@jr2/orchestrator 0.4.1 → 0.6.0

package/src/sandbox-kube.ts

@@ -43,7 +43,7 @@
 // containers:
 //
 //   volume        runtime     the kit's Harness image, as an `image` volume → /opt/jr2
-//   volume        conversations  an emptyDir → /conversations, the Harness container's alone
+//   volume        conversations  an emptyDir → /run/jr2/conversations, the Harness container's alone
 //                             (ADR-0031: a Harness restart inside the pod keeps its conversations)
 //   initContainer preflight   the USER'S image + that volume → ADR-0037's probe, the thing that
 //                             proves a registry ref, whose first appearance is this provision
@@ -83,11 +83,14 @@ import {
   custodianBootstrap,
   custodianComposition,
   custodianScript,
+  CREDENTIAL_KEYS,
+  heldStandInKey,
   CUSTODIAN_BOOTSTRAP_KEY,
   CUSTODIAN_SCRIPT_KEY,
   type CustodianComposition,
 } from "./custodian.ts";
-import { readHeldManifest, workspaceHeldPod, type HeldManifest } from "./held-secrets.ts";
+import { heldStandIn, readHeldManifest, workspaceHeldPod, type HeldManifest } from "./held-secrets.ts";
+import { markHarnessEnv } from "./harness-env.ts";
 import {
   effectorManifestKey,
   readSandboxEffectorManifest,
@@ -133,10 +136,14 @@ import {
   type SandboxObject,
   type SandboxWatch,
 } from "./sandbox-watch.ts";
-import { effectorKey, harnessToken, harnessTokenDigest, sandboxToken } from "./tokens.ts";
+import { controlStandIn, controlToken, effectorKey, harnessToken, harnessTokenDigest, sandboxToken } from "./tokens.ts";
 import type { AttachError, AttachRequest, AttachResponse } from "./wire.ts";
 import type { Continuity, MemoryKill, PlacingWait, ProvisionedRepo, SandboxLoss, SandboxPort } from "./workspace.ts";
 
+/** A Secret's `data`: each value base64'd. */
+const base64Values = (values: Record<string, string>): Record<string, string> =>
+  Object.fromEntries(Object.entries(values).map(([k, v]) => [k, Buffer.from(v).toString("base64")]));
+
 /** Where jr2's runtime lands in every container that gets it (ADR-0037). `/opt/jr2` and not `/app`
  * because a stranger's base may already use `/app`, and one layout must serve both the stock
  * Harness image and an arbitrary Sandbox Image. It is a PUBLISHED surface: `bin/` beside `lib/`
@@ -156,11 +163,21 @@ const RUNTIME_VOLUME_MOUNT = { name: RUNTIME_VOLUME, mountPath: RUNTIME_MOUNT, s
 /** The primary container's command (ADR-0037). Absolute, so it never depends on the image's
  * `WORKDIR`, and identical to the stock Harness image's own `CMD` — one runtime, two placements.
  * `tini` is PID 1 (ADR-0061): the Agent's processes are the Harness's children, and a tree the
- * memory guard kills must leave no zombies behind. */
+ * memory guard kills must leave no zombies behind. The Harness holds the Stand-ins in its memory,
+ * and below Landlock ABI 6 a confined child can still signal it (ADR-0076): `effector nocore`
+ * starts it with no core file, so a dumping signal writes nothing a child reads, and
+ * `--disable-sigusr1` keeps SIGUSR1 from opening Node's inspector, which would run a child's code
+ * in the Harness. `--harness-env` gives the Harness process only the names jr2 composed, less each
+ * name that loads code from a path, and the domain the whole start env (`harness-env.ts`). */
 const HARNESS_COMMAND = [
   `${RUNTIME_MOUNT}/bin/tini`,
   "--",
+  `${RUNTIME_MOUNT}/bin/effector`,
+  "nocore",
+  "--harness-env",
+  "--",
   `${RUNTIME_MOUNT}/bin/node`,
+  "--disable-sigusr1",
   `${RUNTIME_MOUNT}/src/main.ts`,
 ];
 
