[warp-agent-staging]

Summary

Spec only for REMOTE-3452. No runtime, protocol, or chart implementation is included.

Read specs/REMOTE-3452/PRODUCT.md for behavior, then TECH.md sections 4–6 for shared-policy identity, launch fencing, and finalization.

• Cilium-first enforcement with native one-time DNS snapshots as the fallback. Shared fingerprints hash only canonical final enforcement content. DNS answers/settings matter only through the rendered rules; resource kind/namespace bound API lookup without extra salts.
• Immutable policies carry a finalizer and durable run/execution consumer registrations before ordinary Job creation. UID/resourceVersion fencing prevents cleanup from racing pending launches.
• Automatic cleanup runs only after zero execution consumers remain, including with --no-cleanup. Ambiguous reservations never expire on a timer and can require verified operator recovery.
• One disabled-by-default backend.kubernetes.network_policy block contains enabled and dns settings, mirrored as Helm kubernetesBackend.networkPolicy. Existing authenticated team/host routing needs no extra assignment scope. In-cluster DNS autodetection, the pre-enforced Helm baseline, reserved warp- metadata, and operator container choices remain.
• No capability negotiation. All pool replicas must be upgraded before policy-bearing dispatch. Reuse is not CNI readiness proof; implementation acceptance requires supported-CNI enforcement tests while terminating and after restart.

Validation

• git diff --cached --check passed before commit.
• Checked docs-only scope, 12 behaviors, seven technical sections, the YAML example shape/disabled default, unified naming, content-only identity, preserved lifecycle criteria, two companion links, 13 pinned Warp source references, and fingerprint bounds.
• Runtime, Helm, and live-CNI checks are future implementation requirements, not results claimed by this spec-only revision.

Approval

Approved by Ben Navetta in the origin thread. Approval is not deployment or feature-flag authorization.

[warp-agent-staging]

This PR was generated with Warp.

Comment @warp-staging-factory on this PR to send it follow-up work.