@jr2/orchestrator 0.2.0 → 0.3.0

package/src/sandbox-kubectl.ts

@@ -40,21 +40,22 @@
 //   initContainer preflight   the USER'S image + that volume → ADR-0037's probe, the thing that
 //                             proves a registry ref, whose first appearance is this provision
 //   container     harness     the Sandbox Image, command overridden, /work + /opt/jr2 mounted
-//   container     adapter     jr2-owned, the pod's only credential holder (below)
+//   container     custodian   jr2-composed, the pod's only credential holder (below)
 //   container     user        optional, the image's own entrypoint, the checkouts (/work, plus
 //                             /repos and /opt/jr2 read-only) and NOTHING else
 //
-// This is also where the ADAPTER is injected (ADR-0013). The operator needs no change to carry it:
-// ADR-0001 made `Sidecars` generic container fragments it schedules WITHOUT understanding, so the
-// Adapter is exactly that — a container with an image, an env, and a Secret. What this module
-// builds is the pod's asymmetry:
+// This is also where the CUSTODIAN is composed (ADR-0013, ADR-0059). The operator needs no change
+// to carry it: ADR-0001 made `Sidecars` generic container fragments it schedules WITHOUT
+// understanding, so the Custodian is exactly that — a container with an image, its mounts, and a
+// readiness probe the pod's Ready waits on. What this module builds is the pod's asymmetry:
 //
-//   harness container   JR2_ADAPTER_URL=http://127.0.0.1:8081     (an address, no credential)
-//   adapter container   JR2_ORCHESTRATOR_URL + JR2_SANDBOX_TOKEN   (the credential, via envFrom)
+//   harness container     JR2_CUSTODIAN_URL + the Stand-in of every credential  (no credential)
+//   custodian container   the Sandbox token and every held secret, as files     (the credentials)
 //
 // The Agent has code execution in the first and none in the second. The token is minted here — a
 // signed Sandbox name (see tokens.ts), so re-provisioning after a restart yields the SAME token and
-// the Secret re-applies as a no-op.
+// the Secret re-applies as a no-op. What else the Custodian holds is `jr2 up`'s resolution, read
+// per provision from the `jr2-held` mount (custodian.ts builds both placements' pods alike).
 
 import { execFile } from "node:child_process";
 import { join } from "node:path";
@@ -65,19 +66,18 @@ import {
   type HarnessEnvVar,
   type SandboxPlacement,
 } from "./config.ts";
+import { custodianComposition, type CustodianComposition } from "./custodian.ts";
+import { readHeldManifest } from "./held-secrets.ts";
 import { readImageRefs, resolveSandboxImage, resolveUserImage, type ImageRefs } from "./images.ts";
-import { CA_CONFIGMAP, IMAGES_KEY, IMAGES_MOUNT, REPOS_MOUNT } from "./names.ts";
+import { HELD_KEY, HELD_MOUNT, IMAGES_KEY, IMAGES_MOUNT, REPOS_MOUNT } from "./names.ts";
 import { repoIdentity } from "./repo-identity.ts";
 import type { RepoResources } from "./repos.ts";
-import { sandboxToken } from "./tokens.ts";
+import { harnessTokenDigest, sandboxToken } from "./tokens.ts";
 import type { ProvisionedRepo, SandboxPort, WorkspaceSpec } from "./workspace.ts";
 
 /** Run one kubectl invocation to completion. `input` is piped to stdin (`apply -f -`). */
 export type KubectlExec = (args: string[], opts?: { input?: string }) => Promise<{ stdout: string; stderr: string }>;
 
-/** Where the Harness container sees the instance's CA bundle (ADR-0020). */
-const CA_MOUNT = "/etc/jr2/ca";
-
 /** Where jr2's runtime lands in every container that gets it (ADR-0037). `/opt/jr2` and not `/app`
  * because a stranger's base may already use `/app`, and one layout must serve both the stock
  * Harness image and an arbitrary Sandbox Image. It is a PUBLISHED surface: `bin/` beside `lib/`
@@ -97,10 +97,6 @@ const HARNESS_COMMAND = [`${RUNTIME_MOUNT}/bin/node`, `${RUNTIME_MOUNT}/src/main
  * checkouts must hold this volume — which is why the User Container mounts it (ADR-0005). */
 const UPLOAD_PACK = `${RUNTIME_MOUNT}/bin/jr2-upload-pack`;
 
