[NaveCohenMonday]

Summary

Allow an operator to configure an identity bootstrap for an exact immutable workload image. This lets the assistant separate its trusted runtime and untrusted shell inside the existing agent container; it does not add another Pod or container.

Task-ID: 33.03.24

Related Issue

Assigned Globster fork work: Workspace task 33.03.24. This is an operator integration for the maintained fork, not an upstream feature proposal.

Changes

• Default-empty process_bootstraps map requires SHA256 image references and bounded absolute command arguments. Matching sidecar workloads prefix the existing process-supervisor command with the bootstrap.
• Only an exact allowlisted image starts as root with CHOWN, SETUID, SETGID and SETPCAP; all other capabilities are dropped, privilege escalation remains disabled, and RuntimeDefault seccomp is required. The trusted image must irreversibly drop bootstrap privileges before running runtime or shell code.
• Unmatched images keep the existing non-root path. Existing network sidecar and proc masks are unchanged.
• Helm renders the operator map; configuration, architecture and cluster-debug docs describe the boundary. Fix the prebuilt binary staging script's empty-array handling on macOS Bash 3.

Testing

• mise run --jobs 1 pre-commit passes.
• Full Rust workspace/server tests, Python tests and TypeScript CI passed in the local CI run. Full CI stopped at Go lint because a reused cache referenced a removed worktree; mise run --jobs 1 go:ci then passed with fresh Go caches. Cargo dependency policy checks passed.
• Helm lint and all 61 gateway-config rendering tests passed, including default-disabled and exact-image allowlist cases.
• Actual local ARM Kind gateway used the new driver: control-plane image upgrade/restart converged, the assistant completed a real owner chat with NumPy and persisted a file across restart. Runtime and shell capabilities were zero after bootstrap; denied private data, platform writes, direct network, UID escalation and detached-child cleanup were verified.
• Upstream mise run e2e was attempted. Its Alpine supervisor image build stopped at certificate validation fetching apk packages in this local network. TLS verification was not disabled. This is separate from the passing actual managed-Kind assistant journey above.

Checklist

• Conventional commit with DCO sign-off.
• Architecture and user-facing configuration docs updated.
• Operator default remains empty; no cluster activation or staging deployment in this PR.

The assistant image, ABI 4/5 node AppArmor policy and ARM capacity changes are separate task PRs. Their staged activation must be ordered; merely merging this code does not enable a bootstrap for any workload.