feat(bridge): import the complete optional Kars Bridge application

[Pal Lakatos-Toth (pallakatos)]

Complete Kars Bridge application, optional add-on

Draft; not beta/release-approved. Target: kars-bridge.
Head: f8f4a7faf31dbd6d506e219d039d7c0163cf385c.
Prerequisite: #554 merged from 8798a57bf9c35964754cab97fb294a5494c0078f.
Actual integration ancestor: e3d61351100e1091b0fc8b5220ac36e75a81848d.

This head includes the protected prerequisite merge, the scoped delegated source
attestation and a reproduced CI status-observation fix. Controller/router/BFF/web/
gateway/CLI production code and policies remain unchanged from qualified
aa405635.

Current blocker: all final execution and source gates passed. The remaining
failed check and unresolved review conversation are CodeQL IMDS alert 827,
which still needs an authorized disposition. The PR remains draft and unmerged;
no H100 deployment or normal release has been approved by this qualification.

Current CI fixture correction

The preceding b967c1e3 core workflow finished with 183 passed, one failed.
Only the KarsMemory honest-state assertion failed: it captured an empty phase,
then Ready=False / NoSandboxesReferencing. Its immediate diagnostic dump already
contained the valid complete Compiled/False/NoSandboxesReferencing status.

The actual shell fixture reproduced the same failure before this fix. It read
phase, Ready and reason in three separate API requests across one controller
status publication. The ConfigMap can also become visible before that status.
No controller/memory implementation defect is established by this observation.

The fixture now reads one JSON response, waits for complete current-generation
status while pinning identity/intent, and retains the existing deadlines and
accepted state tuples. The same split-read pattern is corrected in the related
InferencePolicy, KarsEval and EgressApproval assertions; evaluator Pending/False
settlement, egress host-count/finalizer checks and invalid-state failures remain.
API errors fail explicitly rather than receiving new retries.

All 19 new regressions plus 28 existing harness cases pass locally, including
the actual shell reproduction, malformed/stale/replaced snapshots and deadline
bounds. No controller, runtime, policy or timeout change is included. Fresh
hosted acceptance now passed: core CI 34908997660 completed all 21 jobs, and
Kind job 104199283421 reported 184 passed, zero failed, including the
correct coherent states for all four repaired observations. The earlier
183/1 result remains recorded as a failure, not relabeled.

Publishes the existing Bridge application under bridge/: Rust BFF, Next.js
Workspace/Console/Audit, optional Teams gateway, separate Helm chart, development
entrypoints, documentation and acceptance fixtures. The original snapshot is
0a10472ed7e2940235b714276e8def3c0d9190f4; all 398 imported product paths remain.
Private history, credentials, operator state, deployment overlays, caches and
frozen SDK/probe ancestry are excluded.

Core remains independently usable. Bridge has separate packages, opt-in builds
and a separate Helm release. Adding/removing Bridge must preserve core identities,
resources and customer data. /sandbox remains ephemeral; no PVC feature is added.

Reviewed functional repairs

Final application review found six concrete problems not covered by the previous
green suites. All six repairs are now published in this head, independently
re-reviewed, and qualified by actual component execution:

Finding	Repair state
Active HTML/SVG artifacts inherit Bridge origin	Safe download/sandbox response boundary; all four real-handler regressions passed
Operators bypass admin-only budget/retention controls	Verified-session web and BFF middleware/handler checks; five Rust and six real-JWT web cases passed
Gateway uses positional calls incompatible with locked Kubernetes SDK	Request-object API with SDK-derived types; real SDK HTTP cases passed
Completed remediation suppresses later same-package advisories	History/in-flight authority preserved; all 16 renewal regressions passed
Separate-namespace gateway targets the wrong workspace	Core-read/add-on-storage separation; rendered, SDK and uninstall/lifecycle cases passed
Filename matching is presented as recorded agent attribution	Per-file explicit/inferred evidence; actual renderer regressions passed

At aa405635, public Bridge CI passed all 11 jobs. BFF job 104154078482 executed all
25 new Rust regressions by exact name, plus the full 259-library/4+2-integration
suite, with zero ignored cases. All 37 required regression registrations passed.
Web job 104154078446 passed all 50 contracts and the actual Next 16.3.3 build/
immutable-root startup. Gateway job 104154078031 ran locked Vitest 4.1.11:
84 normal cases passed, then all three actual Kind lifecycle cases passed.
These hosted results close the earlier local Next/Vitest cache limitations.
Its full core CI also passed all 21 jobs, and native acceptance passed all
18 cases, three cold API installs and the aggregate. The final source attestation
is now published. The newer current-base head still needs its own full
core/native/scanner gates; none of this is beta or H100 approval.