-/** The Adapter's port on the pod's loopback. The program defaults to this address too, so the
- * fetch url names it only when the composition moved it (attachScript). */
-const DEFAULT_ADAPTER_PORT = 8081;
-
 /** ADR-0005's default work group. Convention, not config: the pod's `fsGroup` is granted to every
  * container as a supplemental group, so the Harness writes `/work` whatever the number and no
  * image's `/etc/group` needs to know it. The one override is the spec's `workGroup`. */
@@ -263,6 +259,10 @@ export type KubectlSandboxOptions = {
    * off it at invoke time, handed to `provision()` as a string — and resolved against this map at
    * provision. The per-run spec never names one (ADR-0051). */
   imagesPath?: string;
+  /** The held-secret manifest `jr2 up` resolved (ADR-0059) — read per provision like the image map,
+   * so a held-secret edit reaches future Sandboxes without rolling this process. Default: the
+   * `jr2-held` ConfigMap's mount. */
+  heldPath?: string;
   /** Extra env for the HARNESS container (`harness.env`) — merged ahead of the
    * mechanism-owned vars, which win on collision. */
   env?: HarnessEnvVar[];
@@ -273,20 +273,11 @@ export type KubectlSandboxOptions = {
    * `sandbox.tolerations`, written on the CR verbatim and copied onto the pod by the operator, which
    * merges nothing with them. Absent → wherever an ordinary pod lands. */
   placement?: SandboxPlacement;
-  /** The instance ships a private-CA bundle (ADR-0020): mount the `jr2-ca` ConfigMap into the
-   * HARNESS container and point NODE_EXTRA_CA_CERTS at it — never the Adapter, which speaks plain
-   * HTTP to the Orchestrator's Service (the same asymmetry as env/envFrom above). */
+  /** The instance ships a private-CA bundle (ADR-0020): the HARNESS container trusts it, and the
+   * Custodian verifies a bound host with it (custodian.ts). */
   caBundle?: boolean;
-  /**
-   * Where the Adapter reaches the Orchestrator FROM INSIDE THE CLUSTER — the orchestrator's own
-   * Service DNS (derived from JR2_NAMESPACE by the entrypoint). The Agent is never told it.
-   * A thunk is still accepted for callers that resolve their address late.
-   */
-  orchestratorUrl?: string | (() => string | undefined);
   /** The key Sandbox tokens are signed with — from the instance Secret (ADR-0013/0019). */
   signingKey?: Buffer;
-  /** The Adapter's port on the pod's loopback. Default 8081. */
-  adapterPort?: number;
   /** Kube namespace for Sandbox CRs. Default `default`. */
   namespace?: string;
   /** kubectl `--context` override. Default: the current context (ADR-0009). */
@@ -339,6 +330,7 @@ export type KubectlSandboxOptions = {
 export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
   const ns = opts.namespace ?? "default";
   const imagesPath = opts.imagesPath ?? join(IMAGES_MOUNT, IMAGES_KEY);
+  const heldPath = opts.heldPath ?? join(HELD_MOUNT, HELD_KEY);
   const workRoot = opts.workRoot ?? "/work";
   const readyTimeoutMs = opts.readyTimeoutMs ?? 120_000;
   const repoTimeoutMs = opts.repoTimeoutMs ?? 25 * 60_000;
@@ -346,32 +338,12 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
   const exec = opts.exec ?? defaultKubectlExec;
   const credentials = opts.credentials ?? [];
 
-  const adapterPort = opts.adapterPort ?? DEFAULT_ADAPTER_PORT;
   const leaseIntervalMs = opts.leaseIntervalMs ?? 5 * 60_000;
   const base = ["--namespace", ns, ...(opts.context ? ["--context", opts.context] : [])];
 
-  /** The Sandbox's token Secret — read by the Adapter container, and by nothing else in the pod. */
+  /** The Sandbox's token Secret — mounted into the Custodian container, and nothing else in the pod. */
   const secretName = (name: string) => `${name}-token`;
 
