workspace

type AgentdDeliveryConfig struct {
	Image             string
	BinarySHA256AMD64 string
	BinarySHA256ARM64 string
}

type BinaryPins struct {
	SHA256AMD64 string
	SHA256ARM64 string
}

type CachedOrgStatusClient struct {
	// contains filtered or unexported fields
}

type FailureClass string

type HostResolver interface {
	LookupHost(ctx context.Context, host string) ([]string, error)
}

type OpencodeDeliveryConfig struct {
	Image             string
	BinarySHA256AMD64 string
	BinarySHA256ARM64 string
}

type OrgStatusClient interface {
	GetOrgStatus(ctx context.Context, orgID string) (status string, ok bool)
}

type OrgStatusLogger interface {
	Info(msg string, keysAndValues ...any)
	Error(err error, msg string, keysAndValues ...any)
}

type PodObservation struct {
	Exists             bool
	Phase              corev1.PodPhase
	Reason             string
	Message            string
	ContainerReason    string
	ContainerExitCode  int32
	ContainerOOMKilled bool
	CrashLoop          bool
	Unschedulable      bool
	Scheduled          bool
}

type RecoveryPolicy struct {
	MaxAttempts    int
	BackoffBase    time.Duration
	BackoffMax     time.Duration
	BackoffFactor  int
	StabilityReset time.Duration
	SafeModeAfter  int32
}

type WorkspaceReconciler struct {
	client.Client
	Scheme *runtime.Scheme
	// HostResolver is used by the per-workspace NetworkPolicy generator
	// (network_policy.go) to resolve declared FQDNs to /32 ipBlocks at
	// reconcile time. Tests inject a stub; production uses
	// defaultHostResolver (net.DefaultResolver) when nil.
	HostResolver HostResolver

	// InferenceRelayURL is the self-hosted relay URL for free-tier inference
	// (Epic 42 InferenceRelay fleet). When set, workspace pods route opencode
	// free-tier provider requests through this URL for IP distribution. When
	// empty (the chart default), opencode uses its default gateway
	// (opencode.ai/zen/v1) directly with the built-in `public` key.
	InferenceRelayURL string

	// OrgStatusClient, when non-nil AND the workspace belongs to an org
	// (Spec.Owner.OrgID != ""), is consulted on every Active reconcile to drive
	// D20 org-level suspension: if the org is suspended, the workspace
	// transitions Active → Suspending (pod killed, PVC retained). The client is
	// nil when --api-service-url is unset, disabling the feature. Lookups are
	// cached (30s TTL); a lookup failure fails open (workspace keeps running).
	OrgStatusClient OrgStatusClient

	// DefaultRuntimeClass is the container runtime class applied to all
	// workspace pods (Epic 51 S51.1). Typically "gvisor" for production
	// multi-tenant deployments to provide kernel-level isolation against
	// container escape. Empty means use the default (runc). Set via
	// --default-runtime-class controller flag, sourced from Helm
	// .Values.gvisor.defaultRuntimeClass (only set when .Values.gvisor.enabled
	// is true). Individual workspaces can override via spec.runtimeClass for
	// compatibility opt-out (admin-gated).
	DefaultRuntimeClass string

	// APIServiceURL is the in-cluster URL of the API service, used by the
	// workspace init container's bootstrap subcommand (Epic 35 US-35.4) to
	// fetch decrypted credentials via POST /internal/v1/pod-bootstrap. Same
	// value as --api-service-url (also used for OrgStatusClient). When empty,
	// the bootstrap subcommand degrades gracefully (empty secrets, pod boots
	// without credentials; live /reload-secrets push handles delivery).
	APIServiceURL string

	// PreviewOriginBaseDomain (Epic 66 Phase 1): when non-empty, workspace
	// pods receive PREVIEW_ORIGIN_BASE_DOMAIN so agentd's dev_preview_url
	// MCP tool emits the per-workspace-origin bootstrap URL instead of the
	// path-based URL. Sourced from the same previewOrigin.baseDomain chart
	// value the API consumes — one flag enables the deployment-wide mode.
	// Empty = path-based dev preview (unchanged behavior).
	PreviewOriginBaseDomain string

	// #863 agentd overlay delivery. When AgentdImage is set, buildPod pins a
	// digest-addressed image volume into every workspace pod and the
	// entrypoint verifies the binary's sha256 against the per-arch pins
	// before exec. All three fields must be set together (validated at
	// startup by validateAgentdDeliveryConfig). Empty AgentdImage = legacy
	// mode (binary baked into runtimes/base; no volume, mount, or env).
	AgentdImage             string
	AgentdBinarySHA256AMD64 string
	AgentdBinarySHA256ARM64 string

	// Design 0053 §4.2 opencode overlay delivery. When OpencodeImage is
	// set, buildPod pins a digest-addressed image volume into every
	// workspace pod (RO mount at /opencode on the workspace container
	// only) and the supervisor verifies the binary's sha256 against the
	// per-arch pins before spawn. All three fields must be set together
	// (validated at startup by validateOpencodeDeliveryConfig). Empty
	// OpencodeImage = baked-in mode (opencode stays in runtimes/base; S1
	// default — the feature is opt-in and inert until the base strip).
	OpencodeImage             string
	OpencodeBinarySHA256AMD64 string
	OpencodeBinarySHA256ARM64 string

	// AgentdSidecarEnabled (design 0051 US-2, chart-gated, default
	// false): when true, buildPod appends the native agentd sidecar and
	// switches the main container to supervise-opencode mode. Requires
	// AgentdImage (validated at startup) — the sidecar runs the same
	// digest-pinned delivery artifact.
	AgentdSidecarEnabled bool

	// Recorder emits Kubernetes events on the Workspace (agentd verify
	// failures). Injected from mgr.GetEventRecorderFor() in production;
	// a FakeRecorder in tests.
	Recorder record.EventRecorder
	// contains filtered or unexported fields
}