🤖 fix: trust only Coder's own 404 in the CoderTemplateTest and pool member workspace lookups, and refresh the AI provider how-to

[ThomasK33]

Two follow-ups after v0.1.4.

1. The CoderTemplateTest and pool member workspace lookups trust only Coder's own 404. A 404 without Coder's message, such as a proxy's HTML page or Route not found. for a wrong base URL, now makes the controller wait as CoderUnavailable. It keeps the create marker. Before, such a 404 counted as "no workspace":
   • After the settle window, the confirm read failed the test or member as CreateOutcomeUnknown. The test released its finalizer, and the member cleared its marker. A ktt- workspace could then stay in Coder with nothing to clean it up.
   • Before the create, the name lookup took the 404 as "the name is free" and sent the create request.
2. The AI provider how-to is current again. The prerequisite now reads "coder-k8s v0.1.4 or later" and still says to pin the image to the release version. The CoderRejected row now says "the create or update request", because the sync PATCH also returns it (🤖 fix: keep the create answer in CoderTemplateTest waits and retry 408/499 on the CoderAIProvider sync #347).

Fixes #351

Change

• internal/controller/codertemplatetest_confirm.go (confirm read), internal/controller/codertemplatetest_controller.go (name lookup before the create) and internal/controller/coderworkspacepoolmember_ready.go (confirmPoolMemberCreate): isCoderResourceNotFound from 🤖 fix: check a CoderAIProvider's provider ID before Coder calls, and trust only Coder's own delete 404 #325 replaces isCoderNotFound. Each is a one-line change.
• internal/controller/fakecoder_test.go: the fake's workspace-by-name 404 now has Coder's own message, "Resource not found or you do not have access to this resource". Without it, every test that reads a missing workspace would wait.
• docs/how-to/manage-ai-providers.md: the two text fixes above.

The pool member controller is not registered yet. It must have this fix before PR 12 of #153 registers it.

Why the message check is safe for Coder's own 404

In Coder v2.37.3, every 404 on GET /api/v2/users/{user}/workspace/{workspacename} comes from httpapi.ResourceNotFound, which has the fixed message (coderd/httpapi/httpapi.go:149-155). This holds for the handler (workspaceByOwnerAndName in coderd/workspaces.go) and for the route's middleware (httpmw/userparam.go, httpmw/organizationparam.go). Route not found. is Coder's answer to an unknown route (httpapi.go:180).

I checked the v0.1.4 facts too: tag v0.1.4 is 33726526 and has the CoderAIProvider controller and CRD. Its dist/install.yaml still uses ghcr.io/coder/coder-k8s:latest, so the pin advice stays. On GHCR, :latest and :0.1.4 have the same digest (sha256:80057d31…).

Tests

All three envtests run two cases from nonCoderNotFounds: an HTML 404 page and a JSON 404 Route not found..

• TestTemplateTestConfirmTrustsOnlyCodersNotFound: after an uncertain create (502) and the full 15-minute settle window, a non-Coder 404 gives Running / CoderUnavailable. Then Coder's own 404 gives CreateOutcomeUnknown. There is only one create request.
• TestTemplateTestLookupTrustsOnlyCodersNotFound: a non-Coder 404 on the lookup before the create gives Pending / CoderUnavailable, with no marker and no create request. The next reconciles create the workspace.
• TestPoolMemberConfirmTrustsOnlyCodersNotFound: the same as the first test, for a pool member. The marker stays after the non-Coder 404.

Validation

• Red on main (322124dc), with the tests and the fake change on top and the controller files from main: all 6 subtests fail. The confirm tests reach Failed (CreateOutcomeUnknown) instead of waiting. The lookup test reaches Running (it sent the create) instead of Pending.
• Green with the fix: every TestTemplateTest* and TestPoolMember* test passes (98).
• Mutations, each reverted alone, each caught by its own test only:
  1. The template test confirm read back to isCoderNotFound: only TestTemplateTestConfirmTrustsOnlyCodersNotFound fails.
  2. The template test lookup back to isCoderNotFound: only TestTemplateTestLookupTrustsOnlyCodersNotFound fails.
  3. The pool member confirm read back to isCoderNotFound: only TestPoolMemberConfirmTrustsOnlyCodersNotFound fails.
  4. The fake's old 404 message: many existing template test cases fail. So the fake change is needed, and the existing tests now prove that Coder's own 404 still counts.
• make verify-vendor, make build, make lint, make docs-check, make test, make test-integration pass. markdownlint and cspell pass on the changed doc.
• The first make test run failed two timing tests in internal/aggregated/storage, which this PR does not touch: TestTemplatePromoteConfirmation/timeout_before_apply ("waited 1.05s … the PATCH budget is 50ms") and TestTemplatePromoteDeadline/slow_re-read_ends_before_the_deadline. The host load was about 50 then. Both tests and a full make test passed on the next run, on the same head.

Not in this PR

The pool member's name lookup before the create (checkCreate in coderworkspacepoolmember_controller.go) still uses isCoderNotFound. It is the pool member twin of the template test lookup above. #351 does not list it. It is dormant and only affects the step before the create.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $85.28

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T11:31:15.168688Z	91b6f1f	PR opened
🔒 Security Review	✅ Completed 2026-10-14T11:34:16.177098Z	91b6f1f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 91b6f1f35a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.