@wardby/cli 0.2.0 → 0.3.0

package/dist/providers/jobs/kubernetes-isolation.js

@@ -6,15 +6,34 @@
  */
 import { createHash } from "node:crypto";
 import { isIP } from "node:net";
-import { CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT, CODING_WORKER_GID, CODING_WORKER_UID, WORKER_STOP_GRACE_SECONDS, isRepositoryDigest, } from "./docker-isolation.js";
-import { GVISOR_RUNTIME_CLASS, KubernetesPlatformError, STORAGE_INIT_EPHEMERAL_MIB, WORKER_EPHEMERAL_MIB, conformResources, describeMib, normalizePlatformMetadata, platformProfile, podEphemeralStorageMib, } from "./kubernetes-platform.js";
+import { StoredCodingServicesSchema } from "../../coding/services/catalog.js";
+import { CLAUDE_TOOL_SETUP_ENV, CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT, CODING_WORKER_GID, CODING_WORKER_UID, WORKER_STOP_GRACE_SECONDS, claudeToolLimits, isRepositoryDigest, } from "./docker-isolation.js";
+import { GVISOR_RUNTIME_CLASS, KubernetesPlatformError, STORAGE_INIT_EPHEMERAL_MIB, TOOL_RUNNER_EPHEMERAL_MIB, WORKER_EPHEMERAL_MIB, conformResources, describeMib, normalizePlatformMetadata, platformProfile, podEphemeralStorageMib, } from "./kubernetes-platform.js";
 export const KUBERNETES_ISOLATION_ERROR = "kubernetes_isolation_unsupported";
-export const KUBERNETES_PROVIDER_UNSUPPORTED = "kubernetes_provider_unsupported";
 /** Extra seconds past timeoutSec before Kubernetes kills the pod (keeper included). */
 export const POD_DEADLINE_GRACE_SECONDS = 300;
 export const KEEPER_CONTAINER = "keeper";
 export const STORAGE_INIT_CONTAINER = "storage-init";
 export const WORKER_CONTAINER = "worker";
+/** Claude's credential-free command runner: a native sidecar in the run pod. */
+export const TOOL_RUNNER_CONTAINER = "tool-runner";
+/** The run Secret's key holding the tool runner's setup (claude-tool-setup.ts). */
+export const TOOL_SETUP_SECRET_KEY = "tool-setup";
+/** Where the tool runner listens and the agent's relay connects (claude-tool-runner/main.mjs). */
+export const TOOL_SOCKET_PATH = "/run/wardby/tool/runner.sock";
+const CODEX_ENTRYPOINT = "/opt/wardby/coding-worker/main.js";
+const CLAUDE_ENTRYPOINT = "/opt/wardby/claude-coding-worker/main.js";
+/** Every service sidecar's container name starts with this (service-postgres, service-redis, ...). */
+export const SERVICE_CONTAINER_PREFIX = "service-";
+/** Disk-backed scratch for each of a service's writablePaths (a socket directory, /tmp). */
+export const SERVICE_SCRATCH_MIB = 64;
+export function serviceContainerName(name) {
+    return `${SERVICE_CONTAINER_PREFIX}${name}`;
+}
+/** What a service sidecar reserves of the pod's ephemeral storage: its data volume plus its scratch volumes. */
+export function serviceEphemeralStorageMib(service) {
+    return service.resources.diskMib + SERVICE_SCRATCH_MIB * service.writablePaths.length;
+}
 export const STORAGE_ROOT = "/run/wardby/storage";
 export const KEEPER_SEEDED_MARKER = `${STORAGE_ROOT}/input/.seeded`;
 export const PROXY_POD_LABEL = { "app.kubernetes.io/name": "wardby-coding-proxy" };
@@ -36,33 +55,55 @@ export const ENFORCEMENT_PROBE_PROXY_UNREACHABLE = 4;
 export const ENFORCEMENT_PROBE_DENY_REFUSED = 5;
 const WORKER_SERVICE_ACCOUNT = "wardby-coding-worker";
 const RUN_ID = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,199}$/;
