[bborbe]

What

Remove the clusterAssigner CronJob from the chart:

• delete helm/templates/cluster-assigner-cronjob.yaml, cluster-assigner-kafkauser.yaml, cluster-assigner-sun-secret.yaml
• delete the clusterAssigner values block from helm/values.yaml and its section from helm/README.md
• delete the EXCLUDE_ASSIGNEES render case from hack/test-helm-render.sh
• chart 0.17.0 → 0.18.0 (0.17.0 was taken by another change while this PR sat in draft)

Claims replace the push model (goal SC5 of [[Agent Tasks Are Scheduled Across Clusters by Claim]]): an executor takes work by claim instead of having cluster: stamped on the task before it starts. cluster: survives only as a hand-set pin.

Gate cleared (2026-10-22, operator decision)

CLAIM_MODE=on is live and verified on nuke dev, nuke prod and sun, all on executor v0.30.1; the operator dropped the 24 h soak. Rebased onto master by merging origin/master (no force-push); the only conflict was CHANGELOG.md, resolved by keeping both entries.

Ordering

This PR does not gate bborbe/nuke#626. nuke still pins chart 0.17.0, which renders the CronJob; deleting nuke's values block removes it without any chart change. This PR removes the templates from the chart and needs a release (0.18.0) before it affects any consumer — after that, a consumer that wants the dead surface gone bumps its pin, which is optional cleanup.

1. merge bborbe/nuke#626 → operator runs the prod agent apply → the CronJob is pruned
2. merge this → release 0.18.0 (chart-level cleanup; nothing changes on any cluster until a consumer bumps)

Why

The operator dropped the assigner on 2026-10-22 and nuke#586 — which would have flipped it live with sun routing — is closed unmerged. The assigner has always run with DRY_RUN=true and never published (live job log: run started dry_run=true sun_routing=false), so this removal is behaviourally inert; it deletes dead chart surface and the template that was SUN_ROUTING's only carrier.

Consumer impact

Helm ignores unknown values, so a values file that still sets clusterAssigner renders unchanged — it just no longer deploys the CronJob. nuke drops its blocks in bborbe/nuke#626. Verified locally: this chart rendered with nuke's old values-prod.yaml (which still sets clusterAssigner.enabled: true) produces 66 objects, 0 cluster-assigner hits and 0 SUN_ROUTING hits.

Validation

• helm lint helm — 1 chart linted, 0 failed
• ./hack/test-helm-render.sh — all cases pass after the merge (rerunOnLostClaim false/true/unset, the three PVC cases)
• grep -rn 'clusterAssigner\|cluster-assigner' helm/ → 0

No Go code changed, so make precommit (go mod tidy / generate / test / addlicense) was not run — the chart render test is the gate that covers this diff.

