feat(orchestrator+egress): slice 8 — multi-tenant egress via the resolver (#352)

The egress addon now selects each request's Config by the calling bottle's
source IP, so one shared sidecar serves every bottle. Opt-in and fail-closed;
single-tenant behaviour is unchanged.

Orchestrator side (source-IP-primary attribution, per the PRD invariant):
  * registry: `by_source_ip` (the single active bottle at a source IP —
    network-layer attribution); `attribute` now composes it + the token.
  * service: `resolve(source_ip, token="")` — with a token, strict
    attribution; without, source IP alone.
  * control_plane: `POST /resolve`'s identity_token is now OPTIONAL (absent
    → source-IP-only); split cleanly from the token-required `/attribute`.
  * policy_resolver: `resolve` token now optional.

Egress side:
  * egress_addon_core: `resolve_client_config(resolver, client_ip, token)` —
    fetches + parses the client's Config, **fail-closed**: unattributed, a
    resolver error, or an unparseable policy all yield deny-all (no routes).
    Host-testable; `PolicyResolverLike` Protocol keeps it import-free.
  * egress_addon: consolidated mode when `BOT_BOTTLE_ORCHESTRATOR_URL` is
    set → `_active_config(flow)` resolves per client IP (reads + strips the
    `x-bot-bottle-identity` header); `request()` uses it. Unset → the static
    routes file, exactly as before. `PolicyResolver` added to the bundle.

Security note: source-IP-only resolution is safe where the IP is unspoofable
(Firecracker /31 + nft) AND the control plane is reachable only by the
trusted sidecar; the identity token, when the agent injects it, strengthens
it on weaker backends.

Scope note: the egress data plane is now multi-tenant. Remaining to be fully
live: the network topology routing every bottle's proxy to the one shared
sidecar, git-gate multitenancy, and agent-side identity-token injection.

Tests: registry by_source_ip; orchestrator resolve (with/without token);
control-plane /resolve token-optional; resolver token-optional;
resolve_client_config fail-closed matrix. All 182 egress tests still pass
(single-tenant unchanged). Full suite green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck

Dockerfile.sidecars

@@ -64,6 +64,7 @@ COPY --from=gitleaks-src /usr/bin/gitleaks /usr/bin/gitleaks
 COPY bot_bottle/egress_addon_core.py /app/egress_addon_core.py
 COPY bot_bottle/egress_dlp_config.py /app/egress_dlp_config.py
 COPY bot_bottle/egress_addon.py      /app/egress_addon.py
+COPY bot_bottle/policy_resolver.py   /app/policy_resolver.py
 COPY bot_bottle/dlp_detectors.py     /app/dlp_detectors.py
 COPY bot_bottle/yaml_subset.py       /app/yaml_subset.py
 COPY bot_bottle/paths.py             /app/paths.py

bot_bottle/docker_cmd.py

@@ -0,0 +1,27 @@
+"""Lean, framework-free `docker` subprocess primitive.
+
+Deliberately a top-level module with a single stdlib import so it can be
+reused from anywhere without cost. It is intentionally *not* placed in
+`backend.docker.util`: importing that module runs `backend/__init__.py`,
+which eagerly loads all three bottle backends (docker + firecracker +
+macos) plus the manifest/egress/git-gate/supervise framework — ~76 modules
+— which would drag the whole backend layer into the deliberately-lean
+orchestrator. This primitive stays free of that so both the orchestrator's
+docker components and (in time) `backend.docker.util` can share it."""
+
+from __future__ import annotations
+
+import subprocess
+
+
+def run_docker(argv: list[str]) -> subprocess.CompletedProcess[str]:
+    """Run a `docker` command, capturing stdout/stderr as text. Never raises
+    on a non-zero exit — callers inspect `returncode` / `stderr` so they can
+    stay fail-closed or tolerate idempotent no-ops (e.g. removing an
+    already-absent container)."""
+    return subprocess.run(
+        argv, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
+    )
+
+
+__all__ = ["run_docker"]

bot_bottle/egress_addon.py

@@ -32,6 +32,7 @@ from egress_addon_core import (  # type: ignore[import-not-found]  # pylint: dis
     is_git_push_request,
     load_config,
     match_route,
+    resolve_client_config,
     outbound_scan_headers,
     route_to_yaml_dict,
     scan_inbound,
@@ -51,11 +52,26 @@ try:
 except ImportError:  # pragma: no cover - host-side path
     from bot_bottle import supervise as _sv  # type: ignore[import-not-found]
 
+try:
+    from policy_resolver import PolicyResolver  # type: ignore[import-not-found]
+except ImportError:  # pragma: no cover - host-side path
+    from bot_bottle.policy_resolver import PolicyResolver
+
 
 DEFAULT_ROUTES_PATH = "/etc/egress/routes.yaml"
 
 INTROSPECT_HOST = "_egress.local"
 
+# Consolidated (multi-tenant) mode: when this points at the per-host
+# orchestrator's control plane, the addon resolves each client's Config by
+# source IP per request instead of using a single static routes file. Unset
+# → legacy per-bottle single-tenant mode (unchanged).
+ORCHESTRATOR_URL_ENV = "BOT_BOTTLE_ORCHESTRATOR_URL"
+
+# App-layer identity token (defense-in-depth over the source-IP invariant);
+# the agent injects it, the addon strips it so it never leaks upstream.
+IDENTITY_HEADER = "x-bot-bottle-identity"
+
 # Seconds the egress proxy holds a token-blocked request open waiting for the
 # operator's supervisor decision (PRD 0062), overridable via env.
 DEFAULT_TOKEN_ALLOW_TIMEOUT_SECONDS = 300.0
@@ -72,9 +88,17 @@ _TOKEN_ALLOW_JUSTIFICATION = (
 
 
 class EgressAddon:
+    # Class default so addons built via __new__ (e.g. in tests) default to
+    # single-tenant; __init__ sets the instance attribute for real runs.
+    _resolver: "PolicyResolver | None" = None
+
     def __init__(self) -> None:
         self.routes_path = os.environ.get("EGRESS_ROUTES", DEFAULT_ROUTES_PATH)
         self.config: Config = Config(routes=())
+        # Consolidated mode: resolve per-client Config from the orchestrator.
+        # Absent → single-tenant (static routes file); behaviour unchanged.
+        orch_url = os.environ.get(ORCHESTRATOR_URL_ENV, "").strip()
+        self._resolver = PolicyResolver(orch_url) if orch_url else None
         # Tokens the operator has approved this session (PRD 0062). In-memory
         # only — a restart re-prompts. Mutated only from the asyncio loop that
         # runs the addon hooks, so no lock is needed.
@@ -194,6 +218,20 @@ class EgressAddon:
             + "\n"
         )
 
+    def _active_config(self, flow: http.HTTPFlow) -> Config:
+        """The Config to apply to this request. Single-tenant → the static
+        `self.config`. Consolidated → the calling bottle's Config, resolved
+        by source IP (fail-closed to deny-all if unattributed). The identity
+        token, if the agent injected one, is read then stripped so it never
+        leaks upstream."""
+        if self._resolver is None:
+            return self.config
+        conn = flow.client_conn
+        client_ip = conn.peername[0] if conn and conn.peername else ""
+        token = flow.request.headers.get(IDENTITY_HEADER, "")
+        flow.request.headers.pop(IDENTITY_HEADER, None)
+        return resolve_client_config(self._resolver, client_ip, token)
+
     async def request(self, flow: http.HTTPFlow) -> None:
         request_path, _, query = flow.request.path.partition("?")
 
@@ -201,10 +239,12 @@ class EgressAddon:
             self._serve_introspection(flow, request_path)
             return
 
+        config = self._active_config(flow)
+
         # DLP outbound scan BEFORE stripping auth — catches tokens the
         # agent tried to smuggle in any header, path, query param, or body.
         # Hostname is included to catch DNS-tunnelling exfiltration attempts.
-        route = match_route(self.config.routes, flow.request.pretty_host)
+        route = match_route(config.routes, flow.request.pretty_host)
         if route is not None:
             if not await self._handle_outbound_dlp(flow, route):
                 return
@@ -224,7 +264,7 @@ class EgressAddon:
 
         if is_git_fetch_request(request_path, query):
             git_decision = decide_git_fetch(
-                self.config.routes, flow.request.pretty_host,
+                config.routes, flow.request.pretty_host,
             )
             if git_decision.action == "block":
                 self._block(
@@ -242,7 +282,7 @@ class EgressAddon:
         req_headers = {k.lower(): v for k, v in flow.request.headers.items()}
 
         decision = decide(
-            self.config.routes,
+            config.routes,
             flow.request.pretty_host,
             request_path,
             os.environ,
@@ -257,7 +297,7 @@ class EgressAddon:
         if decision.inject_authorization is not None:
             flow.request.headers["authorization"] = decision.inject_authorization
 
-        if self.config.log >= LOG_FULL:
+        if config.log >= LOG_FULL:
             self._log_request(flow)
 
     def _block_dlp(self, flow: http.HTTPFlow, result: ScanResult) -> None:

bot_bottle/egress_addon_core.py

@@ -413,6 +413,34 @@ def load_config(text: str) -> "Config":
     return parse_config(payload)
 
 
+class PolicyResolverLike(typing.Protocol):
+    """The bit of `policy_resolver.PolicyResolver` this module needs — kept a
+    Protocol so egress_addon_core stays free of that import."""
+
+    def resolve(self, source_ip: str, identity_token: str = ...) -> "str | None":
+        ...
+
+
+def resolve_client_config(
+    resolver: PolicyResolverLike, client_ip: str, identity_token: str = ""
+) -> "Config":
+    """The calling client's egress Config, resolved from the orchestrator via
+    `resolver` and parsed — **fail-closed**. An unattributed client (None), a
+    resolver error, or an unparseable policy all yield a deny-all Config (no
+    routes → every request blocked). A compromised, absent, or confused
+    orchestrator must never *widen* a bottle's egress."""
+    try:
+        policy = resolver.resolve(client_ip, identity_token)
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+        return Config(routes=())  # orchestrator unreachable/errored → deny
+    if not policy:
+        return Config(routes=())  # unattributed or empty → deny-all
+    try:
+        return load_config(policy)
+    except ValueError:
+        return Config(routes=())  # unparseable policy → deny
+
+
 # ---------------------------------------------------------------------------
 # Match evaluation
 # ---------------------------------------------------------------------------
@@ -804,6 +832,8 @@ __all__ = [
     "is_git_push_request",
     "is_git_fetch_request",
     "load_config",
+    "resolve_client_config",
+    "PolicyResolverLike",
     "match_route",
     "outbound_scan_headers",
     "parse_config",

bot_bottle/orchestrator/__init__.py

@@ -7,23 +7,57 @@ backend-neutral "consolidation core" that needs no VM packaging:
 
   * `registry`      — the SQLite runtime-state store + fail-closed
                       attribution (source IP + per-bottle identity token).
-  * `control_plane` — the HTTP control-plane RPC (register / deregister /
-                      list / attribute / health), with live reload.
+  * `broker`        — the signed, structured launch-request contract + a
+                      `LaunchBroker` (stub for the harness) that verifies
+                      provenance before acting.
+  * `sidecar`       — the consolidated per-host sidecar: a `Sidecar`
+                      lifecycle contract (idempotent singleton) + a
+                      `DockerSidecar` impl. One sidecar shared by all
+                      bottles instead of one per bottle.
+  * `service`       — the `Orchestrator`: owns the registry, brokers the
+                      launch lifecycle (launch/teardown), manages the
+                      shared sidecar, attributes.
+  * `control_plane` — the HTTP control-plane RPC (launch / teardown /
+                      list / attribute / sidecar / health).
 
