feat(config): collapse the operator surface to two settings — mode + enforceScope (JEF-274)

[thejefflarson]

What & why

Collapses protector's ~four-dozen operator settings toward ~a dozen by replacing the
drift-prone per-surface enforcement knobs with two settings (ADR-0021):

• mode: audit (DEFAULT) — everything observes & proposes; nothing blocks or acts (shadow).
• mode: enforce + enforceScope {namespaces, labels} — the ONE scope. Arms all three
  enforcement surfaces together, each confined to exactly that scope: signature-webhook
  deny + mesh-webhook deny + the engine's reversible network cut. The fail-closed
  enforcing-webhook selector and the actuation RBAC grant are DERIVED from the same
  enforceScope, so they can no longer drift. No per-surface toggle, no
  enforce-everywhere wildcard (empty enforce is refused by both the engine at startup
  and helm at render).

ADR-0021 records the model and the load-bearing decision that one enforceScope now arms
the engine's live cut (a mutation, unlike the view-only ADR-0016 surface) — the widened
blast radius of flipping enforce, guarded by audit-being-default + no-wildcard + the
cut keeping all its own gates (corroboration, blast-radius, adjudicator veto, self-revert).

Actuator-count finding

PROTECTOR_ENGINE_ACTUATOR is kept (not made a constant): more than one live actuator
is real per ADR-0007/0010 — networkpolicy (IsolationActuator, flannel/kube-router / any
NetworkPolicy-enforcing CNI) and adminnetworkpolicy (KubeActuator, surgical ANP edge-cut
for Cilium/Calico), plus dryrun. It's a per-cluster CNI choice (real infra), defaulted
to the portable networkpolicy.

Old → new migration (all legacy defaults were audit ⇒ safe default unchanged)

Removed knob	Now derived from
PROTECTOR_ENFORCE_NAMESPACES / _LABELS	mode + enforceScope
PROTECTOR_MESH_ENFORCE_NAMESPACES / _LABELS	mode + enforceScope
PROTECTOR_ENGINE_ENABLE	mode: enforce ⇒ network cut armed
PROTECTOR_ENGINE_ENFORCE_NAMESPACES	enforceScope (namespaces + labels)
PROTECTOR_ENGINE (on/off master)	engine always runs (shadow by default)
chart engine.actuationRBAC	mode: enforce
chart webhook.enforcedNamespaceSelector	enforceScope
PROTECTOR_ENGINE_HYPOTHESIS=model	a model endpoint being configured
PROTECTOR_INGEST_TOKEN (inline)	standardized on PROTECTOR_INGEST_TOKEN_FILE
chart KEV/EPSS file paths	fixed mount default in code (JEF-273 owns feeds)
chart verify/cache/max-image/model/notify tuning	code-default env escape hatches
— added —	opt-in rekor lane (rekor.enabled / url, ADR-0020 §4)

Kept unchanged: PROTECTOR_ALLOW_EXTERNAL_MODEL / _NOTIFY (separate egress escape
hatches) and all real infra (ADDR, TLS, DASHBOARD_ADDR, JOURNAL_PATH, CLUSTER_LABEL,
TUF_CACHE, FALCO_ADDR, AUDIT_ADDR, REGISTRY_*, model endpoint/name, notify url/verbose).

Operator-surface count

Chart env knobs before ≈ 48 → after ≈ a dozen operator-facing values (mode,
enforceScope, engine.actuator, engine.model.*, engine.notify.*, rekor.*,
signature.gatedPrefixes/identityRegexp/oidcIssuer, ingest/cert/feed infra).

Manual security review

• mode: audit is byte-identical to today's safe default: empty EnforceScopes
  (audit everywhere) + EnabledActions::none() ⇒ build_actuator returns the dry-run
  actuator before reading the actuator value; webhooks render audit-everywhere +
  match-nothing sentinel; RBAC grants no NetworkPolicy write; the buried tuning falls to
  the same code defaults (5 / 300 / 32) the old chart set.
• enforce arms EXACTLY the three surfaces in EXACTLY enforceScope, never wider:
  the gates share one EnforceScope; the engine ActuationScope matches namespace or
  Pod label and requires every cut endpoint in scope (a scope leak can't widen it);
  the webhook selector maps namespaces→namespaceSelector In and labels→objectSelector
  In (AND-ing a mixed scope narrows to the intersection — never wider); no wildcard
  (empty enforce refused twice). Model promotion (judgement) is no longer
  operator-enabled — a conservative removal of a widening path.

Tests / gates (from engine/)

• cargo fmt, cargo build, cargo build --example dashboard_preview — clean
• cargo clippy --all-targets — no warnings
• cargo test — 499 + 6 + 9 + 1 pass, 1 ignored (added Posture derivation tests,
  ActuationScope label-scoping test, re-pointed the ingest-token test)
• helm lint charts/protector — passes; helm template with audit-default AND
  mode=enforce (namespaces + labels + adminnetworkpolicy) verified; all chart CI
  invariants (fail-closed webhook, ingest authn, feed sidecar) pass locally, re-pointed
  at the new scope

Decisions made (autonomous)

• Audit webhook no longer excludes enforced namespaces (relies on the fail-closed
  webhook dominating on outage — safe double-validation) to avoid the impossible
  OR-exclusion across namespace/object selectors; documented in ADR-0021.
• Mixed enforceScope (namespaces AND labels): the fail-closed webhook AND-s the two
  selectors (intersection for outage-blocking); the union is still fully enforced when
  protector is up. Prefer a single axis per scope. Flagged in ADR-0021.
• Model-timeout code default raised 30 → 120s so burying the chart knob doesn't
  regress model deploys.
• KEV/EPSS: added fixed-path code defaults (env now a true escape hatch); left the
  feed-sidecar wiring to JEF-273. ANP actuation RBAC added when
  actuator: adminnetworkpolicy (was a pre-existing gap).
• e2e.sh re-pointed at mode/enforceScope (in-repo test that exercises the engine).

🤖 Generated with Claude Code