feat: add default-off Kubernetes cluster operator#115

Merged

iarbpairs merged 105 commits into

LycaonLLC:mainfrom

usr-bin-roygbiv:agent/t4-cluster-operator

Jul 21, 2026

Commits on Jul 20, 2026

test(cluster): define operator and chart contracts
usr-bin-roygbiv
committed
test(cluster): define default-off operator client contracts
usr-bin-roygbiv
committed
test(cluster): define CI and proof contracts
usr-bin-roygbiv
committed
test(cluster): define operator gateway contracts
usr-bin-roygbiv
committed
fix(ci): make cluster test pipeline self-contained
usr-bin-roygbiv
committed
fix(ci): run cluster contracts before implementation gates
usr-bin-roygbiv
committed
feat(cluster): add portable Kubernetes operator
usr-bin-roygbiv
committed
ci(cluster): implement image and live proof harness
usr-bin-roygbiv
committed
ci(cluster): reuse bounded Harbor registry auth
usr-bin-roygbiv
committed
feat(cluster): add default-off operator client
usr-bin-roygbiv
committed
ci(cluster): hand chart contracts to Helm stage
usr-bin-roygbiv
committed
feat(cluster): add stateless cluster gateway
usr-bin-roygbiv
committed
fix(cluster): close server integration gaps
usr-bin-roygbiv
committed
fix(cluster): align gateway resources with CRDs
usr-bin-roygbiv
committed
fix(operator): wait for sessions before workspace deletion
usr-bin-roygbiv
committed
Replace cluster static auth with TokenReview identity
usr-bin-roygbiv
committed
test(cluster): cover integration safety gaps
usr-bin-roygbiv
committed
fix(cluster): harden portable runtime reconciliation
usr-bin-roygbiv
committed
test(cluster): require rotating CI identity
usr-bin-roygbiv
committed
feat(cluster): support projected CI identity
usr-bin-roygbiv
committed
fix(cluster): separate CI API and web endpoints
usr-bin-roygbiv
committed
fix(cluster): harden session state and replay boundaries
usr-bin-roygbiv
committed
fix(cluster): secure HA projections and idempotency
usr-bin-roygbiv
committed
fix(cluster): harden portable operator packaging
usr-bin-roygbiv
committed
fix(ci): bind cluster proof and image evidence
usr-bin-roygbiv
committed
fix(cluster): enforce negotiated client projections
usr-bin-roygbiv
committed
test(ci): assert truthful signer rejection
usr-bin-roygbiv
committed
fix(ci): run cluster gates on compatible runtimes
usr-bin-roygbiv
committed
test(ci): require Bun for cluster protocol gates
usr-bin-roygbiv
committed
fix(ci): satisfy release lint and Bun execution
usr-bin-roygbiv
committed
fix(ci): align cluster Bun verification
usr-bin-roygbiv
committed
fix(ci): type cluster verification fixtures
usr-bin-roygbiv
committed
fix(ci): resolve client contracts and CA path
usr-bin-roygbiv
committed
test(cluster): align negotiated projection fixtures
usr-bin-roygbiv
committed
fix(cluster): align web projection contracts
usr-bin-roygbiv
committed
fix(ci): provision pinned Bun for upstream tests
usr-bin-roygbiv
committed
test(wire): cover cluster command ownership
usr-bin-roygbiv
committed
test(protocol): preserve additive cluster provenance
usr-bin-roygbiv
committed
fix(projection): preserve ordered inventory semantics
usr-bin-roygbiv
committed
fix(cluster): require Bun for server tests
usr-bin-roygbiv
committed
test(desktop): assert cluster capability default off
usr-bin-roygbiv
committed
test: advance projection fixture cursors
usr-bin-roygbiv
committed
test: resolve protocol source in playwright
usr-bin-roygbiv
committed
ci: install playwright in e2e container
usr-bin-roygbiv
committed
test: answer preview state recovery
usr-bin-roygbiv
committed
test: isolate preview response values
usr-bin-roygbiv
committed
test: assert workspace metadata row
usr-bin-roygbiv
committed
test: dismiss mobile session drawer
usr-bin-roygbiv
committed
test: target preview selector exactly
usr-bin-roygbiv
committed
test: normalize reduced motion duration
usr-bin-roygbiv
committed
test: scope preview lease fixture identity
usr-bin-roygbiv
committed
fix: omit empty preview type selector
usr-bin-roygbiv
committed
ci: run wire tests with git available
usr-bin-roygbiv
committed
test: require Git-capable wire runner
usr-bin-roygbiv
committed
ci: install jq for tooling contracts
usr-bin-roygbiv
committed
fix(ci): make checksum parsing portable to POSIX awk
usr-bin-roygbiv
committed
fix(ci): run image evidence in portable shells
usr-bin-roygbiv
committed
fix(ci): preserve multi-arch evidence identity
usr-bin-roygbiv
committed
fix(cluster): align live proof and bounded metrics
usr-bin-roygbiv
committed
fix(ci): parse structured Loki errors
usr-bin-roygbiv
committed
test(web): inspect disabled attribute exactly
usr-bin-roygbiv
committed
fix(cluster): configure pinned OMP session runtime
usr-bin-roygbiv
committed
fix(cluster): align OMP authority child home
usr-bin-roygbiv
committed
Fix OMP profile config convergence
usr-bin-roygbiv
committed
Harden cluster runtime configuration
usr-bin-roygbiv
committed
Fail closed on OMP runtime revocation
usr-bin-roygbiv
committed