-Launch/teardown, the launch broker, and the actual egress/git/supervise
-data plane land in later slices once this core is proven (see the PRD's
-sequencing: plain-process dev-harness -> docker orchestrator -> firecracker).
+The actual backend-native launch (a real docker/firecracker broker) and
+the egress/git/supervise data plane land in later slices once this core is
+proven (see the PRD sequencing: plain-process dev-harness -> docker
+orchestrator -> firecracker).
 """
 
 from __future__ import annotations
 
 from .registry import BottleRecord, RegistryStore, new_identity_token
+from .broker import (
+    BrokerAuthError,
+    LaunchBroker,
+    LaunchRequest,
+    StubBroker,
+    sign_request,
+    verify_request,
+)
+from .docker_broker import DockerBroker, DockerBrokerError
+from .sidecar import DockerSidecar, Sidecar, SidecarError
+from .service import Orchestrator
 from .control_plane import ControlPlaneServer, dispatch, make_server
 
 __all__ = [
     "BottleRecord",
     "RegistryStore",
     "new_identity_token",
+    "BrokerAuthError",
+    "LaunchBroker",
+    "LaunchRequest",
+    "StubBroker",
+    "DockerBroker",
+    "DockerBrokerError",
+    "Sidecar",
+    "DockerSidecar",
+    "SidecarError",
+    "sign_request",
+    "verify_request",
+    "Orchestrator",
     "ControlPlaneServer",
     "dispatch",
     "make_server",

bot_bottle/orchestrator/__main__.py

@@ -12,11 +12,16 @@ container packaging. Wrapping this exact service in a backend-native unit
 from __future__ import annotations
 
 import argparse
+import secrets
 from pathlib import Path
 
 from .. import log
+from .broker import LaunchBroker, StubBroker
 from .control_plane import make_server
+from .docker_broker import DockerBroker
 from .registry import RegistryStore, default_db_path
+from .service import Orchestrator
+from .sidecar import DockerSidecar, Sidecar
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -28,12 +33,34 @@ def main(argv: list[str] | None = None) -> int:
         "--db", type=Path, default=None,
         help=f"registry DB path (default: {default_db_path()})",
     )
+    parser.add_argument(
+        "--broker", choices=("stub", "docker"), default="stub",
+        help="launch broker: 'stub' records requests; 'docker' runs containers",
+    )
+    parser.add_argument(
+        "--sidecar", action="store_true",
+        help="run one consolidated per-host sidecar bundle (build-if-missing)",
+    )
     args = parser.parse_args(argv)
 
     registry = RegistryStore(args.db)
     registry.migrate()
 
-    server = make_server(registry, host=args.host, port=args.port)
+    # An ephemeral signing secret ties the orchestrator (signer) to its
+    # broker (verifier). 'stub' records launches instead of starting
+    # anything; 'docker' runs real containers (firecracker drops in later).
+    secret = secrets.token_bytes(32)
+    broker: LaunchBroker = DockerBroker(secret) if args.broker == "docker" else StubBroker(secret)
+    sidecar: Sidecar | None = DockerSidecar() if args.sidecar else None
+    orchestrator = Orchestrator(registry, broker, secret, sidecar)
+
+    # One persistent per-host sidecar, shared by every bottle: build the
+    # bundle image if missing, then bring the singleton up (idempotent).
+    if sidecar is not None:
+        orchestrator.ensure_sidecar()
+        log.info("consolidated sidecar ensured", context={"name": sidecar.name})
+
+    server = make_server(orchestrator, host=args.host, port=args.port)
     bound_host, bound_port = server.server_address[0], server.server_address[1]
     log.info(
         "orchestrator control plane listening",

bot_bottle/orchestrator/broker.py

@@ -0,0 +1,176 @@
+"""Launch broker contract (PRD 0070).
+
+A VM/container can't spawn its own host-network siblings, so the
+orchestrator brokers agent launches through a small privileged component.
+The request it sends is:
+
+  * **structured** — static flags + ids only (bottle id, pool slot, a
+    content-addressed image ref), never a free-form path or argv, so a
+    request can't be coerced into launching an arbitrary payload; and
+  * **signed** — wrapped as a compact JWS/JWT the broker verifies before
+    acting, so a *compromised co-located component* (an agent-facing
+    sidecar, say) can't forge a launch. This is the concrete form of the
+    "structured requests only" rule in the PRD security review.
+
+Signing is **HS256** over a secret shared by the orchestrator (signer) and
+the broker (verifier) — appropriate here because both are trusted host
+components provisioned together; the secret is exactly what an
+agent-facing component does not have. (Stdlib only — the project takes no
+runtime deps; a cross-host deployment could swap in an asymmetric alg.)
+"""
+
+from __future__ import annotations
+
+import abc
+import base64
+import hashlib
+import hmac
+import json
+import secrets
+import time
+from dataclasses import dataclass
+
+_JWT_HEADER = {"alg": "HS256", "typ": "JWT"}
+_ALLOWED_OPS = ("launch", "teardown")
+
+
+class BrokerAuthError(Exception):
+    """A broker request failed provenance or schema verification —
+    bad/absent signature, malformed token, or a payload that doesn't match
+    the fixed launch-request shape. Fail-closed: the broker must not act."""
+
+
+@dataclass(frozen=True)
+class LaunchRequest:
+    """The structured, un-coercible launch/teardown request. Ids + flags
+    only — `image_ref` is a content-addressed id, never a path/argv."""
+
+    op: str  # one of _ALLOWED_OPS
+    bottle_id: str
+    source_ip: str = ""
+    image_ref: str = ""
+    slot: int | None = None
+
+
+# --- minimal JWS/JWT (HS256), stdlib only ----------------------------------
+
+def _b64url(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _b64url_decode(text: str) -> bytes:
+    return base64.urlsafe_b64decode(text + "=" * (-len(text) % 4))
+
+
+def _mac(signing_input: str, secret: bytes) -> str:
+    digest = hmac.new(secret, signing_input.encode("ascii"), hashlib.sha256).digest()
+    return _b64url(digest)
+
+
+def sign_request(req: LaunchRequest, secret: bytes) -> str:
+    """Serialize `req` to signed-JWT form. Adds a per-signature `jti`
+    (replay id) and `iat` (issued-at)."""
+    claims: dict[str, object] = {
+        "op": req.op,
+        "bottle_id": req.bottle_id,
+        "source_ip": req.source_ip,
+        "image_ref": req.image_ref,
+        "slot": req.slot,
+        "jti": secrets.token_hex(8),
+        "iat": int(time.time()),
+    }
+    header = _b64url(json.dumps(_JWT_HEADER, sort_keys=True, separators=(",", ":")).encode())
+    payload = _b64url(json.dumps(claims, sort_keys=True, separators=(",", ":")).encode())
+    signing_input = f"{header}.{payload}"
+    return f"{signing_input}.{_mac(signing_input, secret)}"
+
+
+def verify_request(token: str, secret: bytes) -> LaunchRequest:
+    """Verify the signature and the request shape; return the parsed
+    request. Raises `BrokerAuthError` on any failure (fail-closed)."""
+    parts = token.split(".")
+    if len(parts) != 3:
+        raise BrokerAuthError("malformed token")
+    header_b, payload_b, sig = parts
+    if not hmac.compare_digest(_mac(f"{header_b}.{payload_b}", secret), sig):
+        raise BrokerAuthError("bad signature")
+    try:
+        header = json.loads(_b64url_decode(header_b))
+        claims = json.loads(_b64url_decode(payload_b))
+    except (ValueError, json.JSONDecodeError) as e:
+        raise BrokerAuthError("malformed token payload") from e
+    if not isinstance(header, dict) or header.get("alg") != "HS256":
+        raise BrokerAuthError("unexpected header/alg")
+    if not isinstance(claims, dict):
+        raise BrokerAuthError("claims are not an object")
+
+    op = claims.get("op")
+    bottle_id = claims.get("bottle_id")
+    source_ip = claims.get("source_ip", "")
+    image_ref = claims.get("image_ref", "")
+    slot = claims.get("slot")
+    if (
+        not isinstance(op, str) or op not in _ALLOWED_OPS
+        or not isinstance(bottle_id, str) or not bottle_id
+        or not isinstance(source_ip, str) or not isinstance(image_ref, str)
+        or not (slot is None or isinstance(slot, int))
+    ):
+        raise BrokerAuthError("request does not match the launch-request schema")
+    return LaunchRequest(
+        op=op, bottle_id=bottle_id, source_ip=source_ip, image_ref=image_ref, slot=slot
+    )
+
+
+# --- the broker itself ------------------------------------------------------
+
+class LaunchBroker(abc.ABC):
+    """Verifies a signed request came from the orchestrator, then performs
+    the backend-native launch/teardown. Subclasses implement `_launch` /
+    `_teardown`; verification is shared and fail-closed."""
+
+    def __init__(self, secret: bytes) -> None:
+        self._secret = secret
+
+    def submit(self, token: str) -> LaunchRequest:
+        """Verify `token` and perform its op. Returns the verified request;
+        raises `BrokerAuthError` if provenance/shape fails."""
+        req = verify_request(token, self._secret)
+        if req.op == "launch":
+            self._launch(req)
+        else:
+            self._teardown(req)
+        return req
+
+    @abc.abstractmethod
+    def _launch(self, req: LaunchRequest) -> None:
+        ...
+
+    @abc.abstractmethod
+    def _teardown(self, req: LaunchRequest) -> None:
+        ...
+
+
+class StubBroker(LaunchBroker):
+    """Dev-harness broker: records verified requests without launching
+    anything. Exercises the full sign -> verify -> act contract in-process."""
+
+    def __init__(self, secret: bytes) -> None:
+        super().__init__(secret)
+        self.launched: list[LaunchRequest] = []
+        self.torn_down: list[LaunchRequest] = []
+
+    def _launch(self, req: LaunchRequest) -> None:
+        self.launched.append(req)
+
+    def _teardown(self, req: LaunchRequest) -> None:
+        self.torn_down.append(req)
+
+
+__all__ = [
+    "BrokerAuthError",
+    "LaunchRequest",
+    "LaunchBroker",
+    "StubBroker",
+    "sign_request",
+    "verify_request",
+]

bot_bottle/orchestrator/control_plane.py

@@ -2,23 +2,30 @@
 
 The backend-agnostic control-plane RPC (CLI / console -> orchestrator) over
 **HTTP** — the universal transport chosen in 0070 (works on every host; no
-vsock / unix-socket portability caveats). Endpoints mutate the live
-registry, so register/deregister are the *live-reload* path — no restart:
+vsock / unix-socket portability caveats):
 
-    GET    /health              -> 200 {"status": "ok"}
-    GET    /bottles             -> 200 {"bottles": [ <redacted record>, ... ]}
-    POST   /bottles             -> 201 {"bottle_id", "identity_token"}
-                                   body: {"source_ip", ["bottle_id"], ["metadata"]}
-    DELETE /bottles/<bottle_id> -> 200 {"deregistered": true} | 404
-    POST   /attribute           -> 200 {"bottle_id"} | 403
-                                   body: {"source_ip", "identity_token"}
+    GET    /health                    -> 200 {"status": "ok"}
+    GET    /sidecar                   -> 200 {"configured", ["name","running"]}
+    GET    /bottles                   -> 200 {"bottles": [ <redacted record>, ...]}
+    POST   /bottles                   -> 201 {"bottle_id","identity_token"}  (launch)
+                                         body: {"source_ip", ["image_ref"],
+                                                ["metadata"], ["policy"]}
+    PUT    /bottles/<bottle_id>/policy -> 200 {"updated": true} | 404  (live reload)
+                                         body: {"policy"}
+    DELETE /bottles/<bottle_id>        -> 200 {"torn_down": true} | 404  (teardown)
+    POST   /attribute                 -> 200 {"bottle_id"} | 403
+    POST   /resolve                   -> 200 {"bottle_id","policy"} | 403
+                                         body: {"source_ip","identity_token"}
+
+`POST /bottles` / `DELETE` drive the full launch lifecycle: they mint (or
+tear down) the bottle in the registry AND broker the backend-native launch
+via the orchestrator. Register/deregister without a launch are internal to
+`Orchestrator`, not exposed here.
 