-/** The worker waits for the launcher's seeded marker, then runs the image's normal entrypoint. */
-const WORKER_GATE = [
-    'const fs = require("node:fs");',
-    'const marker = "/run/wardby/input/.seeded";',
-    "(function wait() {",
-    "  if (fs.existsSync(marker)) {",
-    '    import("/opt/wardby/coding-worker/main.js").catch(() => { process.exitCode = 1; });',
-    "  } else {",
-    "    setTimeout(wait, 250);",
-    "  }",
-    "})();",
-].join("\n");
+/** The worker waits for the launcher's seeded marker, then runs its provider's entrypoint. */
+function workerGate(entrypoint) {
+    return [
+        'const fs = require("node:fs");',
+        'const marker = "/run/wardby/input/.seeded";',
+        "(function wait() {",
+        "  if (fs.existsSync(marker)) {",
+        `    import(${JSON.stringify(entrypoint)}).catch(() => { process.exitCode = 1; });`,
+        "  } else {",
+        "    setTimeout(wait, 250);",
+        "  }",
+        "})();",
+    ].join("\n");
+}
 /**
  * Creates the worker's subPath mount sources, owned by the run uid, before any regular container
  * starts. Otherwise the kubelet creates them root-owned while setting up the worker's subPath mounts,
  * and the keeper (uid 10001, no capabilities) can't chmod them. Idempotent; no shell.
  */
-const STORAGE_INIT_SCRIPT = [
-    'const fs = require("node:fs");',
-    'for (const name of ["workspace", "input", "output"]) {',
-    `  const path = ${JSON.stringify(STORAGE_ROOT)} + "/" + name;`,
-    "  fs.mkdirSync(path, { recursive: true, mode: 0o700 });",
-    "  fs.chmodSync(path, 0o700);",
-    "}",
-].join("\n");
-function isolationError() {
-    return new Error(KUBERNETES_ISOLATION_ERROR);
+function storageInitScript(directories) {
+    return [
+        'const fs = require("node:fs");',
+        `for (const name of ${JSON.stringify(directories).replaceAll(",", ", ")}) {`,
+        `  const path = ${JSON.stringify(STORAGE_ROOT)} + "/" + name;`,
+        "  fs.mkdirSync(path, { recursive: true, mode: 0o700 });",
+        "  fs.chmodSync(path, 0o700);",
+        "}",
+    ].join("\n");
+}
+const STORAGE_DIRECTORIES = ["workspace", "input", "output"];
+/**
+ * Claude's socket volume: its own memory-backed emptyDir, mounted by the worker and the tool runner
+ * only. Under gVisor a Unix socket bound on the disk-backed storage volume is invisible to another
+ * container; a memory-backed emptyDir that two containers mount is one tmpfs shared across the
+ * sandbox (GKE Autopilot annotates it `share: pod`), so the agent's relay can connect.
+ */
+const TOOL_SOCKET_VOLUME = "tool-socket";
+const TOOL_SOCKET_VOLUME_MIB = 1;
+/**
+ * `reason` is a short, fixed code naming which check failed (never a value from the spec itself,
+ * so nothing operator-supplied — an image reference, a limit — ever ends up in the message). It's
+ * appended the same way kubernetes-preflight.ts's `failure(check, cause)` tags a canary failure:
+ * callers that only match on the bare `KUBERNETES_ISOLATION_ERROR` prefix (a substring match, e.g.
+ * `toThrow(KUBERNETES_ISOLATION_ERROR)` or `error.message.startsWith(...)`) are unaffected, while
+ * an operator reading the message (or a `this.warn(...)` of it — see kubernetes.ts's `launch()`)
+ * gets more than a bare code to go on.
