feat: flexible manifests

.claude/settings.local.json

@@ -10,7 +10,9 @@
       "Bash(go:*)",
       "Bash(ls:*)",
       "Bash(cat:*)",
-      "Bash(task test-e2e:*)"
+      "Bash(task test-e2e:*)",
+      "Bash(k3d cluster *)",
+      "Bash(kubectl config *)"
     ]
   }
 }

.devcontainer/Dockerfile

@@ -50,19 +50,21 @@ RUN apt-get update \
 # TASK_VERSION -> https://github.com/go-task/task/releases
 # TILT_VERSION -> https://github.com/tilt-dev/tilt/releases
 # ACTIONLINT_VERSION -> https://github.com/rhysd/actionlint/releases
+# VALKEY_VERSION -> https://github.com/valkey-io/valkey/releases
 
 ENV PATH="/go/bin:/usr/local/go/bin:${PATH}" \
     KUBECTL_VERSION=v1.36.1 \
     KUSTOMIZE_VERSION=5.8.1 \
     KUBEBUILDER_VERSION=4.14.1 \
     GOLANGCI_LINT_VERSION=v2.12.2 \
     HELM_VERSION=v4.2.0 \
-    K3D_VERSION=v5.8.3 \
+    K3D_VERSION=v5.9.0 \
     FLUX_VERSION=2.8.8 \
     FLUX_OPERATOR_VERSION=0.50.0 \
     TASK_VERSION=v3.51.1 \
     TILT_VERSION=v0.37.3 \
-    ACTIONLINT_VERSION=1.7.12
+    ACTIONLINT_VERSION=1.7.12 \
+    VALKEY_VERSION=9.1.0
 
 # https://github.com/fluxcd/flux2/releases
 # https://fluxoperator.dev/
@@ -133,6 +135,14 @@ RUN asset="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
     && install -m 0755 actionlint /usr/local/bin/actionlint \
     && rm -rf "${tmpdir}"
 
+# Install valkey-cli
+# Valkey only ships prebuilt binaries for Ubuntu jammy/noble; the jammy build
+# (glibc 2.35) is compatible with this bookworm image (glibc 2.36). Extract only
+# the CLI binary from the release tarball.
+RUN curl -fsSL "https://download.valkey.io/releases/valkey-${VALKEY_VERSION}-jammy-x86_64.tar.gz" \
+    | tar -xzO "valkey-${VALKEY_VERSION}-jammy-x86_64/bin/valkey-cli" > /usr/local/bin/valkey-cli \
+    && chmod +x /usr/local/bin/valkey-cli
+
 # Set working directory
 WORKDIR /workspaces
 

.github/workflows/ci.yml

@@ -276,7 +276,7 @@ jobs:
             e2e_ginkgo_procs: "2"
             k3d_agent_count: "0"
           - name: full
-            script: "task test-e2e-full"
+            script: "task test-e2e"
             needs_artifact: false
             # Bumped 1 -> 4: the full suite was serialized to avoid the
             # cross-target rule-change snapshot coupling, now fixed (per-target

README.md

@@ -180,6 +180,10 @@ helm upgrade gitops-reverser \
 The default quickstart namespace is `default`, so the `git-creds` Secret above should exist there
 unless you explicitly set `quickstart.namespace` to something else.
 
