@namzu/sandbox 25.0.0 → 27.0.0

package/src/backends/kubernetes/egress-policy.ts

@@ -470,6 +470,51 @@ export interface KubernetesPerSandboxEgressConfig {
 	 * leave `tlsServerNames` off for a domain list.
 	 */
 	readonly narrowing?: KubernetesCiliumEgressNarrowing
+	/**
+	 * The identity the operator's fence bounds, spelled as the API server
+	 * spells a user: `system:serviceaccount:<namespace>:<name>` for a
+	 * ServiceAccount. When set, the fence check requires the policy's
+	 * `matchConditions` to name exactly this identity
+	 * (`request.userInfo.username == '<identity>'`), and refuses before any
+	 * write when they name another one or none.
+	 *
+	 * Unset (the default), the identity is not checked: the shipped fence
+	 * names `system:serviceaccount:namzu-sandboxes:namzu-sandbox-host`, and a
+	 * host that authenticates as something else would otherwise hold the write
+	 * verbs with a fence that never matches it — which reads exactly like an
+	 * enforced one. Set it whenever you know who the host is.
+	 */
+	readonly hostIdentity?: string
+	/**
+	 * The operator-pinned set of hosts and ports a host may grant. Names the
+	 * `ConfigMap` that holds it; see
+	 * `k8s/manifests/validatingadmissionpolicy-cilium-permitted-hosts.yaml`
+	 * for the companion policy that enforces it at admission and the shape of
+	 * the ConfigMap.
+	 *
+	 * Set, three things change and nothing else does:
+	 *
+	 *  - the fence check additionally proves the companion policy and its
+	 *    binding (the policy name with `-hosts` appended, and its binding),
+	 *    including that the binding's `paramRef` is THIS ConfigMap and denies
+	 *    when it is missing;
+	 *  - every `setNetworkPolicy` call with a non-empty list reads the
+	 *    ConfigMap first and refuses locally, with a named error and nothing
+	 *    written, a host or a port outside it. A narrowing that leaves a
+	 *    host's ports unrestricted is a port outside any list;
+	 *  - a missing or malformed ConfigMap refuses every such call.
+	 *
+	 * Unset (the default), none of that runs and behaviour is what it was.
+	 */
+	readonly permittedHostsParam?: KubernetesPermittedHostsParam
+}
+
+/** Where the operator-pinned permitted hosts and ports live. */
+export interface KubernetesPermittedHostsParam {
+	/** The `ConfigMap`'s name. */
+	readonly name: string
+	/** Its namespace. */
+	readonly namespace: string
 }
 
 /**
@@ -654,7 +699,14 @@ export class KubernetesPerSandboxEgressConfigError extends Error {
 	override readonly name = 'KubernetesPerSandboxEgressConfigError'
 
 	constructor(
-		readonly field: 'engine' | 'admissionPolicyName' | 'admissionPolicyBindingName' | 'labelKey',
+		readonly field:
+			| 'engine'
+			| 'admissionPolicyName'
+			| 'admissionPolicyBindingName'
+			| 'labelKey'
+			| 'hostIdentity'
+			| 'permittedHostsParam.name'
+			| 'permittedHostsParam.namespace',
 		readonly value: string,
 		reason: string,
 	) {
@@ -755,60 +807,53 @@ export function assertPerSandboxEgressIsUsable(egress: KubernetesEgressConfig |
 	if (perSandbox.narrowing !== undefined) {
 		assertCiliumNarrowingIsUsable(perSandbox.narrowing, 'perSandbox.narrowing')
 	}
+	const { hostIdentity, permittedHostsParam } = perSandbox
+	if (hostIdentity !== undefined && (hostIdentity === '' || hostIdentity.trim() !== hostIdentity)) {
+		throw new KubernetesPerSandboxEgressConfigError(
+			'hostIdentity',
+			hostIdentity,
+			'is not a user name (an empty or space-padded identity matches nothing, so the fence check would refuse every write)',
+		)
+	}
+	if (permittedHostsParam !== undefined) {
+		for (const field of ['name', 'namespace'] as const) {
+			const value = (permittedHostsParam as Partial<Record<'name' | 'namespace', string>>)[field]
+			if (typeof value !== 'string' || value === '' || value.trim() !== value) {
+				throw new KubernetesPerSandboxEgressConfigError(
+					`permittedHostsParam.${field}`,
+					String(value),
+					'is not an object name (the parameter ConfigMap is named by both fields, and an empty or space-padded one names nothing, so every write would be refused)',
+				)
+			}
+		}
+	}
 	perSandboxEgressLabelKey(egress)
 }
 
