feat(router): add scoped governed services and bounded telemetry

[Pal Lakatos-Toth (pallakatos)]

Current combined prerequisite candidate

Current head: 068ae16041ecf7bd2b8321dfeb22e381ebbd587b. This draft now follows #551 (public/pr7-sre-authority), not the already-assembled credential-source feature branch. Do not merge into that intermediate base; #551 must qualify and land before this slice is retargeted to kars-bridge.

The SRE privacy prerequisite is now integrated into control-credential issuance/reuse and owned revocation/rotation. Independent bounded review closed canonical-SRE early-return quarantine and the migration/readiness cycle: fresh privacy/identity/current-epoch checks and complete old cached-Pod retirement remain mandatory, but ordinary workload availability is not a prerequisite for establishing privacy authority. Migrating does not authorize issuance or reuse.

The two repair batches passed their targeted Rust cases and strict paired Clippy; source-level closure is recorded separately from human approval. The forwarded SRE action-schema repair also has independent Rust/Helm-drift and real API evidence. Existing dispatch/cancel/reset and telemetry repairs are retained.

Full combined hosted CI and actual SRE/governed-service lifecycle acceptance remain pending. The SRE fixture issue still blocks prerequisite acceptance. No human sign-off or signature waiver is claimed here, and this PR remains draft. The new private observer route and GitHub App-store materializer belong to the separate credential integration slice; they are not claimed by this candidate. No main promotion, private Bridge publication or customer deployment occurs. Historical preparation states follow.

---

Publication stack

Follows #549 and targets its credential-source branch for a focused delta. Do not merge into the intermediate feature branch. After preceding slices land, retarget to the protected kars-bridge integration branch and require fresh exact-head CI, genuine audit sign-offs and independent approval. Final promotion to main remains separate.

Scope

• Add a bounded, UID-qualified capability-request queue with explicit request IDs, cancellation, expiry, immutable decisions, scope compare-and-swap reset and stale-request rejection.
• Separate operator controls from agent-visible credentials: router-services-admin/control-token is mounted only in the inference router. The legacy admin token and localhost alone cannot authorize inspection, decisions or reset.
• Project Sandbox/workspace/runtime-Namespace identity and qualified Task UID/generation/full effective authorization where applicable. Caller-supplied assignment labels are correlation, not execution proof.
• Preserve immediate denied-egress behavior by default. Optional bounded waits resume only when both the request is approved and the existing normal egress policy allows the operation. A decision never grants network access by itself.
• Add bounded metadata-only model/MCP/governance/proxy observations, scoped cursors, explicit missing/partial observations, and correctly classified MCP isError/transport failures. Observers must not replay accepted generations or alter provider credential routing.
• Add narrow controller credential/identity projection and operational documentation at docs/governed-services.md.

Explicit boundaries and later integration

This is service infrastructure, not assignment delivery, runtime workers, an autonomous approval/grant broker, keyless GitHub services, managed MCP/skill/memory installation, a durable execution/receipt ledger, or aggregate task-budget enforcement. Existing unsupported finite/shared launch budgets remain rejected. Ordinary standalone Kars requires no Bridge installation.

Later task delivery must call POST /internal/access-requests/reset using the separate private service-control credential and current scope_id. Do not restore the old agent-visible-token/unscoped-reset contract. A future grant worker must compare current live Task UID, generation and full effective authorization before acting; resetting a request queue is not grant revocation.

Telemetry retains bounded identifiers/status/timing/usage, not prompts, assistant text, arguments/results, URLs, headers or credential bodies. Explicit request reasons remain bounded untrusted agent text. State is in-process and not durable billing evidence.

Remaining HIGH prerequisite — not review-ready

The legacy SRE agent can read cluster-wide Kubernetes Secrets with its mounted ServiceAccount credential, including the new operator token. Router-only mounts do not establish privacy. The operator-authorized registration/migration prerequisite is now published as draft #551, which must qualify and be integrated before this service layer: trusted UID enrollment, safe retirement of legacy grants, preserved Azure identity and pinned-image compatibility, and a real filtered Kubernetes access path. Names, labels and ownership-looking annotations are not sufficient authority. The current published candidate remains unsafe for deployment until that HIGH is closed.

The two MEDIUM findings are repaired in 11f4224d: cancellation/reset now coordinate with a dispatch claim after awaited policy checks, and accepted failed/incomplete Responses or error-plus-DONE streams no longer become completed telemetry. The claim is distinct from upstream acceptance; response bytes and no-replay behavior are preserved. Bounded source review is closed, 1,071 router unit plus 29 service integration tests passed, and strict router Clippy passed. The exact-head CI suite now passes apart from the missing genuine audit signatures, including the existing Kind smoke (https://github.com/Azure/kars/actions/runs/34185514205/job/101937153329). That suite does not cover the unresolved SRE-held Kubernetes credential path; the HIGH remains a deployment and merge blocker.

Do not mark this draft ready or merge it while the SRE prerequisite or genuine review/signature gates remain open.

Evidence and remaining gates

Current candidate: 11f4224d7c830b2c57878e356d1b4b20b13751e0, based on qualified namespace/credential stack head 8b206065.

• Owning-agent qualification: 1,168 relevant tests passed (1,067 router unit, 24 new HTTP/lifecycle/telemetry integration, 73 existing guardrail/provider integration, four controller projection cases), plus strict affected-crate Clippy and formatting.
• Committed-diff LOC/no-stub/crypto/copyright guards passed. No dependency changes or installations were introduced.
• The existing disposable Kind harness now covers the real mounted credential boundary, rejection of the legacy token on privileged routes, live Sandbox/Namespace UID attribution, decisions/reset and stale scopes. It uses private credentials through curl stdin rather than arguments/logs and cleans up its local port-forward. Hosted execution passed at ab3a9a7c (112 cases, zero failures; https://github.com/Azure/kars/actions/runs/34179155035/job/101919697541 ). This initial smoke covers mounts, simple credential rejection and scope reset, but does not test SRE-held Kubernetes authority, the cancellation interleaving or accepted semantic model errors. That initial-head CI result does not close the HIGH SRE authority issue; the two MEDIUM repairs have separate evidence above. The genuine-signature gate also remains blocked.
• Independent review found the three blockers above; closure and public exact-head CI remain pending. Local/source-level evidence does not constitute live or human approval.
• Capability audit: docs/security-audits/2026-09-08-governed-router-services.md. Two genuine author/independent-reviewer sign-offs remain pending; the audit gate must not be bypassed or satisfied with fabricated identities.

No customer/H100 deployment, Azure mutation, public image release, integration merge or main merge is performed by preparing this draft.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None