fix: link populated name in activity summaries for generateName creates

Activity summary templates linked audit.objectRef.name, which is empty for
resources created with generateName (the assigned name lives in
responseObject.metadata.name). Reading audit.objectRef.name errored with
"no such key: name", so the activity was never produced and the create was
silently missing from the user's activity feed. Confirmed in production for
Connector and Domain.

Link the populated name and scope each affected rule so the field is
guaranteed present, matching the existing has()-guarded match style used by
the delete rules.

Key changes:
- Connector, ConnectorAdvertisement, TrafficProtectionPolicy,
  BackendTLSPolicy, Gateway: create/update summaries link
  responseObject.metadata.name; their match conditions gain
  has(audit.responseObject.metadata.name) so the field is always present
  (events without it fall through to the existing create/update fallback)
- Domain: guard the requestObject.spec and spec.domainName path segments
  before linking the domain name

Claude-Session: https://claude.ai/code/session_01KnYuL5Pf1R5ysZoxxNkKiu

Author: scotwells

config/milo/activity/policies/backendtlspolicy-policy.yaml

@@ -16,8 +16,8 @@ spec:
   auditRules:
     # BackendTLSPolicy creation with spec available
     - name: create
-      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec)"
-      summary: "{{ actor }} created backend TLS policy {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} created backend TLS policy {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # BackendTLSPolicy creation fallback (no spec)
     - name: create-fallback
@@ -36,8 +36,8 @@ spec:
 
     # BackendTLSPolicy update with spec available - excludes status subresource
     - name: update
-      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec)"
-      summary: "{{ actor }} updated backend TLS policy {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} updated backend TLS policy {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # BackendTLSPolicy update fallback (no spec)
     - name: update-fallback

config/milo/activity/policies/connector-policy.yaml

@@ -16,8 +16,8 @@ spec:
   auditRules:
     # Connector creation with spec available
     - name: create
-      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec)"
-      summary: "{{ actor }} created connector {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} created connector {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # Connector creation fallback (no spec)
     - name: create-fallback
@@ -36,8 +36,8 @@ spec:
 
     # Connector update with spec available - excludes status subresource
     - name: update
-      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec)"
-      summary: "{{ actor }} updated connector {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} updated connector {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # Connector update fallback (no spec)
     - name: update-fallback

config/milo/activity/policies/connectoradvertisement-policy.yaml

@@ -17,8 +17,8 @@ spec:
   auditRules:
     # ConnectorAdvertisement creation with spec available
     - name: create
-      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec)"
-      summary: "{{ actor }} created connector advertisement {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} created connector advertisement {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # ConnectorAdvertisement creation fallback (no spec)
     - name: create-fallback
@@ -37,8 +37,8 @@ spec:
 
     # ConnectorAdvertisement update with spec available - excludes status subresource
     - name: update
-      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec)"
-      summary: "{{ actor }} updated connector advertisement {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} updated connector advertisement {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # ConnectorAdvertisement update fallback (no spec)
     - name: update-fallback

config/milo/activity/policies/domain-policy.yaml

@@ -18,7 +18,7 @@ spec:
     # Domain creation with spec.domainName available - use domain name as display text
     - name: create
       match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec)"
-      summary: "{{ actor }} created domain {{ link(audit.requestObject.spec.domainName, audit.objectRef) }}"
+      summary: "{{ actor }} created domain {{ has(audit.requestObject.spec) && has(audit.requestObject.spec.domainName) ? link(audit.requestObject.spec.domainName, audit.objectRef) : '' }}"
 
     # Domain creation fallback (no spec)
     - name: create-fallback
@@ -38,7 +38,7 @@ spec:
     # Domain update with spec available - excludes status subresource
     - name: update
       match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec)"
-      summary: "{{ actor }} updated domain {{ link(audit.requestObject.spec.domainName, audit.objectRef) }}"
+      summary: "{{ actor }} updated domain {{ has(audit.requestObject.spec) && has(audit.requestObject.spec.domainName) ? link(audit.requestObject.spec.domainName, audit.objectRef) : '' }}"
 
     # Domain update fallback (no spec)
     - name: update-fallback

config/milo/activity/policies/gateway-policy.yaml

@@ -16,8 +16,8 @@ spec:
   auditRules:
     # Gateway creation with spec available
     - name: create
-      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec)"
-      summary: "{{ actor }} created gateway {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} created gateway {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # Gateway creation fallback (no spec)
     - name: create-fallback
@@ -36,8 +36,8 @@ spec:
 
     # Gateway update with spec available - excludes status subresource
     - name: update
-      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec)"
-      summary: "{{ actor }} updated gateway {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} updated gateway {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # Gateway update fallback (no spec)
     - name: update-fallback

config/milo/activity/policies/trafficprotectionpolicy-policy.yaml

@@ -16,8 +16,8 @@ spec:
   auditRules:
     # TrafficProtectionPolicy creation with spec available
     - name: create
-      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec)"
-      summary: "{{ actor }} created traffic protection policy {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb == 'create' && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} created traffic protection policy {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # TrafficProtectionPolicy creation fallback (no spec)
     - name: create-fallback
@@ -36,8 +36,8 @@ spec:
 
     # TrafficProtectionPolicy update with spec available - excludes status subresource
     - name: update
-      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec)"
-      summary: "{{ actor }} updated traffic protection policy {{ link(audit.objectRef.name, audit.objectRef) }}"
+      match: "!audit.user.username.startsWith('system:') && audit.verb in ['update', 'patch'] && !has(audit.objectRef.subresource) && has(audit.requestObject.spec) && has(audit.responseObject.metadata.name)"
+      summary: "{{ actor }} updated traffic protection policy {{ link(audit.responseObject.metadata.name, audit.objectRef) }}"
 
     # TrafficProtectionPolicy update fallback (no spec)
     - name: update-fallback