operator: reconcile dependency changes safely

[usr-bin-roygbiv]

OP line item

OP-04 — controller/reconciliation contract. Temporarily stacked on draft #136; this branch is based exactly on OP-02 commit cb63bbddddf6f33a01420962c37752d0bbf23222 and does not copy or shim OP-02.

Observable contract

• T4ClusterHost changes enqueue only affected T4Workspaces and T4Sessions; T4Workspace changes enqueue only affected T4Sessions.
• Existing sessions fail closed when Host, Workspace, or exact-name OMP dependencies become missing, invalid, or mismatched.
• Revocation removes only the session-owned deterministic Pod and Service, clears stale status resource names, publishes explicit false conditions at the current observed generation, and converges idempotently across duplicate events/controller restart.
• Exact-name OMP ConfigMap/Secret get permissions remain least privilege; ready sessions retain bounded periodic convergence rather than broad Secret list/watch.
• Existing lease leader election, namespaced cache, Workspace Delete/Retain finalization, owner-reference conflict handling, deterministic resources, and bounded requeues remain intact. T4ClusterHost remains status-only and owns no child cleanup/finalizer.

Migration and rollback

No CRD, storage, or data migration. Rollback is the prior controller image/commit; deterministic owned resources and existing finalizers remain compatible. A rollback may delay dependency convergence to the existing periodic paths but does not require schema rollback.

Red/green proof

• Red tests commit: e8a94ba103c72aa8d75d45d9934296ac954b08c4 (implementation intentionally absent; exact CI links pending).
• Green implementation commit/head: pending.
• GitHub exact-head proof: pending.
• Authoritative Woodpecker exact-head proof: pending.
• No deployment or rollout proof is claimed.

Non-goals

No OP-02 CRD lifecycle changes; no gateway, OpenAPI, client, runtime-provider, durable-ledger, image publication, deployment, broad ConfigMap/Secret watch permissions, or T4ClusterHost finalizer.

Wall time: 0.89 seconds

OP-04 final reconciliation proof

• Final exact head: 578f48a408e1b64fc96a5ff663a2a725db99bb2f; verified on Roy GitHub and z-peterson/t4-code GitLab mirror.
• Initial focused red: 49622d89bf965e10dc7487d093157e1932124cd7, run 29873799320, cluster 88779780287: normal Pod/Service conflicts reset validated dependency conditions.
• Authoritative-reader/policy reds: bc4a2c3 run 29875214845 cluster 88784196462; 59e7d01 run 29875380531 cluster 88784777240; a900edf run 29876239117 cluster 88787331715; 76de2ef run 29877245162 cluster 88790391562.
• Final green: run 29877344403, cluster 88790747613, verify 88791635411.
• Independent materialized exact-head review: CLEAN at full 578f48a408e1b64fc96a5ff663a2a725db99bb2f (confidence 0.99; no findings).
• Draft is intentionally retained pending authoritative Woodpecker repo-38 proof for this exact head.

[usr-bin-roygbiv]

OP-04 final split-reader proof

• Red (tests only): cfd36a8214275fe4591d0753f909b6def9bae559; GitHub CI run 29877900170, cluster job 88792363303 failed at reconciler_test.go:190: cached-empty Session list left Ready=False/Terminating, expected current-generation Ready=False/SessionsRemain.
• Final exact head: b056ec5972bd9f1f58a62de21a1485914d3d29bf. Workspace deletion now lists namespace Sessions through APIReader (falling back to Client only when unset) and filters Spec.WorkspaceRef in memory before PVC cleanup/finalizer removal.
• Green: GitHub CI run 29878265804 completed success; cluster 88793413846 success; verify 88794401716 success.
• Independent exact-head review: CLEAN, zero P0/P1/P2 at b056ec5972bd9f1f58a62de21a1485914d3d29bf; confirmed authoritative Session scan, fallback/error propagation, in-memory filter, preserved Delete/Retain PVC semantics and finalizer ordering, and focused regression coverage.
• Exact distribution: Roy fork and GitLab agent/t4-op04-controller-reconciliation both resolve to b056ec5972bd9f1f58a62de21a1485914d3d29bf by git ls-remote.
• Changed files for this repair: packages/cluster-operator/controllers/reconciler_test.go, packages/cluster-operator/controllers/workspace_controller.go.

PR remains draft and mergeable. Remaining gate: authoritative Woodpecker proof for this exact mirrored SHA; no Woodpecker result is claimed here and no manual run was triggered.

[wolfiesch]

Blocking isolation issue: session_controller.go authorizes the workspace PVC through the informer-backed client, then creates the Pod using only the claim name. A stale cached owned PVC can therefore authorize a Pod after the authoritative PVC has been replaced by a foreign object under the same deterministic name. I reproduced this with split cached/API-reader state; reconciliation succeeded and created a Pod referencing the foreign claim. Please re-read and validate the authoritative PVC immediately before Pod creation, including UID, owner, storage class, RWX and Bound state. The workspace readiness path should also avoid publishing authorization-critical state from stale PVC data.