apiVersion: v2
name: sandbox
description: |
  Wave 1 deployment chart for sandbox-controller — the Catalyst-built
  reconciler for `sandbox.openova.io/v1.Sandbox` CRs.

  Per products/sandbox/docs/architecture.md §7 the sandbox-controller
  is the sister of organization-controller (one-CR-per-Sandbox-user,
  per-Org-vcluster materialization). Wave 1 installs the Deployment +
  ClusterRole + ClusterRoleBinding + ServiceAccount; Wave 2 adds the
  pty-server + openova-sandbox-mcp Deployments inside each Sandbox
  namespace.

  The `Sandbox` CRD itself ships separately under
  products/catalyst/chart/crds/sandbox.yaml (PR #1615).

  This chart is opt-in via `.Values.enabled` (default false) so an
  operator can keep Sandbox off-by-default on a Sovereign until the
  Wave 2 pty-server + token issuance flow is also rolled in.
type: application
annotations:
  # Catalyst-authored umbrella; no upstream OCI dep (controller built in-house).
  # Required so blueprint-release.yaml's umbrella-shape gate accepts this chart
  # (see issue #181 + docs/BLUEPRINT-AUTHORING.md §11.1).
  catalyst.openova.io/no-upstream: "true"
  catalyst.openova.io/smoke-render-mode: "default-off"
# 0.3.1 (TBD-V14, issue #2015, 2026-05-20): default
# `env.newapiBaseURL` was `http://newapi.newapi.svc.cluster.local:3000`,
# but the canonical bp-newapi ClusterIP Service is named via
# `bp-newapi.fullname` (release `newapi` + chart `bp-newapi`
# => `newapi-bp-newapi`) per platform/newapi/chart/templates/_helpers.tpl.
# The bootstrap-kit overlay does NOT override `env.newapiBaseURL`, so
# every Sovereign sandbox-controller resolved a DNS name no Service
# publishes — `POST /admin/tokens/sandbox` returned `no such host`
# and the canonical Pillar-4 customer journey (qwen-code Sandbox
# session → TokenMint) stalled. Verified via
# `helm template newapi platform/newapi/chart/ -s templates/service.yaml`
# → metadata.name: newapi-bp-newapi. Walker on t38 (chart 1.4.216,
# substrate be4f78bc872e2c56) caught the live regression.
version: 0.3.1
appVersion: "0.3.1"
keywords:
  - catalyst
  - sandbox
  - controller
  - reconciler
  - openova
maintainers:
  - name: OpenOva Catalyst
    email: catalyst@openova.io