@@ -834,8 +851,14 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
         // Never empty: the Custodian's address is unconditional. The seat's own vars (the fallback
         // `HOME`) come FIRST, so the instance's `harness.env` can still override them the way it
         // overrides anything the image set.
-        env: [...seat.env, ...harnessEnv(req.name, custodian, cpuHintEnv())],
-        ...(cfg().envFrom?.length ? { envFrom: cfg().envFrom } : {}),
+        // Marked (`harness-env.ts`, ADR-0076): the Harness's start tells jr2's names from the image's.
+        ...(() => {
+          const marked = markHarnessEnv(
+            [...seat.env, ...harnessEnv(req.name, custodian, cpuHintEnv())],
+            cfg().envFrom ?? [],
+          );
+          return { env: marked.env, ...(marked.envFrom.length ? { envFrom: marked.envFrom } : {}) };
+        })(),
         // What the AGENT gets: an address on its own loopback and a Stand-in for every credential,
         // and no credential anywhere. The Custodian beside it holds them (ADR-0013, ADR-0059).
         sidecars,
@@ -902,7 +925,7 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
    * `data`, not `stringData`: a server-side apply owns the fields it names, and `stringData` is
    * write-only — it never reads back as the field applied.
    */
-  const applyTokenSecret = async (name: string, owner: KubeObject): Promise<void> => {
+  const applyTokenSecret = async (name: string, owner: KubeObject, manifest: HeldManifest): Promise<void> => {
     if (!opts.signingKey) throw new Error("kubeSandbox: a Custodian needs a signingKey to mint its Sandbox token");
     const uid = owner.metadata?.uid;
     if (!uid) throw new Error(`Sandbox "${name}": the CR's apply answered with no uid to own its token Secret`);
@@ -925,7 +948,19 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
         ],
       },
       type: "Opaque",
-      data: { JR2_SANDBOX_TOKEN: Buffer.from(sandboxToken(opts.signingKey, name)).toString("base64") },
+      // The pod's credentials (ADR-0076, C1, C1b): its fetch token and its control token, which the
+      // Custodian alone mounts; its secret control Stand-in; and one secret Stand-in per held secret
+      // the pod's manifest names, which the Custodian (for its swap) and the Harness container (as
+      // files under `/run/jr2/`) mount. Every one a signed name, so a re-provision re-applies the
+      // same values. Never a ConfigMap, the CR, an env, an event or a log line.
+      data: base64Values({
+        [CREDENTIAL_KEYS.fetchToken]: sandboxToken(opts.signingKey, name),
+        [CREDENTIAL_KEYS.controlToken]: controlToken(opts.signingKey, name),
+        [CREDENTIAL_KEYS.controlStandIn]: controlStandIn(opts.signingKey, name),
+        ...Object.fromEntries(
+          manifest.secrets.map((s) => [heldStandInKey(s.name), heldStandIn(opts.signingKey!, name, s.name)]),
+        ),
+      }),
     });
   };
 
