stacklok / toolhive / 24687077953

push

github

Add policy_stopped workload status and enforce policy gate on restart (#4857)

* Add policy_stopped workload status and enforce policy gate on restart

Introduces WorkloadStatusPolicyStopped as a first-class workload status
to support enterprise policy enforcement. When non-registry servers are
blocked by policy, workloads can be set to this status so the UI and CLI
can surface the reason clearly, rather than showing an opaque "error".

- Add WorkloadStatusPolicyStopped constant to pkg/container/runtime/types.go
- Update enums tag in pkg/core/workload.go to include policy_stopped
- Map policy_stopped to BackendUnhealthy in mapWorkloadStatusToVMCPHealth
- Call EagerCheckCreateServer in restartSingleWorkload so the policy gate
  blocks restart of workloads that violate the active policy
- Add 🚫 indicator for policy_stopped in CLI list and status output,
  following the existing ⚠️ pattern for unauthenticated workloads
- Regenerate swagger docs to include the new status enum value

Part of stacklok/stacklok-enterprise-platform#406

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Remove enterprise reference from WorkloadStatusPolicyStopped comment

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix exhaustive lint errors in status switch statements

Add all WorkloadStatus cases to the switches in list and status
commands to satisfy the exhaustive linter.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Address PR review comments: fix policy gate bypass and missing enum

- Add policy_stopped to workloadStatusResponse enums tag so the swagger
  spec for the status endpoint includes the new value
- Add EagerCheckCreateServer check in maybeSetupContainerWorkload after
  loadRunnerFromState to cover the path where the outer LoadState call
  fails on a partial name but succeeds after label-based name resolution
- Regenerate swagger docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Set policy_stopped statu... (continued)

8 of 24 new or added lines in 4 files covered. (33.33%)

58204 of 87699 relevant lines covered (66.37%)

61.9 hits per line