-  /** Resolved at provision time (see the option's doc): the Orchestrator's in-cluster address. */
-  const orchestratorUrl = (): string | undefined =>
-    typeof opts.orchestratorUrl === "function" ? opts.orchestratorUrl() : opts.orchestratorUrl;
-
-  /** The Adapter, as the operator sees it: an opaque container fragment (ADR-0001). */
-  const adapterSidecar = (name: string, refs: ImageRefs) => ({
-    name: "adapter",
-    image: refs.adapter,
-    env: [
-      { name: "JR2_ORCHESTRATOR_URL", value: orchestratorUrl() },
-      { name: "JR2_SANDBOX", value: name },
-      { name: "JR2_ADAPTER_PORT", value: String(adapterPort) },
-    ],
-    // The credential, and the reason this is a separate container: `local()` tools give the Agent
-    // code execution in the HARNESS container, so anything mounted there is the Agent's. Here, it
-    // is out of reach — different container, no shared process namespace.
-    envFrom: [{ secretRef: { name: secretName(name) } }],
-  });
-
   /**
    * The User Container (ADR-0005): the opt-in third seat, composed only when the wrapper's static
    * `user` option names an image (ADR-0049). The ZERO-CONTRACT seat — jr2 injects nothing, probes
@@ -395,8 +367,8 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
    * Agent, with no credential of their own. Nothing else follows it in: `ext::` names the program
    * by absolute path, so this seat still gets no env, no command, and no probe. The repo volumes
    * are the operator's — it defines `repo-<key>` for every key the CR names — so this seat mounts
-   * them by name. The Adapter is deliberately not given any of the three: it reads no worktree, and it is the
-   * container holding the pod's only credential, so it gets the narrowest mount set that works.
+   * them by name. The Custodian is deliberately not given any of the three: it reads no worktree, and it is the
+   * container holding the pod's credentials, so it gets the narrowest mount set that works.
    * It also carries no `securityContext`, which the operator reads as the exemption — root is
    * ALLOWED here, because hardening a seat whose identity is "what jr2 does not own" is an opinion,
    * and the standard managed-access shape (a root sshd that setuids sessions down) must run
@@ -413,25 +385,31 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
   });
 
   /** The pod's sidecar list (ADR-0001: opaque fragments the operator schedules verbatim). The
-   * Adapter is ALWAYS here: with its ref in the image map there is no "no adapter configured"
-   * state left to branch on, and a Sandbox without one is a pod that comes up Ready and then parks
-   * its Machine forever on a tool call it cannot make (ADR-0013). A map with no `adapter` fails the
-   * read instead (images.ts). The User Container joins it only when the spec named one. */
-  const sidecarsFor = async (name: string, refs: ImageRefs, keys: string[], user?: string) => [
-    adapterSidecar(name, refs),
+   * Custodian is ALWAYS here: a Sandbox without one is a pod that comes up Ready and then parks its
+   * Machine forever on a Menu it cannot read (ADR-0013). The User Container joins it only when the
+   * spec named one. */
+  const sidecarsFor = async (custodian: CustodianComposition, refs: ImageRefs, keys: string[], user?: string) => [
+    custodian.custodianContainer,
     ...(user !== undefined ? [await userSidecar(refs, user, keys)] : []),
   ];
 
   // The Harness container's env: the instance's passthrough (`harness.env` — e.g. model
-  // config) first, then the mechanism-owned vars (the Adapter address, the CA trust path), which
-  // win on collision. Note the asymmetry stands (ADR-0013): user env/envFrom land on the HARNESS
-  // container only — never on the Adapter, whose env is minted here and carries the pod's only
-  // credential.
-  const harnessEnv = (): HarnessEnvVar[] => [
-    ...(opts.env ?? []),
-    { name: "JR2_ADAPTER_URL", value: `http://127.0.0.1:${adapterPort}` },
-    ...(opts.caBundle ? [{ name: "NODE_EXTRA_CA_CERTS", value: `${CA_MOUNT}/ca.crt` }] : []),
-  ];
+  // config) first, then the mechanism-owned vars (the Custodian's address and every Stand-in, the
+  // proxy and the trust bundles — custodian.ts), which win on collision. Note the asymmetry stands
+  // (ADR-0013): user env/envFrom land on the HARNESS container only — never on the Custodian, whose
+  // mounts are composed here and carry the pod's credentials.
+  //
+  // The gate rides LAST (ADR-0058): the digest of the bearer the Orchestrator derives for THIS
+  // Sandbox. A digest because the Agent reads this env; last because a `harness.env` entry of the
+  // same name must not be able to choose the Harness's credential.
+  const harnessEnv = (name: string, custodian: CustodianComposition): HarnessEnvVar[] => {
+    if (!opts.signingKey) throw new Error("kubectlSandbox: a Harness needs a signingKey to check its bearer");
+    return [
+      ...(opts.env ?? []),
+      ...custodian.harnessEnv,
+      { name: "JR2_HARNESS_TOKEN_SHA256", value: harnessTokenDigest(opts.signingKey, name) },
+    ];
+  };
 