@@ -1030,7 +1065,7 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
       },
       data: {
         [CUSTODIAN_BOOTSTRAP_KEY]: JSON.stringify(custodianBootstrap(manifest, orchestrator)),
-        [CUSTODIAN_SCRIPT_KEY]: custodianScript(manifest),
+        [CUSTODIAN_SCRIPT_KEY]: custodianScript(manifest, { fetch: true }),
       },
     });
   };
@@ -1257,8 +1292,9 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
         image: refs.custodian,
         pod,
         config: sandboxCustodianConfigMap(req.name),
-        token: { secret: secretName(req.name), key: "JR2_SANDBOX_TOKEN" },
+        credentials: { secret: secretName(req.name) },
         sandbox: req.name,
+        ...(req.secrets?.length ? { granted: req.secrets } : {}),
         caBundle: cfg().caBundle === true,
         resources: split.custodian,
       });
@@ -1287,7 +1323,7 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
       sandboxes();
       const applied = await kube().apply(SANDBOXES, ns, cr).catch(noOperator(req.name, "Sandbox"));
       // After the CR: its uid owns both, so they go when it goes.
-      await applyTokenSecret(req.name, applied);
+      await applyTokenSecret(req.name, applied, manifest);
       await applyCustodianConfig(req.name, applied, manifest);
       if (effectorManifest) {
         await applyEffectorKey(req.name, applied);
@@ -1394,19 +1430,19 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
       const endpoint = sandbox?.status?.endpoint;
       if (!endpoint) throw new Error(`Sandbox "${req.name}" has no endpoint to attach through — is it gone?`);
       if (req.repos.length === 0) {
-        throw new Error("the attach names no Repo Slot — nothing to attach (a workspace() declares at least one)");
+        throw new Error(
+          "the attach names no Repo Slot — nothing to attach (a Workspace with no Repo Slot skips the attach, ADR-0051)",
+        );
       }
       const body: AttachRequest = {
         slots: req.repos.map((r) => {
           const { identity, key } = repoIdentity(r.url);
           return { slot: r.slot, url: r.url, identity, key, ...(r.ref !== undefined ? { ref: r.ref } : {}) };
         }),
-        branch: req.spec.branch,
-        ...(req.spec.reviewSha ? { reviewSha: req.spec.reviewSha } : {}),
       };
-      const { repos, review } = await postAttach(req.name, endpoint, body);
+      const { repos, bases } = await postAttach(req.name, endpoint, body);
       const stale = staleSlots(req.repos, staleByName.get(req.name));
-      return { repos, ...(review ? { review } : {}), ...(stale ? { stale } : {}) };
+      return { repos, bases, ...(stale ? { stale } : {}) };
     },
 
     leaseIntervalMs,
@@ -1456,7 +1492,20 @@ export function kubeSandbox(opts: KubeSandboxOptions = {}): SandboxPort {
     async destroy(name) {
       staleByName.delete(name);
       // The token Secret is the CR's child from birth, so deleting the CR reaps it (ADR-0001).
-      await kube().delete(SANDBOXES, ns, name);
+      await kube().delete(SANDBOXES, ns, name, { foreground: true });
+      // A retry of the same invoke id takes the same name, and the pod takes it too: a new Sandbox
+      // must not find the old pod on its way out, and read `Lost` (ADR-0075). So the wait is
+      // for the pod as well: foreground keeps the CR until the pod is gone. Bounded: a stuck finalizer
+      // is the operator's to report, and the run does not wait on it for ever.
+      for (let i = 0; i < 120; i++) {
+        if (
+          (await kube()
+            .get<SandboxObject>(SANDBOXES, ns, name)
+            .catch(() => undefined)) === undefined
+        )
+          return;
+        await new Promise((resolve) => setTimeout(resolve, 500));
+      }
     },
   };
 }

