Skip to content

feat(team): add standing-team control plane - #545

Draft
Pal Lakatos-Toth (pallakatos) wants to merge 34 commits into
public/pr2-core-governancefrom
public/pr3-team-control-plane
Draft

feat(team): add standing-team control plane#545
Pal Lakatos-Toth (pallakatos) wants to merge 34 commits into
public/pr2-core-governancefrom
public/pr3-team-control-plane

Conversation

@pallakatos

@pallakatos Pal Lakatos-Toth (pallakatos) commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • add KarsTeam as a long-lived governance envelope over short-lived task runs
  • materialize principal/member task roles through the existing KarsTask authority path
  • add cadence-driven run generation, pause/hibernate behavior, health, and steering digests
  • add provenance-indexed team knowledge commons
  • add governed KarsSkill and KarsProfile primitives with admission validation
  • protect envelope authority fields with a ValidatingAdmissionPolicy

Stack

Security properties

  • role and run envelopes reuse the existing attenuation lattice
  • invalid capabilities or profiles degrade the team instead of launching partial authority
  • skills require a bounding policy
  • knowledge entries retain source/run provenance
  • envelope authority axes are controller-writable-only

Prior local qualification

  • controller: 960 passed
  • phase taxonomy guard: passed
  • cargo clippy --all-targets --all-features -- -D warnings: passed
  • formatting and Helm lint: passed
  • CNCF conformance: 17/17 passed
  • LOC and repository security gates: passed

Security audit: docs/security-audits/2026-09-03-standing-team-control-plane.md.

Publication review contract

Stacked on #544. Review this delta now, but do not merge it into the intermediate publication branch. After its parent is merged, retarget to kars-bridge and require fresh full CI and approval before merging.

  • Kars remains independently usable; none of these core foundations requires Bridge.
  • This is a scoped foundation, not a claim that the complete Bridge execution/engineering experience is publicly available.
  • CI, CodeQL, dependency review, secret scanning, and all existing policy gates now run on publication PR bases as well as their existing protected branches. No gate is waived and no privileged pull_request_target trigger is introduced.
  • The npm bulk audit gate rejects malformed lockfiles and advisory responses, preserves high/critical blocking, and fails after bounded retries. CLI regression coverage includes the three shipped lockfiles.
  • The local results above describe earlier qualification, not a substitute for the latest commit's GitHub checks or approval. Latest-head qualification and independent foundation review are in progress.
  • No customer/H100 deployment or merge is part of preparing this PR.

Integration landing plan

The public integration branch kars-bridge starts at current main 7eb039e9. Land the reviewed, fully qualified slices there in order: #543 -> #544 -> #545 -> #547, followed by the remaining bounded layers. Downstream PRs stay stacked for focused review until their parent lands, then retarget to the integration branch. Preserve merge ancestry; do not squash/restack away reviewed history by default.

The integration branch has required CI/security gates, up-to-date-base checks, independent approval and conversation resolution, with force pushes, deletion and admin bypass disabled. Its CI pushes must not automatically publish images or releases. Required genuine audit sign-offs are not waived.

Only after complete cross-layer review and qualification of standalone Kars, existing-customer CLI/install/upgrade behavior, and additive Bridge install/removal should a final integration-to-main promotion PR be merged. No partial runtime is being landed directly in main.

Pal Lakatos-Toth and others added 21 commits September 3, 2026 17:13
Pal Lakatos-Toth @pallakatos
feat(team): KarsTeam standing-team primitive with charter cadence loop
da41857 
Adds the durability-axis primitive (design note §11): a KarsTeam CRD plus
reconciler that materializes a principal KarsTask (full envelope) and member
KarsTasks (attenuated, parented to the principal), then runs a charter cadence
loop that mints and launches task-force KarsTasks on schedule — the autonomous
monitoring mechanism for standing operations (monitoring a repo/org, periodic
checks). The reconciler authors KarsTasks rather than re-implementing sandbox
materialization, so all existing attenuation enforcement, mesh agent loop,
receipts, and metering are reused unchanged. Fully additive: a cluster with no
KarsTeam objects behaves identically.

- controller/src/kars_team.rs: KarsTeam CRD (charter, envelope, roster, cadence,
  blueprint, reporting_to, knowledge_commons, paused), validation + commons_name
- controller/src/kars_team_reconciler.rs: principal/member materialization +
  charter cadence loop (PHASE_ACTIVE/DEGRADED/HIBERNATING)
- crd_validations.rs: kars_team_crd() + CEL (tier range, ceiling<=tier, charter)
- helm crd-karsteam.yaml + helm_drift dump/match tests
- phase.rs: PHASE_HIBERNATING; field_managers.rs: CLAW_TEAM; main.rs: wire reconciler

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
feat(team): grant controller RBAC for karsteams resources
e76ce94 
KarsTeam reconciler needs list/watch/create/update/patch on
karsteams (+ /status, /finalizers). Without it the reconciler
self-disables with a 403 at startup.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
feat(team): knowledge commons — provenance-tracked team shared memory
f9b784c 
Implements the team knowledge commons (design note §14) — real, in-cluster
shared memory that a standing team accumulates across its runs, closing the
'no sign of shared memory' gap.