 /**
- * Named refusal for `config.egress.perSandbox` reaching an entry point that
- * can never carry the capability it configures: `createKubernetesWorkspace`.
+ * Formerly the refusal of `config.egress.perSandbox` on
+ * `createKubernetesWorkspace` and `allocateKubernetesWorkspace`, which could
+ * not carry the capability. They carry it now: the workspace's pod template
+ * gets the per-sandbox selector label, the `Sandbox` owns the policies, and
+ * the handle serves `setNetworkPolicy`.
  *
- * `perSandbox` exists to make `Sandbox.setNetworkPolicy` PRESENT on a TASK
- * handle, where the acquire creates the object each policy is named after and
- * owned by and stamps the per-sandbox pod label its selector matches, and
- * where the RBAC and the admission fence are the ones that bound the write.
- * A workspace's create path does none of that — it composes no per-sandbox
- * pod label and tracks no owner uid for one — so on that path the option
- * would be accepted and mean nothing at all: exactly the "declared and
- * silently unused" configuration this module refuses everywhere else. The
- * alternative, omitting the method and saying nothing, is how a host comes to
- * believe it narrowed a workspace's egress.
+ * Nothing throws this any more. It stays exported so an existing
+ * `catch (err) { if (err instanceof KubernetesWorkspacePerSandboxEgressConfigError) … }`
+ * keeps compiling and simply never matches; it will be removed in a later
+ * major.
  *
- * NOT a variant of {@link KubernetesPerSandboxEgressConfigError}, which is
- * about a `perSandbox` value this backend cannot honour ANYWHERE (an engine
- * with no hostname concept, an unnamed fence). This one is about a `perSandbox`
- * value it honours perfectly well on the other entry point, so a caller
- * catching the sibling for a typo'd value does not also catch a correct
- * configuration aimed at the wrong path.
+ * @deprecated No workspace entry point refuses `egress.perSandbox` any more.
  */
 export class KubernetesWorkspacePerSandboxEgressConfigError extends Error {
 	override readonly name = 'KubernetesWorkspacePerSandboxEgressConfigError'
 
 	constructor() {
 		super(
-			`kubernetes: config.egress.perSandbox is set, but a KubernetesWorkspace cannot carry the capability it configures: Sandbox.setNetworkPolicy is implemented on a TASK handle, whose acquire creates the object each per-sandbox policy is named after and owned by and stamps the pod label its selector matches, while a workspace's create path composes no per-sandbox pod label and tracks no owner uid for one. Accepting the option here would declare a capability this path never serves — the silent downgrade this backend refuses on every other entry point — so it is refused before anything is sent. Drop egress.perSandbox from the configuration workspaces are created from (a backend serving task sandboxes can keep it), or create a task sandbox with it, where the method is present.`,
+			'kubernetes: config.egress.perSandbox is set on a workspace entry point. This error is no longer thrown: workspaces serve per-sandbox egress.',
 		)
 	}
 }
 