+ */
+function isolationError(reason) {
+    return new Error(reason === undefined ? KUBERNETES_ISOLATION_ERROR : `${KUBERNETES_ISOLATION_ERROR}:${reason}`);
 }
 function sha256(value) {
     return createHash("sha256").update(value).digest("hex");
@@ -105,22 +146,43 @@ function isWholeMillicores(cpus) {
 }
 export function validateKubernetesSpec(spec) {
     if (spec.kind !== "coding-agent" || !RUN_ID.test(spec.runId))
-        throw isolationError();
-    if (spec.provider === "claude-code")
-        throw new Error(KUBERNETES_PROVIDER_UNSUPPORTED);
-    if (spec.provider !== undefined && spec.provider !== "codex")
-        throw isolationError();
-    if (spec.toolImage !== undefined || !isRegistryDigest(spec.image))
-        throw isolationError();
-    const { cpus, memoryMb, pids, diskMb } = spec.limits;
-    if (!inRange(cpus, 0.1, 32, false) ||
-        !isWholeMillicores(cpus) ||
-        !inRange(memoryMb, 128, 65_536, true) ||
-        !inRange(pids, 16, 4_096, true) ||
-        !inRange(diskMb, 64, 32_768, true) ||
-        !inRange(spec.timeoutSec, 1, 86_400, true)) {
-        throw isolationError();
+        throw isolationError("run-id");
+    if (spec.provider !== undefined && spec.provider !== "codex" && spec.provider !== "claude-code") {
+        throw isolationError("provider");
+    }
+    if (spec.provider === "claude-code") {
+        if (spec.toolImage === undefined || !isRegistryDigest(spec.toolImage)) {
+            throw isolationError("tool-image-not-registry-digest");
+        }
+        // Docker's floor for the same split (docker-isolation.ts validateSpec): the tool runner takes 0.25 CPU and ≥128 MiB.
+        if (spec.limits.cpus < 0.35 || spec.limits.memoryMb < 256)
+            throw isolationError("claude-limits-too-small");
+    }
+    else if (spec.toolImage !== undefined) {
+        throw isolationError("tool-image-set");
     }
+    if (!isRegistryDigest(spec.image))
+        throw isolationError("image-not-registry-digest");
+    if (spec.services !== undefined) {
+        // Re-validated here, not trusted from dispatch: every image a digest, every path and probe in bounds.
+        const names = spec.services.map((service) => service.name);
+        if (spec.services.length === 0 ||
+            new Set(names).size !== names.length ||
+            !StoredCodingServicesSchema.safeParse(spec.services).success) {
+            throw isolationError("services-invalid");
+        }
+    }
+    const { cpus, memoryMb, pids, diskMb } = spec.limits;
+    if (!inRange(cpus, 0.1, 32, false) || !isWholeMillicores(cpus))
+        throw isolationError("cpus-out-of-range");
+    if (!inRange(memoryMb, 128, 65_536, true))
+        throw isolationError("memory-out-of-range");
+    if (!inRange(pids, 16, 4_096, true))
+        throw isolationError("pids-out-of-range");
+    if (!inRange(diskMb, 64, 32_768, true))
+        throw isolationError("disk-out-of-range");
+    if (!inRange(spec.timeoutSec, 1, 86_400, true))
+        throw isolationError("timeout-out-of-range");
 }
 function containerSecurity() {
     return {
@@ -131,6 +193,56 @@ function containerSecurity() {
         capabilities: { drop: ["ALL"] },
     };
 }
+/**
+ * The emptyDirs behind one service's mounts: its data path, then each writable path. The only place
+ * their names are built, so the sidecar's volumeMounts and the pod's volumes can never disagree.
