mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
tlongwell-blockandDawn
02b860dd1c
The provider binary behind the remote-agents spec's Kubernetes binding (`docs/remote-agents.md` §K8s). One process per operation: one JSON object in on stdin, one JSON object out on stdout, exit 0 for any response that was produced. `info` and `deploy`; kube-rs against an ambient kubeconfig only, so no credential ever appears in `provider_config` (I2). The §Deploy State Machine is implemented row by row against a `Substrate` trait, with the real kube-rs implementor in `cluster.rs` and a scripted fake driving the shipped `deploy` in tests. Three mechanisms are normative rather than incidental and are spelled once each: quorum reads with `resourceVersion` left unset, UID + `resourceVersion` delete preconditions, and `Status.reason` as the 409 discriminator — `code == 409` appears nowhere in the crate, because `AlreadyExists` and `Conflict` share it and conflating them takes the adoption path on a failed delete (`:763-765`). Secrets are per-attempt, immutable, and uniquely named, which makes payload and Secret atomic at the pod-spec boundary without a Lease. GC never touches an object lacking the management marker, and its orphan sweep is skipped entirely when the apiserver's `Date` header is absent — a fast local clock must not be able to delete an in-flight Secret. 144 tests. The fake substrate carries a fake clock, which turned two hot-spin bugs in the reconcile loop from unreproducible hangs into instant failures. Per-MUST coverage, including what is deliberately out of scope with its citation, is in the PR body. Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co> Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>