-/**
- * Refuse `config.egress.perSandbox` on the entry point that cannot carry it —
- * `createKubernetesWorkspace`. See
- * {@link KubernetesWorkspacePerSandboxEgressConfigError}.
- *
- * Deliberately not {@link assertPerSandboxEgressIsUsable}, which validates the
- * same config for the path that DOES honour it: a workspace has nothing to
- * validate the option for, whatever its `engine` or `admissionPolicyName` say,
- * because it serves no `setNetworkPolicy` at all. Calling that validator here
- * instead would be worse than saying nothing — it would report a
- * `perSandbox` this deployment can use as if it were in use.
- */
-export function assertWorkspaceCarriesNoPerSandboxEgress(
-	egress: KubernetesEgressConfig | undefined,
-): void {
-	if (egress?.perSandbox === undefined) return
-	throw new KubernetesWorkspacePerSandboxEgressConfigError()
-}
-
 /**
  * The ONE composer for a sandbox pod's `additionalPodMetadata.labels`.
  *
@@ -1686,7 +1731,7 @@ export function assertHostsFitNarrowing(
  * `undefined` means no port restriction: the host's `toFQDNs` rule carries
  * no `toPorts` at all.
  */
-function narrowedHostPorts(
+export function narrowedHostPorts(
 	host: string,
 	narrowing: KubernetesCiliumEgressNarrowing,
 ): readonly number[] | undefined {
@@ -2482,6 +2527,18 @@ export interface EgressAllowance {
 		readonly kind: 'NetworkPolicy' | 'CiliumNetworkPolicy'
 		readonly name: string
 	}
+	/**
+	 * Further objects whose `spec` was compared to its translation by
+	 * {@link verifyEgressPolicyApplied}, and which the union rule therefore
+	 * does not judge rule by rule either. Set only by
+	 * {@link unionEgressAllowance}: the post-write check of a per-sandbox
+	 * policy is a question about TWO named objects, the operator's baseline
+	 * and the policy just written.
+	 */
+	readonly alsoNamed?: readonly {
+		readonly kind: 'NetworkPolicy' | 'CiliumNetworkPolicy'
+		readonly name: string
+	}[]
 }
 
 function readPortRanges(ports: unknown, defaultProtocol: string | undefined): PortSet {
@@ -2652,6 +2709,55 @@ export function egressAllowance(translated: KubernetesTranslatedEgressPolicy): E
 	}
 }
 
+/**
+ * What the pod may reach when TWO translated policies both select it: the
+ * operator's baseline and one per-sandbox policy this backend wrote.
+ *
+ * Kubernetes unions every policy that selects a pod, so the boundary a
+ * per-sandbox write is supposed to produce is exactly baseline PLUS the
+ * written policy, and a third policy allowing more than that is what the
+ * post-write check refuses. Each field is the union of the two sides':
+ *
+ *  - destinations and `toFQDNs` names concatenate;
+ *  - `permitsEverything` is either side's, and `permitsNothing` is both
+ *    sides' — a `no-network` baseline permits nothing, and a baseline that
+ *    permits nothing plus a per-sandbox policy that permits one name permits
+ *    that name, not nothing;
+ *  - DNS lookups: a side that permits nothing contributes no names, a side
+ *    that does not narrow DNS contributes every name, and the union of name
+ *    lists is their concatenation. This is the one field where the naive
+ *    union is wrong: a `no-network` baseline reports `'all'` because a core
+ *    policy "cannot narrow DNS", and taking that at face value would let any
+ *    other policy open the resolver to every name beside a narrowed grant.
+ *
+ * Both objects are marked as named: each had its `spec` compared to its own
+ * translation before this check runs, and neither's `.domain` entries (a
+ * `matchName` plus a `matchPattern`) are expressible in an allowance.
+ */
+export function unionEgressAllowance(
+	baseline: EgressAllowance,
+	added: EgressAllowance,
+): EgressAllowance {
+	const dnsOf = (side: EgressAllowance): 'all' | readonly string[] =>
+		side.permitsNothing ? [] : side.dnsNarrowedTo
+	const baselineDns = dnsOf(baseline)
+	const addedDns = dnsOf(added)
+	const dnsNarrowedTo: 'all' | readonly string[] =
+		baselineDns === 'all' || addedDns === 'all'
+			? 'all'
+			: [...new Set([...baselineDns, ...addedDns])]
+	return {
+		destinations: [...baseline.destinations, ...added.destinations],
+		fqdns: [...baseline.fqdns, ...added.fqdns],
+		dnsNarrowedTo,
+		permitsEverything: baseline.permitsEverything || added.permitsEverything,
+		permitsNothing: baseline.permitsNothing && added.permitsNothing,
+		policyKind: baseline.policyKind,
+		namedObject: baseline.namedObject,
+		alsoNamed: [...(baseline.alsoNamed ?? []), added.namedObject, ...(added.alsoNamed ?? [])],
+	}
+}
+
 // ---------------------------------------------------------------------------
 // Is one policy's rule inside the translation
 // ---------------------------------------------------------------------------
@@ -3311,7 +3417,9 @@ function isNamedObject(
 	kind: EgressPolicyDocument['kind'],
 	name: string,
 ): boolean {
-	return allowance.namedObject.kind === kind && allowance.namedObject.name === name
+	const matches = (entry: { readonly kind: string; readonly name: string }): boolean =>
+		entry.kind === kind && entry.name === name
+	return matches(allowance.namedObject) || (allowance.alsoNamed ?? []).some(matches)
 }
 