 Routing/handling is the pure function `dispatch()` so it is unit-testable
 without a socket; `Handler` / `ControlPlaneServer` / `make_server` are a
-thin stdlib adapter around it.
-
-Note the listing redacts identity tokens — they are never returned except
-once, to the caller that registers the bottle.
+thin stdlib adapter around it. Listing redacts identity tokens — they are
+returned only once, to the caller that launches the bottle.
 """
 
 from __future__ import annotations
@@ -30,7 +37,7 @@ import socketserver
 import typing
 from urllib.parse import urlsplit
 
-from .registry import RegistryStore
+from .service import Orchestrator
 
 # JSON body payload type (parsed request / rendered response).
 Json = dict[str, object]
@@ -46,18 +53,21 @@ def _parse_json_object(body: bytes) -> Json:
     return obj
 
 
-def dispatch(  # pylint: disable=too-many-return-statements
-    registry: RegistryStore, method: str, path: str, body: bytes
+def dispatch(  # pylint: disable=too-many-return-statements,too-many-branches
+    orch: Orchestrator, method: str, path: str, body: bytes
 ) -> tuple[int, Json]:
     """Route one control-plane request to a (status, payload) pair. Pure —
-    no I/O beyond the registry — so it is fully testable without a socket."""
+    no I/O beyond the orchestrator — so it is fully testable without a socket."""
     route = urlsplit(path).path.rstrip("/") or "/"
 
     if method == "GET" and route == "/health":
         return 200, {"status": "ok"}
 
+    if method == "GET" and route == "/sidecar":
+        return 200, orch.sidecar_status()
+
     if method == "GET" and route == "/bottles":
-        return 200, {"bottles": [r.redacted() for r in registry.all()]}
+        return 200, {"bottles": [r.redacted() for r in orch.registry.all()]}
 
     if method == "POST" and route == "/bottles":
         try:
@@ -67,19 +77,34 @@ def dispatch(  # pylint: disable=too-many-return-statements
         source_ip = data.get("source_ip")
         if not isinstance(source_ip, str) or not source_ip:
             return 400, {"error": "source_ip (string) is required"}
-        bottle_id = data.get("bottle_id")
+        image_ref = data.get("image_ref")
         metadata = data.get("metadata")
-        rec = registry.register(
+        policy = data.get("policy")
+        rec = orch.launch_bottle(
             source_ip,
-            bottle_id=bottle_id if isinstance(bottle_id, str) else None,
+            image_ref=image_ref if isinstance(image_ref, str) else "",
             metadata=metadata if isinstance(metadata, str) else "",
+            policy=policy if isinstance(policy, str) else "",
         )
         return 201, {"bottle_id": rec.bottle_id, "identity_token": rec.identity_token}
 
+    if method == "PUT" and route.startswith("/bottles/") and route.endswith("/policy"):
+        bottle_id = route[len("/bottles/"):-len("/policy")]
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        policy = data.get("policy")
+        if not isinstance(policy, str):
+            return 400, {"error": "policy (string) is required"}
+        if orch.set_policy(bottle_id, policy):
+            return 200, {"updated": True}
+        return 404, {"error": "no such bottle"}
+
     if method == "DELETE" and route.startswith("/bottles/"):
         bottle_id = route[len("/bottles/"):]
-        if registry.deregister(bottle_id):
-            return 200, {"deregistered": True}
+        if orch.teardown_bottle(bottle_id):
+            return 200, {"torn_down": True}
         return 404, {"error": "no such bottle"}
 
     if method == "POST" and route == "/attribute":
@@ -91,11 +116,28 @@ def dispatch(  # pylint: disable=too-many-return-statements
         token = data.get("identity_token")
         if not isinstance(source_ip, str) or not isinstance(token, str):
             return 400, {"error": "source_ip and identity_token (strings) required"}
-        rec = registry.attribute(source_ip, token)
+        rec = orch.attribute(source_ip, token)
         if rec is None:
             return 403, {"error": "unattributed"}
         return 200, {"bottle_id": rec.bottle_id}
 
+    if method == "POST" and route == "/resolve":
+        # The per-request lookup the multi-tenant sidecar makes: returns the
+        # bottle's policy. identity_token is OPTIONAL — absent means resolve
+        # by source IP alone (network-layer attribution).
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        source_ip = data.get("source_ip")
+        token = data.get("identity_token")
+        if not isinstance(source_ip, str) or not source_ip:
+            return 400, {"error": "source_ip (string) is required"}
+        rec = orch.resolve(source_ip, token if isinstance(token, str) else "")
+        if rec is None:
+            return 403, {"error": "unattributed"}
+        return 200, {"bottle_id": rec.bottle_id, "policy": rec.policy}
+
     return 404, {"error": "not found"}
 
 
@@ -114,7 +156,7 @@ class Handler(http.server.BaseHTTPRequestHandler):
         assert isinstance(server, ControlPlaneServer)
         length = int(self.headers.get("Content-Length") or 0)
         body = self.rfile.read(length) if length > 0 else b""
-        status, payload = dispatch(server.registry, method, self.path, body)
+        status, payload = dispatch(server.orchestrator, method, self.path, body)
         data = json.dumps(payload).encode()
         self.send_response(status)
         self.send_header("Content-Type", "application/json")
@@ -128,27 +170,30 @@ class Handler(http.server.BaseHTTPRequestHandler):
     def do_POST(self) -> None:
         self._serve("POST")
 
+    def do_PUT(self) -> None:
+        self._serve("PUT")
+
     def do_DELETE(self) -> None:
         self._serve("DELETE")
 
 
 class ControlPlaneServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
-    """Threading HTTP server that carries the registry for its handlers."""
+    """Threading HTTP server that carries the orchestrator for its handlers."""
 
     daemon_threads = True
     allow_reuse_address = True
 
-    def __init__(self, address: tuple[str, int], registry: RegistryStore) -> None:
-        self.registry = registry
+    def __init__(self, address: tuple[str, int], orchestrator: Orchestrator) -> None:
+        self.orchestrator = orchestrator
         super().__init__(address, Handler)
 
 
 def make_server(
-    registry: RegistryStore, host: str = "127.0.0.1", port: int = 0
+    orchestrator: Orchestrator, host: str = "127.0.0.1", port: int = 0
 ) -> ControlPlaneServer:
     """Build (but do not start) a control-plane server. `port=0` binds an
     ephemeral port — read `server.server_address` for the actual one."""
-    return ControlPlaneServer((host, port), registry)
+    return ControlPlaneServer((host, port), orchestrator)
 
 
 __all__ = ["dispatch", "Handler", "ControlPlaneServer", "make_server", "Json"]

bot_bottle/orchestrator/docker_broker.py

@@ -0,0 +1,83 @@
+"""Docker launch broker (PRD 0070) — the first *real* LaunchBroker.
+
+On a verified launch request it starts a Docker container; on teardown it
+removes it. This proves the orchestrator -> backend seam on the cheapest
+backend (the sidecar bundle is already containers). Only the request's
+static ids/flags reach `docker`, so nothing free-form crosses the boundary.
+
+Slice 3 launches a single container from the request's `image_ref`, named
+after the bottle id and labelled for cleanup. Wiring the full agent +
+sidecar bundle (networks, mounts, the consolidated sidecar) is a later
+slice — this is the seam, not the finished launcher.
+"""
+
+from __future__ import annotations
+
+import subprocess
+
+from ..docker_cmd import run_docker
+from .broker import LaunchBroker, LaunchRequest
+
+CONTAINER_PREFIX = "bot-bottle-orch-"
+BOTTLE_ID_LABEL = "bot-bottle-bottle-id"
+
+
+class DockerBrokerError(Exception):
+    """A brokered docker launch/teardown failed (non-zero `docker` exit)."""
+
+
+def container_name(bottle_id: str) -> str:
+    """Deterministic container name for a bottle."""
+    return f"{CONTAINER_PREFIX}{bottle_id}"
+
+
+def run_argv(req: LaunchRequest) -> list[str]:
+    """`docker run` argv for a launch request — built only from its static
+    fields, so it can't be coerced into an arbitrary command."""
+    return [
+        "docker", "run", "--detach",
+        "--name", container_name(req.bottle_id),
+        "--label", f"{BOTTLE_ID_LABEL}={req.bottle_id}",
+        req.image_ref,
+    ]
+
+
+def rm_argv(req: LaunchRequest) -> list[str]:
+    """`docker rm --force` argv to tear a bottle's container down."""
+    return ["docker", "rm", "--force", container_name(req.bottle_id)]
+
+
+class DockerBroker(LaunchBroker):
+    """A `LaunchBroker` that runs / removes a Docker container per bottle.
+    Provenance + schema verification are inherited from `LaunchBroker`."""
+
+    def _docker(self, argv: list[str]) -> subprocess.CompletedProcess[str]:
+        return run_docker(argv)
+
+    def _launch(self, req: LaunchRequest) -> None:
+        if not req.image_ref:
+            raise DockerBrokerError(f"launch request for {req.bottle_id} has no image_ref")
+        proc = self._docker(run_argv(req))
+        if proc.returncode != 0:
+            raise DockerBrokerError(
+                f"docker run failed for {req.bottle_id}: {proc.stderr.strip()}"
+            )
+
+    def _teardown(self, req: LaunchRequest) -> None:
+        proc = self._docker(rm_argv(req))
+        # Idempotent: an already-absent container is a successful teardown.
+        if proc.returncode != 0 and "No such container" not in proc.stderr:
+            raise DockerBrokerError(
+                f"docker rm failed for {req.bottle_id}: {proc.stderr.strip()}"
+            )
+
+
+__all__ = [
+    "DockerBroker",
+    "DockerBrokerError",
+    "container_name",
+    "run_argv",
+    "rm_argv",
+    "CONTAINER_PREFIX",
+    "BOTTLE_ID_LABEL",
+]

bot_bottle/orchestrator/registry.py

@@ -64,9 +64,13 @@ class BottleRecord:
     identity_token: str
     state: str = "active"
     created_at: float = 0.0
-    # Opaque JSON blob for forward-compat (policy refs, pool slot, ...) —
-    # the registry doesn't interpret it, so new fields need no migration.
+    # Opaque JSON blob for forward-compat (pool slot, ...) — the registry
+    # doesn't interpret it, so new fields need no migration.
     metadata: str = ""
+    # The bottle's sidecar policy (opaque JSON — egress allowlist / routes /
+    # git config). The registry stores and serves it verbatim, keyed by
+    # source IP; the multi-tenant sidecar interprets it.
+    policy: str = ""
 
     def redacted(self) -> dict[str, object]:
         """Public view for listing — never exposes the identity token."""
@@ -76,6 +80,7 @@ class BottleRecord:
             "state": self.state,
             "created_at": self.created_at,
             "metadata": self.metadata,
+            "policy": self.policy,
         }
 
 
@@ -97,6 +102,10 @@ _MIGRATIONS = TableMigrations(
         # the "one active bottle per source IP" check cheap.
         "CREATE INDEX IF NOT EXISTS idx_orchestrator_bottles_source_ip "
         "ON orchestrator_bottles (source_ip)",
+        # v3 — per-bottle policy (opaque JSON the sidecar interprets): the
+        # egress allowlist / routes / git config selected by source IP. The
+        # multi-tenant sidecar resolves it per request via `attribute`.
+        "ALTER TABLE orchestrator_bottles ADD COLUMN policy TEXT NOT NULL DEFAULT ''",
     ],
 )
 
