feat(credentials): add governed grants and purpose-limited observations

[Pal Lakatos-Toth (pallakatos)]

Governed credential prerequisites for optional Bridge

Merged into kars-bridge; not release or deployment approval.
Qualified head: 8798a57bf9c35964754cab97fb294a5494c0078f.
Merge: e3d61351100e1091b0fc8b5220ac36e75a81848d at 2026-09-14 21:55:18 UTC.
Integration ancestor: b5ad6791f9085e908cbf3d16b5de9021eb4b43a7.
Paired application: #563.

This prerequisite supplies metadata-only credential grants, UID-bound sources
and operator stores, governed GitHub integration, and purpose-limited private
observations. Kars remains independently usable without Bridge. No private
history, credentials, SDK/probe ancestry or cluster-specific overlays are imported.

Current qualification

All qualification runs in Azure/kars, on the exact public candidate.

Qualification	Current run	Status
Core Rust/CLI, Kind, benchmarks and fault injection	34894935679	All 21 jobs passed; Kind 184/184 with real historical migration
Source gates	34894935658	All seven passed, including current-scope audit and new gate regressions
CodeQL	34894935686	Analysis and alert check passed

The exact-head guarded merge retained all 29 GitHub Actions-bound required
checks. The temporary account-specific review allowance was restored immediately;
strict-base, review/last-push/stale-review, administrator and conversation
protections remain unchanged. No audit or technical-check waiver was used.
Public main remains 7eb039e9ab8a26062808eab0dff9251ec2b76352.

The immediately preceding 9ee285be passed
all 21 core jobs
and CodeQL. This head adds scoped source attestations, the already application-
qualified audit-record boundary logic and public CRD-wait diagnostics/tests.
Controller/router/CLI production source, bundled schemas and dependency locks
are unchanged from that qualified revision.

Independent integrated review found no high-confidence blocker in the recorded
generic credential/private-observation seams and governed GitHub issuance/reuse.
The audit records disclose the existing
maintainer-delegated AI authority,
exact source/base and limits; they do not invent a second human or approve the
whole Bridge application, live GitHub or H100 acceptance.

The gate now requires genuinely new signed records rather than reusing modified
or renamed older approvals, and rejects an unavailable review base. Copyright-only
changes do not demand retrospective signatures on historically completed scopes.
Four old-gate failures were reproduced; all seven real-Git regressions now pass.
No check or signature requirement was waived.

The paired app's 5e9a1fe5 API fixture failed while waiting for a public CRD to
become Established, before admission/workload cases. Its wrapper hid the reason;
the identical core fixture passed. This head enables the existing bounded
public-schema diagnostic for that wait. The extracted command body, fixed
context and all request/child/wait deadlines are preserved; no retry is added.
Four real-child diagnostic/redaction cases pass. The original cause remains
unclassified, and current-head native qualification is still required.

The earlier 03174dca passed
all 21 core jobs,
including Kind 184 passed, zero failed, benchmarks, real historical schema
migration and metrics-dependent SRE acceptance. Its copyright gate also passed.
The subsequent 9ee285be changed only two exact-array-equality expressions
in the rendered-RBAC test before its own successful full qualification.

The preceding production implementation, 344a371f, passed
all 21 core jobs.
Its Rust job executed all 3,066 tests with none skipped, including all twenty
new observer API-egress regressions. The paired application 24c85cd1 passed
all 18 native runtime cases, three cold API installs and the aggregate.
That is actual Kubernetes/Cilium qualification in the controlled no-LLM,
no-active-SRE lane—not real standing-Team or active-SRE-combined approval.
Historical results do not replace the new head's checks.

The preceding CodeQL failure was separate from its successful analysis jobs.
Alerts 828/829 classify Array.includes("cilium.io") in a rendered-RBAC test
as URL substring validation. These are Kubernetes API-group arrays, not URLs.
The published test-only clarification uses exact element equality and passes all
17 contract cases, typecheck and lint locally. It was pushed only after both
preceding full core workflows completed successfully. Its CodeQL check passed.
No alert has been dismissed or suppressed; the newer head still needs its own
hosted clearance.

Corrections on this head: the preceding repository-wide copyright gate
passed in public CI, but full CLI/Rust consumers found that Go-template license
comments were inserted into some chart files also consumed as raw YAML. Five
CLI cases plus suite loading and four Rust schema checks failed. The format-only
correction now uses hash comments for dual-use YAML and preserves original
document boundaries. All twenty CRD consumer inputs retain exactly 21 schema
documents with no additional empty documents. Original bodies, modes and schema
JSON are preserved; no consumer parser or assertion changed.
Separately, the newly issued RUSTSEC-2026-0285 affects locked Rustls 0.23.43.
A minimal patch to Rustls 0.23.45 and its required crypto dependencies is now
published, with provider/features and unrelated locked package choices preserved.
Local full CLI validation passes 1,991 tests with two existing local skips;
33 copyright tests and all 61 targeted staging cases pass. Preceding public Rust,
CLI, RustSec and cargo-deny jobs have now passed without suppressions.
The paired application 1d0fc5c9 passed all 18 native cases, including rotation,
all three cold API installs and the required aggregate on the patched TLS stack.
This remains the controlled no-LLM, no-active-SRE lane. Current-head qualification and
genuine audit/PR approvals remain required.
The preceding app native run passed 17 cases but timed out during grant
rotation: generation 4 remained at observed generation 3. Its initial observer
path passed. This separate liveness symptom has bounded failure-time diagnostics;
no cause-specific runtime fix is inferred from that timeout. The new run's
rotation case passed in 83.61 seconds without extending its deadline.

