chore: close the 10 declarative coverage gaps found by the deploy/ coverage guard

🤖 Generated by the Daily AI Engineer

Evidence

The coverage guard added in #114 found 14 (dimension, repository) pairs that are not declared in
deploy/. They are exempted there — explicitly and with a pointer to this issue — so the guard
could land green and ratchet. This issue closes them.

dimension	repositories missing
`repositories/` (Repository CRs)	`actions`, `.github`, `monorepo`
`repository-permissions/`	`aws`, `kyverno-policies`, `monorepo`, `provider-upjet-unifi`
`team-repositories/grant-maintainers-on-*`	`agent-plugins`, `agent-skills`, `ascoachingogvaner`, `.github`, `fleet-gitops`, `maintenance`, `wedding-app`

For contrast, labels/ and grant-admins-on-* are both 21/21 — completeness is achievable
here, which is the evidence that the above is drift rather than a designed boundary.

Problem

Each gap means a repository whose settings, collaborator permissions, or team access are not
reconciled from Git. The state is whatever it happens to be, and it can be changed by hand without
anything reverting it — the exact failure the declarative model exists to prevent.

Notes before starting

Not all of these are necessarily drift. The grant-maintainers gaps include the three private
repos (ascoachingogvaner, fleet-gitops, wedding-app), where withholding the Maintainers team
may well be deliberate. Decide per repo; where an omission is intended, keep the exemption and
replace its reason with the intent.
repositories/ writes are currently blocked by fix: declarative repo-settings updates are write-blocked (422 on every update PATCH) #112 (422 on every settings PATCH). That
dimension likely has to wait on it; the other two do not.
Adopt existing repos Observe-first with a no-Delete management policy, per the convention
established in feat(deploy): bring the maintenance repo under active management #43–feat(deploy): manage platform, ksail + private repos (phase 2, squash-only) #46.

Acceptance criteria

Each of the 14 pairs is either declared in deploy/, or kept as an exemption whose reason
states the deliberate intent.
tests/declarative-coverage.sh passes with its exemption list reduced accordingly (the guard
already fails on a stale exemption, so this is self-enforcing).
No net-new resource claims Delete or an external name.

Split per dimension if it reviews better. Part of #56.

🔗 Related PRs

#67 - feat: require actions pinned to a full-length commit SHA on all repos but actions [merged]
#78 - feat(repositories): declare provider-upjet-unifi (net-new Library repo) [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]
#88 - feat: archived-repo pattern + reusable-workflows archival groundwork [merged]
#103 - feat(teams): activate declarative Admins policy [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

fix: keep the guard working once the exemption list empties

🤖 Generated by the Daily AI Engineer

Correction — 14 gaps → 10; `repository-permissions` was never a gap

A review finding on #114 caught a real error in how I measured this, and it changes the numbers
above. The original count came from enumerating files on disk. Only what kubectl kustomize deploy/ actually renders reconciles — and deploy/repository-permissions/ is deliberately
not wired into deploy/kustomization.yaml:

# repository-permissions/ is intentionally NOT wired in yet — its own
# kustomization.yaml header documents the precondition (provider-upjet-github
# bump for `sha_pinning_required`, crossplane-contrib/provider-upjet-github#288).
# Hit live 2026-07-09: publishing it stalled the tenant `apps` Kustomization's
# health check for 20m every reconcile, blocking prod deploys and the merge queue.

So that whole dimension is dormant by design, and its four "missing" repos (aws,
kyverno-policies, monorepo, provider-upjet-unifi) were phantoms — there is nothing to
declare while nothing reconciles. Re-adding those files would not close a gap; re-wiring the
directory is a separate, precondition-gated decision that belongs with the provider bump.

Corrected scope — 10 real gaps in 2 dimensions:

dimension	repositories missing
`repositories/` (Repository CRs)	`actions`, `.github`, `monorepo`
`team-repositories/grant-maintainers-on-*`	`agent-plugins`, `agent-skills`, `ascoachingogvaner`, `.github`, `fleet-gitops`, `maintenance`, `wedding-app`

The guard in #114 now derives coverage from the rendered manifest, so it measures what actually
reconciles and its exemption list is down to these 10. The acceptance criteria above stand, minus
the repository-permissions row.

test: guard declarative coverage of deploy/ (#114)

🤖 Generated with Claude Code in an interactive session with the maintainer.

State of the remaining 10 exemptions (read-only, 2026-09-25)

repositories/ (actions, .github, monorepo). The provider 422 that blocked these (#112) is gone: 13 active repositories now run Observe/Create/Update on provider v0.20.0. The catch is that the shared patch declares the org's squash-only merge policy on every Repository, Observe-only ones included, and the drift check compares every declared field with live GitHub.

Repository	Out of line with the shared policy
`actions`	merge commits and rebase merges enabled
`.github`	merge commits and rebase merges enabled; head branches not auto-deleted; "update branch" not suggested
`monorepo`	none

Rulesets already enforce squash-only merges, so these differences are in settings, not in behaviour. monorepo can be adopted directly. Declaring actions or .github Observe-only would put them straight into the drift report. Correcting them means write-enabling .github's management of its own settings. actions should skip this and go to archived-repositories/ when it is archived (#240).

team-maintainers (agent-plugins, agent-skills, .github, maintenance, ascoachingogvaner, fleet-gitops, wedding-app). None of the seven has the Maintainers team live; each has only Admins. The 14 declared grants give maintain, and the team's only member is devantler, who is already an organization admin. Declaring these grants changes no effective access today. ascoachingogvaner and wedding-app are public now; fleet-gitops is still private. Whether the team should cover the private repository, and what the team means once #104 lands, is a maintainer decision. maintenance is being retired (#84), so its exemption can simply expire with it.

chore: agent-claim #115 nonce=cc132e114a06c3230885585d2da2dbbb

feat(github): close the declarative coverage gaps for .github, monore…

chore: agent-claim #115 nonce=40f9bcb71fe04901ccdbf31ecf7bd663

fix(github): let .github and monorepo take updates now that adoption …

Navigation Menu

Repository navigation

chore: close the 10 declarative coverage gaps found by the deploy/ coverage guard #115

Evidence

Problem

Notes before starting

Acceptance criteria

Correction — 14 gaps → 10; `repository-permissions` was never a gap

State of the remaining 10 exemptions (read-only, 2026-09-25)

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

chore: close the 10 declarative coverage gaps found by the deploy/ coverage guard #115

Description

Evidence

Problem

Notes before starting

Acceptance criteria

Activity

coderabbitai commented on Jul 18, 2026

devantler commented on Jul 18, 2026

Correction — 14 gaps → 10; repository-permissions was never a gap

devantler commented on Sep 25, 2026

State of the remaining 10 exemptions (read-only, 2026-09-25)

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions

Correction — 14 gaps → 10; `repository-permissions` was never a gap