feat: add KRM resource streaming library

.devcontainer/Dockerfile

@@ -99,13 +99,21 @@ ENV DEBIAN_FRONTEND=noninteractive
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 ENV DLV_VERSION=v1.27.0 \
-    GOPLS_VERSION=v0.22.0 \
-    STATICCHECK_VERSION=v0.7.0
+    GOPLS_VERSION=v0.23.0 \
+    STATICCHECK_VERSION=v0.7.0 \
+    CODEX_VERSION=0.144.3
 
 RUN apt-get update \
     && apt-get -y install --no-install-recommends bash-completion \
     && apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 
+# Codex CLI. npm's prefix here is /usr, which lives in the container's writable layer — so this
+# has to be baked into the image, not installed at post-create, or a rebuild silently loses it.
+# The login it writes lands in ~/.codex/auth.json, which devcontainer.json mounts as a volume.
+RUN npm install -g "@openai/codex@${CODEX_VERSION}" \
+    && npm cache clean --force \
+    && codex --version
+
 # hadolint ignore=SC2016
 RUN printf '%s\n' \
     '' \

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,19 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2.5.9": {
+      "version": "2.5.9",
+      "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a",
+      "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a"
+    },
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1.10.0": {
+      "version": "1.10.0",
+      "resolved": "ghcr.io/devcontainers/features/docker-outside-of-docker@sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e",
+      "integrity": "sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e"
+    },
+    "ghcr.io/devcontainers/features/git:1": {
+      "version": "1.3.8",
+      "resolved": "ghcr.io/devcontainers/features/git@sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2",
+      "integrity": "sha256:fd75977de13a9979000e0e78baf949adb0ca71d2398995fa22e0a36d7e7e7fe2"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -40,6 +40,7 @@
       "extensions": [
         "golang.go",
         "anthropic.claude-code",
+        "openai.chatgpt",
         "redhat.vscode-yaml"
       ]
     }
@@ -59,12 +60,16 @@
   //      cannot write to it at all. post-create.sh chowns /home/vscode for exactly this reason.
   //      Without it: `claude` cannot log in, `gh auth login` cannot store a token, and the symptom
   //      gives you no clue why.
+  //
+  // Codex is kinder than Claude here: it keeps BOTH its config and its login (auth.json) inside
+  // ~/.codex, so the one volume is the whole story — no symlink into persisted-home needed.
   "mounts": [
     "source=krm-stream-gomodcache,target=/go/pkg/mod,type=volume",
     "source=krm-stream-gobuildcache,target=/home/vscode/.cache/go-build,type=volume",
     "source=krm-stream-dotkube,target=/home/vscode/.kube,type=volume",
     "source=krm-stream-ghconfig,target=/home/vscode/.config/gh,type=volume",
     "source=krm-stream-claudeconfig,target=/home/vscode/.claude,type=volume",
+    "source=krm-stream-codexconfig,target=/home/vscode/.codex,type=volume",
     "source=krm-stream-persisted-home,target=/home/vscode/persisted-home,type=volume"
   ],
   "containerEnv": {

.devcontainer/post-create.sh

@@ -27,16 +27,17 @@ bash "${workspace_dir}/.devcontainer/sync-signing-key.sh" \
   || log "warning: SSH commit signing not configured (no agent / no key?) — commits will be unsigned"
 
 # ------------------------------------------------------- home ownership (READ ME) --
-# Every named volume mounted under /home/vscode (~/.claude, ~/.config/gh, ~/.kube, the Go
-# caches, persisted-home) is created by Docker as ROOT-owned, because the image has no such
+# Every named volume mounted under /home/vscode (~/.claude, ~/.codex, ~/.config/gh, ~/.kube, the
+# Go caches, persisted-home) is created by Docker as ROOT-owned, because the image has no such
 # directory to inherit ownership from. Without this chown, the `vscode` user cannot write to
-# any of them — and the symptom is baffling: `claude` cannot log in, `gh auth login` cannot
-# store a token, and kubectl cannot write a kubeconfig. Same fix as gitops-api's.
+# any of them — and the symptom is baffling: `claude` and `codex` cannot log in, `gh auth login`
+# cannot store a token, and kubectl cannot write a kubeconfig. Same fix as gitops-api's.
 log "ensuring cache dirs exist, then fixing ownership under /home/vscode"
 sudo mkdir -p \
   /home/vscode/.cache/go-build \
   /home/vscode/.cache/golangci-lint \
   /home/vscode/.claude \
+  /home/vscode/.codex \
   /home/vscode/.config/gh \
   /home/vscode/.kube \
   /home/vscode/persisted-home

.github/dependabot.yml

@@ -0,0 +1,61 @@
+# Grouped, so a week of upstream patch releases is one PR to review and one release-note line — not
+# eleven. Every ecosystem in the repo is listed: an ecosystem that is not listed here is one where
+# nobody is watching.
+#
+# Conventional commits, because release-please reads them: `chore(deps):` keeps routine bumps out of
+# the changelog, which is what a consumer of this library wants — they do not care that our linter
+# moved. The k8s.io/* floor is DELIBERATELY excluded below; see gateway/kube/go.mod for why.
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore(deps)"
+
+  # The core module has no dependencies at all — by design, and CI fails if that changes — so there
+  # is nothing here to update. Only the adapter has any.
+  - package-ecosystem: gomod
+    directory: /gateway/kube
+    schedule:
+      interval: weekly
+    groups:
+      gomod:
+        patterns: ["*"]
+    ignore:
+      # The k8s.io/* requirement is a SUPPORTED-VERSION FLOOR, not a version to keep current: Go's
+      # minimal version selection means an adopter already on a newer client-go keeps it, while
+      # chasing patch releases here would force every adopter up to whatever we last built against.
+      # An adapter has no business dictating which Kubernetes libraries its host runs. Raising it is
+      # a deliberate act (it raises the supported minor), so it is not Dependabot's to make.
+      - dependency-name: k8s.io/*
+    commit-message:
+      prefix: "chore(deps)"
+
+  # devDependencies only — this package ships ZERO runtime dependencies, and the three dev ones are
+  # the compiler, its node types, and biome.
+  - package-ecosystem: npm
+    directory: /packages/krm-stream
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Playwright lives here rather than in the library, which is exactly why it needs its own entry.
+  - package-ecosystem: npm
+    directory: /examples/vanilla-browser
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore(deps)"