Commits on Jul 21, 2026

Harden maintainer integration timeout
usr-bin-roygbiv
committed
Make speech concurrency test event-driven
usr-bin-roygbiv
committed
Preserve speech replacement assertions
usr-bin-roygbiv
committed
Bound upstream CI test concurrency
usr-bin-roygbiv
committed
Align bounded test concurrency contract
usr-bin-roygbiv
committed
test(desktop): require cluster operator opt-in wiring
usr-bin-roygbiv
committed
fix(desktop): wire cluster operator opt-in
usr-bin-roygbiv
committed
fix(desktop): keep feature flag construction direct
usr-bin-roygbiv
committed
build(operator): lock Go module checksums
usr-bin-roygbiv
committed
ci(cluster): isolate wire contract tests
usr-bin-roygbiv
committed
fix(desktop): normalize gated pairing capabilities
usr-bin-roygbiv
committed
test(desktop): align effective pairing grant
usr-bin-roygbiv
committed
feat(desktop): request cluster endpoint permissions
usr-bin-roygbiv
committed
fix(operator): use persistent claim phase type
usr-bin-roygbiv
committed
Merge remote-tracking branch 'origin/main' into maint/pr115-main-integration
iarbpairs
committed
fix(operator): make workspace retention immutable
usr-bin-roygbiv
committed
fix(client): suppress unauthorized cluster workspace events
usr-bin-roygbiv
committed
fix(cluster): accept Kubernetes host subdomains
usr-bin-roygbiv
committed
fix(ci): bind images to canonical source
usr-bin-roygbiv
committed
fix(operator): revoke invalid session runtimes
usr-bin-roygbiv
committed
fix(chart): enforce portable resource contracts
usr-bin-roygbiv
committed
fix(cluster): relist after host authority invalidation
usr-bin-roygbiv
committed
fix(operator): watch retained workspace storage
usr-bin-roygbiv
committed
fix(cluster): reload projected Kubernetes tokens
usr-bin-roygbiv
committed
fix(client): gate cluster session metadata
usr-bin-roygbiv
committed
fix(cluster): stabilize PR 115 integration
iarbpairs
committed
Merge remote-tracking branch 'origin/main' into maint/pr115-main-integration
iarbpairs
committed
fix(ci): make image promotion write-once
usr-bin-roygbiv
committed
style(operator): format reconciliation changes
usr-bin-roygbiv
committed
fix(cluster): revalidate routes before dispatch
usr-bin-roygbiv
committed
Merge remote-tracking branch 'roy/agent/t4-cluster-operator' into agent/t4-cluster-operator
usr-bin-roygbiv
committed
fix(client): keep cluster negotiation default-off
iarbpairs
committed
Merge remote-tracking branch 'refs/remotes/roy/agent/t4-cluster-operator' into maint/pr115-main-integration
iarbpairs
committed
fix(cluster): stabilize concurrent authority tests
iarbpairs
committed
Merge remote-tracking branch 'origin/main' into maint/pr115-main-integration
iarbpairs
committed
fix(ci): mirror upstream Flutter gate split
usr-bin-roygbiv
committed
Merge remote-tracking branch 'roy/agent/t4-cluster-operator' into agent/t4-cluster-operator
usr-bin-roygbiv
committed
fix(test): observe automatic restart reattach
iarbpairs
committed
Merge remote-tracking branch 'refs/remotes/roy/agent/t4-cluster-operator' into maint/pr115-main-integration
iarbpairs
committed