@@ -110,6 +119,7 @@ def _row_to_record(row: sqlite3.Row) -> BottleRecord:
         state=row["state"],
         created_at=row["created_at"],
         metadata=row["metadata"],
+        policy=row["policy"],
     )
 
 
@@ -136,6 +146,7 @@ class RegistryStore(DbStore):
         bottle_id: str | None = None,
         identity_token: str | None = None,
         metadata: str = "",
+        policy: str = "",
     ) -> BottleRecord:
         """Register (or replace) a bottle. Mints a bottle_id / identity token
         when not supplied. Live — this is the control-plane reload path."""
@@ -146,12 +157,13 @@ class RegistryStore(DbStore):
             state="active",
             created_at=time.time(),
             metadata=metadata,
+            policy=policy,
         )
         with self._connect() as conn:
             conn.execute(
                 "INSERT OR REPLACE INTO orchestrator_bottles "
-                "(bottle_id, source_ip, identity_token, state, created_at, metadata) "
-                "VALUES (?, ?, ?, ?, ?, ?)",
+                "(bottle_id, source_ip, identity_token, state, created_at, metadata, policy) "
+                "VALUES (?, ?, ?, ?, ?, ?, ?)",
                 (
                     rec.bottle_id,
                     rec.source_ip,
@@ -159,11 +171,23 @@ class RegistryStore(DbStore):
                     rec.state,
                     rec.created_at,
                     rec.metadata,
+                    rec.policy,
                 ),
             )
         self._chmod()
         return rec
 
+    def set_policy(self, bottle_id: str, policy: str) -> bool:
+        """Update a bottle's policy in place (live reload). Returns True if
+        the bottle exists."""
+        with self._connect() as conn:
+            cur = conn.execute(
+                "UPDATE orchestrator_bottles SET policy = ? WHERE bottle_id = ?",
+                (policy, bottle_id),
+            )
+        self._chmod()
+        return cur.rowcount > 0
+
     def deregister(self, bottle_id: str) -> bool:
         """Remove a bottle. Returns True if a row was deleted."""
         with self._connect() as conn:
@@ -188,14 +212,13 @@ class RegistryStore(DbStore):
             ).fetchall()
         return [_row_to_record(r) for r in rows]
 
-    def attribute(self, source_ip: str, identity_token: str) -> BottleRecord | None:
-        """Fail-closed attribution. Returns the bottle only when exactly one
-        active record has this source IP AND its identity token matches
-        (constant-time). Either signal alone is insufficient: an unknown IP,
-        an ambiguous IP (more than one active bottle — a misconfiguration),
-        an empty token, or a token mismatch all deny."""
-        if not identity_token:
-            return None
+    def by_source_ip(self, source_ip: str) -> BottleRecord | None:
+        """Network-layer attribution: the single active bottle at this source
+        IP, or None if unknown or ambiguous (more than one — a
+        misconfiguration). Safe as the *sole* attributor only where the
+        source IP is unspoofable (Firecracker `/31` + nft) and the control
+        plane is reachable only by the trusted sidecar; pair with the
+        identity token (`attribute`) elsewhere."""
         with self._connect() as conn:
             rows = conn.execute(
                 "SELECT * FROM orchestrator_bottles "
@@ -204,7 +227,17 @@ class RegistryStore(DbStore):
             ).fetchall()
         if len(rows) != 1:
             return None
-        rec = _row_to_record(rows[0])
+        return _row_to_record(rows[0])
+
+    def attribute(self, source_ip: str, identity_token: str) -> BottleRecord | None:
+        """Fail-closed attribution: `by_source_ip` AND a matching identity
+        token (constant-time). Either signal alone is insufficient here — an
+        unknown/ambiguous IP, an empty token, or a token mismatch all deny."""
+        if not identity_token:
+            return None
+        rec = self.by_source_ip(source_ip)
+        if rec is None:
+            return None
         if not hmac.compare_digest(rec.identity_token, identity_token):
             return None
         return rec

bot_bottle/orchestrator/service.py

@@ -0,0 +1,121 @@
+"""The per-host orchestrator core (PRD 0070).
+
+`Orchestrator` is the single backend-neutral object the control plane talks
+to: it owns the registry (runtime state) and brokers agent launches. It
+never branches on backend — the `LaunchBroker` abstracts the backend-native
+launch, so this same object drives docker / firecracker / apple once a real
+broker is wired in.
+
+Launch lifecycle:
+
+  * `launch_bottle` mints the bottle (registry: source IP + identity
+    token), sends a *signed, structured* launch request through the broker,
+    and returns the record. If the broker rejects/fails, the registry entry
+    is rolled back so a failed launch leaves no orphan.
+  * `teardown_bottle` sends a signed teardown request, then deregisters.
+"""
+
+from __future__ import annotations
+
+from .broker import LaunchBroker, LaunchRequest, sign_request
+from .registry import BottleRecord, RegistryStore
+from .sidecar import Sidecar
+
+
+class Orchestrator:
+    """Owns the registry + brokers launches, and manages the single
+    consolidated per-host sidecar. Backend-neutral (broker and sidecar
+    abstract the backend-native pieces)."""
+
+    def __init__(
+        self,
+        registry: RegistryStore,
+        broker: LaunchBroker,
+        sign_secret: bytes,
+        sidecar: Sidecar | None = None,
+    ) -> None:
+        self.registry = registry
+        self._broker = broker
+        self._secret = sign_secret
+        self._sidecar = sidecar
+
+    def launch_bottle(
+        self,
+        source_ip: str,
+        *,
+        image_ref: str = "",
+        slot: int | None = None,
+        metadata: str = "",
+        policy: str = "",
+    ) -> BottleRecord:
+        """Register a bottle (with its sidecar policy) and broker its launch.
+        Rolls the registry entry back if the launch doesn't take, so a
+        failure leaves no orphan."""
+        rec = self.registry.register(source_ip, metadata=metadata, policy=policy)
+        req = LaunchRequest(
+            op="launch",
+            bottle_id=rec.bottle_id,
+            source_ip=source_ip,
+            image_ref=image_ref,
+            slot=slot,
+        )
+        launched = False
+        try:
+            self._broker.submit(sign_request(req, self._secret))
+            launched = True
+        finally:
+            if not launched:
+                self.registry.deregister(rec.bottle_id)
+        return rec
+
+    def teardown_bottle(self, bottle_id: str) -> bool:
+        """Broker teardown then deregister. False if the bottle is unknown."""
+        rec = self.registry.get(bottle_id)
+        if rec is None:
+            return False
+        req = LaunchRequest(op="teardown", bottle_id=bottle_id, source_ip=rec.source_ip)
+        self._broker.submit(sign_request(req, self._secret))
+        self.registry.deregister(bottle_id)
+        return True
+
+    def attribute(self, source_ip: str, identity_token: str) -> BottleRecord | None:
+        """Fail-closed attribution (delegates to the registry)."""
+        return self.registry.attribute(source_ip, identity_token)
+
+    def resolve(self, source_ip: str, identity_token: str = "") -> BottleRecord | None:
+        """Resolve the bottle behind a request — the source-IP-keyed lookup
+        the multi-tenant sidecar makes per request; the returned record
+        carries its `policy`. With a token, full attribution (source IP +
+        token); without, network-layer attribution by source IP alone
+        (valid where the IP is unspoofable and the control plane is
+        sidecar-only)."""
+        if identity_token:
+            return self.registry.attribute(source_ip, identity_token)
+        return self.registry.by_source_ip(source_ip)
+
+    def set_policy(self, bottle_id: str, policy: str) -> bool:
+        """Update a bottle's sidecar policy in place (live reload). False if
+        the bottle is unknown."""
+        return self.registry.set_policy(bottle_id, policy)
+
+    # --- consolidated sidecar ----------------------------------------------
+
+    def ensure_sidecar(self) -> None:
+        """Ensure the single per-host sidecar is built and up (idempotent).
+        No-op when no sidecar is configured."""
+        if self._sidecar is not None:
+            self._sidecar.ensure_built()
+            self._sidecar.ensure_running()
+
+    def sidecar_status(self) -> dict[str, object]:
+        """Report the shared sidecar for the control plane / console."""
+        if self._sidecar is None:
+            return {"configured": False}
+        return {
+            "configured": True,
+            "name": self._sidecar.name,
+            "running": self._sidecar.is_running(),
+        }
+
+
+__all__ = ["Orchestrator"]

bot_bottle/orchestrator/sidecar.py

@@ -0,0 +1,139 @@
+"""The consolidated per-host sidecar (PRD 0070).
+
+The core consolidation win: **one** persistent sidecar per host, shared by
+every bottle, instead of a sidecar bundle per bottle. It's safe to share
+because the attribution invariant (source IP + identity token, see
+`registry`) lets the sidecar attribute each request to the right bottle —
+so per-bottle policy lives in one long-lived process keyed on who's calling.
+
+`Sidecar` is the backend-neutral lifecycle contract (mirrors `LaunchBroker`):
+ensure the single instance is up, report it, tear it down. `DockerSidecar`
+is the docker implementation; a firecracker sidecar VM slots in later.
+
+The defining behaviour is **idempotent singleton**: `ensure_running` starts
+the instance if absent and is a no-op if it's already up, so N bottle
+launches never spawn N sidecars.
+"""
+
+from __future__ import annotations
+
+import abc
+import os
+from pathlib import Path
+
+from ..docker_cmd import run_docker
+
+SIDECAR_NAME = "bot-bottle-orch-sidecar"
+SIDECAR_LABEL = "bot-bottle-orch-sidecar=1"
+
+# The real sidecar-bundle image + its Dockerfile. Kept as a local constant
+# rather than imported from backend.docker.sidecar_bundle, which would drag
+# the whole backend layer into the lean orchestrator (see #359); unify when
+# that lands. Env override matches the backend's BOT_BOTTLE_SIDECAR_IMAGE.
+SIDECAR_BUNDLE_IMAGE = os.environ.get("BOT_BOTTLE_SIDECAR_IMAGE", "bot-bottle-sidecars:latest")
+SIDECAR_DOCKERFILE = "Dockerfile.sidecars"
+_REPO_ROOT = Path(__file__).resolve().parents[2]
+
+
+class SidecarError(Exception):
+    """The shared sidecar failed to build/start/stop (non-zero `docker` exit)."""
+
+
+class Sidecar(abc.ABC):
+    """Lifecycle of the single per-host sidecar. Backend-neutral."""
+
+    name: str
+
+    def ensure_built(self) -> None:
+        """Ensure the sidecar's image / rootfs exists, building it if needed.
+        Default: nothing to build (e.g. a stub or a pre-pulled image)."""
+        return
+
+    @abc.abstractmethod
+    def ensure_running(self) -> None:
+        """Start the sidecar if it isn't already up. Idempotent: a no-op
+        when it's already running (that's the whole point — one per host).
+        Assumes the image exists — call `ensure_built()` first."""
+
+    @abc.abstractmethod
+    def is_running(self) -> bool:
+        """True iff the sidecar instance is currently up."""
+
+    @abc.abstractmethod
+    def stop(self) -> None:
+        """Remove the sidecar. Idempotent — absent is success."""
+
+
+class DockerSidecar(Sidecar):
+    """The consolidated sidecar as a single, fixed-name Docker container.
+
+    `image_ref` defaults to the real sidecar-bundle image; `ensure_built`
+    builds it from `Dockerfile.sidecars` when it's missing. (Note: slice 5
+    builds + launches the bundle container; wiring its per-bottle,
+    source-IP-keyed config is a later slice — see PRD 0070.)"""
+
+    def __init__(
+        self,
+        image_ref: str = SIDECAR_BUNDLE_IMAGE,
+        *,
+        name: str = SIDECAR_NAME,
+        build_context: Path | None = None,
+        dockerfile: str | None = SIDECAR_DOCKERFILE,
+    ) -> None:
+        self.image_ref = image_ref
+        self.name = name
+        self._build_context = build_context or _REPO_ROOT
+        self._dockerfile = dockerfile
+
+    def image_exists(self) -> bool:
+        return run_docker(["docker", "image", "inspect", self.image_ref]).returncode == 0
+
+    def ensure_built(self) -> None:
+        """Build the bundle image from its Dockerfile when it's missing.
+        No-op when the image is already present, or when no dockerfile is
+        configured (e.g. a pre-pulled image)."""
+        if self._dockerfile is None or self.image_exists():
+            return
+        proc = run_docker([
+            "docker", "build",
+            "-t", self.image_ref,
+            "-f", str(self._build_context / self._dockerfile),
+            str(self._build_context),
+        ])
+        if proc.returncode != 0:
+            raise SidecarError(f"sidecar image build failed: {proc.stderr.strip()}")
+
+    def is_running(self) -> bool:
+        proc = run_docker([
+            "docker", "ps",
+            "--filter", f"name=^{self.name}$",
+            "--filter", "status=running",
+            "--format", "{{.Names}}",
+        ])
+        return self.name in proc.stdout.split()
+
+    def ensure_running(self) -> None:
+        if self.is_running():
+            return
+        # Clear any stale (stopped) container holding the fixed name, then
+        # start fresh. `rm --force` on an absent name is a tolerated no-op.
+        run_docker(["docker", "rm", "--force", self.name])
+        proc = run_docker([
+            "docker", "run", "--detach",
+            "--name", self.name,
+            "--label", SIDECAR_LABEL,
+            self.image_ref,
+        ])
+        if proc.returncode != 0:
+            raise SidecarError(f"sidecar failed to start: {proc.stderr.strip()}")
+
+    def stop(self) -> None:
+        proc = run_docker(["docker", "rm", "--force", self.name])
+        if proc.returncode != 0 and "No such container" not in proc.stderr:
+            raise SidecarError(f"sidecar failed to stop: {proc.stderr.strip()}")
+
+
+__all__ = [
+    "Sidecar", "DockerSidecar", "SidecarError",
+    "SIDECAR_NAME", "SIDECAR_LABEL", "SIDECAR_BUNDLE_IMAGE",
+]