   /**
    * The two init steps, in order (ADR-0037). They are plain container fragments the operator
@@ -523,10 +501,11 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
     req: { name: string; runId: string; workflow: string; image?: string; user?: string; workGroup?: number },
     refs: ImageRefs,
     repos: FencedRepo[],
+    custodian: CustodianComposition,
   ) => {
     const seat = await seatFor(refs, req.image);
     const sidecars = await sidecarsFor(
-      req.name,
+      custodian,
       refs,
       repos.map((r) => r.key),
       req.user,
@@ -569,14 +548,13 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
         fsGroup: req.workGroup ?? DEFAULT_WORK_GROUP,
         // Ordered, and before any container starts: populate `/opt/jr2`, then prove the image on it.
         initContainers: initContainersFor(refs, seat),
-        // Never empty any more: JR2_ADAPTER_URL is unconditional, so the "omit an empty env" branch
-        // this used to carry was unreachable. The seat's own vars (the fallback `HOME`) come
-        // FIRST, so the instance's `harness.env` can still override them the way it overrides
-        // anything the image set.
-        env: [...seat.env, ...harnessEnv()],
+        // Never empty: the Custodian's address is unconditional. The seat's own vars (the fallback
+        // `HOME`) come FIRST, so the instance's `harness.env` can still override them the way it
+        // overrides anything the image set.
+        env: [...seat.env, ...harnessEnv(req.name, custodian)],
         ...(opts.envFrom?.length ? { envFrom: opts.envFrom } : {}),
-        // What the AGENT gets: an address on its own loopback, and no credential anywhere. This is
-        // the only thing in the pod that tells it how to reach its Machine (ADR-0013).
+        // What the AGENT gets: an address on its own loopback and a Stand-in for every credential,
+        // and no credential anywhere. The Custodian beside it holds them (ADR-0013, ADR-0059).
         sidecars,
         // The Repos this Sandbox attaches, by cache key (ADR-0051). The operator does the rest: a
         // `repo-<key>` volume per entry — the node's cache, hostPath, read-only in the primary
@@ -599,18 +577,19 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
           { name: "runtime", emptyDir: {} },
           // Only for ADR-0037's fallback seat: uid 1000 on a stranger's base has no home at all.
           ...seat.homeVolume,
-          ...(opts.caBundle ? [{ name: "ca", configMap: { name: CA_CONFIGMAP } }] : []),
+          // The Custodian's (its values, leaves and config), and the trust ConfigMap (ADR-0020).
+          ...custodian.volumes,
         ],
-        // CR-level volumeMounts land on the HARNESS container only (the operator's contract) —
-        // exactly the CA-trust asymmetry ADR-0020 wants: the Adapter never inherits it. The Repo
-        // caches are not listed: the operator mounts each `repo-<key>` into this container itself.
+        // CR-level volumeMounts land on the HARNESS container only (the operator's contract): the
+        // trust bundles, and none of the Custodian's volumes. The Repo caches are not listed: the
+        // operator mounts each `repo-<key>` into this container itself.
         volumeMounts: [
           { name: "work", mountPath: workRoot },
           // Read-only: nothing writes under `/opt/jr2` at runtime, and the Agent has code execution
           // in this container — leaving its own runtime writable would let a turn edit it.
           { name: "runtime", mountPath: RUNTIME_MOUNT, readOnly: true },
           ...seat.homeMount,
-          ...(opts.caBundle ? [{ name: "ca", mountPath: CA_MOUNT, readOnly: true }] : []),
+          ...custodian.harnessMounts,
         ],
       },
     };
@@ -668,23 +647,13 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
 