package/src/secret-placement.ts

@@ -6,7 +6,8 @@
 //   - the Instance Harness: the model keys of the `"none"` Agents it hosts, and nothing else (they
 //     cannot execute code, ADR-0031, so nothing else is theirs to use);
 //   - an Effector: what its Effects name with `secret("name")` — the Instance Effector what its
-//     `http` Effects name; a Workspace's Sandbox Effector what its file-body `http`s and
+//     `http` Effects name and the token of each `dispatch` with a target (ADR-0071; a dispatch with
+//     no target runs in the Orchestrator's own process and names nothing); a Workspace's Sandbox Effector what its file-body `http`s and
 //     credentialed `command`s name. The push credential its `push`es spend is not placed here: the provision
 //     names the entry the slot's url matches on the Sandbox, by reference (git-push.ts, ADR-0051).
 //
@@ -27,6 +28,7 @@ import {
   type HeldLookups,
 } from "./held-secrets.ts";
 import type { JR2Config } from "./config.ts";
+import { needsASlot } from "./effect.ts";
 import { declaredPushKinds, pushRefusal } from "./git-push.ts";
 import { INSTANCE_HARNESS_HELD_POD } from "./names.ts";
 import { routeText, type CarriedEffect, type WorkspacePod } from "./parts.ts";
@@ -140,7 +142,36 @@ export function refuseEffectSecrets(config: JR2Config, walk: PlacementWalk): voi
     // An empty value is refused later with the list's own rule (`sourceOf`): it is an unset variable.
     if (namedBy.has(e.name) && e.value) shortRefusal(e, e.value.length);
   }
-  for (const ws of walk.workspaces) pushesOf(config, ws);
+  for (const ws of walk.workspaces) {
+    refuseWithNoSlot(ws);
+    pushesOf(config, ws);
+  }
+}
+
+/**
+ * A Workspace with no Repo Slot (ADR-0051) has no branch and no commit, so the two Sandbox Effector kinds that
+ * run on a commit of a slot's branch have none: a `push`, and a `command` with an Effect secret
+ * (ADR-0067). A `worktree()` has no clone to cut from (ADR-0075). Refused here, before anything is
+ * built, as the invoke would refuse them mid-run. A file-body `http` reads `/work` and stays.
+ */
+function refuseWithNoSlot(ws: PlacedWorkspace): void {
+  if (!ws.pod.noSlot) return;
+  for (const effect of ws.pod.effects) {
+    // Every `command` placed in a Sandbox Effector names a secret: the others run beside the Agent.
+    const why = needsASlot(effect.kind);
+    if (why === undefined) continue;
+    throw new Error(
+      `workflow "${ws.workflow}": ${effect.kind} "${effect.name}" runs in ${workspaceLabel(ws)}, which has no Repo ` +
+        `Slot: ${why} (ADR-0051)`,
+    );
+  }
+  const [cut] = ws.pod.cuts ?? [];
+  if (cut !== undefined) {
+    throw new Error(
+      `workflow "${ws.workflow}": worktree "${cut}" runs in ${workspaceLabel(ws)}, which has no Repo Slot: ` +
+        `${needsASlot("worktree")} (ADR-0075)`,
+    );
+  }
 }
 
 /**
@@ -153,7 +184,7 @@ export function secretPlacementsOf(
   walk: PlacementWalk,
   lookups: Pick<HeldLookups, "secretKeys" | "valueLength"> = {},
 ): SecretPlacements {
-  const { entries, namedBy, http } = namesOf(config, walk);
+  const { entries, namedBy, instancePlaced } = namesOf(config, walk);
   const { pods, redundant } = heldPodsOf(config, walk, new Set(entries.map((e) => e.name)));
   const claimed = new Set(pods.flatMap((p) => p.names));
 
@@ -207,12 +238,12 @@ export function secretPlacementsOf(
     report.push(`${label}: secrets lists ${name}, which its Agents' provider claims already — redundant`);
   }
 
-  const instanceSecrets = new Set(http.flatMap((p) => p.effect.secrets));
+  const instanceSecrets = new Set(instancePlaced.flatMap((p) => p.effect.secrets));
   const instance =
-    http.length === 0
+    instancePlaced.length === 0
       ? undefined
       : effectorPlan(
-          http,
+          instancePlaced,
           secrets.filter((s) => instanceSecrets.has(s.name)),
           values,
         );
@@ -267,6 +298,7 @@ function sandboxPlanOf(
       x.scheme === t.scheme && x.host === t.host && x.port === t.port && x.secrets.join() === t.secrets.join();
     if (!targets.some(same)) targets.push(t);
   }
+  refuseWithNoSlot(ws);
   const pushes = pushesOf(config, ws);
   const commands = ws.pod.effects.some((e) => e.kind === "command" && (e.secrets?.length ?? 0) > 0);
   return {
@@ -322,10 +354,12 @@ function pushesOf(config: JR2Config, ws: PlacedWorkspace): SandboxPush[] {
   return out;
 }
 