bot_bottle/policy_resolver.py

@@ -0,0 +1,76 @@
+"""Sidecar-side per-client policy resolver (PRD 0070).
+
+The consolidated sidecar serves every bottle from one process, so for each
+request it must apply the *calling* bottle's policy, selected by the source
+IP the attribution invariant makes unspoofable. This resolves that policy
+from the orchestrator's control plane (`POST /resolve`), keyed on the
+`(source_ip, identity_token)` pair.
+
+**Always fresh — no cache.** The resolver is called rarely enough that a
+round-trip doesn't matter, and correctness matters more than speed: every
+resolve reflects the orchestrator's *current* view, so a revocation, a
+policy change, or a bottle teardown the orchestrator knows about is honored
+immediately rather than lingering for a cache TTL. (If this ever becomes a
+hot path, add caching with orchestrator-driven invalidation — not a blind
+TTL.)
+
+**Fail-closed:** an unattributed client (the orchestrator answers `403`)
+resolves to `None`, and the caller (the egress addon, git-gate) must then
+deny — exactly as an unknown bottle should be treated. Orchestrator
+*errors* (unreachable / unexpected status) raise, so the caller can fail
+closed too rather than silently serving stale or empty policy.
+
+The resolved value is the policy blob the orchestrator stores verbatim; the
+consumer parses it (e.g. the egress addon's `load_config`). This module is
+stdlib-only and free of bot-bottle imports so it can be COPYed flat into
+the sidecar bundle.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+
+DEFAULT_TIMEOUT_SECONDS = 2.0
+
+
+class PolicyResolveError(RuntimeError):
+    """The orchestrator was unreachable or returned an unexpected status —
+    distinct from a clean `403` (unattributed), which returns None."""
+
+
+class PolicyResolver:
+    """Resolves each client's policy from the orchestrator, fresh per call."""
+
+    def __init__(self, base_url: str, *, timeout: float = DEFAULT_TIMEOUT_SECONDS) -> None:
+        self._base = base_url.rstrip("/")
+        self._timeout = timeout
+
+    def resolve(self, source_ip: str, identity_token: str = "") -> str | None:
+        """The calling bottle's policy blob, or None if unattributed. Always
+        fetches from the orchestrator so revocations / changes / teardowns
+        are honored immediately. `identity_token` is optional — omit it to
+        resolve by source IP alone (the network-layer attribution).
+        Raises `PolicyResolveError` if the orchestrator can't be reached."""
+        body = json.dumps(
+            {"source_ip": source_ip, "identity_token": identity_token}
+        ).encode()
+        req = urllib.request.Request(
+            f"{self._base}/resolve", data=body, method="POST",
+            headers={"Content-Type": "application/json"},
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=self._timeout) as resp:
+                payload = json.loads(resp.read())
+        except urllib.error.HTTPError as e:
+            if e.code == 403:
+                return None  # unattributed → fail closed (caller denies)
+            raise PolicyResolveError(f"/resolve returned HTTP {e.code}") from e
+        except (urllib.error.URLError, TimeoutError, OSError, ValueError) as e:
+            raise PolicyResolveError(f"/resolve unreachable or malformed: {e}") from e
+        policy = payload.get("policy") if isinstance(payload, dict) else None
+        return policy if isinstance(policy, str) else ""
+
+
+__all__ = ["PolicyResolver", "PolicyResolveError"]

tests/integration/test_orchestrator_docker_broker.py

@@ -0,0 +1,56 @@
+"""Integration: the Docker launch broker starts and removes a real container.
+
+Gated on a reachable Docker daemon (skips cleanly otherwise). Uses a tiny
+image; the container may exit immediately — we only assert it exists after
+launch and is gone after teardown.
+"""
+
+from __future__ import annotations
+
+import secrets
+import subprocess
+import unittest
+
+from bot_bottle.orchestrator.broker import LaunchRequest, sign_request
+from bot_bottle.orchestrator.docker_broker import DockerBroker, container_name
+from tests._docker import skip_unless_docker
+
+IMAGE = "busybox"
+
+
+@skip_unless_docker()
+class TestDockerBrokerIntegration(unittest.TestCase):
+    def setUp(self) -> None:
+        self.secret = secrets.token_bytes(16)
+        self.broker = DockerBroker(self.secret)
+        self.bottle_id = "itest" + secrets.token_hex(4)
+        self.name = container_name(self.bottle_id)
+        self.addCleanup(
+            lambda: subprocess.run(
+                ["docker", "rm", "--force", self.name],
+                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
+            )
+        )
+
+    def _exists(self) -> bool:
+        proc = subprocess.run(
+            ["docker", "ps", "-a", "--filter", f"name=^{self.name}$",
+             "--format", "{{.Names}}"],
+            stdout=subprocess.PIPE, text=True, check=False,
+        )
+        return self.name in proc.stdout.split()
+
+    def _submit(self, req: LaunchRequest) -> None:
+        self.broker.submit(sign_request(req, self.secret))
+
+    def test_launch_creates_then_teardown_removes(self) -> None:
+        self._submit(
+            LaunchRequest(op="launch", bottle_id=self.bottle_id, image_ref=IMAGE)
+        )
+        self.assertTrue(self._exists(), "container should exist after launch")
+        self._submit(LaunchRequest(op="teardown", bottle_id=self.bottle_id))
+        self.assertFalse(self._exists(), "container should be gone after teardown")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/integration/test_orchestrator_docker_sidecar.py

@@ -0,0 +1,45 @@
+"""Integration: the consolidated Docker sidecar is an idempotent singleton.
+
+Gated on a reachable Docker daemon. Uses a unique name so it never
+collides with a real per-host sidecar or a leftover from another run.
+"""
+
+from __future__ import annotations
+
+import secrets
+import subprocess
+import unittest
+
+from bot_bottle.orchestrator.sidecar import DockerSidecar
+from tests._docker import skip_unless_docker
+
+IMAGE = "busybox"
+
+
+@skip_unless_docker()
+class TestDockerSidecarIntegration(unittest.TestCase):
+    def setUp(self) -> None:
+        self.name = "bot-bottle-orch-sidecar-itest-" + secrets.token_hex(4)
+        self.sc = DockerSidecar(IMAGE, name=self.name)
+        self.addCleanup(self.sc.stop)
+
+    def _count(self) -> int:
+        proc = subprocess.run(
+            ["docker", "ps", "-a", "--filter", f"name=^{self.name}$",
+             "--format", "{{.Names}}"],
+            stdout=subprocess.PIPE, text=True, check=False,
+        )
+        return sum(1 for n in proc.stdout.split() if n == self.name)
+
+    def test_ensure_is_idempotent_singleton(self) -> None:
+        self.sc.ensure_running()
+        self.assertEqual(1, self._count())
+        # A second ensure must not spawn a second container — one per host.
+        self.sc.ensure_running()
+        self.assertEqual(1, self._count())
+        self.sc.stop()
+        self.assertEqual(0, self._count())
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/integration/test_orchestrator_docker_sidecar_build.py

@@ -0,0 +1,36 @@
+"""Integration: DockerSidecar.image_exists reflects real docker state.
+
+Gated on a reachable Docker daemon. Deliberately does NOT build the full
+sidecar bundle (a heavy, slow image build) — it exercises the `image_exists`
+primitive that `ensure_built` gates on, against a tiny pulled image and a
+name that can't exist.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import unittest
+
+from bot_bottle.orchestrator.sidecar import DockerSidecar
+from tests._docker import skip_unless_docker
+
+IMAGE = "busybox"
+
+
+@skip_unless_docker()
+class TestDockerSidecarImageExists(unittest.TestCase):
+    def test_image_exists_true_for_present_false_for_absent(self) -> None:
+        # Ensure the tiny image is present (build_if_missing is disabled here
+        # so this never triggers a Dockerfile.sidecars build).
+        subprocess.run(
+            ["docker", "pull", IMAGE],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
+        )
+        self.assertTrue(DockerSidecar(IMAGE, dockerfile=None).image_exists())
+        self.assertFalse(
+            DockerSidecar("bot-bottle-nonexistent:doesnotexist", dockerfile=None).image_exists()
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_egress_multitenant.py

@@ -0,0 +1,53 @@
+"""Unit: resolve_client_config — fail-closed per-client egress config (PRD 0070)."""
+
+from __future__ import annotations
+
+import unittest
+
+from bot_bottle.egress_addon_core import resolve_client_config
+from bot_bottle.policy_resolver import PolicyResolveError
+
+
+class _FakeResolver:
+    def __init__(self, result: str | None = None, raises: bool = False) -> None:
+        self._result = result
+        self._raises = raises
+        self.calls: list[tuple[str, str]] = []
+
+    def resolve(self, source_ip: str, identity_token: str = "") -> str | None:
+        self.calls.append((source_ip, identity_token))
+        if self._raises:
+            raise PolicyResolveError("orchestrator down")
+        return self._result
+
+
+class TestResolveClientConfig(unittest.TestCase):
+    def test_valid_policy_is_parsed(self) -> None:
+        cfg = resolve_client_config(
+            _FakeResolver(result="routes:\n  - host: example.com\n"), "10.243.0.1"
+        )
+        self.assertEqual(("example.com",), tuple(r.host for r in cfg.routes))
+
+    def test_unattributed_none_denies_all(self) -> None:
+        cfg = resolve_client_config(_FakeResolver(result=None), "10.243.0.9")
+        self.assertEqual((), cfg.routes)  # no routes → default-deny
+
+    def test_empty_policy_denies_all(self) -> None:
+        self.assertEqual((), resolve_client_config(_FakeResolver(result=""), "10.243.0.1").routes)
+
+    def test_resolver_error_denies_all(self) -> None:
+        # Orchestrator unreachable/errored must never widen egress.
+        self.assertEqual((), resolve_client_config(_FakeResolver(raises=True), "10.243.0.1").routes)
+
+    def test_unparseable_policy_denies_all(self) -> None:
+        cfg = resolve_client_config(_FakeResolver(result="routes: notalist\n"), "10.243.0.1")
+        self.assertEqual((), cfg.routes)
+
+    def test_forwards_source_ip_and_token(self) -> None:
+        r = _FakeResolver(result=None)
+        resolve_client_config(r, "10.243.0.1", "tok")
+        self.assertEqual(("10.243.0.1", "tok"), r.calls[0])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_orchestrator_broker.py