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "Selector-mode review of the clusterAssigner removal: the mechanical funnel is clean and the deletion is complete across templates, values, README section and the EXCLUDE_ASSIGNEES render cases, with the chart bump (0.17.0→0.18.0) consistent. No blocking defects — only non-blocking documentation-accuracy findings (a stale README component description, a stale Chart.yaml source entry, and two CHANGELOG wording/accuracy points); separately, the PR commit subjects exceed the repo's 50-char guideline (61 and 60 chars), which has no file coordinates and is noted here rather than as a pinned comment.",
  "comments": [
    {
      "file": "helm/README.md",
      "line": 8,
      "severity": "minor",
      "blocking": false,
      "blocking_reason": "",
      "message": "The chart intro still advertises the component this PR removes: \"...and an optional **cluster-assigner** CronJob that routes unstarted tasks to a cluster.\" The clusterAssigner section was deleted below, but this component list was not updated, so the README points readers at a CronJob the chart no longer ships. Drop the clause (or reword to reflect the claim-based scheduling that replaces it)."
    },
    {
      "file": "helm/Chart.yaml",
      "line": 15,
      "severity": "nit",
      "blocking": false,
      "blocking_reason": "",
      "message": "`sources` still lists `https://github.com/bborbe/agent-cluster-assigner` even though the chart no longer deploys that component. The other entries are all components the chart ships; remove this one so the chart metadata matches its contents."
    },
    {
      "file": "CHANGELOG.md",
      "line": 13,
      "severity": "minor",
      "blocking": false,
      "blocking_reason": "",
      "message": "The \"behaviourally inert\" safety argument says the assigner \"has always run with `DRY_RUN=true` and never published\", but the values block this PR deletes defaulted `dryRun: false` (publish), with the comment \"Log the commands instead of publishing them\" describing the true branch. The claim is only accurate if nuke prod's values explicitly set `dryRun: true`; confirm that, otherwise the justification for retiring the bridge before `CLAIM_MODE=on` is inaccurate."
    },
    {
      "file": "CHANGELOG.md",
      "line": 13,
      "severity": "nit",
      "blocking": false,
      "blocking_reason": "",
      "message": "\"**Consumers must drop their `clusterAssigner` values in the same change**\" overstates the requirement: the same sentence explains Helm ignores unknown values, so a values file that still sets the key renders unchanged and nothing breaks. Reword to \"should\" (or describe it as optional cleanup) to match the actual no-op behaviour and the PR's optional consumer bump."
    }
  ],
  "concerns_addressed": [
    {
      "concern": "correctness: CHANGELOG release-gate warning may be stale against the PR's release plan",
      "disposition": "not-an-issue",
      "detail": "Examined: CLAIM_MODE still defaults to `off` (helm/templates/executor-deployment.yaml:116) and the chart that first renders it shipped in v0.119.0 on 2026-10-22. Nothing in-repo shows the gate cleared on nuke dev/prod/sun, so the \"not for release before CLAIM_MODE=on\" warning is current, not stale; the nuke deployment values are outside this repo."
    },
    {
      "concern": "correctness: CHANGELOG says consumers 'must' drop clusterAssigner values, then says Helm ignores unknown values / cleanup is optional",
      "disposition": "addressed",
      "detail": "Reported as a nit on CHANGELOG.md:13 — the imperative contradicts the no-op render explained in the same sentence."
    },
    {
      "concern": "correctness: chart bump 0.17.0→0.18.0 and no other file pins the chart version; values.yaml stays valid without orphaned comments",
      "disposition": "not-an-issue",
      "detail": "Grep shows 0.17.0 only in Chart.yaml and CHANGELOG history; no README/Makefile/CI/example pins the chart version. values.yaml top-level keys are unchanged in shape and the removed block leaves no orphaned comments (recurringTaskCreator → a2aWorkerController)."
    },
    {
      "concern": "correctness: zero remaining references to clusterAssigner, cluster-assigner, SUN_ROUTING, EXCLUDE_ASSIGNEES or the deleted show-only template path",
      "disposition": "addressed",
      "detail": "Two stale references remain and are reported: helm/README.md:8 (component list) and helm/Chart.yaml:15 (sources). No template, _helpers.tpl, NOTES.txt, docs, Makefile or .github reference remains; hack/test-helm-render.sh no longer names the removed show-only path."
    },
    {
      "concern": "tests: ~77 lines of EXCLUDE_ASSIGNEES coverage removed; script still parses under set -euo pipefail with no orphaned helpers",
      "disposition": "not-an-issue",
      "detail": "Read hack/test-helm-render.sh end to end: write_values/run_case/run_pvc_case are all still defined and called, `fail`/`tmpdir` still used, the removed write_ca_values/run_ca_case helpers have no callers left, and the remaining cases target the unchanged templates/agents.yaml."
    },
    {
      "concern": "docs: stale cross-references in helm/README after the clusterAssigner section removal",
      "disposition": "addressed",
      "detail": "Reported helm/README.md:8 (the intro still names the CronJob). Section structure after the deletion is clean: recurringTaskCreator table → `---` → `## Generic cluster`; no TOC or other clusterAssigner/SUN_ROUTING mention remains in the README."
    },
    {
      "concern": "security: deleted sun token / CA credential-rendering path; no other template references the secret and no credentials in the diff",
      "disposition": "not-an-issue",
      "detail": "The deleted cluster-assigner-sun-secret.yaml rendered `sun-token`/`sun-ca-data` from caller-supplied values via `required` + `b64enc` with no literal credentials; the diff contains only deletions of empty-default values. Grep over helm/ finds no remaining reference to `cluster-assigner-sun` or `clusterAssigner.sun` values."
    }
  ]
}