 /** Every core `NetworkPolicy` in the list, reduced to {@link EgressPolicyDocument}. */
@@ -3714,7 +3822,22 @@ export async function verifyEgressPolicyUnion(
 	target: EgressVerificationTarget,
 	signal?: AbortSignal,
 ): Promise<void> {
-	const allowance = egressAllowance(translated)
+	await verifyEgressPolicyUnionAgainst(client, egressAllowance(translated), target, signal)
+}
+
+/**
+ * {@link verifyEgressPolicyUnion} against an allowance the caller already
+ * built — the entry point for a question about more than one translation,
+ * which is what the post-write check of a per-sandbox policy is: the pod's
+ * boundary is the baseline's allowance plus the written policy's, see
+ * {@link unionEgressAllowance}.
+ */
+export async function verifyEgressPolicyUnionAgainst(
+	client: KubernetesClient,
+	allowance: EgressAllowance,
+	target: EgressVerificationTarget,
+	signal?: AbortSignal,
+): Promise<void> {
 	const documents: EgressPolicyDocument[] = []
 	try {
 		documents.push(

package/src/backends/kubernetes/identity.ts

@@ -53,6 +53,81 @@ export interface KubernetesWorkspaceIdentity {
 	readonly guestBootId: string | undefined
 }
 
+/**
+ * The identity a host retained for a workspace, to be authenticated against
+ * what stands under the workspace's deterministic name before anything is
+ * written or reported.
+ *
+ *  - `sandboxUid` — the Sandbox object. The decisive field: a delete and
+ *    re-create under the same id changes it, and the disk with it.
+ *  - `volumeClaimUids` — optional, keyed by `volumeClaimTemplates` entry name.
+ *    Checked by {@link openKubernetesWorkspace} and
+ *    {@link reconcileKubernetesWorkspace}; an entry that is absent from the
+ *    cluster is "not there yet", not "replaced". Lifecycle writes pin the
+ *    Sandbox uid alone, because the claims are owned by the Sandbox.
+ */
+export interface KubernetesWorkspaceExpectedIdentity {
+	readonly sandboxUid: string
+	readonly volumeClaimUids?: Readonly<Record<string, string>>
+}
+
+/** Which part of a retained identity did not hold. */
+export type KubernetesWorkspaceIdentityMismatch =
+	| 'sandbox-absent'
+	| 'sandbox-uid'
+	| 'volume-claim-uid'
+	| 'volume-claim-owner'
+
+/**
+ * Thrown by {@link openKubernetesWorkspace} when what stands under the
+ * workspace's name is not the workspace the host retained.
+ *
+ * The refusal is about OWNERSHIP and nothing else. A `resourceVersion` that
+ * moved, a `Ready` condition that flipped and a condition left over from an
+ * earlier generation are the controller doing its work and never raise this;
+ * it needs a different Sandbox uid, a Sandbox that is gone, a claim with a
+ * different uid than the one retained, or a claim owned by another Sandbox.
+ * Nothing was created, woken or written to reach it, and it is terminal:
+ * retrying finds the same stranger.
+ */
+export class KubernetesWorkspaceIdentityMismatchError extends Error {
+	override readonly name = 'KubernetesWorkspaceIdentityMismatchError'
+
+	constructor(
+		readonly workspaceId: string,
+		readonly sandboxName: string,
+		readonly mismatch: KubernetesWorkspaceIdentityMismatch,
+		/** The uid that was retained for the thing that differs. */
+		readonly expected: string | undefined,
+		/** The uid standing there now; `undefined` when nothing does. */
+		readonly actual: string | undefined,
+		/** The `volumeClaimTemplates` entry, for the two claim mismatches. */
+		readonly claim?: string,
+	) {
+		super(
+			`kubernetes: workspace ${workspaceId} (Sandbox ${sandboxName}) is not the workspace this host retained — ${describeMismatch(mismatch, expected, actual, claim)}. Nothing was created, woken or written. The name is deterministic, so what stands under it now is not the disk the retained identity names; decide what the other one is worth before using it.`,