@@ -0,0 +1,86 @@
+"""Unit tests for the orchestrator launch broker (PRD 0070)."""
+
+from __future__ import annotations
+
+import secrets
+import unittest
+
+from bot_bottle.orchestrator.broker import (
+    BrokerAuthError,
+    LaunchRequest,
+    StubBroker,
+    sign_request,
+    verify_request,
+)
+
+
+class TestSignVerify(unittest.TestCase):
+    def setUp(self) -> None:
+        self.secret = secrets.token_bytes(16)
+
+    def test_launch_round_trip(self) -> None:
+        req = LaunchRequest(
+            op="launch", bottle_id="b1", source_ip="10.243.0.1",
+            image_ref="sha256:abc", slot=3,
+        )
+        self.assertEqual(req, verify_request(sign_request(req, self.secret), self.secret))
+
+    def test_teardown_round_trip(self) -> None:
+        req = LaunchRequest(op="teardown", bottle_id="b1")
+        got = verify_request(sign_request(req, self.secret), self.secret)
+        self.assertEqual(("teardown", "b1"), (got.op, got.bottle_id))
+
+    def test_wrong_secret_rejected(self) -> None:
+        token = sign_request(LaunchRequest(op="launch", bottle_id="b1"), self.secret)
+        with self.assertRaises(BrokerAuthError):
+            verify_request(token, secrets.token_bytes(16))
+
+    def test_tampered_payload_rejected(self) -> None:
+        token = sign_request(LaunchRequest(op="launch", bottle_id="b1"), self.secret)
+        header, payload, sig = token.split(".")
+        flipped = payload[:-1] + ("A" if payload[-1] != "A" else "B")
+        with self.assertRaises(BrokerAuthError):
+            verify_request(f"{header}.{flipped}.{sig}", self.secret)
+
+    def test_malformed_tokens_rejected(self) -> None:
+        for bad in ("", "a.b", "a.b.c.d", "not-a-token"):
+            with self.assertRaises(BrokerAuthError):
+                verify_request(bad, self.secret)
+
+    def test_unknown_op_rejected_despite_valid_signature(self) -> None:
+        # A correctly-signed token whose op isn't in the allow-list must
+        # still be refused — the schema guard is independent of provenance.
+        token = sign_request(LaunchRequest(op="rm-rf", bottle_id="b1"), self.secret)
+        with self.assertRaises(BrokerAuthError):
+            verify_request(token, self.secret)
+
+
+class TestStubBroker(unittest.TestCase):
+    def setUp(self) -> None:
+        self.secret = secrets.token_bytes(16)
+        self.broker = StubBroker(self.secret)
+
+    def test_submit_launch_records_verified_request(self) -> None:
+        req = LaunchRequest(op="launch", bottle_id="b1", source_ip="10.243.0.1")
+        got = self.broker.submit(sign_request(req, self.secret))
+        self.assertEqual(req, got)
+        self.assertEqual(["b1"], [r.bottle_id for r in self.broker.launched])
+        self.assertEqual([], self.broker.torn_down)
+
+    def test_submit_teardown_records(self) -> None:
+        self.broker.submit(
+            sign_request(LaunchRequest(op="teardown", bottle_id="b1"), self.secret)
+        )
+        self.assertEqual(["b1"], [r.bottle_id for r in self.broker.torn_down])
+
+    def test_submit_forged_token_is_fail_closed(self) -> None:
+        forged = sign_request(
+            LaunchRequest(op="launch", bottle_id="b1"), secrets.token_bytes(16)
+        )
+        with self.assertRaises(BrokerAuthError):
+            self.broker.submit(forged)
+        self.assertEqual([], self.broker.launched)  # nothing acted on
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_orchestrator_control_plane.py

@@ -7,53 +7,62 @@ server tests), plus one real-socket round-trip to prove the handler wiring.
 from __future__ import annotations
 
 import json
+import secrets
 import tempfile
 import threading
 import unittest
 import urllib.request
 from pathlib import Path
 
+from bot_bottle.orchestrator.broker import StubBroker
 from bot_bottle.orchestrator.control_plane import dispatch, make_server
 from bot_bottle.orchestrator.registry import RegistryStore
+from bot_bottle.orchestrator.service import Orchestrator
 
 
 def _body(obj: object) -> bytes:
     return json.dumps(obj).encode()
 
 
+def _orchestrator(db_path: Path) -> Orchestrator:
+    store = RegistryStore(db_path)
+    store.migrate()
+    secret = secrets.token_bytes(16)
+    return Orchestrator(store, StubBroker(secret), secret)
+
+
 class TestDispatch(unittest.TestCase):
     def setUp(self) -> None:
         self._tmp = tempfile.TemporaryDirectory()
-        self.store = RegistryStore(Path(self._tmp.name) / "r.db")
-        self.store.migrate()
+        self.orch = _orchestrator(Path(self._tmp.name) / "r.db")
 
     def tearDown(self) -> None:
         self._tmp.cleanup()
 
     def test_health(self) -> None:
-        status, payload = dispatch(self.store, "GET", "/health", b"")
+        status, payload = dispatch(self.orch, "GET", "/health", b"")
         self.assertEqual(200, status)
         self.assertEqual("ok", payload["status"])
 
     def test_register_returns_id_and_token(self) -> None:
         status, payload = dispatch(
-            self.store, "POST", "/bottles", _body({"source_ip": "10.243.0.1"})
+            self.orch, "POST", "/bottles", _body({"source_ip": "10.243.0.1"})
         )
         self.assertEqual(201, status)
         self.assertTrue(payload["bottle_id"])
         self.assertTrue(payload["identity_token"])
 
     def test_register_requires_source_ip(self) -> None:
-        status, _ = dispatch(self.store, "POST", "/bottles", _body({}))
+        status, _ = dispatch(self.orch, "POST", "/bottles", _body({}))
         self.assertEqual(400, status)
 
     def test_register_rejects_bad_json(self) -> None:
-        status, _ = dispatch(self.store, "POST", "/bottles", b"{not json")
+        status, _ = dispatch(self.orch, "POST", "/bottles", b"{not json")
         self.assertEqual(400, status)
 
     def test_list_redacts_identity_token(self) -> None:
-        dispatch(self.store, "POST", "/bottles", _body({"source_ip": "10.243.0.1"}))
-        status, payload = dispatch(self.store, "GET", "/bottles", b"")
+        dispatch(self.orch, "POST", "/bottles", _body({"source_ip": "10.243.0.1"}))
+        status, payload = dispatch(self.orch, "GET", "/bottles", b"")
         self.assertEqual(200, status)
         bottles = payload["bottles"]
         assert isinstance(bottles, list)
@@ -65,58 +74,126 @@ class TestDispatch(unittest.TestCase):
 
     def test_attribute_ok_and_forbidden(self) -> None:
         _, reg = dispatch(
-            self.store, "POST", "/bottles", _body({"source_ip": "10.243.0.5"})
+            self.orch, "POST", "/bottles", _body({"source_ip": "10.243.0.5"})
         )
         token = reg["identity_token"]
         ok_status, ok = dispatch(
-            self.store, "POST", "/attribute",
+            self.orch, "POST", "/attribute",
             _body({"source_ip": "10.243.0.5", "identity_token": token}),
         )
         self.assertEqual(200, ok_status)
         self.assertEqual(reg["bottle_id"], ok["bottle_id"])
 
         bad_status, _ = dispatch(
-            self.store, "POST", "/attribute",
+            self.orch, "POST", "/attribute",
             _body({"source_ip": "10.243.0.5", "identity_token": "nope"}),
         )
         self.assertEqual(403, bad_status)
 
     def test_attribute_requires_both_fields(self) -> None:
         status, _ = dispatch(
-            self.store, "POST", "/attribute", _body({"source_ip": "10.243.0.5"})
+            self.orch, "POST", "/attribute", _body({"source_ip": "10.243.0.5"})
         )
         self.assertEqual(400, status)
 
     def test_delete(self) -> None:
         _, reg = dispatch(
-            self.store, "POST", "/bottles", _body({"source_ip": "10.243.0.1"})
+            self.orch, "POST", "/bottles", _body({"source_ip": "10.243.0.1"})
         )
         bid = reg["bottle_id"]
-        status, payload = dispatch(self.store, "DELETE", f"/bottles/{bid}", b"")
+        status, payload = dispatch(self.orch, "DELETE", f"/bottles/{bid}", b"")
         self.assertEqual(200, status)
-        self.assertEqual(True, payload["deregistered"])
-        self.assertEqual([], self.store.all())
+        self.assertEqual(True, payload["torn_down"])
+        self.assertEqual([], self.orch.registry.all())
 
     def test_delete_missing_404(self) -> None:
-        status, _ = dispatch(self.store, "DELETE", "/bottles/ghost", b"")
+        status, _ = dispatch(self.orch, "DELETE", "/bottles/ghost", b"")
         self.assertEqual(404, status)
 
     def test_unknown_route_404(self) -> None:
-        status, _ = dispatch(self.store, "GET", "/nope", b"")
+        status, _ = dispatch(self.orch, "GET", "/nope", b"")
         self.assertEqual(404, status)
 
     def test_trailing_slash_normalized(self) -> None:
-        status, _ = dispatch(self.store, "GET", "/health/", b"")
+        status, _ = dispatch(self.orch, "GET", "/health/", b"")
         self.assertEqual(200, status)
 