+The starter `GitTarget` writes under `live-cluster` by default. That keeps the first run away from
+the repository root. To deliberately target the root instead, add
+`--set quickstart.gitTarget.path=.` to the Helm command.
+
 Check that the starter resources become ready:
 
 ```bash

Tiltfile

@@ -88,9 +88,6 @@ k8s_resource(
 
 test_targets = [
     'test-e2e',
-    'test-e2e-full',
-    'test-e2e-signing',
-    'test-e2e-manager',
     'test-image-refresh',
 ]
 for name in test_targets:

api/v1alpha1/gitprovider_types.go

@@ -23,8 +23,20 @@ import (
 )
 
 // GitProviderSpec defines the desired state of GitProvider.
+//
+// Only the repository URL is immutable. The URL is the destination identity that every
+// referencing GitTarget materializes into; changing it would silently point those
+// targets at a different repository and orphan their existing materialization (the same
+// reason a GitTarget's destination is immutable). To repoint, delete and recreate the
+// GitProvider. Everything else here is operational and deliberately stays mutable —
+// notably allowedBranches (widening or narrowing the writable set is a normal change
+// that must not require tearing down every GitTarget), plus auth, push tuning, and
+// commit identity/signing.
+//
+// +kubebuilder:validation:XValidation:rule="self.url == oldSelf.url",message="spec.url is immutable; delete and recreate the GitProvider to point at a different repository"
 type GitProviderSpec struct {
-	// URL of the repository (HTTP/SSH)
+	// URL of the repository (HTTP/SSH).
+	// Immutable: delete and recreate the GitProvider to point at a different repository.
 	URL string `json:"url"`
 
 	// SecretRef for authentication credentials (may be nil for public repos)

api/v1alpha1/gittarget_types.go

@@ -42,19 +42,42 @@ type GitProviderReference struct {
 }
 
 // GitTargetSpec defines the desired state of GitTarget.
+//
+// The destination fields — providerRef, branch, and path — are immutable. A
+// GitTarget materializes the watched resources at exactly one (provider, branch,
+// folder); changing where it writes would orphan the old materialization and require
+// migrating manifests between repositories/branches/folders. Instead of reconciling
+// that move, the destination is fixed: to relocate a GitTarget, delete it and create a
+// new one. This keeps the one-owner-per-folder invariant and the initial-snapshot gate
+// simple — a successful snapshot can never be silently invalidated by a destination
+// change.
+//
+// +kubebuilder:validation:XValidation:rule="self.providerRef == oldSelf.providerRef",message="spec.providerRef is immutable; delete and recreate the GitTarget to change its destination"
+// +kubebuilder:validation:XValidation:rule="self.branch == oldSelf.branch",message="spec.branch is immutable; delete and recreate the GitTarget to change its destination"
+// +kubebuilder:validation:XValidation:rule="self.path == oldSelf.path",message="spec.path is immutable; delete and recreate the GitTarget to change its destination"
 type GitTargetSpec struct {
 	// ProviderRef references the GitProvider or Flux GitRepository.
+	// Immutable: delete and recreate the GitTarget to change its destination.
 	// +required
 	ProviderRef GitProviderReference `json:"providerRef"`
 
 	// Branch to use for this target.
 	// Must be one of the allowed branches in the provider.
+	// Immutable: delete and recreate the GitTarget to change its destination.
 	// +required
 	Branch string `json:"branch"`
 
-	// Path within the repository to write resources to.
-	// +optional
-	Path string `json:"path,omitempty"`
+	// Path within the repository to write resources to, relative to the repository
+	// root. Required and must be non-empty — there is no default, so a GitTarget can
+	// never silently write to the repository root. To deliberately target the
+	// repository root, set it to "." (the ArgoCD/Flux convention); an empty string is
+	// rejected because it is too easy to leave blank by accident to be a deliberate
+	// root choice. Any leading slash (absolute path) and ".." are rejected, and a
+	// trailing slash is normalized away.