+		)
+	}
+}
+
+function describeMismatch(
+	mismatch: KubernetesWorkspaceIdentityMismatch,
+	expected: string | undefined,
+	actual: string | undefined,
+	claim: string | undefined,
+): string {
+	if (mismatch === 'sandbox-absent') {
+		return `no Sandbox stands there (retained uid ${String(expected)})`
+	}
+	if (mismatch === 'sandbox-uid') {
+		return `its Sandbox has uid ${String(actual)}, the retained one is ${String(expected)}`
+	}
+	if (mismatch === 'volume-claim-uid') {
+		return `its volume claim "${String(claim)}" has uid ${String(actual)}, the retained one is ${String(expected)}`
+	}
+	return `its volume claim "${String(claim)}" (uid ${String(actual)}) is owned by a different Sandbox than ${String(expected)}`
+}
+
 /**
  * Why the guest a handle is talking to is not the guest it was talking to.
  *
@@ -259,3 +334,138 @@ function describeEvidence(evidence: KubernetesGuestEvidence): string {
 	if (evidence === 'unknown') return 'the guest could not be identified at all'
 	return 'the guest is unchanged'
 }
+
+/**
+ * The whole guest a caller authenticated, to be handed to
+ * `workspace.pinGuest()`: the retained workspace identity
+ * ({@link KubernetesWorkspaceExpectedIdentity}, the same shape
+ * `openKubernetesWorkspace` takes) plus the two things only the guest side
+ * can say — the pod the agent runs in and the agent process itself.
+ *
+ * Every one of `sandboxUid`, `podUid` and `guestBootId` is REQUIRED, and a
+ * missing or empty one is refused with {@link KubernetesPinIncompleteError}
+ * rather than treated as "any": a pin that quietly matched everything the
+ * caller left blank would authenticate nothing. Read them off
+ * `workspace.identity` once a call has been answered, because
+ * `guestBootId` is `undefined` until the guest has spoken.
+ */
+export interface KubernetesPinnedGuestIdentity extends KubernetesWorkspaceExpectedIdentity {
+	readonly podUid: string
+	readonly guestBootId: string
+}
+
+/**
+ * `workspace.pinGuest()` was given an identity that cannot pin anything.
+ * Thrown synchronously, before a view exists; nothing was sent.
+ */
+export class KubernetesPinIncompleteError extends Error {
+	override readonly name = 'KubernetesPinIncompleteError'
+
+	constructor(
+		/** The fields that were absent, not a non-empty string, or malformed. */
+		readonly missing: readonly string[],
+	) {
+		super(
+			`kubernetes: pinGuest() needs a complete guest identity and was given one without ${missing.join(', ')}. A pin that left a field blank would match whatever stands there, which authenticates nothing. Read sandboxUid, podUid and guestBootId from workspace.identity after a call has been answered by the guest you mean to pin.`,
+		)
+	}
+}
+
+/** Why a pinned view refused a call. */
+export type KubernetesGuestPinRefusal =
+	/** The workspace's own identity no longer equals the pinned one. Checked before anything is dialed. */
+	| 'identity-changed'
+	/** The guest answered that it is a different agent process. It dispatched nothing. */
+	| 'guest-replaced'
+	/** The pod the view was pinned to refused its token: another pod stands there. */
+	| 'pod-replaced'
+	/** The guest agent is too old to authenticate a request, so a pin would silently not pin. Nothing was sent. */
+	| 'guest-unsupported'
+
+/**
+ * Thrown by every call on a pinned view when the guest behind the workspace
+ * is not the one the view was pinned to.
+ *
+ * It means the call did NOT run: either the host refused before dialing
+ * (`identity-changed`, `guest-unsupported`) or the guest agent compared its
+ * boot id first and dispatched nothing (`guest-replaced`), or the token was
+ * refused unread (`pod-replaced`). The view never rebinds, so the same call
