teamrender

func BindConfig ¶

func BindConfig(
	bp *v1beta1.CellBlueprintDoc,
	r *model.Role,
	roleRef, harness string,
	tc *model.TeamsConfig,
	src teamsource.Source,
	in Inputs,
	project, realm, space, stack string,
) *v1beta1.CellConfigDoc

BindConfig produces a CellConfig referencing bp. The operator-fact values (git author/committer/signingKey/allowedSigners/registry) land in Values keyed by the same `${KEY}` names the blueprint may declare as CellBlueprintParameters; the daemon resolves them at run time per the CellConfig contract. The project's clone URL fills the `project` repo slot; the agents source URL (from tc.spec.sources[<owner/repo>]) fills the `agents` slot — both only when the blueprint actually declares the slot, so a template that doesn't carry the slot produces a config without a stray fill. The secret-slot fills are sourced from the role's per-harness list (role.spec.harnesses[harness].secrets, the agents#750 location) merged with the role-level fallback (role.spec.needs.secrets) — see effectiveSecretNames. Each declared secret name is matched against the blueprint's BlueprintSecretSlot declarations and, when the blueprint declares the slot, filled with an in-realm ContainerSecretRef pointing at the secret of the same name — the runtime resolves the actual bytes via the Secret kind (#623) created out of the two-layer secrets.env path (#1120).

func MarshalYAML ¶

func MarshalYAML(res *Result) ([]byte, error)

MarshalYAML returns the Result as a single multi-document YAML stream. Bundle order: every Secret, then every Blueprint, then every Config — the "Secrets → Blueprints → Configs" ordering called out in #1113. The per-section order matches the slice order on Result (Secrets sorted by metadata.name by teamsecrets.Render; Blueprints/Configs in (role × harness) iteration order) so the dry-run output and the apply-bundle payload are both deterministic.

func MergeNeeds ¶

func MergeNeeds(a, b []string) []string

MergeNeeds returns the lexicographically sorted union of a and b. Empty and whitespace-only entries are dropped, so a per-role override that repeats a role.yaml capability yields a single entry rather than a duplicate. The output is a fresh slice — callers may mutate it without affecting the inputs.

func RenderBlueprint ¶

func RenderBlueprint(
	cacheDir string,
	h *model.Harness,
	r *model.Role,
	harness, roleRef string,
	needs []string,
	image *model.ImageCatalogEntry,
	tc *model.TeamsConfig,
	src teamsource.Source,
	in Inputs,
	project, realm, space, stack string,
) (*v1beta1.CellBlueprintDoc, error)

RenderBlueprint loads the harness's blueprint template, parses it as a Go text/template (alongside every sibling `*.tmpl.yaml` partial in the same directory), executes it against the typed dot-context the agents repo's published blueprints are authored against, and yaml-parses the result into a CellBlueprintDoc.

Template path resolution: harness.Spec.Template resolves relative to the harness's own directory (`<cacheDir>/harnesses/<harness>/`), not the cache root. The agents repo's `harnesses/<name>/harness.yaml` declares `template: blueprint.tmpl.yaml` as a sibling, so the bare-filename form is the canonical shape.

Sibling partials: every `*.tmpl.yaml` in the resolved template's directory is parsed into the same `*template.Template` set so a blueprint's `{{ template "mount_source" . }}` call resolves against a `{{ define "mount_source" }}…{{ end }}` block in any sibling (`partials.tmpl.yaml`, `mounts.tmpl.yaml`, …) without the renderer owning a partials directory of its own.

Dot-context: see renderContextValues for the full shape. The `.operator.*` and `.project.*` leaves are bound from tc, src, and in: the agents source's owner/repo path drives `.operator.REPO_OWNER` (when no tc.spec.repoOwner override is set) and `.project.AGENTS_REPO`; in.ProjectDir and in.TeamDir surface as `.project.PROJECT_DIR` and `.operator.TEAM_ROOT` respectively; tc.spec.homeDir (or `$HOME` when unset) fills `.operator.HOME_DIR`. The metadata.labels are populated with `kukeon.io/team = project`. metadata.realm/space/stack are forced to the (defaulted) realm/space/stack scope (the template need not pre-fill them) so the rendered Config records the same explicit scope the live cell persists — closing the defaulting asymmetry behind the spurious OutOfSync in #1133. If the template did not supply metadata.name, the default `<role>-<harness>` is stamped so the blueprint and its companion config share a deterministic identity.

in.Build + in.SourceRef drive the `.image` bind decision (see renderContextValues): in build mode the locally-built `kukeon.internal/<ref>:<sourceRef>` image is bound; otherwise the catalog entry's published Image is.

func SelectImage ¶

func SelectImage(
	ic *model.ImageCatalog,
	harness string,
	needs []string,
) (*model.ImageCatalogEntry, error)

SelectImage picks the ImageCatalog entry whose `harness` matches and whose `capabilities` superset every entry in needs. Catalog order is the tiebreaker — the first matching entry wins. A miss surfaces errdefs.ErrTeamImageNoMatch naming the first capability no harness-matching image provides + the operator-actionable hint. Empty needs match any image carrying the requested harness; an empty catalog is always a miss (the operator must populate images.yaml).