Docs · Airframe

Airframe: known gaps

Open issues found in use, each with its evidence and a proposed direction. Numbers are stable: a resolved gap is removed and its number is not reused.

#	Gap	Evidence	Direction
5	Tower’s Provisioning and Environment views list GitHub files from the XR’s `resourceRefs` plus the live `RepositoryFile` MRs. A scaffold file leaves both once it is written, so those views show only the platform-owned files (Repository, `identity.yaml`, SecretStore XR requests) and no longer the boilerplate it scaffolded.	`tower/src/provisioning/useProvisioning.ts` (`GITHUB_KINDS`, `toManaged`), `tower/src/environments/useEnvLifecycle.ts`.	Tower reads `status.scaffold.done` on the application / `ApplicationEnvironment` XR and renders those names as done scaffold steps.
6	A cluster rebuild re-composes every scaffold with the template’s default filename. The ledger lives in XR status, so a rebuilt cluster starts empty; the pinned external-name adopts the existing file for every scaffold whose name matches the template default. The six repos whose container file is `Dockerfile` (template default `Containerfile`) would get a second file created next to it (the live-state pin only protects an XR that still observes its own MR).	`src-repo.yaml` `scaffoldFile` helper in the four app stacks; the 2026-09-23 canary notes.	Record the pinned filename in the ledger (`status.scaffold.files[]` with `name`+`file`) and use it as the default on the next compose, or rename those six files to `Containerfile`.
7	README scaffolds never replace GitHub’s auto-init README. Every Repository is `autoInit: true`, so GitHub commits a `README.md` before the README `RepositoryFile` runs; with the pinned external-name the scaffold adopts that stub and its template content is never committed. This holds for src, gitops and gitops-infra repos alike; customs-api’s README is still the “Initial commit” one. Overwriting instead is not an option: an unpinned README with `overwriteOnCreate: true` rewrites a developer’s README whenever the XR is recreated.	`templates/render-*/gitops-repo.yaml`, `src-repo.yaml`; gitops-infra-skyport-auth 0e74458.	Write the template only over the auto-init stub: an Observe-only probe of README.md and an overwriting Create only while its content is exactly GitHub’s `# <repo>` + description. Or drop the README scaffolds.
8	Cloud dependencies have no consumer but an AWS Lambda target. `MessageQueue.consumers[]` and `ObjectStorage.consumers[]` grant IAM access to an `AwsLambdaTarget`’s execution role only. An ECS service has no task role for the app’s own code (`AwsEcsTarget` composes only the execution role ECS uses), a Kubernetes app has no cloud identity, and an Azure consumer authenticates with the shared key in `<name>-credentials`.	`xrds/messagequeue.yaml`, `xrds/objectstorage.yaml` headers; `compositions/awsecstarget/templates/render-target-resources/00-inputs-and-iam.yaml`.	A task role on `AwsEcsTarget` (Glidepath’s ECS deploy must carry `taskRoleArn` forward), IRSA roles for Kubernetes apps through the dev cluster’s public issuer, and managed identities plus role assignments on Azure, each as a new `consumers[]` variant.
9	ManagedPostgreSQL is reachable only over a public endpoint. A Lambda function outside a VPC has no fixed source address, so it can reach the database only through `allowedCidrs: [0.0.0.0/0]`, with the password and TLS as the only protection. The database is owned by the admin user; there is no separate application role.	`xrds/managedpostgresql.yaml` header; docs/user/cloud-dependencies.md “Managed PostgreSQL networking”.	Put the Lambda target in the database’s VPC (private subnets, `vpcConfig` on the function, a security-group reference instead of a CIDR), and a second, least-privilege role created by a bootstrap Job.
10	The Azure cloud-dependency providers are not installed. `provider-azure-servicebus`, `-storage` and `-dbforpostgresql` are commented out in the dev cluster’s providers.yaml, so an Azure `MessageQueue`, `ObjectStorage` or `ManagedPostgreSQL` fails to compose (“no matches for kind”) until they are. Its compositions are render-tested and schema-checked against the v2.8.0 CRDs, never run.	gitops- `10-crds-operators/crossplane/providers.yaml`.	Install them together with the Azure identity’s migration off stored keys, then run each kind once against a real subscription.