Assembled in the protected integration branch

Merged from exact head 3ba7aaed30e02ee3504118efe88aabf82bf01556 into Azure/kars:kars-bridge at 365483a183bd2f7f352c7228110720af10b5b1a0. All 28 non-waived required gates passed. The author explicitly waived only the second audit signature; its failing check result was not falsified. All 29 check/app requirements and original review allowances are restored.

This completes the initial six-slice foundation assembly (#543, #544, #545, #547, #548, #549). The credential-source scope remains the ten supported keys; generic grants and Bridge permission removal are separate unfinished work. main and customer deployments are unchanged. The preparation sections below retain historical pending states.

Current landing decision: explicit author waiver

The author has explicitly waived the second independent-human signature for this integration landing. This supersedes the pending-signature landing blockers in the historical sections below; it does not claim a second review happened.

Current direct integration head: 3ba7aaed30e02ee3504118efe88aabf82bf01556, based on assembled namespace ownership 74abf37d. The ancestry refresh preserved the complete source/audit tree. Fresh exact-head technical gates are running; this PR is ready for guarded landing once they pass. Authenticated waiver and exact source scope: #549 (comment).

The PR can advance onto Azure/kars:kars-bridge after its predecessor lands and every other required gate passes on the refreshed exact head. Only the confirmed one-of-two-signatures audit failure may receive a temporary required-check exception, together with the previously approved account-specific review allowance. Restore all 29 check requirements and original review allowances immediately afterward, including on failure. No CI result or reviewer identity is falsified. main, unresolved later slices, customer deployments and the private Bridge application's publication remain outside this waiver.

Publication stack

Follows #548 and targets its namespace-ownership branch for a focused delta. Do not merge into the intermediate feature branch. After preceding slices land, retarget to the protected kars-bridge integration branch and require fresh exact-head CI, genuine audit sign-offs and independent approval. Final promotion to main remains separate.

Scope

• Add optional same-workspace spec.credentialsRef: {name, uid}. When absent, the existing direct <sandbox>-credentials collection remains the default.
• Require explicit source purpose/intent/target, the reserved source name and real source UID. Bind the source and projection to the exact Sandbox, workspace and runtime Namespace incarnation; never discover credentials by name alone for a future Sandbox.
• Project the selected collection only into the agent container, with metadata-only anchoring and UID/resourceVersion-fenced writes. Provider/router/control-plane credentials are not mounted through this feature.
• Refresh the consumer on key rotation/removal. Invalid or missing sources stop the verified consumer and revoke only the owned projection; they do not silently reactivate legacy credentials. Explicit opt-out restores the unchanged direct collection.
• Add CLI add --credential-source, credentials update --use-source, --remove, --disable-source, workspace selection, UID binding, one-time migration, schema-retention detection and controller acknowledgement.
• Add the CRD schema, migration/operation documentation and a real-consumer lifecycle case in the existing disposable Kind harness.

Deliberate v1 limits

This source supports the existing ten channel/search credential keys only. Arbitrary internal-system keys, raw GitHub tokens, provider credentials and process-environment overrides are not supported. Migration rejects unsupported keys rather than dropping them. Existing direct-mode flags remain available.

This is not full Bridge credential integration or Secret-RBAC closure. Bridge still needs a separate adapter, launch binding, scoped permissions and qualification; its arbitrary-key credential UI cannot simply be redirected to this limited allowlist. No Bridge permissions are removed here. Kars remains independently usable without Bridge.

Source revocation is asynchronous: Kubernetes API/node failures can delay termination, and this does not invalidate an external-provider token or erase a value already observed by an agent. Overlay-managed and unwired runtimes are not supported. These limits are documented in docs/how-to/credential-sources.md.

Hosted installation blocker and repair

The first real Kind run at b69a6ad6 exposed a missing Helm schema declaration: the new CEL rule referenced upstreamCompatibility, so Kubernetes rejected the entire Sandbox CRD. Credential-consumer execution was therefore not established. This was a real install blocker, not the separate missing-signature gate.

Repair 693a46ca declares the existing optional Rust compatibility fields, retains the source/overlay admission restriction, asserts its schema dependencies, and requires the intended rejection message in live admission coverage. Helm setup now stops immediately on failure. Automated source review of the five-file repair is closed with no significant issues found: optional/native behavior is preserved and the CEL field dependencies are declared. This is not live API qualification or human approval. The repaired head must pass actual API-server and lifecycle execution before readiness; rendering and source review alone are not sufficient.