+	// Immutable: delete and recreate the GitTarget to change its destination.
+	// +required
+	// +kubebuilder:validation:MinLength=1
+	Path string `json:"path"`
 
 	// Encryption defines encryption settings for Secret resource writes.
 	// +optional

charts/gitops-reverser/README.md

@@ -137,7 +137,7 @@ resources:
     memory: 128Mi
   limits:
     cpu: 1000m
-    memory: 512Mi
+    memory: 1Gi
 
 monitoring:
   serviceMonitor:
@@ -169,7 +169,7 @@ nodeSelector:
 | `quickstart.namespace` | Namespace for the starter quickstart resources | `default` |
 | `quickstart.gitProvider.url` | Repository URL used by the starter `GitProvider` | `""` |
 | `quickstart.gitProvider.secretRef.name` | Existing Secret name used by the starter `GitProvider` | `git-creds` |
-| `quickstart.gitTarget.path` | Repository path used by the starter `GitTarget` | `live-cluster` |
+| `quickstart.gitTarget.path` | Repository path used by the starter `GitTarget`; set `.` only to deliberately target the repo root | `live-cluster` |
 | `quickstart.watchRule.rules` | Rules used by the starter `WatchRule` | `configmaps create/update/delete` |
 | `queue.redis.addr` | Redis endpoint (`host:port`) for required durable audit queueing | `valkey:6379` |
 | `queue.redis.auth.existingSecret` | Name of a pre-created Secret holding the Redis password | `valkey-auth` |

charts/gitops-reverser/values.yaml

@@ -177,8 +177,8 @@ rbac:
 # Resource limits and requests
 resources:
   limits:
-    cpu: 500m
-    memory: 512Mi
+    cpu: 1000m
+    memory: 1Gi
   requests:
     cpu: 10m
     memory: 256Mi
@@ -267,6 +267,8 @@ quickstart:
   gitTarget:
     name: example-target
     branch: main
+    # Required relative repository path for the starter GitTarget. The chart
+    # default avoids repo-root writes; set "." only to deliberately target root.
     path: live-cluster
     encryption:
       provider: sops

cmd/main.go

@@ -52,7 +52,6 @@ import (
 	"github.com/ConfigButler/gitops-reverser/internal/controller"
 	"github.com/ConfigButler/gitops-reverser/internal/git"
 	"github.com/ConfigButler/gitops-reverser/internal/queue"
-	"github.com/ConfigButler/gitops-reverser/internal/reconcile"
 	"github.com/ConfigButler/gitops-reverser/internal/rulestore"
 	"github.com/ConfigButler/gitops-reverser/internal/telemetry"
 	"github.com/ConfigButler/gitops-reverser/internal/types"
@@ -149,35 +148,34 @@ func main() {
 	)
 	fatalIfErr(mgr.Add(workerManager), "unable to add worker manager to manager")
 
-	// Create ReconcilerManager (will be set up as ControlEventEmitter)
-	reconcilerManager := reconcile.NewReconcilerManager(
-		nil, // eventRouter will be set after EventRouter is created
-		ctrl.Log.WithName("reconciler-manager"),
-	)
-
 	// Watch ingestion manager (placeholder, will get EventRouter set later)
 	watchMgr := &watch.Manager{
 		Client:                 mgr.GetClient(),
 		Log:                    ctrl.Log.WithName("watch"),
 		RuleStore:              ruleStore,
 		EventRouter:            nil, // Will be set below
 		AuditLiveEventsEnabled: true,
+		SensitiveResources:     cfg.sensitiveResources,
 	}
 
-	// Initialize EventRouter with all dependencies
+	// Initialize EventRouter with all dependencies. The streaming-snapshot resync
+	// (M8) is driven directly through the worker, so there is no longer a separate
+	// reconciler manager / two-snapshot handshake.
 	eventRouter := watch.NewEventRouter(
 		workerManager,
-		reconcilerManager,
 		watchMgr,
 		mgr.GetClient(),
 		ctrl.Log.WithName("event-router"),
 	)
-	reconcilerManager.SetEventRouter(eventRouter)
-	reconcilerManager.SetOnReconcilerCreated(watchMgr.MaybeReplaySnapshot)
 
 	// Set EventRouter reference in WatchManager
 	watchMgr.EventRouter = eventRouter
 
+	// Inject the live followability registry into the writer, so a GVR-only DELETE
+	// event resolves to a manifest moved off its canonical path (M6 in the writer).
+	// The registry is a stable pointer the watch manager refreshes in place.
+	workerManager.SetMapper(watchMgr.TypeRegistry())
+
 	// WatchRule controller (with WatchManager reference for dynamic reconciliation)
 	fatalIfErr((&controller.WatchRuleReconciler{
 		Client:       mgr.GetClient(),