[agentydragon-agent]

Staging no longer writes an App token_subjects allowlist. The field and TokenReview path remain supported; omission uses the App's empty default, which accepts no Kubernetes token caller.

Compatibility evidence

• At the start of this work, staging pinned agentplane-app:devel-20261114070234-29f985c, source commit 29f985c62698c841d97dbf96a5002ec7b8dbae24. The current staging pin has since advanced to agentplane-app:devel-20261114071537-9e1f8fe, source commit 9e1f8fe7fe1eb24e47e3cdd763849d9e9dc799a3. The relevant settings and Go loader files are identical at both commits.
• Both App revisions use extra="forbid" and declare token_subjects with default_factory=frozenset. The Go loader accepts the missing optional key and normalizes nil to an empty slice. A focused temporary Bazel settings test removed the key from the YAML and passed; that temporary test is not included here.
• The shared App settings model omits the field only when its value is empty. Staging and direct deployment fixture synthesis tests assert that the resulting YAML has no token_subjects key. fixture_chart.py did not set the field explicitly.

Rollout and rollback

After merge, Flux deploys the generated config without the allowlist; the currently pinned App accepts the omission. Roll back by reverting this PR and redeploying, which restores the explicit staging allowlist. The App continues to accept both explicit token_subjects and omission.

Deliberate omissions

This PR keeps the App model field, Go settings field, TokenReview behavior, token audience, agentplane-agent ServiceAccount, and token-request RBAC. Removing those requires a separate change after this config rolls out. It does not change integration-test token fixtures.

Validation

• bbr test //cluster/cdk8s/agentplane:test_session_dispatcher //agentplane/system_tests/deployment:test_render //cluster/cdk8s:test_generate_manifests passed (BuildBuddy invocation 1ae29a82-195f-4830-b553-c88068970c61).
• bbr build //agentplane/app:settings passed (invocation e3fa227b-2906-4461-a150-68b927ba7da7).
• Scoped pre-commit checks passed.
• Local bb run //cluster/cdk8s:generate_manifests could not analyze because this environment lacks ldd, required by Bazel's host-libc detector. The remote generate-manifests test passed with the committed two-line manifest removal.

Questions for Claude

None.

CI diagnosis at 94c8277e: mcp:test_sampler_roll failed before the scenario, because Runtime could not verify its local certificate. Captured certificates prove the workload CA was issued by the earlier test root key, while root revision 2 held a different key. The same suite already omitted App token_subjects before this PR; its App client uses a fixture operator ID token, and its Kubernetes tokens target backends. Recent devel history passed (b6ee69d, cc0ee7e5-5034-5e93-8356-1678bcf294f5, 182.5s). No remaining special-agent-token caller was found in that suite. #16377 (merged) fixes the independent root-key churn and adds a real-controller renewal regression; this PR now contains only the App manifest change on fresh devel.

PKI correction validation: bbr test //agentplane/system_tests/deployment:test_pki_lifecycle //agentplane/system_tests/suites/mcp:test_sampler_roll passed (050ba465-5a0f-4de7-a6c8-856e4113a572, 72.0s and 152.2s). Named fixture library build passed (c93ec4c0-68ba-4a10-80bf-bd5ef4d662c7); rebased scoped pre-commit passed.

After #16377 merged, rebased onto 8b0021e740 and dropped its included commit. Current App-only head: d11f4db2a93a93b81427339cfb1a2a7b174802ec. Scoped pre-commit (including manifest consistency and kubeconform) and git diff --check passed. Fresh devel still pins App devel-20261114071537-9e1f8fe; its omission-compatible Go loader is unchanged. Previous-head Bazel CI passed; fresh-head CI is pending.

[github-actions]

Visual review for d11f4db2

No visual artifacts were available from the Bazel CI run.

Open the CI run for the complete test results or to request a manual rerun.