+ */
+function serviceStorage(service, index) {
+    return [
+        { name: `service-${index}-data`, mountPath: service.dataPath, sizeMib: service.resources.diskMib },
+        ...service.writablePaths.map((path, scratch) => ({
+            name: `service-${index}-scratch-${scratch}`,
+            mountPath: path,
+            sizeMib: SERVICE_SCRATCH_MIB,
+        })),
+    ];
+}
+/**
+ * One coding-run service as a native sidecar (docs/coding-services.md): an init container with
+ * restartPolicy Always, so the kubelet starts it before the keeper and worker and holds them until
+ * its startup probe (the catalog's readiness command) passes. It runs the catalog's image with its
+ * own entrypoint, under the same security context as every other container, with an emptyDir at its
+ * data path and at each writable path. Same pod, same network namespace: the worker reaches it on
+ * 127.0.0.1, and the run's NetworkPolicy needs no change.
+ */
+function serviceSidecar(service, index, profile) {
+    const env = Object.entries(service.serviceEnv)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([name, value]) => ({ name, value }));
+    return {
+        name: serviceContainerName(service.name),
+        image: service.image,
+        restartPolicy: "Always",
+        ...(env.length > 0 ? { env } : {}),
+        securityContext: containerSecurity(),
+        resources: conformResources(profile, {
+            cpuMillicores: service.resources.cpuMillicores,
+            memoryMib: service.resources.memoryMib,
+            ephemeralStorageMib: serviceEphemeralStorageMib(service),
+        }),
+        startupProbe: {
+            exec: { command: [...service.readiness.command] },
+            periodSeconds: service.readiness.periodSeconds,
+            timeoutSeconds: service.readiness.timeoutSeconds,
+            failureThreshold: service.readiness.failureThreshold,
+            successThreshold: 1,
+        },
+        volumeMounts: serviceStorage(service, index).map(({ name, mountPath }) => ({ name, mountPath })),
+    };
+}
+function serviceVolumes(services) {
+    return services.flatMap((service, index) => serviceStorage(service, index).map(({ name, sizeMib }) => ({ name, emptyDir: { sizeLimit: `${sizeMib}Mi` } })));
+}
 export function buildRunPod(spec, options) {
     validateKubernetesSpec(spec);
     const profile = platformProfile(options.platform ?? "generic");
@@ -144,19 +256,23 @@ export function buildRunPod(spec, options) {
     // conformResources range-checks one container at a time; only this function sees every container,
     // so the SUMMED pod total is checked here — before submission, so an over-large workspace fails
     // closed rather than being rewritten by the platform (which attestation would then reject anyway).
+    const services = spec.services ?? [];
     const ceiling = profile.resources.ephemeralStorageCeilingMib;
-    const podEphemeral = podEphemeralStorageMib(spec.limits.diskMb);
+    const podEphemeral = podEphemeralStorageMib(spec.limits.diskMb, services.reduce((total, service) => total + serviceEphemeralStorageMib(service), 0));
     if (ceiling !== undefined && podEphemeral > ceiling) {
-        throw new KubernetesPlatformError(`a ${spec.limits.diskMb} MiB workspace needs ${podEphemeral} MiB of pod ephemeral storage, over the ${describeMib(ceiling)} ceiling of platform ${profile.name}`);
+        throw new KubernetesPlatformError(`a ${spec.limits.diskMb} MiB workspace${services.length > 0 ? " and its services" : ""} need${services.length > 0 ? "" : "s"} ${podEphemeral} MiB of pod ephemeral storage, over the ${describeMib(ceiling)} ceiling of platform ${profile.name}`);
     }
