[ThomasK33]

Summary

Two CoderMCPServer fixes that #408 made for CoderAIProvider.

1. kubectl get codermcpservers now prints the new status.enabled field in the ENABLED column, not spec.enabled. The field holds the enabled flag that Coder reported at the controller's last read or update. A refused object that Coder does not have, or one whose config was deleted in Coder, shows an empty cell instead of true.
2. status.observedGeneration now moves only together with the conditions of that generation. Before, the status write that stores the config ID after a create or record (before the sync PATCH) advanced it while the conditions still described the previous generation.

Background

The goal is for every open coder-k8s issue to be fixed on main. #415 holds the two CoderMCPServer gaps that #408 (for #321) left out of scope.

The trigger for item 2: a create whose answer is lost (ConfirmingCreate at generation 1), then a spec edit (generation 2), then a reconcile whose sync PATCH hangs until the context expires. The record write stored observedGeneration=2 next to conditions from generation 1. The current conditions in that trace are Reconciling=True, so health shows Progressing. A record after a recreate can carry an old Ready=True, which the current health rules read as Healthy.

Implementation

• Item 1. I added status.enabled (*bool), with the same doc text as CoderAIProvider. The controller sets it after each Coder answer that passes the ID, organization and slug checks: the sync GET and PATCH, the record, the create, the opt-in and consent disables, and the missing-group disable. Coder's own 404 clears it in the sync (DeletedExternally, and recreate together with configID) and in the disable read. The printer column reads .status.enabled. I regenerated the deepcopy, CRD, dist/install.yaml and docs/reference/api/codermcpserver.md.
• Item 2.
  • applyMCPServerStep now sets status.observedGeneration, the same way 🤖 fix: finish the CoderAIProvider activation follow-ups #408 changed applyAIProviderStep. writeStatus no longer sets it.
  • The only status write that applies no step is the config ID write in check(). It now leaves both fields at the old generation.
  • The two other intermediate writes are the create marker and the disable marker. Each applies a step first, so they still advance both fields together.
  • Nothing reads Status.ObservedGeneration.
• Defense in the GitOps rules. config/gitops/*codermcpserver* now ignores conditions whose observedGeneration is not metadata.generation. The new filter is the same as the CoderAIProvider rules. This covers statuses that an older controller wrote. docs/how-to/manage-mcp-servers.md copies both rules and describes the column.
• Test helper. enabledColumn (coderaiprovider_column_test.go) now takes the resource name and a client.Object, so both kinds use it.

codermcpserver_delete.go is unchanged. While an object is being deleted, status.enabled keeps its last value.

Validation

Commit bcf9881 holds only the tests. On it, the tests fail:

--- FAIL: TestCoderMCPServerEnabledColumn/refused_before_a_create
    codermcpserver_column_test.go:27: Expected nil, but got: true
--- FAIL: TestCoderMCPServerEnabledColumn/opt-in_withdrawn,_then_deleted_in_Coder
    codermcpserver_column_test.go:40: expected: false, actual: true
--- FAIL: TestCoderMCPServerInterruptedUpdateKeepsObservedGeneration
    codermcpserver_column_test.go:82: expected: 1, actual: 2  (the config ID write does not observe the edit)
--- FAIL: TestArgoCDHealth/CoderMCPServer/stale_conditions
--- FAIL: TestFluxHealth/CoderMCPServer/stale_conditions

Commit 8dd26af makes them pass. The hang test then checks that the next reconcile applies the edit (Applied, and Coder holds the new display name).

• make verify-vendor, make build, make lint, make test, make test-integration: pass.
• make codegen manifests docs-reference build-installer: no diff after the commits.
• nix develop -c make docs-check (mkdocs strict), markdownlint-cli2 and cspell on the changed docs: pass.
• An independent read-only reviewer found no blockers. It also confirmed that every accepted Coder answer sets the field, and that writeStatus is the only CoderMCPServer status writer.

Risks

• status.enabled holds the value from the controller's last read. It can be stale while Coder is unreachable. Existing objects show an empty cell until their next reconcile reads Coder.
• A Coder flip of enabled now causes one status write on the next resync. This is the intended column update.

Fixes #415
Refs #155

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T17:30:21.121811Z	fd1c3b4	PR opened
🔒 Security Review	✅ Completed 2026-10-30T17:33:19.697721Z	fd1c3b4	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: fd1c3b4d21

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.