcpCheckVerdicts(output: string): Map<string, McpCheckVerdict> {
+  const verdicts = new Map<string, McpCheckVerdict>();
+  for (const line of output.split("\n")) {
+    const m = /^jr2\.preflight mcp=(\S+) (listed|refused|warn|fault)=(.*)$/.exec(line.trim());
+    if (!m) continue;
+    if (m[2] !== "listed") {
+      verdicts.set(m[1]!, { kind: m[2] as "refused" | "warn" | "fault", reason: m[3]! });
+      continue;
+    }
+    let tools: unknown;
+    try {
+      tools = JSON.parse(m[3]!);
+    } catch {
+      tools = undefined;
+    }
+    verdicts.set(
+      m[1]!,
+      Array.isArray(tools) && tools.every((t) => typeof t === "string")
+        ? { kind: "listed", tools: tools as string[] }
+        : { kind: "fault", reason: `the check wrote a tool list that is not a JSON list of names — a jr2 defect` },
+    );
+  }
+  return verdicts;
+}
+
+/**
+ * What one MCP server's listing comes to (ADR-0079): the lines said, and the faults. An allowlisted
+ * name that the list does not have is refused, with what the server has; a server that refused the
+ * request (401, 403) fails the converge, as a model key that the provider refuses does; a server
+ * that did not answer is a warning. Pure, for its test.
+ */
+export function mcpVerdictLines(
+  m: CheckedMcpServer,
+  verdict: McpCheckVerdict,
+  uses: readonly McpUse[],
+  where: string,
+): { said: string[]; faults: string[] } {
+  if (verdict.kind === "warn") {
+    return {
+      said: [
+        `warning: mcp: "${m.server}" at ${m.url} did not answer from a pod on ${where} (${verdict.reason}) — its ` +
+          "tool names are not checked; a Turn of an Agent that names it fails if it does not answer then (ADR-0079)",
+      ],
+      faults: [],
+    };
+  }
+  if (verdict.kind === "fault") {
+    return { said: [], faults: [`mcp: "${m.server}" was not checked on ${where}: ${verdict.reason}`] };
+  }
+  if (verdict.kind === "refused") {
+    return {
+      said: [],
+      faults: [
+        `mcp: "${m.server}" at ${m.url} refused the request from a pod on ${where} (HTTP ${verdict.reason}) — ` +
+          (m.secret
+            ? `a wrong or expired value of ${m.secret}, or a binding of it (hosts, headers, paths) that does not let ` +
+              "its Stand-in through to the url"
+            : "the server needs a credential: give the server a `secret`") +
+          "; every call of an Agent that names it would fail (ADR-0079)",
+      ],
+    };
+  }
+  if (verdict.kind !== "listed") return { said: [], faults: [] };
+  const listed = verdict.tools;
+  const missing = new Map<string, string[]>();
+  for (const use of uses) {
+    if (use.server !== m.server || use.tools === "*") continue;
+    for (const tool of use.tools) {
+      if (listed.includes(tool)) continue;
+      const by = `workflow "${use.workflow}": Agent "${use.slot}"`;
+      missing.set(tool, [...new Set([...(missing.get(tool) ?? []), by])]);
+    }
+  }
+  if (missing.size === 0) {
+    return {
+      said: [`mcp: "${m.server}" lists ${listed.length} tool(s); every allowlisted name is there`],
+      faults: [],
+    };
+  }
+  const has = listed.length ? listed.join(", ") : "no tool";
+  return {
+    said: [],
+    faults: [...missing].map(
+      ([tool, by]) =>
+        `mcp: ${by.join(", ")} allowlists the tool "${tool}", which "${m.server}" does not list — it lists: ${has} (ADR-0079)`,
+    ),
+  };
+}
+
 /** How long the first apply in a new namespace waits for its `default` ServiceAccount: the
  * controller makes it a moment after the namespace, and until then a pod is refused. */
 const FIRST_CONTACT_TRIES = 10;
@@ -2666,7 +3023,7 @@ async function removeCheckLeftovers(
       if (!(since(finished ?? p.metadata.creationTimestamp) > CHECK_ENDED_MARGIN_SECONDS)) continue;
       await removeCheckPod(io, kube, p.metadata.name, namespace, ctx);
     }
-    for (const kind of ["configmap", "secret"]) {
+    for (const kind of ["configmap", "secret", "networkpolicy"]) {
       for (const o of await kube.listJson<CheckObject>({ kind, selector, namespace, ...ctx })) {
         const owner = o.metadata.name.replace(/-(ca|tls|env)$/, "");
         if (named.has(owner) || !(since(o.metadata.creationTimestamp) > CHECK_LEFTOVER_SECONDS)) continue;
@@ -2799,7 +3156,7 @@ export function podFault(
     return `the check pod ended ${end.phase}${said}, and jr2 up could not read its log — run \`jr2 up\` again`;
   }
   const tail = end.output.trim().split("\n").filter(Boolean).slice(-5).join("; ");
-  return `the check pod ended ${end.phase} before it checked this model${said} — it said: ${tail}`;
+  return `the check pod ended ${end.phase} before it checked this one${said} — it said: ${tail}`;
 }
 
 /** One model's preflight failure: the model, the host, and the likely causes. */