     const names = kubernetesRunNames(spec.runId);
     const scratchMb = Math.max(16, Math.min(64, Math.floor(spec.limits.memoryMb / 8)));
     const sidecarCpuMillicores = 250;
     const sidecarMemoryMib = 128;
+    const claude = spec.provider === "claude-code";
+    const tool = claudeToolLimits(spec);
+    const toolScratchMb = Math.max(16, Math.min(64, Math.floor(tool.memoryMb / 8)));
     const storageInit = {
         name: STORAGE_INIT_CONTAINER,
         image: spec.image,
-        command: ["node", "-e", STORAGE_INIT_SCRIPT],
+        command: ["node", "-e", storageInitScript(STORAGE_DIRECTORIES)],
         securityContext: containerSecurity(),
         resources: conformResources(profile, {
             cpuMillicores: sidecarCpuMillicores,
@@ -182,25 +298,73 @@ export function buildRunPod(spec, options) {
     const worker = {
         name: WORKER_CONTAINER,
         image: spec.image,
-        command: ["node", "-e", WORKER_GATE],
+        command: ["node", "-e", workerGate(claude ? CLAUDE_ENTRYPOINT : CODEX_ENTRYPOINT)],
         env: [
             { name: "WARDBY_PROXY_URL", value: `http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}` },
             { name: "WARDBY_RUN_CAPABILITY", valueFrom: { secretKeyRef: { name: names.secret, key: "capability" } } },
         ],
         securityContext: containerSecurity(),
         resources: conformResources(profile, {
-            cpuMillicores: Math.round(spec.limits.cpus * 1000),
-            memoryMib: spec.limits.memoryMb,
-            ephemeralStorageMib: WORKER_EPHEMERAL_MIB,
+            cpuMillicores: Math.round((claude ? spec.limits.cpus - tool.cpus : spec.limits.cpus) * 1000),
+            memoryMib: claude ? spec.limits.memoryMb - tool.memoryMb : spec.limits.memoryMb,
+            ephemeralStorageMib: claude ? WORKER_EPHEMERAL_MIB - TOOL_RUNNER_EPHEMERAL_MIB : WORKER_EPHEMERAL_MIB,
         }),
-        volumeMounts: [
-            { name: "storage", mountPath: "/workspace", subPath: "workspace" },
-            { name: "storage", mountPath: "/run/wardby/input", subPath: "input", readOnly: true },
-            { name: "storage", mountPath: "/run/wardby/output", subPath: "output" },
-            { name: "tmp", mountPath: "/tmp" },
-            { name: "home", mountPath: "/home/wardby" },
-        ],
+        // Claude's agent never sees the repository: the tool runner does, over the socket.
+        volumeMounts: claude
+            ? [
+                { name: "storage", mountPath: "/run/wardby/input", subPath: "input", readOnly: true },
+                { name: "storage", mountPath: "/run/wardby/output", subPath: "output" },
+                { name: TOOL_SOCKET_VOLUME, mountPath: "/run/wardby/tool" },
+                { name: "tmp", mountPath: "/tmp" },
+                { name: "home", mountPath: "/home/wardby" },
+            ]
+            : [
+                { name: "storage", mountPath: "/workspace", subPath: "workspace" },
+                { name: "storage", mountPath: "/run/wardby/input", subPath: "input", readOnly: true },
+                { name: "storage", mountPath: "/run/wardby/output", subPath: "output" },
+                { name: "tmp", mountPath: "/tmp" },
+                { name: "home", mountPath: "/home/wardby" },
+            ],
     };
+    /**
+     * Claude's tool runner (docs/coding-worker-isolation.md): a native sidecar, so the kubelet starts it
+     * before the keeper and worker and holds them until its socket exists. It mounts the workspace and
+     * the socket, gets its registry/service setup from the run's Secret, and never the capability. It
+     * shares the pod's network namespace, so the run's single egress rule (the proxy) applies to it too.
