# terdut-operator status and deferred work

The staged build plan this file used to hold (scaffolding, TerdutServer, TerdutTeam, the child
kinds, the installer chart and first release) is done and shipped; the history is in git. The
design it implemented is in `DESIGN.md`, and its revision section at the top is the current
shape of credentials and the CRD catalog.

## Validation

There is no CI end-to-end job. The golden path (create every kind against a real terdut-server on
`kind`, check the server's own API, delete, check it is gone) is a manual pass, using
`examples/demo/run-demo.sh`. It has not been re-run since the credential and CRD redesign
(2026-10): do that before the next release.

## Deferred

- Narrower Secret RBAC: per-namespace Roles and a restricted cache (today a ClusterRole with
  Secret access cluster-wide, DESIGN.md §9).
- CloudNativePG support alongside the Zalando `postgresClusterRef`.
- Gitops-managed team membership.
- Automatic Deployment restart on upstream Postgres credential rotation.
- Admission webhooks beyond CEL validation.
- OLM packaging.
- A shared API types module (or generated client) between terdut-server, terdut-operator and
  terdut-tui, so contract drift is a compile error and not a manual mirror.