lineage.self.id is the last path segment of the SPIFFE ID, so spiffe://…/ns/team1/sa/weather-service and …/ns/team2/sa/weather-service both emit weather-service, and the consumer, which keys an entity on it, derives one entity for two pods.
That collision was made normative in #761 (round 5, contract v1.6.1 §4; round 6, the TestServiceLabel row "collides by design") — deliberately, as the documentation half. This is the identity half: self.id alone was never the whole identity of a pod. The reduction, the clause and the test row stay.
Proposed. A required namespace key (or namespace_file, for the kubelet-projected /var/run/secrets/kubernetes.io/serviceaccount/namespace in ConfigMaps shared across namespaces), emitted as lineage.self.namespace on both spans; refused at start when absent or not a DNS label; never parsed out of the SPIFFE path. Wire contract v1.7.0. Consumer half: rossoctl/lab-data-governance#229 (design context: rossoctl/lab-data-governance#201).
lineage.self.idis the last path segment of the SPIFFE ID, sospiffe://…/ns/team1/sa/weather-serviceand…/ns/team2/sa/weather-serviceboth emitweather-service, and the consumer, which keys an entity on it, derives one entity for two pods.That collision was made normative in #761 (round 5, contract v1.6.1 §4; round 6, the
TestServiceLabelrow "collides by design") — deliberately, as the documentation half. This is the identity half:self.idalone was never the whole identity of a pod. The reduction, the clause and the test row stay.Proposed. A required
namespacekey (ornamespace_file, for the kubelet-projected/var/run/secrets/kubernetes.io/serviceaccount/namespacein ConfigMaps shared across namespaces), emitted aslineage.self.namespaceon both spans; refused at start when absent or not a DNS label; never parsed out of the SPIFFE path. Wire contract v1.7.0. Consumer half: rossoctl/lab-data-governance#229 (design context: rossoctl/lab-data-governance#201).