+     */
+    const toolRunner = claude
+        ? {
+            name: TOOL_RUNNER_CONTAINER,
+            image: spec.toolImage,
+            command: ["node", "/opt/wardby/claude-tool-runner/main.mjs"],
+            restartPolicy: "Always",
+            env: [
+                {
+                    name: CLAUDE_TOOL_SETUP_ENV,
+                    valueFrom: { secretKeyRef: { name: names.secret, key: TOOL_SETUP_SECRET_KEY } },
+                },
+            ],
+            securityContext: containerSecurity(),
+            resources: conformResources(profile, {
+                cpuMillicores: Math.round(tool.cpus * 1000),
+                memoryMib: tool.memoryMb,
+                ephemeralStorageMib: TOOL_RUNNER_EPHEMERAL_MIB,
+            }),
+            startupProbe: {
+                exec: { command: ["test", "-S", TOOL_SOCKET_PATH] },
+                periodSeconds: 1,
+                timeoutSeconds: 1,
+                failureThreshold: 60,
+                successThreshold: 1,
+            },
+            volumeMounts: [
+                { name: "storage", mountPath: "/workspace", subPath: "workspace" },
+                { name: TOOL_SOCKET_VOLUME, mountPath: "/run/wardby/tool" },
+                { name: "tool-tmp", mountPath: "/tmp" },
+                { name: "tool-home", mountPath: "/home/wardby" },
+            ],
+        }
+        : undefined;
     return {
         apiVersion: "v1",
         kind: "Pod",
@@ -226,6 +390,9 @@ export function buildRunPod(spec, options) {
             dnsConfig: { nameservers: ["127.0.0.1"] },
             hostAliases: [{ ip: options.proxyIp, hostnames: [CODING_PROXY_ALIAS] }],
             ...(options.runtimeClassName ? { runtimeClassName: options.runtimeClassName } : {}),
+            // Part of the submitted spec, so attestation compares it like any other field; the
+            // `priority` and `preemptionPolicy` the API server resolves from it are normalized away.
+            ...(options.priorityClassName ? { priorityClassName: options.priorityClassName } : {}),
             securityContext: {
                 runAsNonRoot: true,
                 runAsUser: CODING_WORKER_UID,
@@ -237,8 +404,22 @@ export function buildRunPod(spec, options) {
                 { name: "storage", emptyDir: { sizeLimit: `${spec.limits.diskMb}Mi` } },
                 { name: "tmp", emptyDir: { medium: "Memory", sizeLimit: `${scratchMb}Mi` } },
                 { name: "home", emptyDir: { medium: "Memory", sizeLimit: `${scratchMb}Mi` } },
+                ...(claude
+                    ? [
+                        { name: TOOL_SOCKET_VOLUME, emptyDir: { medium: "Memory", sizeLimit: `${TOOL_SOCKET_VOLUME_MIB}Mi` } },
+                        { name: "tool-tmp", emptyDir: { medium: "Memory", sizeLimit: `${toolScratchMb}Mi` } },
+                        { name: "tool-home", emptyDir: { medium: "Memory", sizeLimit: `${toolScratchMb}Mi` } },
+                    ]
+                    : []),
+                ...serviceVolumes(services),
+            ],
+            // storage-init first (it must finish before any subPath mount), then Claude's tool runner, then each
+            // service sidecar in declaration order; the keeper and worker start only once every sidecar started.
+            initContainers: [
+                storageInit,
+                ...(toolRunner ? [toolRunner] : []),
+                ...services.map((service, index) => serviceSidecar(service, index, profile)),
             ],
-            initContainers: [storageInit],
             containers: [keeper, worker],
         },
     };
@@ -262,14 +443,14 @@ export function buildRunNetworkPolicy(spec, namespace) {
         },
     };
 }
-export function buildCapabilitySecret(spec, namespace, capability) {
+export function buildCapabilitySecret(spec, namespace, capability, toolSetup) {
     const names = kubernetesRunNames(spec.runId);
     return {
         apiVersion: "v1",
         kind: "Secret",
         type: "Opaque",
         metadata: { name: names.secret, namespace, labels: runLabels(spec.runId) },
-        stringData: { capability },
+        stringData: { capability, ...(toolSetup !== undefined ? { [TOOL_SETUP_SECRET_KEY]: toolSetup } : {}) },
     };
 }
 /**

package/dist/providers/jobs/kubernetes-platform.d.ts

@@ -41,6 +41,11 @@ export declare const GVISOR_RUNTIME_CLASS = "gvisor";
 export declare const STORAGE_INIT_EPHEMERAL_MIB = 64;
 /** Ephemeral storage reserved for the worker's writable layer (/tmp and /home are memory-backed). */
 export declare const WORKER_EPHEMERAL_MIB = 1024;
+/**
+ * A Claude run's tool runner's share of WORKER_EPHEMERAL_MIB (its writable layer; /tmp and home are
+ * memory-backed). The agent gets the rest, so a Claude pod reserves exactly what a Codex pod does.
