Two weeks after the architecture review I asked for a narrower one: just Airframe, my service catalog, read the way an agent would read it. Is the Crossplane layer built well, and could an agent discover, change and verify things through it without a human translating? Twenty findings came back. Fifteen were fixed and live within two days.
Every catalog XR on both clusters was Synced and Ready, and the compositions in git matched their templates. The problems were structural: six near-identical app compositions with no tests, credentials passing through the function pipeline, readiness decided by hand in every template, and one-shot scaffolding reconciled forever.
On the agent side, the contract half was ahead of most platforms: a strict schema, rule ids with fix hints, and closed reason sets. The runtime half was missing. Verify steps were English sentences, the planner wrote an API group that no longer existed, and a typo in an XR was silently dropped.
If an app's Secret was deleted, the function wrote a fresh secret that Dex never accepted, and still reported Ready. Now it adopts the existing one; proved by deleting a Secret and watching it come back identical within a second.
Two credentials travelled through the function pipeline into plain specs in etcd. The provider now takes a secret reference, and the copies happen server side, so no credential value enters a composed manifest.
One build script with a check in CI regenerates every composition from shared templates, and a render harness compares 77 cases against committed expectations. Two renderers agree.
"Scaffold once, reconcile never" became a ledger on the XR's status. GitHub file resources fell from 161 to 60, and every scaffolded file kept the same content, checked file by file.
WorkloadDeployed could never be True from where it was computed; it's gone. A misspelled app name now says AppNotFound instead of quietly pointing at a NodeJS app.
Readiness rules are declared once, as CEL per resource kind, and the per-template annotations are gone. One of them had been wrong the other way.
The root cause was leader-election loss on single-replica operators. Two replicas, budgets and longer leases took webhook failures from one per restart to zero in 444 applies.
Endpoints and the org id moved out of templates into the cluster registry. TLS on two internal links is skipped for now, by decision.
All four done: events only on change, one version pinned everywhere, default compositions, name-length bounds and printer columns on all twenty XRDs.
Autopilot's planner wrote a retired API group and a cicd.yaml shape Glidepath no longer accepted, so the parachute sentence could not pass. Fixed, with a test against the live fleet file.
Server-side apply at sync, and a pre-merge --xr validator with did-you-mean hints. See figure 2.
Verify steps are now structured checks that airframe-verify runs read-only, and every XRD has a machine-readable sidecar tested in CI. Status outputs on the XR wait until something needs them.
Values-file errors come back with a rule id and a hint; XR-side failures still come back as template strings.
Routing HolmesGPT's fix PRs through Clearance needs Clearance to be running, and it exists only as code today. Triage is switched off meanwhile.
An AGENTS.md for every kind, generated from the sidecars, and every chart field carries an owner and a risk class. The scorecard moved from 74 to 82.
Before this, every readiness, naming and policy bug in the git history was found on a cluster. The render harness is the change that moves them to a pull request.
The webhook outages looked like an Airframe problem. They were operators losing leadership on a busy node, and the fix was in the cluster, not the catalog.
A strict schema tells an agent what it may write. It also needs to know what happened afterwards, in a form it can check. That's the half still being built.