AIP-5401/5403: integrate SLIM caller route with LAS

[kc-splunk]

Summary

Implements the AIP-5401 SLIM-to-LAS route configuration and AIP-5403 caller access setup together, with focused unit coverage, an isolated cluster candidate manifest, sanitized probes, and the full acceptance record in the cluster validation document.

The product developer clarified that incremental LAS events are not required for this agent image; the final response is required. The strict PLATFORM_URL requirement will be modified, and the assistantID/threadID issue is under investigation.

Acceptance record

• AIP-5401 – selected graph route and final result: blocked in cluster validation. The supplied image generates non-UUID assistant and thread IDs rejected by LAS, so a successful final response and persisted result could not be demonstrated. Direct LAS graph invocation and state retrieval passed as dependency baseline.
• AIP-5401 – invocation context and errors: context is supplied per invocation; successful forwarding and non-persistence remain unverified. Incremental event forwarding is not required per product clarification. A failed invoke returned HTTP 200 with a terminal success=false / http_error_code=500 envelope.
• AIP-5401 – cpuOnly: blocked by the image's current strict PLATFORM_URL startup requirement; test candidate needed an unreachable loopback placeholder. The developer says this requirement will change.
• AIP-5403 – identity/access: auth remained enabled; missing and malformed bearer requests returned 401. A short-lived Splunk admin JWT passed issuer/signature/current-context validation and reached the adapter. No actual AITK principal or least-privilege route grant was validated.
• AIP-5403 – ingress/transport/egress: recorded as internal ClusterIP over HTTP; no public ingress or namespace NetworkPolicy, and no TLS/mTLS or external caller test.
• Both stories remain In Progress; this PR does not claim acceptance or closure.

Verification

• go test ./pkg/ai/features/slim -count=1 passed.
• YAML parsing and git diff --check passed.
• Isolated cluster candidate cleanup and original shared LAS/SLIM/operator health are documented in the acceptance record.

Cluster validation must be repeated after SLIM fixes assistant/thread UUID handling and the CPU-only PLATFORM_URL requirement.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T10:42:47.270058Z	b09e5f1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b09e5f1dab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Requeue cross-namespace SLIM services on platform changes

When a SLIM AIService references an AIPlatform in another namespace, this route is derived directly from the platform's AgentRuntime provider and assistant ID, but later platform updates will not refresh it: findAIServicesForPlatform in internal/controller/aiservice_controller.go only lists AIServices in the platform's namespace. Cross-namespace references are otherwise accepted and resolved here, so changing the provider can leave AGENT_SERVER_URL pointing to a deleted Service, while changing assistantId leaves LAS_GRAPH_ID stale until an unrelated reconciliation occurs. The platform watch must search all namespaces for matching references or cross-namespace references must be rejected.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Require a trusted issuer before forcing authentication

For any valid AIPlatform with Splunk integration disabled and no trustedIssuers, buildSplunkIssuersVal returns an empty string, yet these defaults unconditionally enable authentication and authorization. The admission webhook explicitly accepts an empty Splunk configuration, so this produces a healthy-looking SLIM deployment for which no bearer token can satisfy the empty issuer allowlist and every caller is denied. Either reject SLIM configurations without an issuer or provide another configured identity path rather than silently deploying an unusable endpoint.

Useful? React with 👍 / 👎.

[kc-splunk]

AIP-5401 / AIP-5403 updated-image cluster retest — 2026-10-16

Retested the supplied feature-las-202610152102-b7cb6e97e381 image at digest sha256:951ac687c0753399e9a636cd507ec541f55ecaade4717c19276d228115c003ef in an isolated Deployment. Full evidence and cleanup: dated validation record. At this retest, the rebased branch head was d2ef5a0 on agent-runtime/ai-tier at 3af152d. The P1 review follow-up moved the PR head to afe8251 (four commits, eight changed paths): SLIM accepts either a model URL or an AgentRuntime route, and the long-lived k0s profile is LAS-only again because it retains an older operator pin. The follow-up package build passed locally; it has not been cluster retested. The PR description is the October 15 snapshot; this comment and the October 16 record supersede its image-specific blocker statements.

Acceptance area	Result
CPU-only readiness	Pass for isolated image: Ready 1/1, zero restarts, HTTP 200 health with no PLATFORM_URL. The reconciler now omits that variable when no model endpoint exists; focused Go tests passed. Operator-owned rollout remains untested.
Assistant/thread contract	Fixed: authenticated create returned HTTP 201 and a UUID; invoke reached LAS with a UUID thread and started the selected graph.
Final response and persisted fixture result (AIP-5401)	Unverified with this dummy fixture; deferred to a contract-compatible test. The deployed echo graph expects request, while SLIM submits messages and system_prompt; a normal invoke therefore ended with KeyError('request'). In a separate preseeded-thread diagnostic, LAS persisted the expected echo response, but SLIM returned Completed success=true with an empty response. These are input-contract and response-shape diagnostics for the dummy graph, not evidence that the Launchpad final-response path fails and not a story blocker in this development phase. AIP-5401's literal returned-and-persisted fixture-result criterion remains unverified until the Launchpad image or a compatible fixture is available. Incremental events are not required per product clarification. AIP-5403 has no final-response criterion.
Context and errors	Partial: a unique context marker appeared in the LAS run list and was absent from persisted thread state. The dummy graph's failed run returned HTTP 200 with a terminal success=false/http_error_code=500 envelope. Resume/HITL is unverified.
AITK-to-SLIM access	Partial: missing and malformed bearer requests returned 401; a Splunk admin JWT passed current-context and reached create/invoke. The actual AITK principal and product grant were not tested. SLIM-to-Agent-Server uses the internal Service without application auth as intended.
Ingress/transport/egress	Recorded with limits: isolated ClusterIP HTTP Service, no public ingress; network restriction, TLS/mTLS, and external caller tests remain unqualified.

The candidate, temporary pull Secret, synthetic LAS objects, port forwards, private tunnel, and exact temporary SSH rule were removed. Primary LAS/SLIM AIServices remained Ready with unchanged UIDs and Deployments 1/1. The dummy-graph mismatch is not an acceptance failure for either story. AIP-5401's compatible final-result check and the other qualification gaps above remain open; no story status or acceptance decision is changed by this comment.

Merge and Jira closure update — 2026-10-16: PR #249 merged into agent-runtime/ai-tier as b884916. AIP-5401 and AIP-5403 were moved to Done / Fixed after separate closure comments. Those comments preserve the unverified product-path checks above; Done records the merged development scope and does not turn the dummy fixture diagnostics into Launchpad acceptance evidence.