+ */
+export declare const TOOL_RUNNER_EPHEMERAL_MIB = 256;
 export interface PlatformResourceRules {
     /** Smallest CPU request the platform accepts, in millicores. */
     cpuFloorMillicores: number;
@@ -118,11 +123,12 @@ export interface ContainerResources {
  */
 export declare function conformResources(profile: KubernetesPlatformProfile, request: ContainerResourceRequest): ContainerResources;
 /**
- * The pod's total ephemeral storage: max(init containers) + sum(regular containers).
- * storage-init's 64 MiB never exceeds keeper + worker, so the total is the keeper's
- * storage volume plus the worker's reservation.
+ * The pod's total ephemeral storage: max(init containers) + sum(regular containers and sidecars).
+ * storage-init's 64 MiB never exceeds the rest, so the total is the keeper's storage volume, the
+ * worker's reservation, and whatever the run's service sidecars reserve (their data and scratch
+ * emptyDirs: serviceEphemeralStorageMib in kubernetes-isolation.ts).
  */
-export declare function podEphemeralStorageMib(diskMb: number): number;
+export declare function podEphemeralStorageMib(diskMb: number, servicesMib?: number): number;
 /**
  * Renders a MiB figure with its GiB equivalent, e.g. `10240 MiB (10 GiB)`. Both
  * places that report the ephemeral-storage ceiling use this rather than writing

package/dist/providers/jobs/kubernetes-platform.js

@@ -12,6 +12,11 @@ export const GVISOR_RUNTIME_CLASS = "gvisor";
 export const STORAGE_INIT_EPHEMERAL_MIB = 64;
 /** Ephemeral storage reserved for the worker's writable layer (/tmp and /home are memory-backed). */
 export const WORKER_EPHEMERAL_MIB = 1024;
+/**
+ * A Claude run's tool runner's share of WORKER_EPHEMERAL_MIB (its writable layer; /tmp and home are
+ * memory-backed). The agent gets the rest, so a Claude pod reserves exactly what a Codex pod does.
+ */
+export const TOOL_RUNNER_EPHEMERAL_MIB = 256;
 /**
  * Deep-freezes a profile. An allowance list is the set of differences attestation
  * will forgive: nothing at runtime — a later module, a test helper, a mistaken
@@ -174,12 +179,13 @@ export function conformResources(profile, request) {
     return { requests, limits: { ...requests } };
 }
 /**
- * The pod's total ephemeral storage: max(init containers) + sum(regular containers).
- * storage-init's 64 MiB never exceeds keeper + worker, so the total is the keeper's
- * storage volume plus the worker's reservation.
+ * The pod's total ephemeral storage: max(init containers) + sum(regular containers and sidecars).
+ * storage-init's 64 MiB never exceeds the rest, so the total is the keeper's storage volume, the
+ * worker's reservation, and whatever the run's service sidecars reserve (their data and scratch
+ * emptyDirs: serviceEphemeralStorageMib in kubernetes-isolation.ts).
