fix(cluster): isolate runtime credentials and proxy identity

[wolfiesch]

Outcome

Close the two P1 security boundaries found in the post-merge cluster audit:

• Session workloads no longer receive a reusable namespace-wide provider credential.
• The managed gateway accepts identity only through an explicit Tailscale proxy contract; generic ingress classes are rejected.

Credential boundary

• Remove provider Secret projection and the controller Secret RBAC grant.
• Require credential-free auth-none model routes behind an external identity- and NetworkPolicy-isolated gateway.
• Structurally validate both models.yml and config.yml, rejecting embedded credentials, custom headers, URL credentials/parameters, duplicate keys, and YAML aliases.
• Treat the former credential values as cutover sentinels so old values fail closed.
• Delete existing owned session Pods and Services when unsafe controller configuration is observed.
• Before OMP starts, perform a read-only preflight requiring credential rows, proven secret settings, broker token files, and encrypted broker snapshots to be absent.
• Reject unknown pinned schemas, database sidecars without agent.db, and linked profile/cache paths.
• Never delete, vacuum, or rewrite durable user state. Legacy development state requires explicit operator cleanup.

Gateway identity boundary

• Require T4_CLUSTER_IDENTITY_PROVIDER=tailscale at server startup.
• Accept only Tailscale-User-Login as the authenticated principal.
• Keep source-address, HTTPS-forwarding, size, and control-character checks.
• Restrict chart-managed ingress to the Tailscale class and managed certificate path.

Verification

• pnpm check passes under pinned Node 24.13.1 and Flutter 3.44.6.
• Full workspace tests pass.
• Tooling regression suite: 313 pass, 2 intentionally skipped, 0 fail.
• Cluster operator controllers, manager, API, and rendered-chart tests pass.
• Cluster-server suite: 11 files and 66 tests pass; typecheck passes.
• Credential preflight: 5 tests pass, including non-mutation, unknown-schema, linked-profile, and linked-cache cases.
• Cluster CI contract: 13 tests pass.
• Helm v3.19.0 rendered-chart tests pass locally; GitHub installs the same pinned Helm release for exact-head chart lint.
• Diff check and secret scan pass.

Review and merge boundary

There are no live users or production credential migrations. This is a pre-production, default-deny cutover. The repository owner authorized an internal security review and merge after fresh exact-head CI succeeds.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fc65fdfbb4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check the broker token in the selected OMP profile

The durable credential preflight checks $HOME/.omp/auth-broker.token, but OMP's profile-local broker token is stored at $HOME/.omp/profiles/<profile>/auth-broker.token (as the repository's maintainer installer does). Thus a session whose selected profile contains that token will pass this check and start OMP with a reusable broker credential accessible to the arbitrary-code session workload. Derive and check the profile root from agentDir (the parent of agent) instead.

Useful? React with 👍 / 👎.