@jr2/orchestrator 0.1.4 → 0.2.1

package/src/stub-harness.ts

@@ -6,7 +6,8 @@
 // silent real Harness, and e2e drives it by playing the agent against `/mcp/<iid>` instead.
 //
 // Wire (ADR-0027 — the normative model of the five endpoints; `@jr2/harness` serves it for real):
-//   POST /agents/:name/:id  {message, definition, model?, thinkingLevel?} → 200 { streamUrl, offset, submissionId }
+//   POST /agents/:name/:id  {message, cwd?, definition, model?, thinkingLevel?} → 200 { streamUrl, offset, submissionId }
+//     (`message` and `cwd` are the Turn's Frame — what it is about and where it works, ADR-0057)
 //   GET  /agents/:name/:id?offset=…[&view=updates] → 200 `[]` + Stream-Next-Offset/Up-To-Date
 //   GET  /agents/:name/:id?…&live=long-poll        → parked; 204 + same headers on timeout
 //   POST /agents/:name/:id/abort                   → 200 { aborted }
@@ -32,15 +33,19 @@
 import { createServer } from "node:http";
 import type { AddressInfo, Socket } from "node:net";
 
-/** One admission of an Agent: which slot, which durable exchange, the prompt, the DEFINITION the
- * Machine's slot carried here (ADR-0049), and this Submission's dials (ADR-0018) — captured so a
- * mechanics-tier test can assert which Agent a state ran and at what settings, exactly as it
- * asserts the prompt. The stub is inert and never READS the definition: a real Harness runs it,
- * this one only proves it rode the wire. */
+/** One admission of an Agent: which slot, which durable exchange, this Turn's FRAME (the prompt
+ * and where it works — ADR-0057), the DEFINITION the Machine's slot carried here (ADR-0049), and
+ * this Submission's dials (ADR-0018) — captured so a mechanics-tier test can assert which Agent a
+ * state ran, at what settings and in which directory, exactly as it asserts the prompt. The stub
+ * is inert and never READS any of it: a real Harness runs the Turn, this one only proves each
+ * piece rode the wire. */
 export type Admission = {
   agentName: string;
   instanceId: string;
   message?: string;
+  /** Where the Working tools would be rooted (ADR-0057). Absent when the Turn carried no `cwd`,
+   * which is the workspace-less run a real Harness answers with `/work`. */
+  cwd?: string;
   definition?: Record<string, unknown>;
   model?: string;
   thinkingLevel?: string;
@@ -122,12 +127,21 @@ export async function startStubHarness(opts: StubHarnessOptions = {}): Promise<R
       req.on("data", (chunk: Buffer) => (body += chunk));
       req.on("end", () => {
         const sent = safeParse(body) as
-          | { message?: string; definition?: Record<string, unknown>; model?: string; thinkingLevel?: string }
+          | {
+              message?: string;
+              cwd?: string;
+              definition?: Record<string, unknown>;
+              model?: string;
+              thinkingLevel?: string;
+            }
           | undefined;
         const admission: Admission = {
           agentName: decodeURIComponent(agentName),
           instanceId: decodeURIComponent(instanceId),
           message: sent?.message,
+          // Recorded only when the Frame carried one, so an admission without a `cwd` reads as
+          // the absence it is rather than a directory the state never named (ADR-0057).
+          ...(sent?.cwd === undefined ? {} : { cwd: sent.cwd }),
           ...(sent?.definition ? { definition: sent.definition } : {}),
           ...(sent?.model ? { model: sent.model } : {}),
           ...(sent?.thinkingLevel ? { thinkingLevel: sent.thinkingLevel } : {}),

package/src/tokens.ts

@@ -21,13 +21,20 @@
 //                   Harness's Adapter bears one signed for that placement's Service name
 //                   (ADR-0031), scoping it to the Menu-only registrations placed there.
 //
+// And one bearer the other way (ADR-0058), which is no principal here because this server never
+// checks it:
+//
+//   Harness bearer  what the Orchestrator presents to the Harness in one pod — admit, stream,
+//                   abort, echo. Derived per placement (`harnessToken`); the Harness holds only
+//                   its sha-256 (`harnessTokenDigest`), so it verifies and mints nothing.
+//
 // The Sandbox token is a SIGNED NAME, not a random string in a table: `<sandbox>.<hmac(key, name)>`,
 // verified by recomputing. Three things fall out that a token table would have to work for — the
 // Orchestrator holds no per-Sandbox state, `provision` stays idempotent (re-minting yields the same
 // token, so a re-applied Secret is a no-op), and a token minted before a restart still verifies
 // after one, which is exactly what ADR-0012's re-attach promises the still-running Adapter.
 
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
@@ -46,6 +53,29 @@ export function sandboxToken(key: Buffer, sandbox: string): string {
   return `${sandbox}.${sign(key, sandbox)}`;
 }
 
+/**
+ * The Harness bearer for one placement (ADR-0058): what the Orchestrator presents on every Harness
+ * wire call — admit, stream, abort, echo — to the Harness in the pod `placement` names (a
+ * Sandbox, or `jr2-instance-harness`). The same signed-name idea as the Sandbox token, turned the
+ * other way: here the Orchestrator is the CALLER. Deterministic for the same reason — a restarted
+ * Orchestrator re-derives the bearer a live Harness already checks against.
+ *
+ * Domain-separated from `sandboxToken` by the `harness:` prefix, which no DNS-label name can
+ * produce, so no Sandbox token ever doubles as a Harness bearer or the reverse.
+ */
+export function harnessToken(key: Buffer, placement: string): string {
+  return sign(key, `harness:${placement}`);
+}
+
+/**
+ * What the Harness in `placement` holds to CHECK its bearer: the sha-256 of it, never the bearer
+ * (ADR-0058). The Agent executes code in that container, and a digest inverts to nothing — so the
+ * Harness can verify its own bearer and can mint none, for itself or for any other pod.
+ */
+export function harnessTokenDigest(key: Buffer, placement: string): string {
+  return createHash("sha256").update(harnessToken(key, placement)).digest("base64url");
+}
+
 /** Mint the per-boot Instance token (opaque and random — it names nothing, it just IS the trust). */
 export function mintInstanceToken(): string {
   return randomBytes(32).toString("base64url");

package/src/vocabulary.ts

@@ -82,7 +82,8 @@ export function inputSchemaOf(machine: AnyStateMachine): z.ZodObject | undefined
 /**
  * What the HOST adds to the input of the machine a run STARTS with, beside the door
  * (`RunHost.start`). One field today: the run's seed Instance ID, minted with the run and
- * reported by `jr2 status`, so an external caller can address the run's first conversation.
+ * reported by `jr2 status`. It names the RUN, never a conversation — jr2 mints every Agent
+ * Instance ID in the input mapper (ADR-0016, ADR-0057), and a Machine cannot pass one in.
  *
  * It is deliberately NOT door material (ADR-0033): no caller sends it — `start` overwrites
  * whatever arrived, after the parse — and it is never served as JSON Schema, so putting it in a

package/src/workspace.ts

@@ -688,7 +688,7 @@ function buildWorkspaceMachine(body: AnyStateMachine, spec: (args: { input: any
     const wrapperRef = self._parent;
     if (!wrapperRef) return;
     const disposeHandles = registerAmbientHandles(wrapperRef, input.handles);
-    const detachEcho = runBindingOf(system as AnyActorSystem).echo?.(input.handles.endpoint);
+    const detachEcho = runBindingOf(system as AnyActorSystem).echo?.(input.handles.endpoint, input.handles.sandbox);
     return () => {
       detachEcho?.();
       disposeHandles();