+ * will keep refusing; pin the new guest if that is what you want.
+ *
+ * `freshGuestBootId` is the id of the agent that refused, when it said:
+ * different from `expected.guestBootId` means replaced, and an agent that
+ * answers `KubernetesAgentRetiringError` with the SAME id is fenced, not
+ * replaced.
+ */
+export class KubernetesGuestPinRefusedError extends Error {
+	override readonly name = 'KubernetesGuestPinRefusedError'
+
+	constructor(
+		readonly reason: KubernetesGuestPinRefusal,
+		readonly workspaceId: string,
+		readonly expected: KubernetesPinnedGuestIdentity,
+		/** The workspace's identity at the time, for `identity-changed`. */
+		readonly actual: KubernetesWorkspaceIdentity | undefined,
+		/** Which pinned field differed, for `identity-changed`. */
+		readonly field: 'sandboxUid' | 'volumeClaimUids' | 'podUid' | 'guestBootId' | undefined,
+		/** The boot id of the agent that answered, for `guest-replaced`. */
+		readonly freshGuestBootId: string | undefined,
+		options?: ErrorOptions,
+	) {
+		super(describePinRefusal(reason, workspaceId, expected, field, freshGuestBootId), options)
+	}
+}
+
+function describePinRefusal(
+	reason: KubernetesGuestPinRefusal,
+	workspaceId: string,
+	expected: KubernetesPinnedGuestIdentity,
+	field: string | undefined,
+	fresh: string | undefined,
+): string {
+	const head = `kubernetes: this view of workspace ${workspaceId} is pinned to guest ${expected.guestBootId} in pod ${expected.podUid}`
+	if (reason === 'identity-changed') {
+		return `${head}, and the workspace's ${field ?? 'identity'} is no longer the pinned one. Nothing was sent. A pinned view never rebinds; pin the new guest if that is the one you mean.`
+	}
+	if (reason === 'guest-replaced') {
+		return `${head}, but the agent that answered is ${fresh ?? 'a different process'}. It compared its boot id before dispatching, so nothing ran. A pinned view never rebinds; pin the new guest if that is the one you mean.`
+	}
+	if (reason === 'pod-replaced') {
+		return `${head}, but that pod refused the pinned token, so a different pod stands there now. Nothing ran. A pinned view never rebinds; pin the new guest if that is the one you mean.`
+	}
+	return `${head}, but its guest agent does not advertise the 'pinned-guest' feature, so it would serve a request on whatever guest it is. Nothing was sent. Rebuild the workspace image from this Namzu release.`
+}
+
+/** A non-empty string, which is what every pinned identity field must be. */
+function isIdentityString(value: unknown): value is string {
+	return typeof value === 'string' && value !== ''
+}
+
+/**
+ * Validate and freeze a pin request, copying it first: the caller's object is
+ * not read again after this returns, so mutating it cannot loosen a pin.
+ */
+export function freezePinnedIdentity(
+	input: KubernetesPinnedGuestIdentity,
+): KubernetesPinnedGuestIdentity {
+	const source = (input ?? {}) as Partial<KubernetesPinnedGuestIdentity>
+	const missing: string[] = []
+	if (!isIdentityString(source.sandboxUid)) missing.push('sandboxUid')
+	if (!isIdentityString(source.podUid)) missing.push('podUid')
+	if (!isIdentityString(source.guestBootId)) missing.push('guestBootId')
+	let claims: Record<string, string> | undefined
+	if (source.volumeClaimUids !== undefined) {
+		claims = {}
+		for (const [name, uid] of Object.entries(source.volumeClaimUids)) {
+			if (!isIdentityString(uid)) missing.push(`volumeClaimUids.${name}`)
+			else claims[name] = uid
+		}
+	}
+	if (missing.length > 0) throw new KubernetesPinIncompleteError(missing)
+	return Object.freeze({
+		sandboxUid: source.sandboxUid as string,
+		podUid: source.podUid as string,
+		guestBootId: source.guestBootId as string,
+		...(claims !== undefined ? { volumeClaimUids: Object.freeze(claims) } : {}),
+	})
+}

