Description
The provider ships a third API-group family alongside the cluster-scoped and namespaced ones: an observe-only family generated from Terraform data sources, carrying roughly 50 read-only kinds across 11 groups. It includes set kinds such as FolderSet, DashboardSet, TeamSet, UserSet, LibraryPanelSet, ProbeSet, CollectorSet and OrganizationUsers. Nothing in this repository uses any of it.
Add a read-only composite that composes these set kinds for a referenced stack and publishes to status what actually exists versus what the platform declared. The output is the thing no current mechanism produces: a continuously reconciled list of objects created out of band that Crossplane does not manage.
This also replaces hand work in the migration runbook, which currently asks an operator to inventory an existing stack manually before handing over ownership. The same object then serves as the ongoing drift detector, which addresses the known limitation that Crossplane readiness only reports the children currently desired.
Nothing here can mutate a tenant, which makes it unusually safe to ship early. Note the agento11y family has no observe-only variant because upstream ships no corresponding data sources.
Acceptance Criteria
- #1 The API is read-only by construction and cannot render a mutating managed resource
- #2 It gates on the referenced stack the same way the existing access claims do
- #3 Status distinguishes declared, observed-and-managed, and observed-but-unmanaged objects
- #4 The migration section of the README points at this API instead of manual inventory steps
- #5 New observe-only kinds are added to the activation policy and a catalog example renders
Definition of Done
- #1 ./scripts/validate.sh passes locally
- #2 hosted Validate workflow passes on the completing commit
Implementation Plan
Wave 2: implement and validate the observe-only inventory composite, provider-kind set, status classification, and inert catalog; root wires shared registries and performs final gates.
Implementation Notes
Wave 1 lane A disposition, 2026-09-08: Not started and Parked because the mandatory root pre-fan-out pass did not produce a pushed seam SHA after route metadata was unavailable. Resume after GCV-0032 completes the section 5.0 pass, then spawn EXECUTION on gpt-5.6-luna at max effort with fork_turns none and the pushed pre-pass SHA. No acceptance criterion or Definition of Done item was checked.
Wave 2 verification: focused inventory race tests, catalog rendering, the integrated local gate, and hosted Validate run 34233686654 all passed. Activation entries were verified against provider v2.14.0.
Final Summary
Delivered the observe-only stack inventory API with readiness gating and declared, managed, and unmanaged status classification. Completing SHA 83f81afee7526fd6e7c4ec0a47675774d00036b8; hosted Validate run 34233686654 succeeded.