[Epic] Marketplace: fix tap defects in 1.7.x patches #4981

Summary

The marketplace (the Tap resource, tap materializer, cozypkg tap and dashboard Repositories page) ships in v1.7.0-alpha.2, v1.7.0-alpha.3 and v1.7.0-rc.1, enabled, and 1.7 will release it that way. This epic tracks what has to be fixed or decided there. Fixes go in parallel and are released in 1.7.x patches.

Creating a Tap needs cluster admin and the platform installs none, so defects that need a connected repository don't trigger without one. The first two below are not in marketplace code at all, both are also in v1.6.4 and need a backport to release-1.6. Nothing here was run on a cluster unless the child issue says so.

Core fixes, needed regardless of marketplace

• fix(operator): the Package reconciler rewrites a HelmRelease that another Package owns #4975
• fix(api): a malformed ApplicationDefinition keeps cozystack-api from starting #4976
• fix(marketplace): artifact names are not checked across PackageSources, and reserved names are checked only by the CLI #4977

Marketplace fixes

• fix(marketplace): connecting a repository installs its components, and Flux installs them as cluster-admin #4978
• fix(marketplace): a tapped repository follows a mutable tag, so connect should pin a digest #4979
• fix(marketplace): disconnecting a repository removes its application definitions without checking tenant instances #4980
• docs(marketplace): five statements no longer match the code website#760
• design-proposals: bring cozymarketplace and cozymarketplace-supplementary in line with what was built community#105

Deferred

No separate issue for these until someone takes them.

• e2e coverage. Nothing tests taps on a cluster today. Scenarios: connect from CLI and API, install, new revision with pinned digest, disconnect with and without instances, name clashes, broken ApplicationDefinition.
• Application kind ownership by origin. Definition created first owns a kind (appdefowner.go L8-L16), so tapped repository can keep a kind that platform adds in later release (from the rule in code, not run). Platform definitions should win, and it needs a decision what happens to existing releases when one takes a kind over.
• Package index. cozystack/packages-index repository doesn't exist. Gate in hack/packages-index calls cozypkg validate, which pinned [email protected] doesn't have, and it runs from the pull request's own checkout. Its auto-merge lane compares neither name, nor PR author, nor version order. If index entries get digest (fix(marketplace): pin a tapped repository to a digest instead of a mutable tag #5082 adds it), gate also has to verify ociRef@digest and send digest change to review lane, today it checks only ociRef:version. Decide whether to build it properly or remove the template.
• Dashboard install. After fix(marketplace): connecting a repository installs its components, and Flux installs them as cluster-admin #4978 connecting installs nothing and console has no action that creates Package, so app from connected repository can be installed only with cozypkg add. Repositories card lists packages only after install, because buildTap takes them from ApplicationDefinitions (compute.go L150-L176). Next to Tap privileged-confirmation gate races source-watcher on a benign-to-privileged flip #4359.
• Non-interactive install. cozypkg add always asks for variant, even when there is only one (add.go L600), and -f creates Package directly without dependency resolution and privileged prompt (add.go L353). Both checks live in CLI, so dashboard, kubectl and terraform would have to repeat them, maybe they belong on server side.
• Dependency added by later revision. Package reconciler marks missing dependency Package not ready and returns before creating or pruning HelmReleases (package_reconciler.go L235-L248, L696-L703). Before fix(marketplace): connecting a repository installs its components, and Flux installs them as cluster-admin #4978 materializer created that Package itself, after it nothing does, so installed app stays in DependenciesNotReady until admin runs cozypkg add <dep>, and only Package status shows that (from code, not run).
• Design proposals after fix(marketplace): connecting a repository installs its components, and Flux installs them as cluster-admin #4978. cozymarketplace README (L52, L60, L128 and guarantees table) and cozymarketplace-supplementary README (L167) describe registration on connect, decision 0001 (L19) too. Decision is frozen, so new decision record should supersede that part.
• Small fixes. Privileged badge reads one component of a variant, and tap watch is not limited to cozy-system.
• Privilege model. HelmReleases from third-party sources, and tenant instances of applications they define, run as Flux cluster-admin identity, and serviceAccountName is never set. Design question next to harden: a handed-over tap Package can escalate to privileged on a later revision without re-confirmation #4358 and Tap privileged-confirmation gate races source-watcher on a benign-to-privileged flip #4359.

Already tracked

• Tap privileged-confirmation gate races source-watcher on a benign-to-privileged flip #4359: privileged confirmation gate races source-watcher, proposes producing catalog from metadata instead of from an install.
• harden: a handed-over tap Package can escalate to privileged on a later revision without re-confirmation #4358: handed-over Package can escalate to privileged on a later revision.
• feat(marketplace): catalog storefront — index-backed package discovery in the dashboard #3976: catalog storefront and default index, it widens the surface so it waits for the items above.
• Option and Tap watches never send the initial-events-end bookmark #4465: Option and Tap watches never send the initial-events-end bookmark.

Already merged

#3940 (marketplace), #4225 (dry-run in tap storage), #4286 (Repositories moved to Admin), #4308 (register apps on connect), #4424 (one ApplicationDefinition per kind), #4741 (categories from tapped repositories in sidebars).