+    def test_sidecar_status_unconfigured(self) -> None:
+        status, payload = dispatch(self.orch, "GET", "/sidecar", b"")
+        self.assertEqual(200, status)
+        self.assertEqual(False, payload["configured"])
+
+    def test_launch_stores_policy_and_resolve_returns_it(self) -> None:
+        _, reg = dispatch(
+            self.orch, "POST", "/bottles",
+            _body({"source_ip": "10.243.0.5", "policy": '{"a":1}'}),
+        )
+        status, payload = dispatch(
+            self.orch, "POST", "/resolve",
+            _body({"source_ip": "10.243.0.5", "identity_token": reg["identity_token"]}),
+        )
+        self.assertEqual(200, status)
+        self.assertEqual(reg["bottle_id"], payload["bottle_id"])
+        self.assertEqual('{"a":1}', payload["policy"])
+
+    def test_resolve_forbidden_on_bad_token(self) -> None:
+        dispatch(self.orch, "POST", "/bottles", _body({"source_ip": "10.243.0.5"}))
+        status, _ = dispatch(
+            self.orch, "POST", "/resolve",
+            _body({"source_ip": "10.243.0.5", "identity_token": "nope"}),
+        )
+        self.assertEqual(403, status)
+
+    def test_put_policy_updates_live(self) -> None:
+        _, reg = dispatch(self.orch, "POST", "/bottles", _body({"source_ip": "10.243.0.1"}))
+        bid = reg["bottle_id"]
+        status, payload = dispatch(
+            self.orch, "PUT", f"/bottles/{bid}/policy", _body({"policy": '{"v":9}'})
+        )
+        self.assertEqual(200, status)
+        self.assertEqual(True, payload["updated"])
+        _, resolved = dispatch(
+            self.orch, "POST", "/resolve",
+            _body({"source_ip": "10.243.0.1", "identity_token": reg["identity_token"]}),
+        )
+        self.assertEqual('{"v":9}', resolved["policy"])
+
+    def test_put_policy_missing_bottle_404(self) -> None:
+        status, _ = dispatch(
+            self.orch, "PUT", "/bottles/ghost/policy", _body({"policy": "{}"})
+        )
+        self.assertEqual(404, status)
+
+    def test_put_policy_requires_string(self) -> None:
+        _, reg = dispatch(self.orch, "POST", "/bottles", _body({"source_ip": "10.243.0.1"}))
+        status, _ = dispatch(
+            self.orch, "PUT", f"/bottles/{reg['bottle_id']}/policy", _body({})
+        )
+        self.assertEqual(400, status)
+
+    def test_resolve_without_token_by_source_ip(self) -> None:
+        _, reg = dispatch(
+            self.orch, "POST", "/bottles",
+            _body({"source_ip": "10.243.0.5", "policy": "P"}),
+        )
+        status, payload = dispatch(
+            self.orch, "POST", "/resolve", _body({"source_ip": "10.243.0.5"})
+        )
+        self.assertEqual(200, status)
+        self.assertEqual(reg["bottle_id"], payload["bottle_id"])
+        self.assertEqual("P", payload["policy"])
+
+    def test_resolve_requires_source_ip(self) -> None:
+        status, _ = dispatch(self.orch, "POST", "/resolve", _body({}))
+        self.assertEqual(400, status)
+
 
 class TestServerRoundTrip(unittest.TestCase):
     def test_http_register_health_attribute(self) -> None:
         tmp = tempfile.TemporaryDirectory()
         self.addCleanup(tmp.cleanup)
-        store = RegistryStore(Path(tmp.name) / "r.db")
-        store.migrate()
-        server = make_server(store, "127.0.0.1", 0)
+        orch = _orchestrator(Path(tmp.name) / "r.db")
+        server = make_server(orch, "127.0.0.1", 0)
         self.addCleanup(server.server_close)
         thread = threading.Thread(target=server.serve_forever, daemon=True)
         thread.start()

tests/unit/test_orchestrator_docker_broker.py

@@ -0,0 +1,100 @@
+"""Unit tests for the Docker launch broker (PRD 0070). Docker is mocked."""
+
+from __future__ import annotations
+
+import secrets
+import unittest
+from unittest.mock import Mock, patch
+
+from bot_bottle.orchestrator.broker import (
+    BrokerAuthError,
+    LaunchRequest,
+    sign_request,
+)
+from bot_bottle.orchestrator.docker_broker import (
+    BOTTLE_ID_LABEL,
+    DockerBroker,
+    DockerBrokerError,
+    container_name,
+    rm_argv,
+    run_argv,
+)
+
+
+class TestArgv(unittest.TestCase):
+    def test_run_argv_uses_only_static_fields(self) -> None:
+        req = LaunchRequest(op="launch", bottle_id="b1", image_ref="busybox")
+        argv = run_argv(req)
+        self.assertEqual(["docker", "run"], argv[:2])
+        self.assertIn("--name", argv)
+        self.assertIn(container_name("b1"), argv)
+        self.assertIn(f"{BOTTLE_ID_LABEL}=b1", argv)
+        self.assertEqual("busybox", argv[-1])  # image is the terminal arg
+
+    def test_rm_argv(self) -> None:
+        req = LaunchRequest(op="teardown", bottle_id="b1")
+        self.assertEqual(["docker", "rm", "--force", container_name("b1")], rm_argv(req))
+
+    def test_container_name_is_prefixed(self) -> None:
+        name = container_name("b1")
+        self.assertTrue(name.startswith("bot-bottle-orch-"))
+        self.assertTrue(name.endswith("b1"))
+
+
+class TestDockerBroker(unittest.TestCase):
+    def setUp(self) -> None:
+        self.secret = secrets.token_bytes(16)
+        self.broker = DockerBroker(self.secret)
+
+    def _submit(self, req: LaunchRequest) -> None:
+        self.broker.submit(sign_request(req, self.secret))
+
+    def test_launch_invokes_docker_run(self) -> None:
+        req = LaunchRequest(op="launch", bottle_id="b1", image_ref="busybox")
+        with patch.object(self.broker, "_docker", return_value=Mock(returncode=0, stderr="")) as m:
+            self._submit(req)
+        m.assert_called_once()
+        self.assertEqual(run_argv(req), m.call_args.args[0])
+
+    def test_launch_without_image_raises_and_skips_docker(self) -> None:
+        req = LaunchRequest(op="launch", bottle_id="b1", image_ref="")
+        with patch.object(self.broker, "_docker") as m:
+            with self.assertRaises(DockerBrokerError):
+                self._submit(req)
+            m.assert_not_called()
+
+    def test_launch_docker_failure_raises(self) -> None:
+        req = LaunchRequest(op="launch", bottle_id="b1", image_ref="busybox")
+        with patch.object(self.broker, "_docker", return_value=Mock(returncode=1, stderr="boom")):
+            with self.assertRaises(DockerBrokerError):
+                self._submit(req)
+
+    def test_teardown_invokes_docker_rm(self) -> None:
+        req = LaunchRequest(op="teardown", bottle_id="b1")
+        with patch.object(self.broker, "_docker", return_value=Mock(returncode=0, stderr="")) as m:
+            self._submit(req)
+        self.assertEqual(rm_argv(req), m.call_args.args[0])
+
+    def test_teardown_is_idempotent_on_missing_container(self) -> None:
+        req = LaunchRequest(op="teardown", bottle_id="b1")
+        absent = Mock(returncode=1, stderr="Error: No such container: bot-bottle-orch-b1")
+        with patch.object(self.broker, "_docker", return_value=absent):
+            self._submit(req)  # must not raise
+
+    def test_teardown_other_failure_raises(self) -> None:
+        req = LaunchRequest(op="teardown", bottle_id="b1")
+        with patch.object(self.broker, "_docker", return_value=Mock(returncode=1, stderr="daemon down")):
+            with self.assertRaises(DockerBrokerError):
+                self._submit(req)
+
+    def test_forged_token_never_touches_docker(self) -> None:
+        req = LaunchRequest(op="launch", bottle_id="b1", image_ref="busybox")
+        forged = sign_request(req, secrets.token_bytes(16))
+        with patch.object(self.broker, "_docker") as m:
+            with self.assertRaises(BrokerAuthError):
+                self.broker.submit(forged)
+            m.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_orchestrator_registry.py

@@ -97,6 +97,42 @@ class TestRegistryStore(unittest.TestCase):
         self.assertNotIn("identity_token", rec.redacted())
         self.assertEqual("10.243.0.1", rec.redacted()["source_ip"])
 
+    def test_register_with_policy_resolves_via_attribution(self) -> None:
+        rec = self.store.register("10.243.0.1", policy='{"allow":["x"]}')
+        self.assertEqual('{"allow":["x"]}', rec.policy)
+        got = self.store.attribute("10.243.0.1", rec.identity_token)
+        assert got is not None
+        self.assertEqual('{"allow":["x"]}', got.policy)
+
+    def test_set_policy_updates_live(self) -> None:
+        rec = self.store.register("10.243.0.1")
+        self.assertEqual("", rec.policy)
+        self.assertTrue(self.store.set_policy(rec.bottle_id, '{"v":2}'))
+        got = self.store.get(rec.bottle_id)
+        assert got is not None
+        self.assertEqual('{"v":2}', got.policy)
+
+    def test_set_policy_missing_is_false(self) -> None:
+        self.assertFalse(self.store.set_policy("ghost", "{}"))
+
+    def test_policy_defaults_empty_and_persists(self) -> None:
+        rec = self.store.register("10.243.0.1")
+        got = RegistryStore(self.db).get(rec.bottle_id)
+        assert got is not None
+        self.assertEqual("", got.policy)
+
+    def test_by_source_ip_returns_single_active(self) -> None:
+        rec = self.store.register("10.243.0.1")
+        got = self.store.by_source_ip("10.243.0.1")
+        assert got is not None
+        self.assertEqual(rec.bottle_id, got.bottle_id)
+
+    def test_by_source_ip_unknown_or_ambiguous_denied(self) -> None:
+        self.assertIsNone(self.store.by_source_ip("10.243.9.9"))  # unknown
+        self.store.register("10.243.0.1", bottle_id="a")
+        self.store.register("10.243.0.1", bottle_id="b")
+        self.assertIsNone(self.store.by_source_ip("10.243.0.1"))  # ambiguous
+
 
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_orchestrator_service.py

@@ -0,0 +1,144 @@
+"""Unit tests for the Orchestrator launch lifecycle (PRD 0070)."""
+
+from __future__ import annotations
+
+import secrets
+import tempfile
+import unittest
+from pathlib import Path
+
+from bot_bottle.orchestrator.broker import LaunchBroker, LaunchRequest, StubBroker
+from bot_bottle.orchestrator.registry import RegistryStore
+from bot_bottle.orchestrator.service import Orchestrator
+from bot_bottle.orchestrator.sidecar import Sidecar
+
+
+class _FailingBroker(LaunchBroker):
+    """Verifies the token like any broker, then fails the launch — to
+    exercise the orchestrator's registry rollback."""
+
+    def _launch(self, req: LaunchRequest) -> None:
+        raise RuntimeError("launch failed")
+
+    def _teardown(self, req: LaunchRequest) -> None:
+        pass
+
+
+class _FakeSidecar(Sidecar):
+    """In-memory sidecar for wiring tests."""
+
+    def __init__(self) -> None:
+        self.name = "fake-sidecar"
+        self.ensured = 0
+        self.built = 0
+        self._running = False
+
+    def ensure_built(self) -> None:
+        self.built += 1
+
+    def ensure_running(self) -> None:
+        self.ensured += 1
+        self._running = True
+
+    def is_running(self) -> bool:
+        return self._running
+
+    def stop(self) -> None:
+        self._running = False
+
+
+class TestOrchestrator(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.secret = secrets.token_bytes(16)
+        self.store = RegistryStore(Path(self._tmp.name) / "r.db")
+        self.store.migrate()
+        self.broker = StubBroker(self.secret)
+        self.orch = Orchestrator(self.store, self.broker, self.secret)
+
+    def tearDown(self) -> None:
+        self._tmp.cleanup()
+
+    def test_launch_registers_and_brokers_signed_request(self) -> None:
+        rec = self.orch.launch_bottle("10.243.0.1", image_ref="sha256:abc", slot=2)
+        self.assertIsNotNone(self.store.get(rec.bottle_id))
+        self.assertEqual(1, len(self.broker.launched))
+        req = self.broker.launched[0]
+        self.assertEqual("launch", req.op)
+        self.assertEqual(rec.bottle_id, req.bottle_id)
+        self.assertEqual("10.243.0.1", req.source_ip)
+        self.assertEqual("sha256:abc", req.image_ref)
+        self.assertEqual(2, req.slot)
+
+    def test_launch_then_attribute(self) -> None:
+        rec = self.orch.launch_bottle("10.243.0.3")
+        got = self.orch.attribute("10.243.0.3", rec.identity_token)
+        assert got is not None
+        self.assertEqual(rec.bottle_id, got.bottle_id)
+        self.assertIsNone(self.orch.attribute("10.243.0.3", "wrong-token"))
+
+    def test_teardown_brokers_and_deregisters(self) -> None:
+        rec = self.orch.launch_bottle("10.243.0.1")
+        self.assertTrue(self.orch.teardown_bottle(rec.bottle_id))
+        self.assertIsNone(self.store.get(rec.bottle_id))
+        self.assertEqual(["teardown"], [r.op for r in self.broker.torn_down])
+
+    def test_teardown_unknown_is_false(self) -> None:
+        self.assertFalse(self.orch.teardown_bottle("ghost"))
+
+    def test_launch_with_policy_is_resolvable(self) -> None:
+        rec = self.orch.launch_bottle("10.243.0.1", policy='{"routes":[]}')
+        got = self.orch.attribute("10.243.0.1", rec.identity_token)
+        assert got is not None
+        self.assertEqual('{"routes":[]}', got.policy)
+
+    def test_set_policy_live_reload(self) -> None:
+        rec = self.orch.launch_bottle("10.243.0.3")
+        self.assertTrue(self.orch.set_policy(rec.bottle_id, '{"x":1}'))
+        got = self.orch.attribute("10.243.0.3", rec.identity_token)
+        assert got is not None
+        self.assertEqual('{"x":1}', got.policy)
+
+    def test_set_policy_unknown_is_false(self) -> None:
+        self.assertFalse(self.orch.set_policy("ghost", "{}"))
+
+    def test_resolve_by_source_ip_without_token(self) -> None:
+        rec = self.orch.launch_bottle("10.243.0.1", policy="P")
+        got = self.orch.resolve("10.243.0.1")  # network-layer, no token
+        assert got is not None
+        self.assertEqual(rec.bottle_id, got.bottle_id)
+        self.assertEqual("P", got.policy)
+
+    def test_resolve_with_token_stays_strict(self) -> None:
+        rec = self.orch.launch_bottle("10.243.0.3")
+        self.assertIsNotNone(self.orch.resolve("10.243.0.3", rec.identity_token))
+        self.assertIsNone(self.orch.resolve("10.243.0.3", "wrong-token"))
+
+    def test_launch_rolls_back_registry_on_broker_failure(self) -> None:
+        orch = Orchestrator(self.store, _FailingBroker(self.secret), self.secret)
+        with self.assertRaises(RuntimeError):
+            orch.launch_bottle("10.243.0.9")
+        self.assertEqual([], self.store.all())  # no orphan
+
+    def test_sidecar_unconfigured_by_default(self) -> None:
+        self.assertEqual({"configured": False}, self.orch.sidecar_status())
+        self.orch.ensure_sidecar()  # no-op, must not raise
+
+    def test_sidecar_wired_and_ensured(self) -> None:
+        sc = _FakeSidecar()
+        orch = Orchestrator(self.store, self.broker, self.secret, sidecar=sc)
+        self.assertEqual(
+            {"configured": True, "name": "fake-sidecar", "running": False},
+            orch.sidecar_status(),
+        )
+        orch.ensure_sidecar()
+        self.assertEqual(1, sc.built)   # ensure_sidecar builds first,
+        self.assertEqual(1, sc.ensured)  # then runs
+        self.assertEqual(
+            {"configured": True, "name": "fake-sidecar", "running": True},
+            orch.sidecar_status(),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_orchestrator_sidecar.py