Current public qualification

Qualification	Current run	Status
Bridge components, BFF/web, dependency checks and add-on lifecycle	34908997571	All jobs passed on the fixture-fix head
Native API, controller/BFF lifecycle, TLS and CNI	34908997644	All 18 cases, three cold API installs and aggregate passed
Core with Bridge physically absent	34908997660	All 21 jobs passed; Kind 184/184, including all four coherent-status observations
Standalone prerequisite	34894935679	All 21 jobs and all required gates passed; merged as e3d6135
Source gates	34908997560	All source gates passed, including audit and copyright
CodeQL	34908997607	Analysis passed; alert check reports only the still-open IMDS HTTP alert 827

Artifact 10374607713 binds both revisions to f8f4a7fa: all 18 cases passed,
rotation in 84.49 seconds, runtime/network qualification true, active-SRE-combined
false. The repaired KarsMemory observation separately passed in the core Kind
job; the two workflows are not interchangeable evidence.

Preceding artifact 10372307257 binds both revisions to b967c1e3: all 18 cases
passed, rotation in 87.71 seconds, runtime/network-policy qualification true.
This remains the controlled-no-LLM/no-active-SRE lane, not live standing-Team
or active-SRE-combined approval.

Repaired-source artifact 10370845677 binds both native revisions to aa405635:
18 passed, zero failed or blocked, rotation in 85.68 seconds. Runtime and
network-policy qualification are true; active-SRE-combined qualification is false.

The preceding artifact 10367675286 binds both native revisions to 5e9a1fe5: 18 passed,
zero failed or blocked, rotation in 78.3 seconds. Runtime and network-policy
qualification are true; active-SRE-combined qualification remains false.
That head's separate API/CEL failure occurred before policy/workload cases while waiting
for a public CRD to be Established. Its cause was discarded by the command
wrapper and is not established. The identical standalone fixture passed.
Bounded public-schema diagnostics are now published without changing any timeout,
retry or acceptance assertion; no failure is relabeled.

The preceding application 1d0fc5c9 passed
all 21 core jobs,
all 11 Bridge component jobs,
and all 18 native cases, three cold API installs and the aggregate.
Core 03174dca also passed all 21 jobs.
Both Kind suites reported 184 passed, zero failed, including real historical
migration and metrics-dependent SRE acceptance. The intermediate 5e9a1fe5
changed only two CLI test expressions; the current head includes the six
application repairs and bounded CI corrections described above.

All qualification runs in Azure/kars. Current heads must establish their own
results; no historical outcome is substituted or failure waived.

CodeQL alerts 828/829, concerning API-group array membership rather than URL
validation, are now reported fixed after the exact-element-equality change.
Alert 827 flags the existing
fixed http://169.254.169.254 IMDS token request. That client bypasses proxies,
does not follow redirects, and is separate from HTTPS-only Foundry/AAD clients.
Azure documents IMDS as host-local HTTP;
changing this endpoint to HTTPS would not be a supported repair. Its alert
disposition is still open and requires authorization; no absent-user response
has been treated as approval. No dismissal, scanner suppression or authentication
change has been made.

Current corrections: preceding public copyright checks passed in both candidates.
Full CLI/Rust validation exposed a header-style regression in chart files also
read as raw YAML: Go-template comments are not valid for those readers. The
correction now preserves raw schema objects and original Helm document boundaries,
without changing CLI/Rust consumers or weakening tests. All twenty CRD inputs
retain exactly 21 schemas with zero added documents. Local full CLI suites pass:
1,995 app tests and 1,991 core tests, each with two existing local skips. All 61
targeted staging tests and 33 copyright tests pass per worktree. The corresponding
public Rust/schema regressions have also passed on this head.

A separate RustSec advisory published on 2026-09-14,
RUSTSEC-2026-0285,
affects core Rustls 0.23.43 and BFF Rustls 0.23.41. Local commits update both to
0.23.45 with the required aws-lc/webpki family. Provider/features and unrelated
locked package choices are unchanged; Cargo validates the minimized locked graph.
This security patch is published and its preceding public RustSec/cargo-deny and
separate BFF dependency audit pass.
Both preceding heads' Rust and CLI jobs passed. Native artifact 10365070493 binds core and
Bridge to 1d0fc5c9 and reports all 18 cases passed with zero failures or blocked
cases, including rotation/current-bearer/revocation in 83.61 seconds. Runtime
and network-policy qualification are true; active-SRE-combined qualification
remains false. No production timeout or retry was introduced for the earlier
unproven rotation delay.
The preceding native artifact 10360357779 reports 17 passes and one rotation
timeout: the workspace grant advanced to generation 4 while status remained at
generation 3. Initial observer readiness and other preceding cases passed.
The cause of that liveness symptom remains unproven. A bounded failure-only
snapshot now retains controller restart/termination facts and metadata-only
grant/observer resources before subsequent test cleanup can restart the controller.
Its eight regressions pass in the 188-test native suite. No speculative runtime
change, production logging, timeout extension or retry is included.

