[codyhartsook]

Description

compileActorEgressPolicy fails when any compiler is registered and a tokenPassthrough target has no header. That assumes every registered compiler exists to bind targets, but Compiler is a general extension point. A compiler that only adds another header gets its actors denied egress, even when the runtime forwards the caller's token.

This removes the binding check, so compilers now own binding each target. The existing policy validation stays.

A compiler that forgets to bind a target now fails at call time instead of at compile time. OSS doesn't register any compilers, so default installs don't change.

Related Issues

None required.

Testing

go test -race ./core/internal/substrate/ ./core/pkg/app/
make -C go lint

TestCompileActorEgressPolicyMayLeaveTargetsUnbound compiles a policy with no extensions and with one that adds another header, and neither binds the target.

Change Type

/kind fix

Changelog

Embedding controllers can now register egress policy compilers that leave tokenPassthrough targets unbound, because each compiler now owns target binding.