workspace

type CachedOrgStatusClient struct {
	// contains filtered or unexported fields
}

type FailureClass string

type HostResolver interface {
	LookupHost(ctx context.Context, host string) ([]string, error)
}

type OrgStatusClient interface {
	GetOrgStatus(ctx context.Context, orgID string) (status string, ok bool)
}

type OrgStatusLogger interface {
	Info(msg string, keysAndValues ...any)
	Error(err error, msg string, keysAndValues ...any)
}

type PodObservation struct {
	Exists             bool
	Phase              corev1.PodPhase
	Reason             string
	Message            string
	ContainerReason    string
	ContainerExitCode  int32
	ContainerOOMKilled bool
	CrashLoop          bool
	Unschedulable      bool
	Scheduled          bool
}

type RecoveryPolicy struct {
	MaxAttempts    int
	BackoffBase    time.Duration
	BackoffMax     time.Duration
	BackoffFactor  int
	StabilityReset time.Duration
	SafeModeAfter  int32
}

type WorkspaceReconciler struct {
	client.Client
	Scheme *runtime.Scheme
	// HostResolver is used by the per-workspace NetworkPolicy generator
	// (network_policy.go) to resolve declared FQDNs to /32 ipBlocks at
	// reconcile time. Tests inject a stub; production uses
	// defaultHostResolver (net.DefaultResolver) when nil.
	HostResolver HostResolver

	// InferenceRelayURL is the Cloudflare Worker URL for free-tier inference
	// (Epic 26). When set, workspace pods route opencode provider requests
	// through this URL for IP distribution. When empty, opencode uses its
	// default gateway (opencode.ai/zen/v1) directly.
	InferenceRelayURL string

	// InferenceRelaySecret is the path-segment secret that authenticates
	// requests to the CF Worker. When set, it is appended to InferenceRelayURL
	// as the first path segment: https://relay.example.com/<secret>.
	// The Worker strips and validates this segment before forwarding upstream.
	// Set via --inference-relay-secret controller flag, sourced from a k8s Secret.
	InferenceRelaySecret string

	// OrgStatusClient, when non-nil AND the workspace belongs to an org
	// (Spec.Owner.OrgID != ""), is consulted on every Active reconcile to drive
	// D20 org-level suspension: if the org is suspended, the workspace
	// transitions Active → Suspending (pod killed, PVC retained). The client is
	// nil when --api-service-url is unset, disabling the feature. Lookups are
	// cached (30s TTL); a lookup failure fails open (workspace keeps running).
	OrgStatusClient OrgStatusClient

	// DefaultRuntimeClass is the container runtime class applied to all
	// workspace pods (Epic 51 S51.1). Typically "gvisor" for production
	// multi-tenant deployments to provide kernel-level isolation against
	// container escape. Empty means use the default (runc). Set via
	// --default-runtime-class controller flag, sourced from Helm
	// .Values.gvisor.defaultRuntimeClass (only set when .Values.gvisor.enabled
	// is true). Individual workspaces can override via spec.runtimeClass for
	// compatibility opt-out (admin-gated).
	DefaultRuntimeClass string

	// APIServiceURL is the in-cluster URL of the API service, used by the
	// workspace init container's bootstrap subcommand (Epic 35 US-35.4) to
	// fetch decrypted credentials via POST /internal/v1/pod-bootstrap. Same
	// value as --api-service-url (also used for OrgStatusClient). When empty,
	// the bootstrap subcommand degrades gracefully (empty secrets, pod boots
	// without credentials; live /v1/reload-secrets push handles delivery).
	APIServiceURL string
	// contains filtered or unexported fields
}