- controller/src/team_commons.rs: ConfigMap-backed commons (kars-commons-<team>),
  owned by the team. Append-only, provenance-tracked entries (id, author,
  source run, timestamp, content digest, size), budget-bounded with oldest-first
  pruning. ensure_commons / record_entry / prior_knowledge.

Two load-bearing paths make this functional memory, not a display:
- Write path (autonomous): when a standing-operation run completes with a
  substantive deliverable (tokens spent or artifacts produced — harness-neutral),
  the reconciler harvests its output into a commons entry, then retires the run's
  sandbox (launch=false) so runs never pile up. Backpressure caps concurrent
  runs so the charter loop can't outrun completion.
- Read path (functional): when minting the next run, the most recent commons
  entries are injected as prior knowledge into the run objective, so the team
  builds on what it already knows instead of starting cold each tick.

Runs are driven to completion autonomously via the existing mesh run-request
annotation. Verified live: run (13646 tokens) -> harvested with provenance ->
sandbox retired -> next run objective carries the prior-knowledge preamble.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
feat(team): operations health — autonomous-monitoring report
44e1e1a 
Computes a standing team's operational health from run outcomes + cadence
punctuality, so the operator can tell at a glance whether the team is actually
producing, not merely scheduled (addresses 'monitor that they work
autonomously, checking periodically').

- KarsTeamStatus: health (Healthy/Watching/Unproductive/Stalled/Hibernating),
  runsSucceeded, tokensSpentTotal, commonsEntryCount, lastSuccessAt
- harvest pass now tallies substantive vs barren runs + total tokens + newest
  success; health derives from those + overdue-cadence detection
- team_commons::entry_count for shared-memory size
- regenerated crd-karsteam.yaml (status fields); helm drift green

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
fix(team): make auto-launched standing runs reliable (no hard timeout)
8cf739e 
Standing-operation runs stamp run-requested at launch, which raced the
sandbox's mesh warm-up: the first delivery fired before the agent was ready,
producing a permanent 180s-timeout deliverable that was then retired.

- mesh delivery: a transient miss (agent not yet discoverable, or no reply
  within the window) is now retried on the next poll up to MAX_DELIVERY_ATTEMPTS
  instead of being recorded as a terminal timeout on the first miss. Only after
  the warm-up budget is spent is a terminal 'agent never came online' result
  written. Tracked via the run-attempts annotation.
- team retire: a run's sandbox is torn down only once delivery is terminal
  (deliverable landed AND run-completed stamped), so the team never pulls a
  sandbox out from under a run that's still warming up / retrying.

Verified live: a fresh standing run delivered ok with 28291 tokens and no
timeout, then retired cleanly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
feat(admission): envelope-write VAP — governance fields controller-wr…
f03dd35 
…itable-only (arch-D)

ValidatingAdmissionPolicy that makes a KarsTask/KarsTeam's governance fields
controller-writable-only. On UPDATE by any principal other than the controller
SA, it denies:
- writing .status (the controller-owned governance facts), and
- RAISING spec.envelope.tier / authorityCeiling / delegationDepth (self-escalation).

Voluntary attenuation (lowering envelope fields) and non-authority spec edits
(objective, paused, execution.launch, annotations) remain allowed, so the Bridge
BFF and operators keep working. The controller SA is exempt via matchCondition.
UPDATE-only (CREATE bounds are the CRD's own CEL); status subresources included.

Verified live: self-escalate tier 4->5 DENIED, hand-write status DENIED,
voluntary attenuation ALLOWED, controller status writes ALLOWED.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
feat(receipt): record the validated launch package at the receipt hea…
ae6cc33 
…d (§20)

The receipt predicate now opens with the validated launch package — the editable
composition (runtime/model/tool-policy/MCP/isolation/memory) the operator
reviewed before launch — pinned by a deterministic sha256 digest. This puts
what-was-approved at the head of the signed record (the launch ledger), so the
receipt binds not just the trust envelope but the concrete plan that ran.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
feat(team): daily digest to the steering inbox (§20)
3da56d3 
A standing team now publishes a periodic digest — its autonomous-monitoring
report — without being asked. On cadence.digestEveryMinutes the reconciler
appends a timestamped entry (health, runs generated/delivered, tokens spent,
knowledge accumulated) to a rolling kars-team-digest-<team> ConfigMap.