-function effectorPlan(http: HttpPlaced[], secrets: EffectSecret[], values: Record<string, string>): EffectorPlan {
+function effectorPlan(placed: InstancePlaced[], secrets: EffectSecret[], values: Record<string, string>): EffectorPlan {
   const targets: EffectorTargetConfig[] = [];
-  for (const { effect } of http) {
-    // An Open url has no target, so it allows nothing: `jr2 up` refuses it before this (ADR-0054).
+  for (const { effect } of placed) {
+    // An Open url or an Open dispatch target has no target, so it allows nothing: `jr2 up` refuses
+    // it before this (ADR-0054). A dispatch's target is its origin, its one secret the token
+    // (ADR-0071).
     if (effect.target === undefined) continue;
     const t = { ...effect.target, secrets: [...effect.secrets].sort() };
     const same = (x: EffectorTargetConfig) =>
@@ -337,12 +371,17 @@ function effectorPlan(http: HttpPlaced[], secrets: EffectSecret[], values: Recor
     secrets,
     values,
     targets,
-    longestTimeoutMs: Math.max(...http.map((p) => p.effect.timeoutMs)),
-    effects: http.map((p) => `${p.workflow}/${p.effect.name}`),
+    // The grace a rollout gives a replica covers the http Effects alone (ADR-0071): a dispatch is
+    // idempotent by construction, so a `wait` a rollout cuts is sent again under its key and its
+    // poll resumes, and a wait of hours never stretches the Effector's grace.
+    longestTimeoutMs: Math.max(0, ...placed.flatMap((p) => (p.effect.kind === "http" ? [p.effect.timeoutMs] : []))),
+    effects: placed.map((p) => `${p.workflow}/${p.effect.name}`),
   };
 }
 
-type HttpPlaced = { workflow: string; effect: Extract<CarriedEffect, { method: string }> };
+/** An Effect the Instance Effector runs: an http one with no Worktree file, or a dispatch with a
+ * target (ADR-0068, ADR-0071). */
+type InstancePlaced = { workflow: string; effect: Extract<CarriedEffect, { kind: "http" | "dispatch" }> };
 
 /** A Workspace as a human reads it: its workflow and the placement route to it, an inline hop as
  * `invoked inline in state <id>`. */
@@ -423,11 +462,14 @@ function namesOf(config: JR2Config, walk: PlacementWalk) {
     }
     byName.set(e.name, e);
   }
-  // Every Effect that names a secret names it, whatever its kind: an `http` one in the Instance
-  // Effector, a file-body `http` and a credentialed `command` in their Workspace's Sandbox Effector.
+  // Every Effect that names a secret names it, whatever its kind: an `http` one and a `dispatch`'s
+  // token in the Instance Effector, a file-body `http` and a credentialed `command` in their
+  // Workspace's Sandbox Effector. A dispatch with no target is placed "orchestrator" and names none
+  // (ADR-0071).
   const namedBy = new Map<string, Array<{ label: string; where: string }>>();
-  const http = walk.effects.filter(
-    (p): p is HttpPlaced => p.effect.kind === "http" && p.effect.placement === "instance",
+  const instancePlaced = walk.effects.filter(
+    (p): p is InstancePlaced =>
+      (p.effect.kind === "http" || p.effect.kind === "dispatch") && p.effect.placement === "instance",
   );
   // Keyed by the Effect's placement route and slot name, as workspacePodsOf keys a pod's Effects:
   // two slots of one name in one workflow — one in a workspace(), one outside it — are two Effects,
@@ -463,7 +505,7 @@ function namesOf(config: JR2Config, walk: PlacementWalk) {
       namedBy.set(name, [...(namedBy.get(name) ?? []), { label, where }]);
     }
   }
-  return { entries, namedBy, http };
+  return { entries, namedBy, instancePlaced };
 }
 
 /** An Effect secret shorter than 8 characters is refused, and the refusal says why. */

package/src/server.ts

@@ -295,6 +295,9 @@ export async function serverMain(opts: ServerMainOptions): Promise<RunningInstan
     instanceHarness: namespace
       ? `http://${INSTANCE_HARNESS_SERVICE}.${namespace}.svc:${INSTANCE_HARNESS_PORT}`
       : undefined,
+    // What a foreign dispatch names this Orchestrator by at the callee's door (ADR-0071): its
+    // namespace, which is stable and not secret — never a run's Instance ID.
+    ...(namespace ? { orchestratorName: namespace } : {}),
     // Where an http Effect runs (ADR-0068): the Instance Effector's headless Service. `jr2 up`
     // converges it whenever a registered Machine carries an http Effect.
     ...(namespace ? { instanceEffector: `${INSTANCE_EFFECTOR}.${namespace}.svc:${EFFECTOR_PORT}` } : {}),