Run the Tenant RGD local pilot: adoption rehearsal + parity diff on the Docker cluster

[devantler]

🤖 Generated by the Daily AI Assistant

Part of #1932 — step 3b, the live exercise of the pilot scaffolding #2389 shipped. Gates Phase B of the ownership-transition design (ADR on the epic, 2026-07-05).

Problem

The Tenant RGD (#2197) has never been instantiated — no cluster has ever expanded a Tenant CR. Before the prod swap we need proof of (a) parity: the RGD's 10 expanded objects match the hand-written skeleton, and (b) adoption: kro v0.9.2 silently takes over pre-existing Flux-created objects via forced SSA (verified in source; needs live confirmation).

Proposal (one local-cluster session)

1. Bring up the Docker-provider cluster; enable the opt-in tenant-ascoachingogvaner.yaml in k8s/providers/docker/apps/kustomization.yaml.
2. Parity: diff the kro-expanded objects against the skeleton manifests (normalize managed-fields/labels).
3. Adoption rehearsal (the exact prod sequence): reset, apply the 10 skeleton objects first, then enable the Tenant CR — verify silent takeover (kro.run/applyset field manager, ApplySet labels), zero deletes/recreates.
4. Record results on Generalize the Tenant abstraction — evaluate Capsule vs KRO vs Helm library chart #1932; fix any RGD parity gaps as a draft PR.

Constraint

The platform AGENTS.md maintenance rules bar agent runs from starting clusters ("Never run a cluster"), so this needs either a maintainer-attended/sanctioned session or an explicit exception for this one-off pilot — flagging rather than self-granting. GHCR creds must be seeded in the local OpenBao (infrastructure/ghcr/auth) for the OCIRepository leg; the expansion itself validates without them.

Acceptance criteria

• Parity diff clean (or gaps fixed via draft PR); adoption rehearsal shows takeover with no object deletion; results recorded on Generalize the Tenant abstraction — evaluate Capsule vs KRO vs Helm library chart #1932.

[coderabbitai]

🔗 Related PRs

#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [closed]
#2339 - docs(agents): record merge-queue mechanics + root-cause-before-requeue [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!