   /**
    * Mint this Sandbox's token into a Secret, BEFORE the CR exists — the operator creates the pod
-   * the moment it sees the CR, and a pod whose `envFrom` names an absent Secret sits in
-   * CreateContainerConfigError. Idempotent by construction: the token is the Sandbox's name, signed
-   * (tokens.ts), so a re-provision after an orchestrator restart re-applies the SAME value, and the
-   * Adapter that has been holding it all along stays valid.
+   * the moment it sees the CR, and a pod whose volume names an absent Secret never starts.
+   * Idempotent by construction: the token is the Sandbox's name, signed (tokens.ts), so a
+   * re-provision after an orchestrator restart re-applies the SAME value, and the Custodian that has
+   * been holding it all along stays valid.
    */
   const applyTokenSecret = async (name: string): Promise<void> => {
-    if (!opts.signingKey) throw new Error("kubectlSandbox: an Adapter needs a signingKey to mint its Sandbox token");
-    // Fail the provision rather than ship an Adapter that cannot reach the Orchestrator. A mute
-    // Adapter is the worst possible outcome: the pod comes up Ready, the Agent is admitted, its
-    // tool call dies on `localhost`, and the Machine simply parks forever — a hang with no error.
-    if (!orchestratorUrl()) {
-      throw new Error(
-        "kubectlSandbox: the Adapter has no route to the Orchestrator (no orchestratorUrl — deployed " +
-          "instances derive Service DNS from JR2_NAMESPACE). An Agent with no Adapter cannot drive its " +
-          "Machine at all (ADR-0013).",
-      );
-    }
+    if (!opts.signingKey) throw new Error("kubectlSandbox: a Custodian needs a signingKey to mint its Sandbox token");
     const secret = {
       apiVersion: "v1",
       kind: "Secret",
@@ -775,7 +744,17 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
       // reaches future Sandboxes without rolling the Orchestrator. Reading before the Secret apply
       // also means an unknown image name costs nothing: no Secret, no CR, nothing to clean up.
       const refs = await readImageRefs(imagesPath);
-      const cr = await crFor(req, refs, repos);
+      // The same stance for what the Custodian holds (ADR-0059): `jr2 up` resolved it host-side,
+      // where `.env` exists, and this process reads the result — never its own config, whose
+      // `.env` values are absent in-cluster.
+      const manifest = await readHeldManifest(heldPath);
+      const custodian = custodianComposition(manifest, {
+        image: refs.custodian,
+        token: { secret: secretName(req.name), key: "JR2_SANDBOX_TOKEN" },
+        sandbox: req.name,
+        caBundle: opts.caBundle === true,
+      });
+      const cr = await crFor(req, refs, repos, custodian);
 
       // The Repo resources, BEFORE the CR names them (ADR-0051): a bound one already exists from
       // the boot and only its eviction clock moves — this run's spelling never rewrites the spec
@@ -786,7 +765,7 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
       // a Sandbox whose Repo could not be recorded.
       for (const repo of repos) await opts.repos.ensure(repo);
 
-      await applyTokenSecret(req.name); // before the CR: the pod's Adapter mounts it at start
+      await applyTokenSecret(req.name); // before the CR: the pod's Custodian mounts it at start
       await exec(["apply", ...base, "-f", "-"], { input: JSON.stringify(cr) });
 
       const applied = Date.now();
@@ -860,12 +839,7 @@ export function kubectlSandbox(opts: KubectlSandboxOptions = {}): SandboxPort {
     },
 
     async attach(req) {
-      const { script, repos, review } = attachScript(req.spec, req.repos, {
-        reposMount: REPOS_MOUNT,
-        workRoot,
-        // The fetch url names the Adapter only when it is somewhere unexpected (ADR-0053).
-        ...(adapterPort !== DEFAULT_ADAPTER_PORT ? { adapterUrl: `http://127.0.0.1:${adapterPort}` } : {}),
-      });
+      const { script, repos, review } = attachScript(req.spec, req.repos, { reposMount: REPOS_MOUNT, workRoot });
       // `-c harness` is unchanged and still correct after ADR-0037: the primary container runs the
       // Sandbox Image, so `git` here is the git the user chose. Never `-c user` — that seat is
       // zero-contract, may hold no git at all, and jr2 commands nothing in it (ADR-0005).
@@ -994,7 +968,7 @@ function staleSlots(
 export function attachScript(
   spec: WorkspaceSpec,
   repos: Array<{ slot: string; url: string; ref?: string }>,
-  paths: { reposMount: string; workRoot: string; adapterUrl?: string },
+  paths: { reposMount: string; workRoot: string },
 ): { script: string; repos: Record<string, string>; review?: Record<string, string> } {
   const worktrees: Record<string, string> = {};
   const review: Record<string, string> = {};
@@ -1040,7 +1014,7 @@ export function attachScript(
       // (ADR-0051). Push still succeeds only with a caller-supplied credential (a forwarded agent
       // in the User Container); the pod itself holds none. `--` keeps the url an operand, never an
       // option.
-      `git -C ${sq(dflt)} remote set-url origin -- ${sq(fetchUrl(identity, paths.adapterUrl))}`,
+      `git -C ${sq(dflt)} remote set-url origin -- ${sq(fetchUrl(identity))}`,
       `git -C ${sq(dflt)} remote set-url --push origin -- ${sq(repo.url)}`,
       // `ext` is on git's own "known scary" list, so its built-in default is `never` and the url
       // above would die with `fatal: transport 'ext' not allowed` before the program ever ran.
@@ -1078,13 +1052,11 @@ export function attachScript(
 
