fix(security): Address critical/high findings deferred from PR #1556 (GPU offload intake)

[dwhiteddsoft]

Summary

During review of PR #1556 (Xavier GPU offload intake), Katrien De Graeve (@katriendg) raised several Critical/High severity findings across the controller, runtime SDK, and CI/dependency tooling. These were explicitly deferred at merge time ("This is us intaking a Microsoft research project. We will file this as an issue to be addressed but wanted to get this into the repo.") rather than fixed in-PR. This issue tracks those deferred items so they get addressed post-merge.

Category

• Improvement suggestion (security hardening)

Description

Six Critical/High findings from Katrien De Graeve (@katriendg)'s review of PR #1556 remain open. Two other Critical/High findings from the same review were already fixed in-PR (CI path-filter gate in 8b97d4b6, Containerfile digest-pinning in 290f0eec) and are not included here.

Findings

#	Severity	Component	Finding
1	Critical	gpu-offload/runtime/remoter/remoter.py:776	Server resolves and imports caller-supplied module_name/class_name/func_name with no peer authentication and no server-side allowlist — any pod that can reach the listener can invoke an undeclared importable (e.g. os.system) inside the inference server.
2	High	gpu-offload/controller/mutate.py:684	Namespace-owned ConfigMap data controls the generated server image/env, but the generated Deployment inherits the source workload's service account, pull secrets, runtime class, and mounts — a ConfigMap editor can run attacker-selected code under a trusted identity.
3	High	gpu-offload/controller/mutate.py:1271	A transient failure in the initial cluster-wide list permanently kills the detached reconciliation worker, but /readyz keeps returning 200 — the webhook keeps mutating clients without ever creating their server Deployments.
4	High	gpu-offload/helm/gpu-offload/templates/mutating-webhook.yaml:76	failurePolicy: Fail can block all opted-in workload creation if the controller/Service/TLS is unhealthy, with no validated production rollback path.
5	High	gpu-offload/controller/pyproject.toml, gpu-offload/runtime/, gpu-offload/examples/so101-real-hardware/	Three new independent uv projects are not covered by .github/dependabot.yml — Dependabot cannot raise version/security PRs for their lockfiles.
6	High	.github/workflows/dependency-review.yml:47	The SO-101/transformers GHSA exception was added to the shared allow-ghsas list, suppressing it repo-wide for every manifest, with no expiry or automated removal path.

Acceptance Criteria

• (Finding 1 — Critical) remoter.py authenticates the peer connection and validates the complete decoded callable identity against controller-owned policy before importing it; negative tests cover forged peers and undeclared callables.
• (Finding 2 — High) Executable image/identity/mount policy is moved to administrator-owned immutable configuration; namespace-supplied remote.yaml input selects only an opaque, allowlisted profile.
• (Finding 3 — High) Controller tracks initial-sync and worker liveness, retries startup failures with backoff, and fails /readyz while required reconciliation workers are unavailable.
• (Finding 4 — High) A production rollback path is documented and validated: canary admission, Helm rollback/uninstall, emergency webhook removal, generated Deployment cleanup, and post-rollback admission verification.
• (Finding 5 — High) .github/dependabot.yml covers /gpu-offload/controller, /gpu-offload/runtime, and /gpu-offload/examples/so101-real-hardware, with a check that every committed uv.lock directory has Dependabot ownership.
• (Finding 6 — High) The SO-101/transformers GHSA exception is path-scoped instead of repo-wide, with an owner and a removal condition tied to the first compatible fixed LeRobot/transformers release.

Relevant Context

• Source PR: feat(deployment): add Xavier GPU offload for robot inference #1556 (feat(deployment): add Xavier GPU offload for robot inference)
• Reviewer: Katrien De Graeve (@katriendg)
• Review threads (all marked resolved in-PR, deferred rather than fixed):
  • Finding 1: feat(deployment): add Xavier GPU offload for robot inference #1556 (comment)
  • Finding 2: feat(deployment): add Xavier GPU offload for robot inference #1556 (comment)
  • Finding 3: feat(deployment): add Xavier GPU offload for robot inference #1556 (comment)
  • Finding 4: feat(deployment): add Xavier GPU offload for robot inference #1556 (comment)
  • Finding 5: feat(deployment): add Xavier GPU offload for robot inference #1556 (comment)
  • Finding 6: feat(deployment): add Xavier GPU offload for robot inference #1556 (comment)

Additional Notes

gpu-offload/ is an intake of a Microsoft research project; these findings were accepted as known gaps at merge time specifically on the condition that they'd be tracked here rather than left undocumented.

---

Before submitting:

• I have searched existing issues for duplicates
• I have reviewed the README and documentation