package/src/backends/kubernetes/index.ts

@@ -126,12 +126,15 @@ import {
 	assertPerSandboxEgressIsUsable,
 	composeAdditionalPodLabels,
 	defaultEgressPolicyName,
+	egressAllowance,
 	egressProfileLabel,
 	egressUnionVerificationEnabled,
 	perSandboxEgressLabelKey,
 	translateEgressPolicy,
+	unionEgressAllowance,
 	verifyEgressPolicyApplied,
 	verifyEgressPolicyUnion,
+	verifyEgressPolicyUnionAgainst,
 } from './egress-policy.js'
 import {
 	type KubernetesIngressConfig,
@@ -430,6 +433,13 @@ export interface KubernetesAcquisition {
 	 * {@link owner}.
 	 */
 	readonly perSandboxLabelValue?: string
+	/**
+	 * The bound pod's own labels, as the API server reported them — what a
+	 * policy's selector actually matches. Present under the same condition as
+	 * {@link owner}; the post-write union check enumerates the policies that
+	 * select THESE labels.
+	 */
+	readonly podLabels?: Readonly<Record<string, string>>
 	/** The TTL acquire stamped, which every renewal re-stamps. */
 	readonly ttlSeconds: number
 	/** DELETE that object. An already-gone object counts as released. */
@@ -628,7 +638,8 @@ export function buildKubernetesBackend(config: KubernetesBackendInternalConfig):
 	// CONFIGURATION and never a runtime probe, so a caller's capability
 	// detection cannot depend on when it asked.
 	const perSandbox = config.egress?.perSandbox
-	const fence = perSandbox === undefined ? undefined : buildAdmissionFence(client, perSandbox)
+	const fence =
+		perSandbox === undefined ? undefined : buildAdmissionFence(client, perSandbox, config.namespace)
 	return {
 		tier: 'microvm',
 		name: 'kubernetes',
@@ -655,6 +666,17 @@ export function buildKubernetesBackend(config: KubernetesBackendInternalConfig):
 							egress: { ...egress, perSandbox: egress.perSandbox },
 							owner: acquisition.owner,
 							selectorValue: acquisition.perSandboxLabelValue,
+							...(egressBoundary !== undefined && acquisition.podLabels !== undefined
+								? {
+										verifyUnion: (written, signal) =>
+											egressBoundary.verifyUnionWith(
+												acquisition.podLabels ?? {},
+												`the per-sandbox policy ${written.name} written for Sandbox ${acquisition.owner?.name} in namespace ${config.namespace}`,
+												written,
+												signal,
+											),
+									}
+								: {}),
 						})
 					: undefined
 			return await admitProbedSandbox(
@@ -690,6 +712,12 @@ export interface KubernetesEgressBoundary {
 	 * exact-match comparison and its once-per-boundary memo.
 	 */
 	verifyNamedObject(signal?: AbortSignal): Promise<void>
+	/**
+	 * The translated policy itself — the same one-per-boundary translation