  */
-export function podEphemeralStorageMib(diskMb) {
-    return diskMb + WORKER_EPHEMERAL_MIB;
+export function podEphemeralStorageMib(diskMb, servicesMib = 0) {
+    return diskMb + WORKER_EPHEMERAL_MIB + servicesMib;
 }
 /**
  * Renders a MiB figure with its GiB equivalent, e.g. `10240 MiB (10 GiB)`. Both

package/dist/providers/jobs/kubernetes-preflight.js

@@ -191,6 +191,9 @@ async function runCanary(options, state, proxyIp, timeoutMs, cleanupTimeoutMs) {
             namespace,
             proxyIp,
             runtimeClassName: config.runtimeClassName,
+            // The canary carries the class too, so a class missing from the cluster fails the
+            // preflight rather than the first real run.
+            priorityClassName: config.priorityClassName,
             platform: config.platform,
         });
         const podSpec = pod.spec;

package/dist/providers/jobs/kubernetes.d.ts

@@ -1,6 +1,7 @@
 import { type Readable } from "node:stream";
 import type { KubernetesJobConfig } from "../../config/providers.js";
 import { type KubernetesApi } from "./kubernetes-api.js";
+import type { CodingProvider } from "../../coding/provider.js";
 import type { JobHandle, JobResult, JobSpec, JobStatus, WorkspaceJobLauncher } from "./types.js";
 export interface KubernetesClusterInfo {
     /** The proxy Service's ClusterIP: the enforcement witness's address (8787 reachable, 8788 not). */
@@ -20,8 +21,19 @@ export interface KubernetesJobLauncherOptions {
     now?: () => number;
     sleep?: (milliseconds: number) => Promise<void>;
     readyTimeoutMs?: number;
-    /** How long to wait for the run's NetworkPolicy to be enforced before seeding. Default 30_000. */
+    /**
+     * How long to wait for the run's NetworkPolicy to be enforced before seeding. Default 30_000,
+     * but never *less* than `enforcementExecTimeoutMs * ENFORCEMENT_BLOCKED_STREAK`: see the
+     * constructor. An explicit override here is a floor raise, not an escape hatch — the gate still
+     * needs room for a full streak of probes at whatever the effective exec timeout is.
+     */
     enforcementTimeoutMs?: number;
+    /**
+     * Bound for a single enforcement probe exec. Default 10_000 (DEFAULT_ENFORCEMENT_EXEC_TIMEOUT_MS).
+     * Raise this on a resource-constrained cluster (e.g. `kind` on a laptop) where a healthy probe
+     * can legitimately take longer than 10 s to run inside the keeper's CPU/memory limits.
+     */
+    enforcementExecTimeoutMs?: number;
     createArchive?: (directory: string) => {
         stream: Readable;
         done: Promise<number>;
@@ -44,8 +56,14 @@ export declare class KubernetesJobLauncher implements WorkspaceJobLauncher {
     private readonly createArchive;
     private readonly warn;
     private readonly enforcementTimeoutMs;
+    private readonly enforcementExecTimeoutMs;
     private preflightResult?;
     constructor(options: KubernetesJobLauncherOptions);
+    /**
+     * Services run as native sidecars in the run pod (kubernetes-isolation.ts), for either provider:
+     * Claude Code's tool runner is a sidecar in the same pod, so it reaches them on 127.0.0.1 too.
+     */
+    supportsServicesFor(provider: CodingProvider): boolean;
     /**
      * Every per-run object name derives from the run id, so the handle is known before any cluster call.
      * The executor persists it first; a crash mid-launch then still has a handle to clean up with (the
@@ -104,7 +122,8 @@ export declare class KubernetesJobLauncher implements WorkspaceJobLauncher {
      * Streams the keeper's workspace through the strict extractor into `staging`.
      * The transfer is bounded by `timeoutMs` (see transferBudgetMs): on expiry the
      * extraction is aborted. On any failure the output stream this method created
-     * is destroyed, since the exec's own timeout does not end it.
+     * is destroyed, since the exec's own timeout does not end it. Excluded dependency
+     * and cache paths never leave the pod (see src/coding/collect-exclude.ts).
      */
     private extractWorkspace;
     /**