- kars_team.rs: cadence.digestEveryMinutes + status.lastDigestAt; CRD regen
- team_digest.rs: rolling digest log (last 30), provenance (team/reportingTo)
- kars_team_reconciler.rs: publish when the digest interval elapses

Verified live: digest published (Healthy: 21 runs, 4 delivered, 56098 tokens,
4 knowledge entries) and surfaced.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
feat(team): KarsSkill + KarsProfile CRDs, skill grants, profile insta…
435ef37 
…ntiation, governed promote, capability-readiness gate

Closes the durability-axis composition layer (§13/§17/§12/§19), all additive:

- KarsSkill CRD (§13): reusable, versioned capability bundle (bounding tool
  policy + MCP + recipe + knowledge pack), validated + content-digested by its
  reconciler. Granted to ROLES — the team reconciler merges a Ready skill's
  tool policy / MCP servers / recipe into the materialized member blueprint, so
  the grant is a real authority fact, not a label.
- KarsProfile CRD (§17): vetted team template (charter + roster + skills +
  envelope + domain), validated + digested. A KarsTeam with spec.profileRef
  inherits the profile's charter (if empty) + roster (if empty) — domain-blind
  platform, domain in the profile.
- Governed promote (§12): KarsTeam.spec.requestedTier opens a human tierRaise
  KarsApproval against the principal; only on approval does the controller widen
  the envelope (controller-only raise — enforced by the envelope-write VAP), and
  the approval is bound into the principal's receipt (human-approved + ledgered).
- Capability-readiness gate (§19): the charter loop checks every referenced MCP
  server is provisioned + Ready before minting a run; if not, it pauses-with-
  reason (clear status detail) instead of dispatching a doomed run that loops.

Wiring: 2 new reconcilers + RBAC + helm CRDs + helm-drift tests. 952 tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pal Lakatos-Toth @pallakatos
fix(team): promote uses merge-patch + charter CEL allows profile inhe…
fefa290 
…ritance

- process_promotion widens the envelope via a merge-patch (not SSA apply) so the
  other envelope fields are preserved (an apply dropped siblings and failed CRD
  validation on the next reconcile).
- charter CEL now allows an empty charter when spec.profileRef is set, so a
  profile-instantiated team passes admission and inherits the profile's charter.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@pallakatos
fix(team): meet public conformance gates
39fa94e 
Add skill/profile admission validation, document the standing-team security review, and format the control-plane slice for public CI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge updated core governance base
adc091f 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge existing-AKS adoption stack
5aa9131 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge explicit kube-context stack
067881d 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge existing-cluster documentation stack
4fb606c 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge existing AKS values template stack
957c283 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge complete existing AKS prerequisites stack
9c67a69 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge fixed public image repository stack
735076e 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge npm lockfile audit stack
b2732a8 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge npm bulk audit stack
03c7756 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Merge stacked publication qualification
8fe755b 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@pallakatos
refactor(team): route content hashes through signing provider
ea6f578 
Keep the crypto gate intact by reusing the standard SHA-256 wrapper for skill, profile and commons identifiers. Preserve the existing identifier bytes and full receipt payload hashes, with known-vector regression coverage.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
This was referenced Sep 7, 2026
Draft
Open
Draft
@pallakatos
fix(team): bind authority and preserve scoped team evidence
4a8a6ff 
Enforce exact promotion bindings and ownership, reconcile revocation and removed roles, preserve inherited skill configuration and mandatory policy bounds, and isolate commons/digests with CAS persistence. Bind full profile/launch configuration, fail closed on unsupported aggregate budget launches, and keep admission defaults safe under reused Helm values. Decompose the state machine without LOC waivers. Rust qualification follows integration of the required governance APIs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Integrate repaired governance APIs into team foundations
21782f5 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903

# Conflicts:
#	controller/src/kars_receipt_log.rs
@pallakatos
test(team): pin authority fixtures and reject stale promotion digests
41e0b84 
Keep Ready fixtures independent of ambient model defaults and exercise both stale-status rejection and a fresh reconcile that cannot reuse an old approval.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Integrate qualified governance and nil-safe admission followups
ae66349 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
fix(team): qualify integrated schemas and independent test fixtures
3bfc99f 
Use current Kubernetes timestamps and strict shared parsing, align inherited Team/Profile schema descriptions, and initialize the test TLS provider explicitly so stateful regressions do not depend on other tests running first. Preserve all lint and drift gates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Carry current publication guardrails through team integration
415b53c 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
fix(team): bound complete cadence objectives and commons history
44c94b2 
Reserve the fixed team/charter prefix within the existing 4096-character objective limit, then select only complete serialized provenance entries with intact framing. Fail explicitly when fixed content cannot fit, without truncating the charter or bypassing commons ownership/integrity checks. Add Unicode, escaping, capacity-boundary and stateful cadence-recovery regressions. Rust execution remains deferred while the shared Cargo target is leased.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Carry qualified effective authority snapshot into team closure
4bb5043 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Preserve signed historical decisions in team governance
1fd9781 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903

# Conflicts:
#	controller/src/kars_receipt.rs
@pallakatos
Carry final entry-slice compatibility through team foundations
94d5721 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
fix(team): use the shared degraded phase constant
8a75f24 
Preserve the existing health value while satisfying the phase taxonomy guard.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
@pallakatos
Carry governance CI corrections into team qualification
73094aa 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lachie83 Lachlan Evenson (lachie83) Awaiting requested review from lachie83 lachie83 will be requested when the pull request is marked ready for review lachie83 is a code owner
@johnsonshi Johnson Shi (johnsonshi) Awaiting requested review from johnsonshi johnsonshi will be requested when the pull request is marked ready for review johnsonshi is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pallakatos