Verified preceding native result

At 24c85cd1, native run 34853257629
passed all 18 runtime cases, all three cold API installs and the required aggregate.
Artifact 10353631768 binds both revisions to that head and reports
runtimeQualified=true, networkPolicyEnforcementQualified=true, zero failures
and zero blocked cases. Executed checks include:

• Fresh observer/privacy RPC and purpose-only pinned TLS/API negatives.
• Positive 9447/9448 traffic and unauthorized-peer denial.
• Current-bearer rotation, revocation and old-key rejection.
• Writer uninstall/core continuity, source preservation and grant revocation.

This is the controlled-no-LLM-agent, no-active-sre-native lane.
activeSreCombinedQualified=false remains explicit. It is not proof of the real
standing-Team maintenance/PR journey or the full supported-pair matrix.
The preceding component workflow also passed all 11 jobs. Core 344a371f passed
all 21 core jobs and all twenty new observer-egress Rust regressions.

The original observer timeout was traced to actual Cilium API SYN denials.
A correctly targeted temporary allowance produced an authenticated API HTTP 200;
the controller-generated permanent policy then achieved observer Ready without
that intervention. Diagnostic outcomes were never promoted into passing cases.

Latest changes

Bounded CI acquisition

The previous app core workflow failed while fetching/applying metrics-server;
its single unchanged-source retry failed earlier on malformed Kind checksum input.
The current CI-only repair retains Kind v0.24.0, kubectl v1.30.5 and metrics
v0.7.2, with strict official Kind checksum/SHA validation before executable
publication. HTTPS acquisition, redirects and transient retries are bounded;
no integrity fallback or unverified cached binary is accepted.
Metrics download and local-manifest apply have separate diagnostics within the
existing 90-second/phase budget, with no Kubernetes mutation retry. Metrics retains
its existing HTTPS provenance, not a new checksum guarantee.

Repository-wide Microsoft/MIT coverage

The original 390 missing Bridge source headers were inserted without deleting
source bytes or existing author notices. Repo-wide coverage now accounts for all
2,307 tracked files: 2,056 inline headers and 251 explicitly covered strict-data,
legal, generated and third-party files. Binary/strict-data files are not claimed
to contain comment headers. Original ownership and MIT licensing are preserved.

The shared checker/applier handles appropriate comment syntax and preserves
shebangs, encoding declarations, Docker directives, frontend directives and
Markdown frontmatter. Generated-source coverage requires reviewed exact paths;
authored files cannot bypass checks merely by appearing beneath build, dist
or similar names. Unknown first-party formats fail.

Byte-sensitive inputs—including the verbatim Helm AGT profile and its runtime
digest—remain unchanged under explicit license coverage. No templates or product
logic were rewritten to accommodate headers. Legal notices, upstream assets and
vendored payloads retain their licensing.

Validation and preserved contracts

Both worktrees passed 33 copyright, 27 acquisition and 28 harness tests, existing
size/copyright checks, type/manifest checks and preserved Helm renders. The native
188-test contract suite also passed locally after the header pass. Local npm-cache
versions differ from the lock; hosted results remain authoritative.

The bounded runtime corrections preserve original namespace/claim/UID/RV fences,
current authorization, actual pause/revocation/refill, consumed revisions and
old-Pod retirement. Only the controller gained management of namespaced Cilium
policies required by enrolled observers; no CNI installation, world/node allowance,
UID-1000 bypass, agent/BFF privileges or TLS/authentication weakening was added.
The native test now distinguishes the two real retirement-phase Pod baselines
while retaining identity, data, root, rotation and old/new-key assertions.

Existing receipt pinning, standard digest/signature adapters and the explicit
legacy-v1 credential-key compatibility boundary remain unchanged. Their scoped
reviews and regressions are not whole-application security sign-off.

Remaining gates and rollout boundary

Complete current-head CI, the authorized IMDS alert disposition and required PR
review before merge. Scoped source attestations are published under the recorded
delegation; they do not waive these gates or claim another human review.
No signature, ownership claim, alert dismissal or approval is fabricated.
Three earlier tentative BFF claims were not established as
current-flow defects; the subsequent six concrete findings above have reviewed
repairs and actual component regression closure. Complete flow acceptance and
the remaining current-head gates are still required.

Land the core prerequisite first, then activate stable Bridge component/native
requirements while retaining existing branch protections before application merge.
Once the integrated public kars-bridge branch is beta-ready, H100 acceptance will
exercise core alone, optional Bridge installation, the real authenticated standing
Team/maintenance/evidence/review/revision flow, explicitly authorized merge, and
Bridge removal with core intact. The current BFF leaves actual merges to a human
GitHub action; no automatic merge authority is introduced.

No main or normal-release change, image publication, H100 deployment or private
repository visibility change is included in this PR.

[github-actions]

Dependency Review Summary

The full dependency review summary was too large to display here (1765KB, limit is 1024KB).

Please download the artifact named "dependency-review-summary" to view the complete report.

View full job summary