fix: bound the JWKS refresh rate and reject an unknown symbol policy (ADR 0066)

[kfeofantov]

Two places where input the agent does not trust decided something quietly.
Reasoning, alternatives and what changes for an operator are in
ADR 0066.

The JWKS refetch

jwt.ParseWithClaims asks for the key before it checks the signature, and
the handler calls Verify before it reads the body. So the kid comes out
of a token nobody has verified, and each distinct value a caller invented cost
two GETs to the API server — discovery and JWKS — serialized behind
CachingKeySource's one mutex with a ten-second ceiling each. The refresh rate
was a property of the caller.

Refreshes now happen at most once per 30s. The stamp is taken before the
attempt, so a refresh that failed is rate-limited on the same floor — an
unreachable API server is where retrying per request costs the most and helps
least. Against the node's one-minute scan interval, a key rotation is picked up
at most one round late, on a report the next pass re-sends anyway (ADR 0003).

The chart's NetworkPolicy already bounds who can reach the port (ADR 0039); that
is who, not how often, and a policy the CNI does not enforce is the case worth
surviving.

The symbol policy

profiling.thirdPartySymbols was compared to "keep" and everything else took
the other branch — so "Keep", "true" and every typo silently meant drop.
Failing closed is the right direction and the wrong report: this field governs
the allow-list deciding which frames may leave the node (ADR 0011 §4), and it is
the one control an operator cannot check by reading their own values file. An
unrecognized value now fails the start, the same shape as ADR 0040's rule for an
unset expectedSubject. Empty stays valid — it selects the default and is what
a default install renders.

One test had to change to keep proving its claim

TestAFailedRefreshKeepsTheKeysAlreadyInHand passed unchanged, but for the
wrong reason: with the floor in place its second lookup no longer attempted a
refresh at all, and "the refresh failed" and "no refresh was made" leave the
server's hit count identical. It now advances the clock past the floor and
counts attempts on the source itself.

Also carried here

The .gitignore fix that #103 was meant to land and did not — I staged it and
then ran a stray git stash/git stash pop before committing, which unstages,
so only internal/model/coverage.go went in. origin/main still has an
unanchored coverage.* that matches a source file in any directory and swallows
it in silence. One line, and it belongs on main more than it belongs in a third
PR of its own.

Checks

$ go test -race ./...        # green
$ golangci-lint run ./...    # 0 issues
$ go vet -tags e2e ./...     # clean
$ make chart-lint vulncheck  # clean

No docs/security.md change: nothing collected, stored or transmitted differs.

🤖 Generated with Claude Code

https://claude.ai/code/session_011YRKuL97KRndaopfpixrhp