[danielle-mustillo]

Why

A kagent install that watches only its own namespace can share a Substrate with other installs. The Substrate API showed it every install's actors and actor templates, and it served another tenant's atespace or namespace when a caller named it. The paging rewrite in #2771 dropped the watched-namespace filter for actors and templates. Page tokens leaked too. ate-api tokens are readable base64 JSON that hold the last row's key, so a token passed through to the caller can name another tenant's actor or worker.

What changed

• One scope, built from the watched namespaces, applies to every Substrate read: actors, templates, workers, and worker pools. An empty request means the watched namespaces. Any other namespace or atespace returns PermissionDenied.
• The controller asks ate-api for actors and templates one watched atespace at a time. The actor page token is kagent's own, base64url("atespace/inner").
• ate-api cannot filter workers by namespace. So the controller reads all workers, keeps the watched ones, and pages them by name with the token base64url("namespace/name"). A bad or foreign token returns InvalidArgument, and ate-api worker errors return only the gRPC code.

Scope

• Covers ListSubstrateActors, ListSubstrateWorkers, and GetSubstrateSummary. Only proto comments change. A cluster-wide install passes ate-api's pages and tokens through, as before.
• The UI atespace placeholder says "All watched atespaces".
• Not included: duplicate row checks after scoped ate-api lists.

Tradeoffs

• Each worker list request reads every tenant's workers. Passing ate-api's token through costs less but leaks names. Replace this with an ate-api namespace filter when one exists.

Blast Radius

Only installs that watch some namespaces change. They see less, and requests outside their scope fail. A page token from an older controller returns InvalidArgument, so reload the UI page.

Verification

• Kind cluster with one shared Substrate and two installs that each watch one tenant. As tenant-a, ListSubstrateActors {} returned both tenants before and only tenant-a after. A request that named tenant-b returned its data before and PermissionDenied after. A worker page token decoded to a tenant-b worker before and to a tenant-a worker name after. A cluster-wide install still sees both tenants.
• Kind cluster with actors in tenant-a, tenant-b, and tenant-c, and a controller that watches tenant-a and tenant-c. Actor pages no longer reach tenant-b, and a forged tenant-b/ token returns InvalidArgument.
• Unit tests send over 600 forged tokens to both lists. No read, row, or token leaves the watched namespaces. Each test commit fails on its parent. go test ./core/internal/service/... and make lint pass.

[EItanya]

🤖 AI-generated review. I looked through them to make sure they weren't crazy and they all seem worth looking at.

Thanks for the fix! I found one correctness issue and two follow-ups:

1. Can we deduplicate observedNamespaces once when constructing the service? watch_namespaces does not require unique values, and resolveSubstrateScope preserves duplicates. walkActors and substrateActorTemplates then query each entry, so ["tenant-a", "tenant-a"] reports every actor and template twice. I reproduced this with one actor and one template: the summary returned ActorCount == 2 and two template entries. A regression test should include non-adjacent duplicates as well.

2. The public protobuf comments for GetSubstrateSummaryRequest.atespace and ListSubstrateActorsRequest.atespace still say that an empty value lists all atespaces. With this change, it means the watched namespaces unless the controller is cluster-wide, and an explicitly unwatched atespace returns PermissionDenied. Can we update the source comments and regenerate so clients don't interpret a scoped result as cluster-wide inventory?

3. TestSubstrateTenantIsolation uses an empty Kubernetes client, so it doesn't exercise worker-pool isolation even though the PR applies the scope to every Substrate read. Can we seed in-scope and foreign pools and assert the exact namespace/name pairs for scoped, multi-namespace, and cluster-wide summaries?

[danielle-mustillo]

Thanks @EItanya. All three were real. Fixed in 3 commits:

1. Duplicate watch namespaces. e70146e adds a [tenant-a, tenant-c, tenant-a] case. It failed on the old code with 3 actors, agent-a twice and tenant-a/pool-a twice. 9b19e56 drops duplicates once in NewService and keeps the configured order. I left the config itself accepting duplicates, so an existing install with a repeated entry still starts.
2. Proto comments. 4774891 updates both atespace comments and regenerates the Go and TS output.
3. Worker pools. e70146e seeds pools in tenant-a, tenant-b and tenant-c. It asserts the exact namespace/name pairs for the single-namespace, two-namespace, duplicate and cluster-wide summaries. To check that the test can fail, I removed the namespace filter in listWorkerPools. Three subtests failed.

[EItanya]

🤖 AI-generated comment.

Can we have ListSubstrateActors query each atespace in watchNamespaces, like the summary already does, and let kagent own the continuation token?

Preserving the upstream token means the multi-namespace case still reads globally and filters afterward. That requires global Substrate permissions and leaves users paging through empty results for other tenants. It also leaves a hole in the isolation fix: Substrate's cursor contains the last actor's atespace and name, encoded as base64 JSON. Filtering the actor out of the response still exposes those identifiers through the token.

For watchNamespaces: [tenant-a, tenant-c], we could finish paging through tenant-a, then continue with tenant-c. The kagent cursor would track the current atespace and its upstream token. An explicit atespace would still be checked against the watched namespaces, and a cluster-wide controller could keep the global query. I think revisiting the upstream-token contract is worthwhile here so the query and pagination both respect the scope.

[EItanya]

LGTM, just needs rebase