# Accepted execution admission

This separate process checks native writes in namespaces labelled
`execution.pharos.dev/identity-mode: accepted-work`. Install it before the Site agent
enables accepted member execution. Qualification must verify the fail-closed webhook registration.

Render `deployment.yaml`, `network.yaml` and `webhook.yaml` with the Runtime
namespace/account/image, native token audience, control-plane CIDR and serving CA.
Create `execution-admission-tls` with a certificate valid for the Service DNS name;
put its CA in the webhook's `caBundle`. The process serves TLS on 8443. Its projected
Site token uses the separate `<runtime account>-admission` subject, which Site
Coordination must allow only for accepted-execution queries. Native rights are
read-only: the member ServiceAccount UID and exact service-owner objects.

The existing `runtime-config`, Site API CA and Kubernetes CA are reused. Set
`REPOSITORY_ORIGIN` to the exact trusted GitLab HTTPS origin. The webhook has no
journal, database credentials, repository issuer credentials or native write rights.
The native API server calls `/validate`; failed queries, unavailable owners,
invalid responses and unexpected material refuse admission. Existing CEL policies
continue to enforce the restricted Pod profile and controller-created resources.

The query returns the saved immutable Run/Attempt payload and its confirmed retained member
binding. The webhook re-renders that payload using the installation's pinned batch
image, StorageClass and workspace size, compares all material fields and checks
the live ServiceAccount UID. Only explicitly recognised API-server defaults may
be added. A supplied material hash identifies the owner query; it cannot authorise
a different native specification. Credential files have fixed names and helper
contents, and remain scoped to the accepted repository set and trusted origin.

KServe's empty model-container name is recognised only when the accepted
InferenceService omitted it. When admitting that service's endpoint, the
independently read owner may carry KServe's exact cleanup finaliser. This exception
applies only to the existing owner; creation retains strict finaliser checks.
Other finalisers and changes to the owner's model or execution material are refused.

Deletion and observation use the existing UID-bound Runtime grants. They do not
need new dispatch authority. KServe's controller keeps reconciling already accepted
InferenceServices under its own restricted admission rules.

These manifests are installation templates. Production workers remain paused until
the real-owner qualification exercises native admission, TLS, identity replacement,
Project closure and member-removal behaviour on the target cluster.


The webhook gates compute, read helpers and new workspaces. Credential Secret
writes remain under the separate Runtime-only CEL policy and Source Control's
Run/Attempt repository authority. This permits stage-out credential renewal after
the compute deadline without authorising new compute or a new workspace.