fix(substrate): scope actors and templates to the watched namespaces

[danielle-mustillo]

Why

When a kagent install watches only its own namespace and shares a Substrate with other installs, the Substrate API listed every install's actors and actor templates. It also served another tenant's atespace or namespace when a caller named it. That second path leaked workers too. Before #2771, actors and templates were filtered by watched namespace. The paging rewrite in #2771 dropped that filter for actors and templates and kept it only for workers.

What changed

• One scope, built from the watched namespaces, now applies to every Substrate read: actors, templates, workers, and worker pools.
• An empty request means the watched namespaces. A namespace or atespace outside them returns PermissionDenied with a message that says so.
• The summary asks ate-api for each watched atespace in turn, so it never reads other tenants' rows. A worker with no namespace is shown only on a cluster-wide install.

Scope

• Covers ListSubstrateActors, ListSubstrateWorkers, and GetSubstrateSummary. No API change.
• atespace proto comments now say an empty value means the watched namespaces. A namespace listed twice in watchNamespaces is counted once.
• Not included: reading ahead past empty actor pages when two or more namespaces are watched, and updating the "All atespaces" wording in the UI.

Tradeoffs

• ListSubstrateActors must pass ate-api's page token through unchanged. So with two or more watched namespaces it reads all atespaces and filters each page. A page can be empty and still have a next-page token, as the worker list already allows. A composite token would avoid this, but it changes the token contract.

Blast Radius

Only installs that watch some namespaces change. They see less, and requests outside their scope are refused. A cluster-wide install behaves as before.

Verification

• Two-tenant kind cluster: one shared Substrate and two kagent installs, each watching its own namespace, with one session per tenant. Only the controller image changed between runs. As tenant-a:
  • ListSubstrateActors {} returned ["tenant-a","tenant-b"] before and ["tenant-a"] after.
  • GetSubstrateSummary {atespace: tenant-b} returned tenant-b's templates before and PermissionDenied after.
  • ListSubstrateWorkers {namespace: tenant-b} returned tenant-b's worker before and PermissionDenied after.
  • A cluster-wide install still sees both tenants.
• Unit tests: each test commit fails on the code before it. Deleting the filter in ListSubstrateActors makes the multi-namespace test fail.
• go test ./core/internal/service/... passes, and make lint reports 0 issues.

[EItanya]

🤖 AI-generated review. I looked through them to make sure they weren't crazy and they all seem worth looking at.

Thanks for the fix! I found one correctness issue and two follow-ups:

1. Can we deduplicate observedNamespaces once when constructing the service? watch_namespaces does not require unique values, and resolveSubstrateScope preserves duplicates. walkActors and substrateActorTemplates then query each entry, so ["tenant-a", "tenant-a"] reports every actor and template twice. I reproduced this with one actor and one template: the summary returned ActorCount == 2 and two template entries. A regression test should include non-adjacent duplicates as well.

2. The public protobuf comments for GetSubstrateSummaryRequest.atespace and ListSubstrateActorsRequest.atespace still say that an empty value lists all atespaces. With this change, it means the watched namespaces unless the controller is cluster-wide, and an explicitly unwatched atespace returns PermissionDenied. Can we update the source comments and regenerate so clients don't interpret a scoped result as cluster-wide inventory?

3. TestSubstrateTenantIsolation uses an empty Kubernetes client, so it doesn't exercise worker-pool isolation even though the PR applies the scope to every Substrate read. Can we seed in-scope and foreign pools and assert the exact namespace/name pairs for scoped, multi-namespace, and cluster-wide summaries?

[danielle-mustillo]

Thanks @EItanya. All three were real. Fixed in 3 commits:

1. Duplicate watch namespaces. e70146e adds a [tenant-a, tenant-c, tenant-a] case. It failed on the old code with 3 actors, agent-a twice and tenant-a/pool-a twice. 9b19e56 drops duplicates once in NewService and keeps the configured order. I left the config itself accepting duplicates, so an existing install with a repeated entry still starts.
2. Proto comments. 4774891 updates both atespace comments and regenerates the Go and TS output.
3. Worker pools. e70146e seeds pools in tenant-a, tenant-b and tenant-c. It asserts the exact namespace/name pairs for the single-namespace, two-namespace, duplicate and cluster-wide summaries. To check that the test can fail, I removed the namespace filter in listWorkerPools. Three subtests failed.