+	 * both checks compare against. Read-only: nothing is created or fetched
+	 * from the cluster. `resolveKubernetesExecutionProfile` fingerprints it.
+	 */
+	translatedPolicy(): Promise<KubernetesTranslatedEgressPolicy>
 	/**
 	 * Enumerate every policy selecting THIS pod and refuse when any of them
 	 * allows egress the translation does not. A no-op under
@@ -700,6 +728,20 @@ export interface KubernetesEgressBoundary {
 		subject: string,
 		signal?: AbortSignal,
 	): Promise<void>
+	/**
+	 * The same enumeration after a per-sandbox policy was WRITTEN: refuse when
+	 * any policy selecting this pod allows more than the baseline translation
+	 * plus `added`. Never cached — it runs once per write, against the cluster
+	 * as it is at that moment, because a policy applied between two writes is
+	 * exactly what it exists to notice. A no-op under
+	 * `egress.verify: 'named-object-only'`.
+	 */
+	verifyUnionWith(
+		podLabels: Readonly<Record<string, string>>,
+		subject: string,
+		added: KubernetesTranslatedEgressPolicy,
+		signal?: AbortSignal,
+	): Promise<void>
 }
 
 /**
@@ -776,6 +818,7 @@ export function buildEgressBoundary(
 	// resolves and a per-check throw would surface from a cache lookup.
 	const perSandboxKey = perSandboxEgressLabelKey(egress)
 	return {
+		translatedPolicy: translate,
 		async verifyNamedObject(signal) {
 			namedObject ??= (async () => {
 				await verifyEgressPolicyApplied(client, await translate(), signal)
@@ -808,6 +851,20 @@ export function buildEgressBoundary(
 			passes.set(key, { at: now(), pending })
 			await pending
 		},
+		async verifyUnionWith(podLabels, subject, added, signal) {
+			if (!egressUnionVerificationEnabled(egress)) return
+			const baseline = await translate()
+			await verifyEgressPolicyUnionAgainst(
+				client,
+				unionEgressAllowance(egressAllowance(baseline), egressAllowance(added)),
+				// 'cilium' whatever `egress.engine` says: the policy just written is
+				// a `CiliumNetworkPolicy`, so the Cilium collection has to be
+				// enumerated for a widening one to be seen at all. Under the
+				// default engine the create path reads core policies only.
+				{ namespace: config.namespace, podLabels, engine: 'cilium', subject },
+				signal,
+			)
+		},
 	}
 }
 
@@ -1667,7 +1724,9 @@ export async function acquireKubernetesSandbox(
 				? { refreshAgent: buildAgentAddressRefresh(client, namespace, binding, agentPort, mode) }
 				: {}),
 			ownedPath,
-			...(owner !== undefined ? { owner, perSandboxLabelValue: objectName } : {}),
+			...(owner !== undefined
+				? { owner, perSandboxLabelValue: objectName, podLabels: pod.labels ?? podLabels }
+				: {}),
 			ttlSeconds,
 			release,
 			renew,