Latest changes: CI reliability and repository attribution

• Kind remains v0.24.0, kubectl v1.30.5, and metrics-server v0.7.2.
  The CI installer validates the official exact-filename checksum and binary
  SHA-256 before chmod or PATH publication. HTTPS redirects, connection/transfer
  budgets and transient retries are bounded; malformed checksums and digest
  mismatches never trigger an unverified fallback.
• Metrics-server download and local-manifest apply are separate operations
  sharing the original 90-second/phase budget. Kubernetes mutations are not
  retried. Metrics retains its existing HTTPS provenance; no new checksum
  guarantee is claimed for that manifest.
• Format-aware copyright enforcement covers all tracked files. This core tree
  has 1,520 inline Microsoft/MIT headers and 238 explicitly accounted-for legal,
  generated, strict-data and third-party files. Binary/strict-data files are not
  falsely described as containing comments. Existing notices and MIT licensing
  are preserved.
• Generated coverage is restricted to reviewed exact artifact paths; directory
  names such as build or dist and the .d.ts suffix do not exempt authored
  source. Unknown first-party formats fail the check.

Local validation passed 33 copyright, 27 acquisition and 28 harness tests in
both worktrees, plus existing size/copyright gates. Insertion-only byte/mode
proofs, parser/frontmatter checks and Helm render comparisons preserve behavior.
The verbatim embedded AGT profile, crypto fixtures, lock data and upstream assets
remain byte-identical under explicit license coverage. No product logic,
permissions, tool versions or runtime deadlines changed in this latest batch.

The CI corrections respond to two distinct prior failures: an unclassified
metrics-server fetch/apply failure, and a later malformed Kind checksum download
before cluster creation. The first failure's precise cause remains unknown.
Neither was accepted as a passing test or bypassed.

Runtime corrections already verified

Observer policies provide canonical API Service/ready-Endpoint host routes.
Already-installed Cilium receives a namespaced API-entity policy on validated
TCP ports. Original namespace UID/claim, grant ownership and policy UID/RV
fences remain; durable cleanup hints cover interrupted retirement and removed
targets. Only the controller receives CNP management rights—not CCNP access or
agent/BFF privileges. CNI installation/configuration, UID-1000 egress restrictions,
TLS and authentication are unchanged.

Enrollment handles only confirmed pause conflicts through bounded full
revalidation. Writer and Task reconciliation do not require an incidental
shared status transition; actual owned pause/revocation/refill, current authority,
consumed revisions and old-Pod retirement remain required. Historical schema
migration retains its bounded, UID/RV-fenced, no-adoption behavior.

Independent scoped source reviews and executed regressions support these
corrections, but do not constitute whole-PR audit approval. Kubernetes RBAC remains
name-based; application UID checks are not a claim of raw-GET UID authorization.

Integration boundary

Current-head qualification and the guarded integration landing are complete.
The bounded GitHub-services and governed-grants attestations are published under
the explicit delegation, with genuine review scope and honest AI attribution.
This does not approve the separate application, H100 or a normal release.

Before the separately qualified application lands, require the stable
Bridge/native aggregates while retaining existing protections. No main/release
promotion, registry publication, H100 deployment or private-repository visibility
change is included.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
cargo/aws-lc-fips-sys	0.14.2	Unknown	Unknown
cargo/aws-lc-rs	1.18.1	Unknown	Unknown
cargo/aws-lc-sys	0.45.0	Unknown	Unknown
cargo/pkg-config	0.3.34	🟢 4.5	Details Check Score Reason Code-Review 🟢 6 Found 11/16 approved changesets -- score normalized to 6 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 4 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/rustls	0.23.45	Unknown	Unknown
cargo/rustls-webpki	0.103.15	Unknown	Unknown
cargo/rustls	>= 0.23.45, < 0.24.0	Unknown	Unknown

Scanned Files

• Cargo.lock
• controller/Cargo.toml

[Pal Lakatos-Toth (pallakatos)]

Owner-approved CodeQL disposition: alert 804 (rust/path-injection) is a test-only/framework-source false positive at head 80cffb63399aa945de680140683dd202252e947f, analysis merge 3ae018743f4c9f5ebc5f37f6bfa23ab9fcef9cfd. The owner explicitly selected false-positive-804 after reviewing this scope.

The sink at inference-router/src/github_services_tests.rs:9 is reachable only under cfg(test) and receives paths created by local tempfile fixtures. Production has no configurable path field and opens the literal /etc/kars/github/config.json. The reported source is server-owned Axum State<Service> initialized with with_state(service), not a path supplied by an HTTP caller.

Only alert 804 is dispositioned. No query exclusion, security-check removal, audit-signature waiver, or merge approval is implied. Native credential/ServiceAccount/CNI and combined active-SRE qualification remain outstanding; this PR stays draft.