hermes-bot
f76defb1e1
- Desired redirect URIs carry redirect_uri_type: authorization, which the API returns on every entry (RedirectURISerializer default in 2026.8.4); without it every pass would re-PATCH the provider. - OIDC slugs and gate names are kept apart: a slug that is a gate name is refused, an existing application without this controller's OAuth2 provider is refused, and the sweep keeps proxy and OAuth2 applications by their own sets, so an OIDCClient can neither take over nor delete a gate. - Status is written only when it changed. - Adoption of an unassigned oidc-<slug> provider is documented; removal logs say OIDC client. - reconcile() takes k8s/ak for tests; new loop tests: create then quiet, duplicate slug, transient error keeps the client, sweep after the resource is gone, slug equal to a gate name.