Intentional behaviors and review decisions

These decisions were confirmed by the maintainer on 2026-10-16 following the project-wide correctness and security review. The finding numbers below refer to that review. Each listed behavior is intentional, not a bug.

Missing rationale text does not make a decision pending. The maintainer will add explanations for human reviewers later. These decisions apply only to the behaviors described here; unrelated defects remain in scope for review.

Finding 2: Unauthenticated admin API

The admin API intentionally provides its existing read and mutation endpoints without application-level authentication or authorization. Do not report the absence of those checks as a new bug or add them as an unsolicited fix.

Maintainer rationale: TODO

Finding 7: Source OCI TLS verification

Superseded by the maintainer request on 2026-10-26: OCI registry and token requests verify TLS by default, including redirected requests. Exceptions are the enabled built-in registry and exact hostnames explicitly listed in kube-system/orbit-deploy-registries under insecure. proxies in that ConfigMap rewrites image registry/path prefixes before image resolution.

Finding 8: Optional SSH host verification

SSH Git sources intentionally accept the remote host when sshKnownHosts is absent or empty. Do not make that field mandatory or change its default behavior as an unsolicited security fix. Defects in configured verification remain in scope.

Maintainer rationale: TODO

Finding 10: Cleanup attempt is the lifecycle cutoff

Deleted-deployment cleanup is best effort. The cleanup attempt is the cutoff; there is intentionally no durable cleanup retry queue or finalizer ensuring eventual removal. A failed attempt can leave resources behind. Do not report the lack of persistent retries as a new bug or add an indefinite retry scheme.

This does not authorize unsafe deletion: tenant boundaries, current ownership, and no-delete protections still apply. Uncertain scope or annotation reads must not permit a destructive operation.

Maintainer rationale: TODO