Assembled in the protected integration branch

Merged from exact head b27b8b327163e3b1c80dad35309281ab6be674eb into Azure/kars:kars-bridge at 74abf37d95b8f9de9d27b02016ae3f733ee5e6f0. All 28 non-waived required gates passed. The author explicitly waived the second audit signature; no CI result or reviewer identity was falsified. All 29 required check/app bindings and original review allowances are restored; main is unchanged.

The informational unused-variable review note was addressed with source evidence: object is used inside the json! metadata response. Its conversation was resolved without changing code, dismissing the scanning alert or disabling a scan. The preparation states below are historical.

Current landing decision: explicit author waiver

The author has explicitly waived the second independent-human signature for this integration landing. This supersedes the pending-signature landing blockers in the historical sections below; it does not claim a second review happened.

Current direct integration head: b27b8b327163e3b1c80dad35309281ab6be674eb, based on assembled inference 2a9fde8a. The ancestry refresh preserved the complete source/audit tree. Fresh exact-head technical gates are running; this PR is ready for its guarded landing once they pass. Authenticated waiver and exact source scope: #548 (comment).

The PR can advance onto Azure/kars:kars-bridge after its predecessor lands and every other required gate passes on the refreshed exact head. Only the confirmed one-of-two-signatures audit failure may receive a temporary required-check exception, together with the previously approved account-specific review allowance. Restore all 29 check requirements and original review allowances immediately afterward, including on failure. No CI result or reviewer identity is falsified. main, unresolved later slices, customer deployments and the private Bridge application's publication remain outside this waiver.

Publication stack

Follows #543 -> #544 -> #545 -> #547. This draft targets the inference branch so the diff contains only namespace ownership and its directly coupled creation/cleanup paths. Do not merge into the intermediate feature branch. After its parent lands, retarget to the protected kars-bridge integration branch and require fresh exact-head CI and independent approval. Main promotion remains a separate final gate.

Scope

• Bind runtime namespaces to the exact source workspace, Sandbox name/UID and Namespace UID backlink; guard reconciliation, cleanup, approval targets and router-token reads.
• Create new namespaces atomically. Reject cross-workspace same-name collisions, recreated identities and unproven existing namespaces without force adoption.
• Preserve proven legacy workloads through metadata-only adoption; add read-only kars namespace preflight and explicit reviewed-UID administrator adoption for ambiguous cases.
• Preflight both upgrade commands and SRE installation against an existing controller. Discovery/RBAC/transport errors never become false absence or a forced reinstall.
• Preserve kars add and local-Kubernetes kars dev credential prestaging through a two-way reservation. Fresh SRE installs let the controller claim the namespace before creating the writer account; real Helm upgrades retain exact-release legacy resources.
• Fence the existing handoff credential writer by created Sandbox identity, live namespace claim/backlink, metadata-only Secret anchor and Secret UID/resourceVersion. No new credential sources or RBAC expansion.
• Handle legacy self-hosted namespace GC without adopting unproven resources, and preserve normal cancellation when deletion races reservation binding.

This is a safety prerequisite, not generic credential sources, durable aggregate budgets, complete Team execution, or Bridge publication. Kars still has no dependency on Bridge. No live cluster migration, customer deployment, image publication, release or main merge is performed by this PR.

Compatibility and migration

Read docs/how-to/namespace-ownership.md before controller replacement. Proven legacy namespaces keep their UID, data and pod templates. Same-second/ambiguous ownership requires an explicit administrator decision; conflicts leave running resources untouched rather than silently adopting them. Old unfinished pre-CR reservations require separate inventory. Direct Helm/GitOps upgrades must run preflight; client-only rendering cannot infer previous Helm ownership, so pruning workflows must preserve migrated legacy runtime namespaces. Rolling back to an older controller removes claim-v1 enforcement.

Evidence and open gates

Candidate: 62093414cb8d5d9937c1d9974504047c84669d6c, based on inference head 45cfa009.

• Local repair qualification: 42 focused controller tests, 32 spawn tests including 11 credential-claim regressions, and 161 CLI/Helm/dev tests passed. Strict all-target Clippy for both crates, typecheck/scoped lint and existing static gates passed.
• Actual Helm lookup is exercised against an isolated read-only test API, including legacy retention, disabled SRE, foreign releases, absence and read failures.
• The disposable Kind gate passed at this exact head: 105 cases, zero failures, including actual SRE install with UID-bound namespace/writer materialization and removal preserving the core namespace. Evidence: https://github.com/Azure/kars/actions/runs/34150756641/job/101838058446 . No live customer cluster was used.
• Hosted exact-head CLI/Rust/Helm, dependency/security, CodeQL, Kind, chaos and benchmark checks have all passed. This supplies the lockfile-exact evidence missing from the earlier authorized local cache runs. The sole remaining failing check is security-audit-required: the original candidate had zero genuine Signed-off-by entries; the latest audit-only update records the maintainer approval, leaving the independent reviewer outstanding.
• Automated technical review has closed all reported namespace findings at 62093414, including handoff credential fencing and reservation cancellation; no significant regressions were found in those bounded paths. This was source-level review and regression inspection, not independent execution, live-cluster qualification or human approval. Genuine review/sign-offs and the full CI gates remain required.
• The dated capability audit is docs/security-audits/2026-09-07-sandbox-namespace-ownership.md. The maintainer sign-off is recorded in the latest audit-only update; independent human sign-off remains pending. The audit gate must remain blocked until those sign-offs exist; no identity or approval is fabricated.

Keep this PR draft until its remaining review and CI gates are satisfied.

Protected integration handoff

After each predecessor lands, retarget this slice directly to Azure/kars:kars-bridge, preserve merge ancestry and require fresh exact-head qualification. Do not merge into its intermediate feature-branch base.

The assembly branch retains 29 required CI/security gates, strict base freshness, one required review, last-push approval, stale-review dismissal, conversation resolution and administrator enforcement; force pushes and deletion remain disabled. The owner permits a temporary pallakatos account-specific review-bypass allowance only for an otherwise-qualified assembly merge, with the original allowance restored immediately afterward. It does not waive capability-audit signatures or any technical/security gate and never applies to main.

The owner explicitly signed off and approved on 2026-09-08. That genuine maintainer sign-off is recorded using the authenticated GitHub noreply identity. A separate independent person must still review and sign; no approval is invented for them. This PR remains draft until its gates are satisfied. Core assembly is separate from the Bridge application repository, which remains private pending an explicit public destination.

Maintainer sign-off recorded (2026-09-08)

Current head: 83ff66420e79d65b7cb0fad204047cbcf0ef16d2. The audit record now contains the explicitly authorized pallakatos maintainer sign-off, scoped to this slice's previously qualified source. Forwarded predecessor updates are also audit-documentation-only; production and test source are unchanged.

One of the two required human sign-offs is recorded. The independent reviewer remains outstanding, so the capability-audit gate and draft status remain in place. Fresh checks apply to the new head. This is not approval for later functional changes, other unresolved slices, customer deployment, public Bridge source publication or main promotion.