fix: reconcile vault grants across cloud updates

[alongubkin]

Existing vaults could miss newly added grants during updates. Azure and GCP update handlers now reconcile their grants before reporting success. AWS, Azure, and GCP vaults also detect permission-only changes, so setup schedules reconciliation even when resource config and dependencies are unchanged.

Each controller records the resolved-grant revision only after success and stops scheduling updates once it converges. Setup authority checks remain in place. GCP reconciliation preserves other vaults' conditional grants and shared unconditional bindings. Retries compare binding and member sets, so a lost response can adopt a committed policy even if another writer reorders it. New and known-empty GCP profiles can skip namespace IAM work without project metadata; legacy checkpoints with unknown grant history must have metadata before setup can report cleanup success.

State compatibility: adds one optional permissionsRevision field to the three vault controllers with serde(default). Older checkpoints load without it; direct setup reconciles them once. Importers initialize it to None. No state variants are added or renamed.

Validation: cargo test -p alien-infra --all-features --lib passed in an isolated Linux sandbox: 947 passed, 0 failed, 1 existing test ignored. Regressions cover new consumers, permission-only changes, convergence, legacy checkpoints, missing saved identifiers, setup handoff, Live resources, empty GCP profiles, unrelated vault grants, and serialized retry after a lost response. Fail-then-pass validation: disabling permission-change scheduling caused all three cloud regressions to fail; restoring it passed all three. The legacy cleanup and reordered-policy retry regressions also failed against the old behavior and passed with the fixes. All Greptile review threads are resolved. Greptile scored the final commit 5/5 after findings were addressed before CI. GitHub CI passed: Rust crates, every-package/target checks, worker integration, and PR conventions. Cloud E2E selected no deployment jobs for this change.

Closes ALIEN-1305

Live AWS validation: added an opt-in controller integration test. Reading the synthetic SecureString is denied before the permission-only update, then succeeds after the real executor reconciles IAM. Reading another namespace and reading from an unrelated role remain denied. All fixture roles and parameters are deleted and their absence verified. Disabling permission-change detection makes the same cloud test fail; restoring the candidate passes again. This validates AWS vault reconciliation, not full workload startup. Live Azure and GCP validation remains pending.

[alongubkin]

@greptile review

Please review the update paths, setup authority checks, saved-state retry behavior, and GCP preservation of other vaults' conditional grants. CI is deferred until review findings are addressed; regression tests are being validated in an isolated Linux sandbox.

[alongubkin]

@greptileai please review

Please review the current head, 48d3572. The original handlers now fail nine sandbox regressions; validation of the fixed handlers is running. This push corrects only the new GCP test fixture's optional condition title. CI remains deferred until review findings are addressed.

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Vault permission reconciliation across cloud platforms.

The PR appears safe to merge; the previous write-access finding is addressed, and no new actionable issues were found.

What we checked:

• Another vault keeps write access: The server checks grants across every desired vault before removing the shared role. It removes only the management member when none still needs it.
• Role lookup has required inputs: The caller supplies the required names before generating plans for registered vault grants. The lookup generates plans without making cloud writes.

Summary

The PR makes vault updates apply changed grants and saves permissions_revision only after success. Older checkpoints reconcile once before converging.

• AWS removes stale owned policies. Azure applies grants during updates.
• GCP preserves grants shared with other vaults and removes write access when no desired vault grant needs it.
• The latest change addresses the previous finding about retained project-wide write access. No new actionable issues were found.
• This review checked code and regression tests; it did not run cloud validation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Setup plans vault update] --> B{Grant revision changed?}
  B -->|No| C[No permission-only update]
  B -->|Yes| D[Check setup authority]
  D --> E[Apply desired grants and remove owned stale grants]
  E --> F{Cloud work succeeded?}
  F -->|No| G[Keep previous revision for retry]
  F -->|Yes| H[Save permissions_revision]
  H --> C

Loading

_{Reviews (9) · Last reviewed commit: "fix: remove dropped GCP vault write gran..." · Reviewed by Greptile}

[alongubkin]

@greptileai please review the current head.

Both findings are addressed: the fixture title now uses Some(...), and Azure/GCP vaults record the resolved-grant revision after successful reconciliation. Their needs_update hooks schedule permission-only changes, then stop after convergence. The new revision fields default to None for older checkpoints, and importers initialize them without granting runtime setup authority.

New executor regressions cover matching saved dependencies and checkpoints without the revision field. All 15 preceding vault regressions passed in the Linux sandbox; the expanded suite is running now. CI remains deferred until review findings are resolved.

[alongubkin]

@greptileai please review the current head, 1d1eca4.

The empty-profile finding is fixed and has a create/update regression. Permission-only scheduling now covers AWS as well as Azure and GCP. GCP preserves other vault namespaces and shared unconditional roles, and retries can adopt an already-committed policy without writing again.

The new grant revision defaults to None on older checkpoints and is recorded only after successful reconciliation. The preceding expanded vault suite passed all 19 tests. The final full infrastructure unit suite is running in the Linux sandbox. CI remains deferred until review findings are resolved.

[alongubkin]

@greptileai please review the latest commit. All 947 infrastructure unit tests pass in an isolated Linux sandbox (one existing test ignored). All review findings have been addressed and resolved, including permission-only scheduling and empty GCP grant profiles. Please update the confidence score for the latest head.

[alongubkin]

@greptileai please review the latest head. The delayed findings on legacy empty-profile cleanup and order-sensitive retries are now fixed. The strengthened regression tests fail against the old behavior (6 passed, 2 failed) and the final full-suite rerun is underway. Existing unknown grant history requires project metadata; new or known-empty profiles remain supported. Binding and member order no longer cause redundant IAM writes.

[alongubkin]

@greptileai please review the latest head. This is an empty commit to trigger GitHub CI after addressing review findings first. Its code tree is identical to ecd16e6, which received 5/5. Sandbox validation passed all 947 infrastructure unit tests, with one existing ignored test; all review threads are resolved.

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review