Lifecycle cleanup repair and closure

Hosted run 34161927565 at 693a46ca successfully installed the CRD, enforced the intended overlay admission guard, and passed real BYO credential delivery, rotation/key removal, source-deletion revocation without fallback, and explicit opt-out. Sandbox namespace deletion completed. The subsequent InferencePolicy fixture deletion hung until the job deadline; the complete E2E gate therefore remains failed, not green.

Diagnostic commit d444656b exposed the root cause: Kubernetes rejected the partial server-side-apply finalizer-removal payload because metadata.name was missing, leaving the policy terminating after its profile ConfigMap was deleted. Repair 8b206065 replaces both finalizer registration/removal with complete name/namespace/UID/resourceVersion-fenced metadata merges, preserves other finalizers, and propagates non-404 ConfigMap cleanup errors before releasing cleanup authority. Fourteen targeted reconcile/HTTP cases and strict controller Clippy passed. Automated bounded review of the finalizer repair is closed with no significant issues found. This is source/test inspection, not human approval or independent live execution. The mandatory Kind gate now passes at exact head 8b206065: 111 cases, zero failures, including complete policy cleanup and preservation of the core namespace. Evidence: https://github.com/Azure/kars/actions/runs/34169168508/job/101889685225 . All technical CI gates pass; the sole remaining failing check requires two genuine audit sign-offs (author and independent reviewer). No human approval is implied.

Evidence and remaining gates

Current candidate: 8b206065608593667a40665b3f48225ef9ce278d, based on namespace head 62093414.

• Owning-agent local qualification: 66 targeted Rust tests, strict controller all-target Clippy, 90 CLI/Helm tests, typecheck and changed-file lint passed. Existing diff-based LOC/no-stub/crypto/copyright guards passed after handoff. No dependencies were changed or installed.
• The added Kind case uses the already-loaded BYO test image and fixed log markers, not printed credential values. It covers actual consumer environment, rotation/removal, no-fallback revocation, explicit legacy restoration and cleanup. Its syntax and hosted execution both passed at 8b206065, including the final mandatory cleanup.
• Automated technical review of the complete source/CLI lifecycle and frozen E2E harness is complete at b69a6ad6, with no significant issues found. Source review and in-memory CLI probes are not independent live execution, human sign-off or merge approval. Hosted lifecycle results and genuine review/signature gates remain required.
• The dated capability audit is docs/security-audits/2026-09-07-credential-sources.md. The maintainer signature is recorded; the independent-reviewer signature remains pending; the audit gate must remain blocked until they exist. No identities or sign-offs are fabricated.
• Hosted exact-head CLI/Rust/Helm, dependency/security, CodeQL, Kind, chaos and benchmark checks have all passed, supplying the lockfile-exact evidence beyond the authorized local cache runs.

No customer/H100 deployment, Azure infrastructure mutation, public image release, integration merge or main merge is performed by preparing this draft.

Protected integration handoff

After each predecessor lands, retarget this slice directly to Azure/kars:kars-bridge, preserve merge ancestry and require fresh exact-head qualification. Do not merge into its intermediate feature-branch base.

The assembly branch retains 29 required CI/security gates, strict base freshness, one required review, last-push approval, stale-review dismissal, conversation resolution and administrator enforcement; force pushes and deletion remain disabled. The owner permits a temporary pallakatos account-specific review-bypass allowance only for an otherwise-qualified assembly merge, with the original allowance restored immediately afterward. It does not waive capability-audit signatures or any technical/security gate and never applies to main.

The owner explicitly signed off and approved on 2026-09-08. That genuine maintainer sign-off is recorded using the authenticated GitHub noreply identity. A separate independent person must still review and sign; no approval is invented for them. This PR remains draft until its gates are satisfied. Core assembly is separate from the Bridge application repository, which remains private pending an explicit public destination.

Maintainer sign-off recorded (2026-09-08)

Current head: b8d6cc2159819f0a782b48be48b73900df521725. The audit record now contains the explicitly authorized pallakatos maintainer sign-off, scoped to this slice's previously qualified source. Forwarded predecessor updates are also audit-documentation-only; production and test source are unchanged.

One of the two required human sign-offs is recorded. The independent reviewer remains outstanding, so the capability-audit gate and draft status remain in place. Fresh checks apply to the new head. This is not approval for later functional changes, other unresolved slices, customer deployment, public Bridge source publication or main promotion.