[oblinder]

Summary

Two onboarding checks that close gaps in how a managed service's inbound is protected, on both enforcement sides.

1. PRD D30 check #2 requires an enforcing jwt-validation inbound, and tools are checked under agent side.

 check_preconditions(service, side)
-  if side is agent-side and service is a tool: skip every check
+  #1 sidecar        — every service (also a tool under agent side)
+  #2 pipeline
+    inbound:  jwt-validation            — every service, both sides
+              + opa                     — an agent; a tool under target side
+              + mcp-parser              — a tool under target side
+    outbound: mcp-parser + opa          — an agent under agent side
+    a required plugin with on_error: off | observe fails (it does not enforce)
+  #6 probes         — not for a tool under agent side (_probes_apply)

Why: under agent side a tool gets a pass-through CR, so jwt-validation (signature, issuer, aud = the tool's own client ID) is the only thing in front of it. Without it the tool is fully open. Under target side a missing jwt-validation already fails closed (no identity, PRD D27), but it is now caught at onboarding. The failure semantics do not change: EnforcementPreconditionError before the bootstrap, 409 with failed_checks, DLQ for NATS.

2. A warning when a platform login client can mint tokens for a tool (agent side only).

sequenceDiagram
    participant C as Controller
    participant I as IdP Configuration Service
    participant K as Keycloak
    C->>I: GET /platform-clients/tool-audiences?client_id=TOOL_ID
    I->>K: read the login clients in PLATFORM_SOURCE_CLIENTS, their scopes and mappers
    I-->>C: items of login_client, scope, link, mapper, tool_client_id
    Note over C: one WARNING per item, under agent side only, never raises

Loading

The operator attaches each workload's agent-<ns>-<workload>-aud scope to every client in PLATFORM_CLIENT_IDS as a default scope. Then that login client's user tokens pass the tool's jwt-validation and, under agent side, reach the tool through its pass-through CR with no AIAC check. The match is by the oidc-audience-mapper config (included.client.audience / included.custom.audience), not by the scope name. It runs after a tool's onboarding build and at the Controller start after the resync. Under target side there is no warning: the tool's inbound has no platform-client bypass, so such a token is denied there.

src/aiac/
├── agent/uc/onboarding/preconditions.py      # C1: per-side, per-type plugin rules; on_error
├── agent/uc/onboarding/platform_audience.py  # new: warn_platform_tool_audiences
├── agent/uc/onboarding/orchestrator.py       # call after the build (tools)
├── agent/controller/start.py                 # call after the resync
├── idp/service/configuration/keycloak/main.py  # new endpoint
└── idp/configuration/{api,models}.py         # get_platform_tool_audiences, PlatformToolAudience

Docs: PRD D30, known limits, UC-1a flow, §9; the uc1, aiac-agent, idp-configuration-service and library-idp specs; the runbook, deploy.md, the k8s comments, the github-tool demo spec.

Evidence

• Before (origin/main code, the new tests of test_preconditions.py):

  FAILED TestCheck2Pipeline::test_every_service_needs_jwt_validation_in_the_inbound_pipeline[agent-side-tool-inbound3]
  FAILED TestCheck2Pipeline::test_a_required_plugin_that_does_not_enforce_fails[agent-side-tool-inbound2-observe]
  FAILED TestAgentSideScope::test_a_tool_without_jwt_validation_fails_2[('mcp-parser', 'opa')]
  FAILED TestAgentSideScope::test_a_tool_with_no_sidecar_fails_1
  17 failed
  

  After:

  17 passed
  unit lane: 2147 passed (was 2077 on origin/main)
  ruff, ruff-format, pyright (changed files): clean
  

• C2 has about 40 new unit tests: the endpoint (default / optional / client-mapper links, match by mapper not by name, access.token.claim per Keycloak, one realm scope read, 502 on a Keycloak error, read-only), the library method, and the helper (agent side only, one warning per link, a failure never raises, no line breaks in log values).
• System lane (-m system, 102 tests collected): not run on either side. The deploy of this PR's images to the Kind cluster was blocked, so the cluster still runs an older AIAC build. A run against that build would not test this PR. The Kind overlay and the chart default pipeline already have jwt-validation (map form, default on_error), so a valid setup passes check Chore(deps): Bump python from 3.12-slim to 3.14-slim in /src/aiac/policy/model_store/service #2 unchanged.
  • Target side: command .venv/bin/pytest -m system -rs, not run. 0 passed, 0 failed, 0 skipped. C1/C2: not observed. The precondition for C1 is present: k8s/opa-kind-verify.sh passes, and the team1 inbound pipeline has jwt-validation (default on_error), mcp-parser and opa.
  • Agent side: command .venv/bin/pytest -m system -rs after a clean redeploy with AIAC_ENFORCEMENT_SIDE=agent-side, not run. 0 passed, 0 failed, 0 skipped. C1/C2: not observed. Expected C2 result on this cluster: no WARNING, because the operator's PLATFORM_CLIENT_IDS is not set, so no login client holds a tool audience.

Merge Danger

Door: two-way

Revert the commits to restore the old checks. Nothing is stored or migrated.

Blast Radius: onboarding

• An onboarding whose namespace pipeline has no enforcing jwt-validation inbound now fails with 409, on both sides. So does a tool under agent side with no sidecar.
• Under agent side, C2 logs one WARNING for each tool that a platform login client can reach. That happens when the operator's PLATFORM_CLIENT_IDS names the login client (empty by default). This is a log line only.
• Known limits (in PRD §6): C2 does not read the realm default-default scopes or the operator's per-namespace PLATFORM_CLIENT_IDS; a tool under agent side is not required to have opa inbound, so in such a namespace PRD D20 cannot deny a tool that has no CR.

🤖 Generated with Claude Code

[oblinder]

Replaced by #240. #240 merges all six commits of this PR, and then removes the login-client audience warning (C2) together with the agent-side enforcement scheme, so C2 does not get to main. The jwt-validation check (C1) is kept.