[Baylem]

Superseded by #835, which carries the reviewed commits on an upstream branch for native GitHub stacking. This PR is closed without merging; its review history remains available here.

Shared GameTemplate updates currently change every referencing server immediately. This adds per-server adoption of immutable template snapshots: Automatic remains the default, while OnRequest retains the admitted content until an administrator requests the exact installed revision digest.

The operator reports desired, effective and observed running revisions. Rendering, backup metadata, restore planning and capture filters use the effective snapshot. Adoption shares the existing lifecycle owner with backup/restore/wipe, gracefully stops using the old template, waits for the owned workload to drain, and then changes the pin. A later catalog update cannot replace an already admitted target. Existing PVC identities remain intact.

Existing servers initialize revision tracking without a provenance-only restart, preserving their Pod templates and leaving running revision unknown. Real configuration edits and security upgrades still apply. Restricted-incompatible targets are rejected before admission or drain. New servers pin before first rendering. Documentation covers Module version pinning, mutable image references, missing snapshots and the distinction between data backups and runtime rollback bundles.

Includes #760, #766, #767, #764, #762 and the #759 build prerequisite. These integrations preserve pod-bound backup preparation, effective-template volume classifications, Restricted validation and configurable resource changes. Failed/deleted restore startup and orphan recovery retain ownership until the previous game/PVC writers drain. The management-placement and Restricted workload buckets remain registered in upstream change-based test selection.

Validation: Linux operator/API/agent builds, controller/unit/envtest and E2E source compilation, canonical CRD generation/synchronization, actionlint and offline zizmor passed. Runtime tests run in CI under repository policy. Added regressions for exact admission, owner/drain races, baseline initialization, concurrent spec edits, effective-template consumption and incompatible security profiles, plus a real-cluster data-retention rollout scenario. CI runtime results are pending.

Closes #731

API password redaction and PUT preservation use the server's verified effective snapshot, with cache isolation by server identity and revision. Missing or invalid snapshots fail closed. Cloning rejects configurations whose copied passwords would become ordinary fields under the current template. Creation, cloning and edits before initial pinning atomically retain password-key classification in protected metadata, so a catalog change cannot expose values between validation and admission. Template adoption rejects populated password fields that become public or invalid types before value validation can quote them in status. Cleared protection retires only with a successful pin update.

Backup detail UI follows Pencil nodes zhLZN (achieved consistency and legacy volume coverage) and bHJy6 (recorded per-volume coverage). JSON and PNG exports are included under assets/design-export/, with screenshot coverage for both states. The design was saved in Pencil and manually checked against Chrome; application and screenshot TypeScript compilation passed. Runtime and visual verification of this updated head remains pending CI.

The drawer explicitly resets inherited HeroUI margins and foreground color to match the Pencil references. Header/footer sizing and button labels are aligned in the saved design and exports. The remote SSE fixture now uses selected-cluster read permissions. CI uses the shared checksum-verified Trivy release installer with bounded retries; scans and gates remain intact.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: stack/pr-764
• File: .coderabbit.yaml
• Commit: 91f4df6
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 55070e11-8d6e-437a-a9b8-87bd8e2ac178

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Baylem]

The failed api-mods rerun stopped before tests started because its image artifact had expired. I requested a full workflow rerun, then resolved the current-upstream conflicts in 22494f1d; fresh CI on that commit rebuilds the artifacts. The merge preserves staged-rollout tests, Restricted workload coverage and diagnostics safeguards. Production and controller/E2E source compilation plus the required workflow static checks passed.

[Baylem]

Updated in 52aae3f with the legacy cleanup fix from #766, stopped-capture artifact retry from #764, and upstream’s operator lint/frpc dependency fixes. Source compilation, regression-source compilation and required workflow checks passed.

The earlier ARM64 operator failure was a 90-second capture-readiness timeout. The ephemeral container was inserted, but the fixture’s cleanup removed the Pod before workflow diagnostics collected its state, so the logs do not establish the cause. Added failure-only capture/Pod-status diagnostics before teardown, bounded to ten seconds. Existing assertions and deadlines are unchanged. Fresh CI will retry the test and retain evidence if it fails again; I am not treating this timeout as resolved until the new result is available.

[ValgulNecron]

This pr is editing the UI without a pencil edit. please do the edit in pencil too