@@ -0,0 +1,129 @@
+"""Unit tests for the consolidated Docker sidecar (PRD 0070). Docker mocked."""
+
+from __future__ import annotations
+
+import unittest
+from unittest.mock import Mock, patch
+
+from bot_bottle.orchestrator.sidecar import (
+    SIDECAR_NAME,
+    DockerSidecar,
+    SidecarError,
+)
+
+_RUN_DOCKER = "bot_bottle.orchestrator.sidecar.run_docker"
+
+
+def _proc(returncode: int = 0, stdout: str = "", stderr: str = "") -> Mock:
+    return Mock(returncode=returncode, stdout=stdout, stderr=stderr)
+
+
+class TestDockerSidecar(unittest.TestCase):
+    def setUp(self) -> None:
+        self.sc = DockerSidecar("bot-bottle-sidecars:latest")
+
+    def test_default_name(self) -> None:
+        self.assertEqual(SIDECAR_NAME, self.sc.name)
+
+    def test_is_running_reads_docker_ps(self) -> None:
+        with patch(_RUN_DOCKER, return_value=_proc(stdout=self.sc.name + "\n")):
+            self.assertTrue(self.sc.is_running())
+        with patch(_RUN_DOCKER, return_value=_proc(stdout="")):
+            self.assertFalse(self.sc.is_running())
+
+    def test_ensure_running_is_noop_when_already_up(self) -> None:
+        with patch(_RUN_DOCKER, return_value=_proc(stdout=self.sc.name)) as m:
+            self.sc.ensure_running()
+        # Only the is_running() ps probe — no rm / run.
+        self.assertEqual(1, m.call_count)
+
+    def test_ensure_running_starts_the_singleton_when_absent(self) -> None:
+        calls: list[list[str]] = []
+
+        def fake(argv: list[str]) -> Mock:
+            calls.append(argv)
+            return _proc(stdout="") if argv[:2] == ["docker", "ps"] else _proc()
+
+        with patch(_RUN_DOCKER, side_effect=fake):
+            self.sc.ensure_running()
+
+        runs = [c for c in calls if c[:2] == ["docker", "run"]]
+        self.assertEqual(1, len(runs))
+        self.assertIn(self.sc.name, runs[0])
+        self.assertIn("bot-bottle-sidecars:latest", runs[0])
+
+    def test_ensure_running_raises_on_docker_failure(self) -> None:
+        def fake(argv: list[str]) -> Mock:
+            if argv[:2] == ["docker", "ps"]:
+                return _proc(stdout="")
+            if argv[:2] == ["docker", "run"]:
+                return _proc(returncode=1, stderr="boom")
+            return _proc()
+
+        with patch(_RUN_DOCKER, side_effect=fake):
+            with self.assertRaises(SidecarError):
+                self.sc.ensure_running()
+
+    def test_stop_is_idempotent_on_missing(self) -> None:
+        absent = _proc(returncode=1, stderr="Error: No such container: x")
+        with patch(_RUN_DOCKER, return_value=absent):
+            self.sc.stop()  # must not raise
+
+    def test_stop_raises_on_other_failure(self) -> None:
+        with patch(_RUN_DOCKER, return_value=_proc(returncode=1, stderr="daemon down")):
+            with self.assertRaises(SidecarError):
+                self.sc.stop()
+
+
+class TestDockerSidecarBuild(unittest.TestCase):
+    def setUp(self) -> None:
+        self.sc = DockerSidecar()  # defaults to the real bundle image + dockerfile
+
+    def test_image_exists_reads_docker_inspect(self) -> None:
+        with patch(_RUN_DOCKER, return_value=_proc(returncode=0)):
+            self.assertTrue(self.sc.image_exists())
+        with patch(_RUN_DOCKER, return_value=_proc(returncode=1)):
+            self.assertFalse(self.sc.image_exists())
+
+    def test_ensure_built_is_noop_when_image_present(self) -> None:
+        with patch(_RUN_DOCKER, return_value=_proc(returncode=0)) as m:
+            self.sc.ensure_built()
+        self.assertEqual(1, m.call_count)  # only the image-inspect probe
+
+    def test_ensure_built_builds_from_dockerfile_when_missing(self) -> None:
+        calls: list[list[str]] = []
+
+        def fake(argv: list[str]) -> Mock:
+            calls.append(argv)
+            if argv[:3] == ["docker", "image", "inspect"]:
+                return _proc(returncode=1)  # missing
+            return _proc()
+
+        with patch(_RUN_DOCKER, side_effect=fake):
+            self.sc.ensure_built()
+
+        builds = [c for c in calls if c[:2] == ["docker", "build"]]
+        self.assertEqual(1, len(builds))
+        self.assertIn(self.sc.image_ref, builds[0])
+        self.assertIn("-f", builds[0])
+        self.assertTrue(any(a.endswith("Dockerfile.sidecars") for a in builds[0]))
+
+    def test_ensure_built_noop_when_no_dockerfile(self) -> None:
+        sc = DockerSidecar("busybox", dockerfile=None)
+        with patch(_RUN_DOCKER) as m:
+            sc.ensure_built()
+        m.assert_not_called()
+
+    def test_ensure_built_raises_on_build_failure(self) -> None:
+        def fake(argv: list[str]) -> Mock:
+            if argv[:3] == ["docker", "image", "inspect"]:
+                return _proc(returncode=1)
+            return _proc(returncode=1, stderr="build boom")
+
+        with patch(_RUN_DOCKER, side_effect=fake):
+            with self.assertRaises(SidecarError):
+                self.sc.ensure_built()
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_policy_resolver.py

@@ -0,0 +1,76 @@
+"""Unit tests for the sidecar-side PolicyResolver (PRD 0070). HTTP mocked."""
+
+from __future__ import annotations
+
+import json
+import unittest
+import urllib.error
+from unittest.mock import MagicMock, patch
+
+from bot_bottle.policy_resolver import PolicyResolveError, PolicyResolver
+
+_URLOPEN = "bot_bottle.policy_resolver.urllib.request.urlopen"
+
+
+def _resp(payload: object) -> MagicMock:
+    """A urlopen() return value: a context manager whose read() yields JSON."""
+    m = MagicMock()
+    m.__enter__.return_value.read.return_value = json.dumps(payload).encode()
+    return m
+
+
+def _http_error(code: int) -> urllib.error.HTTPError:
+    return urllib.error.HTTPError("http://x/resolve", code, "err", {}, None)  # type: ignore[arg-type]
+
+
+class TestPolicyResolver(unittest.TestCase):
+    def setUp(self) -> None:
+        self.r = PolicyResolver("http://orch:8080")
+
+    def test_resolve_returns_policy(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"bottle_id": "b1", "policy": "P"})):
+            self.assertEqual("P", self.r.resolve("10.243.0.1", "tok"))
+
+    def test_resolve_always_fetches_fresh(self) -> None:
+        # No cache — every resolve hits the orchestrator so revocations /
+        # policy changes are honored immediately.
+        with patch(_URLOPEN, return_value=_resp({"policy": "P"})) as m:
+            self.r.resolve("10.243.0.1", "tok")
+            self.r.resolve("10.243.0.1", "tok")
+        self.assertEqual(2, m.call_count)
+
+    def test_unattributed_403_is_none_fail_closed(self) -> None:
+        with patch(_URLOPEN, side_effect=_http_error(403)):
+            self.assertIsNone(self.r.resolve("10.243.0.9", "tok"))
+
+    def test_other_http_error_raises(self) -> None:
+        with patch(_URLOPEN, side_effect=_http_error(500)):
+            with self.assertRaises(PolicyResolveError):
+                self.r.resolve("10.243.0.1", "tok")
+
+    def test_unreachable_raises(self) -> None:
+        with patch(_URLOPEN, side_effect=urllib.error.URLError("refused")):
+            with self.assertRaises(PolicyResolveError):
+                self.r.resolve("10.243.0.1", "tok")
+
+    def test_missing_policy_field_is_empty(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"bottle_id": "b1"})):
+            self.assertEqual("", self.r.resolve("10.243.0.1", "tok"))
+
+    def test_posts_source_ip_and_token(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"policy": "P"})) as m:
+            self.r.resolve("10.243.0.7", "the-token")
+        req = m.call_args.args[0]
+        self.assertTrue(req.full_url.endswith("/resolve"))
+        sent = json.loads(req.data)
+        self.assertEqual("10.243.0.7", sent["source_ip"])
+        self.assertEqual("the-token", sent["identity_token"])
+
+    def test_resolve_without_token_sends_empty(self) -> None:
+        with patch(_URLOPEN, return_value=_resp({"policy": "P"})) as m:
+            self.r.resolve("10.243.0.7")  # token optional
+        self.assertEqual("", json.loads(m.call_args.args[0].data)["identity_token"])
+
+
+if __name__ == "__main__":
+    unittest.main()