chore: close the 10 declarative coverage gaps found by the deploy/ coverage guard

[devantler]

🤖 Generated by the Daily AI Engineer

Evidence

The coverage guard added in #114 found 14 (dimension, repository) pairs that are not declared in
deploy/. They are exempted there — explicitly and with a pointer to this issue — so the guard
could land green and ratchet. This issue closes them.

dimension	repositories missing
repositories/ (Repository CRs)	actions, .github, monorepo
repository-permissions/	aws, kyverno-policies, monorepo, provider-upjet-unifi
team-repositories/grant-maintainers-on-*	agent-plugins, agent-skills, ascoachingogvaner, .github, fleet-gitops, maintenance, wedding-app

For contrast, labels/ and grant-admins-on-* are both 21/21 — completeness is achievable
here, which is the evidence that the above is drift rather than a designed boundary.

Problem

Each gap means a repository whose settings, collaborator permissions, or team access are not
reconciled from Git. The state is whatever it happens to be, and it can be changed by hand without
anything reverting it — the exact failure the declarative model exists to prevent.

Notes before starting

• Not all of these are necessarily drift. The grant-maintainers gaps include the three private
  repos (ascoachingogvaner, fleet-gitops, wedding-app), where withholding the Maintainers team
  may well be deliberate. Decide per repo; where an omission is intended, keep the exemption and
  replace its reason with the intent.
• repositories/ writes are currently blocked by fix: declarative repo-settings updates are write-blocked (422 on every update PATCH) #112 (422 on every settings PATCH). That
  dimension likely has to wait on it; the other two do not.
• Adopt existing repos Observe-first with a no-Delete management policy, per the convention
  established in feat(deploy): bring the maintenance repo under active management #43–feat(deploy): manage platform, ksail + private repos (phase 2, squash-only) #46.

Acceptance criteria

• Each of the 14 pairs is either declared in deploy/, or kept as an exemption whose reason
  states the deliberate intent.
• tests/declarative-coverage.sh passes with its exemption list reduced accordingly (the guard
  already fails on a stale exemption, so this is self-enforcing).
• No net-new resource claims Delete or an external name.

Split per dimension if it reviews better. Part of #56.

[coderabbitai]

🔗 Related PRs

#67 - feat: require actions pinned to a full-length commit SHA on all repos but actions [merged]
#78 - feat(repositories): declare provider-upjet-unifi (net-new Library repo) [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]
#88 - feat: archived-repo pattern + reusable-workflows archival groundwork [merged]
#103 - feat(teams): activate declarative Admins policy [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Engineer

Correction — 14 gaps → 10; repository-permissions was never a gap

A review finding on #114 caught a real error in how I measured this, and it changes the numbers
above. The original count came from enumerating files on disk. Only what kubectl kustomize deploy/ actually renders reconciles — and deploy/repository-permissions/ is deliberately
not wired into deploy/kustomization.yaml:

# repository-permissions/ is intentionally NOT wired in yet — its own
# kustomization.yaml header documents the precondition (provider-upjet-github
# bump for `sha_pinning_required`, crossplane-contrib/provider-upjet-github#288).
# Hit live 2026-07-09: publishing it stalled the tenant `apps` Kustomization's
# health check for 20m every reconcile, blocking prod deploys and the merge queue.

So that whole dimension is dormant by design, and its four "missing" repos (aws,
kyverno-policies, monorepo, provider-upjet-unifi) were phantoms — there is nothing to
declare while nothing reconciles. Re-adding those files would not close a gap; re-wiring the
directory is a separate, precondition-gated decision that belongs with the provider bump.

Corrected scope — 10 real gaps in 2 dimensions:

dimension	repositories missing
repositories/ (Repository CRs)	actions, .github, monorepo
team-repositories/grant-maintainers-on-*	agent-plugins, agent-skills, ascoachingogvaner, .github, fleet-gitops, maintenance, wedding-app

The guard in #114 now derives coverage from the rendered manifest, so it measures what actually
reconciles and its exemption list is down to these 10. The acceptance criteria above stand, minus
the repository-permissions row.