 /**
  * `origin`'s fetch url for one Repo (ADR-0053): the `ext::` transport, the program's absolute path
- * on the runtime volume, the service git asks for, and the Repo's identity. The Adapter's address
- * rides as a third argument only when the composition moved the Adapter off its default port —
- * the program reads `$JR2_ADAPTER_URL` and then falls back to that same address, so spelling it out
- * unconditionally would put a number in every `git remote -v` that says nothing.
+ * on the runtime volume, the service git asks for, and the Repo's identity. No address: the
+ * program asks the Custodian at its one loopback address, which every Harness pod has (ADR-0059).
  */
-function fetchUrl(identity: string, adapterUrl?: string): string {
-  return `ext::${UPLOAD_PACK} %S ${extArg(identity)}${adapterUrl !== undefined ? ` ${extArg(adapterUrl)}` : ""}`;
+function fetchUrl(identity: string): string {
+  return `ext::${UPLOAD_PACK} %S ${extArg(identity)}`;
 }
 
 /**

package/src/server.ts

@@ -11,7 +11,7 @@
 //   JR2_SIGNING_KEY     base64 key Sandbox tokens are signed with; from the Secret so live Sandboxes
 //                      survive a pod restart. Absent → minted into `<dir>/.jr2/secret` (dev-grade).
 //   JR2_NAMESPACE       the pod's own namespace (Deployment fieldRef) — presence = "deployed":
-//                      Sandboxes are driven in it, and the Adapters' route home is Service DNS.
+//                      Sandboxes are driven in it, and the Custodians' route home is Service DNS.
 //   <git.credentials[].token>
 //                      each token env var the config names rides the instance Secret (ADR-0051):
 //                      the Orchestrator materializes it into the Repo's credential Secret.
@@ -25,7 +25,6 @@
 // previous deploy bound — an Instance that drops its last `workspace()` leaves `jr2 gc` able to
 // collect what it stopped using.
 
-import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { loadConfig } from "./config.ts";
 import { loadWorkflows, startInstance, type RunningInstance } from "./instance.ts";
@@ -37,7 +36,6 @@ import {
   IMAGES_MOUNT,
   INSTANCE_HARNESS_PORT,
   INSTANCE_HARNESS_SERVICE,
-  ORCHESTRATOR_SERVICE,
 } from "./names.ts";
 import { partsOf, type CarriedRepo } from "./parts.ts";
 import { kubectlRepoFetches, type RepoFetches } from "./repo-fetch.ts";
@@ -66,14 +64,12 @@ export async function serverMain(opts: ServerMainOptions): Promise<RunningInstan
   const signingKey =
     env.JR2_SIGNING_KEY !== undefined ? Buffer.from(env.JR2_SIGNING_KEY, "base64") : await loadSigningKey(opts.dir);
 
-  // Deployed (JR2_NAMESPACE set): Adapters dial the orchestrator at its own Service DNS — stable
-  // by nature, which is what lets live Sandboxes outlive orchestrator restarts (ADR-0013).
+  // Deployed (JR2_NAMESPACE set): Custodians dial the orchestrator at its own Service DNS — stable
+  // by nature, which is what lets live Sandboxes outlive orchestrator restarts (ADR-0013). `jr2 up`
+  // writes that address into the Custodian's bootstrap; nothing here passes it on.
   const namespace = env.JR2_NAMESPACE;
 
