feat(control-plane): provisionTenant/deprovisionTenant orchestration behind an injectable driver (fake driver only)

[jaytbarimbao-collab]

Summary

Builds the immediately-buildable piece #7180's research comment identified: provisionTenant()/deprovisionTenant() as real orchestration logic behind an injectable driver interface, fully tested against a fake in-memory driver — without waiting on the still-open per-tenant-Postgres-provider decision.

Greenfield: a new standalone control-plane/ repo-root package (@loopover/control-plane), bootstrapped mirroring review-enrichment/'s structure (own package.json/tsconfig/src/test, Node's built-in node --test runner).

What's here

• TenantProvisioningDriver — the three steps Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 names (create-container / provision-DB / inject-secrets) + their idempotent teardown inverses + a containerExists reachability probe. Mirrors the CodingAgentDriver injectable-driver-with-fake pattern (packages/loopover-engine/src/miner/coding-agent-driver.ts).
• provisionTenant() / deprovisionTenant() — product-agnostic orchestration (identical call shape for an ORB and an AMS tenant; product is forwarded to every step, never branched on). Provision runs the three steps in order; deprovision tears down in reverse (revoke → drop → destroy) so a secret is never left addressable after its DB/container is gone.
• createFakeTenantProvisioningDriver — in-memory driver (mirroring createFakeCodingAgentDriver), with a call-order log for white-box assertions.

Hard constraint honored

Fake driver only. No real Cloudflare Containers call, no real Postgres provisioning, no live credential — a real inject-secrets would delegate to #7174's broker (src/orb/broker.ts) and real create/provision to the eventual Postgres driver, but none of those live paths are imported (dependencies: {}). Real drivers slot in behind this seam later without touching the orchestration, exactly like driver-factory.ts's real drivers sit beside its fake today.

Tests

control-plane/test/** (node --test, 10 tests): the acceptance-shape success lifecycle (create → container exists → destroy → container gone) and the required destroy-of-a-nonexistent-tenant no-op branch, plus fake-driver contract/idempotency tests. Run via npm run control-plane:test (added to root package.json mirroring the rees:* scripts).

Notes for reviewers

• Codecov: like review-enrichment/, control-plane/ is a standalone package with its own node --test runner, so it's intentionally not added to the root codecov.yml/vitest.config.ts coverage.include — no root Codecov patch gate applies to it (matching the repo's apps/**/rees convention).
• CI: this PR adds the package + root control-plane:install/control-plane:test scripts but intentionally does not touch .github/workflows/ci.yml. Wiring a path-filtered CI job (mirroring the rees job) is a mechanical follow-up I kept out of this change to avoid a large edit to the shared workflow file — happy to add it here if preferred.

Closes #7524

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-20 21:37:07 UTC}

9 files · 1 AI reviewer · no blockers · readiness 86/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This adds a new standalone control-plane package with a product-agnostic provisionTenant/deprovisionTenant orchestration over an injectable TenantProvisioningDriver, backed only by a fake in-memory driver (no real Cloudflare/Postgres/secret-broker IO is imported, matching the stated constraint). The orchestration order is correct (create-container → provision-DB → inject-secrets forward, reverse on teardown) and the fake's idempotent destroy/drop/revoke no-op branches are genuinely exercised by tests rather than fabricated. The most notable detail is the top-level `control-plane:test` script isn't wired into the root `test:ci` chain, so this new package's tests won't run in the umbrella CI gate the rest of the repo relies on.

Nits — 5 non-blocking

• control-plane:test (package.json) is never invoked from the root test:ci script, so this package's 10 tests are not part of the umbrella CI verification chain — worth confirming that's intentional for this scaffolding-only PR.
• provisioning.ts's Extract<TenantLifecycleState, "active"|"torn down"> types are a nice touch but the wider TenantLifecycleState union (provisioning/suspended) is otherwise unused in this PR — fine for now but flag if it drifts.
• The fake driver's containers/databases/injectedSecrets getters return live Set references cast as ReadonlySet, so a caller could still mutate them via a type-unsafe cast; not exploitable in tests but worth a defensive .freeze or copy if this fake is reused outside tests.
• control-plane/package-lock.json commits resolved integrity hashes for a brand-new package — fine, but worth confirming npm ci --prefix control-plane in the new script actually matches lockfileVersion 3 conventions used elsewhere in the repo.
• Wire control-plane:test into the root test:ci script (or explicitly note in the PR description why it's deliberately excluded pending Design: shared hosting control-plane for ORB + AMS SaaS (provisioning, secrets, billing, health) #7173 follow-up).

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7524
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 170 registered-repo PR(s), 82 merged, 16 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jaytbarimbao-collab; Gittensor profile; 170 PR(s), 16 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR bootstraps a control-plane/ package mirroring review-enrichment's structure, defines a TenantProvisioningDriver interface with the three named steps plus idempotent teardown inverses, implements product-agnostic provisionTenant/deprovisionTenant orchestration, and provides a fake in-memory driver exercised by tests covering the create→exists→destroy→gone lifecycle and the destroy-of-nonexis

Review context

• Author: jaytbarimbao-collab
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 170 PR(s), 16 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Add a concise scope and risk note.
• Then work through the remaining 1 step in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.47%. Comparing base (37e7f86) to head (7c06d1f).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7543   +/-   ##
=======================================
  Coverage   88.47%   88.47%           
=======================================
  Files         720      720           
  Lines       75733    75733           
  Branches    22547    22547           
=======================================
  Hits        67008    67008           
  Misses       7679     7679           
  Partials     1046     1046           

Flag	Coverage Δ
shard-1	33.05% <ø> (+0.01%)	⬆️
shard-2	36.85% <ø> (+<0.01%)	⬆️
shard-3	25.66% <ø> (ø)
shard-4	38.88% <ø> (ø)
shard-5	34.21% <ø> (ø)
shard-6	36.22% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.