Description
Add a single-owner per-stack alerting composite covering RuleGroup, ContactPoint, MuteTiming, MessageTemplate and InhibitionRuleV1Beta1. Contact points are already an optional stack child, so this generalises that rather than replacing it.
Exclude NotificationPolicy. It is an organization-wide singleton whose provider documentation states it manages the entire tree and overwrites its policies, and whose deletion resets the tree to defaults. In a stack-per-tenant topology one Crossplane owner per stack is coherent, so the objection is not ownership but blast radius on delete and the absence of any partial form. Route instead through per-rule simplified routing, which is available now, and revisit named routing trees later: RoutingtreeV1Beta1 is preview, requires Grafana 13.1 or later and a feature toggle, and no resource was found that sets Grafana feature toggles on a Cloud stack.
The decision this API must not default is provenance. Resources provisioned through the alerting provisioning API are stamped with a provenance marker and become read-only in the tenant Grafana UI. Setting the disable provenance flag hands editing back and accepts that Crossplane will contest tenant edits on every reconcile. There is no third option, so make it a required enum on the spec rather than inheriting whatever the provider defaults to. Handoff is a legitimate posture for seeded content while security stays locked.
Note the existing reconciliation vocabulary already distinguishes enforced from createOnly; align naming with it rather than inventing a parallel scheme.
Acceptance Criteria
- #1 The spec carries a required provenance choice and neither value is silently defaulted
- #2 NotificationPolicy is not rendered by any path, and the README states why and what to use instead
- #3 Naming aligns with the existing enforced and createOnly reconciliation vocabulary
- #4 Exactly one owner per stack for each whole-set alerting object
- #5 A catalog example renders a rule group with simplified routing and no live endpoints
Definition of Done
- #1 ./scripts/validate.sh passes locally
- #2 hosted Validate workflow passes on the completing commit
Implementation Plan
Wave 2: implement and validate the single-owner alerting bundle without NotificationPolicy, with explicit provenance and inert catalog; root wires and gates.
Implementation Notes
Wave 1 lane C disposition, 2026-09-08: Not started and Parked because the mandatory root pre-fan-out pass did not produce a pushed seam SHA after route metadata was unavailable. Resume after GCV-0032 completes the section 5.0 pass, then spawn JUDGMENT+EXECUTION on gpt-5.6-terra at high effort with fork_turns none and the pushed pre-pass SHA. No acceptance criterion or Definition of Done item was checked.
Wave 2 verification: focused alerting race tests proved explicit provenance, simplified routing, duplicate-owner rejection, and createOnly forProvider ownership. Catalog, integrated local gate, and hosted Validate run 34233686654 passed.
Final Summary
Delivered the single-owner alerting bundle for five stack-scoped kinds, with explicit enforced or createOnly provenance and no NotificationPolicy path. Completing SHA 83f81afee7526fd6e7c4ec0a47675774d00036b8; hosted Validate run 34233686654 succeeded.