-  // Resolved HERE, not left for startInstance to mint: every Sandbox Harness gets the token's
-  // sha-256 as its echo gate (ADR-0023, below), so the token must exist before the first
-  // provision. From the instance Secret when deployed; per-boot for a host-booted fixture,
-  // exactly as before.
+  // From the instance Secret when deployed; per-boot for a host-booted fixture.
   const instanceToken = env.JR2_INSTANCE_TOKEN ?? mintInstanceToken();
 
   // The data-plane switch (ADR-0012/0031/0051): a registered Machine COMPOSES a Sandbox — read off
@@ -124,13 +120,6 @@ export async function serverMain(opts: ServerMainOptions): Promise<RunningInstan
             name: "JR2_HARNESS_JSON",
             valueFrom: { configMapKeyRef: { name: HARNESS_CONFIGMAP, key: HARNESS_CONFIG_KEY } },
           },
-          // The echo gate (ADR-0023): the Harness verifies echo bearers against this sha-256. The
-          // digest, never the token — the Agent executes code in the Harness container, and a
-          // digest inverts to nothing (the Instance token itself never enters a Sandbox, ADR-0013).
-          {
-            name: "JR2_ECHO_TOKEN_SHA256",
-            value: createHash("sha256").update(instanceToken).digest("base64url"),
-          },
           ...(config?.harness?.env ?? []).filter((v) => v.valueFrom !== undefined),
         ],
         envFrom: [{ secretRef: { name: HARNESS_ENV_SECRET } }, ...(config?.harness?.envFrom ?? [])],
@@ -139,7 +128,6 @@ export async function serverMain(opts: ServerMainOptions): Promise<RunningInstan
         caBundle: config?.harness?.caBundle !== undefined,
         // Which nodes are Sandbox nodes (ADR-0052) — the CR carries it, the operator reads no config.
         ...(config?.sandbox ? { placement: config.sandbox } : {}),
-        orchestratorUrl: `http://${ORCHESTRATOR_SERVICE}.${namespace}.svc:${port}`,
         signingKey,
         namespace,
         ...(opts.exec ? { exec: opts.exec } : {}),

package/src/tokens.ts

@@ -1,6 +1,6 @@
 // Bearer tokens (ADR-0013), because the Sandbox boundary is otherwise theater. The Harness
 // container shares the pod's network namespace, so an Agent can reach the Orchestrator directly;
-// a per-pod NetworkPolicy cannot distinguish its packets from the Adapter's. Only authentication
+// a per-pod NetworkPolicy cannot distinguish its packets from the Custodian's. Only authentication
 // closes this, and only the token bounds what a caller may DO (as opposed to where it may talk).
 //
 // Two principals, and the asymmetry between them is the whole design:
@@ -10,24 +10,32 @@
 //                   announced once on stdout (fixtures capture it). An Agent never has it — it
 //                   never enters a Sandbox.
 //
-//   Sandbox token   the Adapter's credential. Authorizes exactly: deliver to `kind: "agent"`
+//   Sandbox token   the Custodian's credential. Authorizes exactly: deliver to `kind: "agent"`
 //                   registrations whose Sandbox is THIS one. Never a Gate (a compromised Agent
 //                   must not approve its own review), never another Sandbox (`coding.ts`'s iids
 //                   are derivable and feature ids are readable from the Work Source, so a merely
 //                   run-scoped token would let one feature's coder inject a verdict into another
-//                   feature's reviewer). Delivered as a Secret via the CR's `envFrom` into the
-//                   Adapter container ALONE, which is the one place the Agent cannot read.
+//                   feature's reviewer). Delivered as a Secret mounted into the Custodian
+//                   container ALONE, which the Agent cannot read; the Harness holds its
+//                   Stand-in (ADR-0059).
 //                   The signed name is a POD hosting Turns, not a Sandbox CR per se: the Instance
-//                   Harness's Adapter bears one signed for that placement's Service name
+//                   Harness's Custodian holds one signed for that placement's Service name
 //                   (ADR-0031), scoping it to the Menu-only registrations placed there.
 //
+// And one bearer the other way (ADR-0058), which is no principal here because this server never
+// checks it:
+//
+//   Harness bearer  what the Orchestrator presents to the Harness in one pod — admit, stream,
+//                   abort, echo. Derived per placement (`harnessToken`); the Harness holds only
+//                   its sha-256 (`harnessTokenDigest`), so it verifies and mints nothing.
+//
 // The Sandbox token is a SIGNED NAME, not a random string in a table: `<sandbox>.<hmac(key, name)>`,
 // verified by recomputing. Three things fall out that a token table would have to work for — the
 // Orchestrator holds no per-Sandbox state, `provision` stays idempotent (re-minting yields the same
 // token, so a re-applied Secret is a no-op), and a token minted before a restart still verifies
-// after one, which is exactly what ADR-0012's re-attach promises the still-running Adapter.
+// after one, which is exactly what ADR-0012's re-attach promises the still-running Custodian.
 
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
@@ -35,7 +43,7 @@ import { join } from "node:path";
 export type Principal =
   /** The instance's own operator: the CLI, a human, a webhook translator holding the token. */
   | { kind: "instance" }
-  /** One Sandbox's Adapter, speaking for the Agent in that pod — and for no one else. */
+  /** One Sandbox's Custodian, speaking for the Agent in that pod — and for no one else. */
   | { kind: "sandbox"; sandbox: string };
 
 /** Resolve a bearer token to a principal; undefined = not a token we minted (→ 401). */
@@ -46,6 +54,29 @@ export function sandboxToken(key: Buffer, sandbox: string): string {
   return `${sandbox}.${sign(key, sandbox)}`;
 }
 
+/**
+ * The Harness bearer for one placement (ADR-0058): what the Orchestrator presents on every Harness
+ * wire call — admit, stream, abort, echo — to the Harness in the pod `placement` names (a
+ * Sandbox, or `jr2-instance-harness`). The same signed-name idea as the Sandbox token, turned the
+ * other way: here the Orchestrator is the CALLER. Deterministic for the same reason — a restarted
+ * Orchestrator re-derives the bearer a live Harness already checks against.
+ *
+ * Domain-separated from `sandboxToken` by the `harness:` prefix, which no DNS-label name can
+ * produce, so no Sandbox token ever doubles as a Harness bearer or the reverse.
+ */
+export function harnessToken(key: Buffer, placement: string): string {
+  return sign(key, `harness:${placement}`);
+}
+
+/**
+ * What the Harness in `placement` holds to CHECK its bearer: the sha-256 of it, never the bearer
+ * (ADR-0058). The Agent executes code in that container, and a digest inverts to nothing — so the
+ * Harness can verify its own bearer and can mint none, for itself or for any other pod.
+ */
+export function harnessTokenDigest(key: Buffer, placement: string): string {
+  return createHash("sha256").update(harnessToken(key, placement)).digest("base64url");
+}
+
 /** Mint the per-boot Instance token (opaque and random — it names nothing, it just IS the trust). */
 export function mintInstanceToken(): string {
   return randomBytes(32).toString("base64url");
@@ -55,7 +86,7 @@ export function mintInstanceToken(): string {
  * The instance's HMAC signing key, at `<dir>/.jr2/secret` (0600), created on first use.
  *
  * It MUST outlive the process: an Orchestrator restart leaves live Sandboxes running (ADR-0012 re-attach),
- * and their Adapters still hold tokens minted by the process that died. A fresh key would reject
+ * and their Custodians still hold tokens minted by the process that died. A fresh key would reject
  * every one of them — the Agent would silently lose its only route to its Machine.
  */
 export async function loadSigningKey(dir: string): Promise<Buffer> {

package/src/workspace.ts

@@ -688,7 +688,7 @@ function buildWorkspaceMachine(body: AnyStateMachine, spec: (args: { input: any
     const wrapperRef = self._parent;
     if (!wrapperRef) return;
     const disposeHandles = registerAmbientHandles(wrapperRef, input.handles);
-    const detachEcho = runBindingOf(system as AnyActorSystem).echo?.(input.handles.endpoint);
+    const detachEcho = runBindingOf(system as AnyActorSystem).echo?.(input.handles.endpoint, input.handles.sandbox);
     return () => {
       detachEcho?.();
       disposeHandles();
@@ -805,7 +805,7 @@ function buildWorkspaceMachine(body: AnyStateMachine, spec: (args: { input: any
                   endpoint: ctx.endpoint!,
                   // Derived, not remembered: the same function every port operation names the CR
                   // with, so the Sandbox the registrar publishes — and the Agent actor records on its
-                  // registration — is the one the Adapter's token is scoped to, by construction
+                  // registration — is the one the Custodian's token is scoped to, by construction
                   // (ADR-0013).
                   sandbox: workspaceName(runBindingOf(system as AnyActorSystem).runId, ctx.wsId),
                   repos: out.repos,