[ThomasK33]

Summary

A deleted CoderMCPServer now deletes the Coder MCP server config that it created, then releases its finalizer. Before this PR, the dormant reconciler kept the finalizer of any object that could own a config, and deleted nothing. The kind is not registered, so users see no change.

This is plan step M7 (plan 4.10). It also removes the object's entry from the reconciler's in-memory credential hash map on release, from the #329 final assessment.

How a delete works

1. No config ID and no create marker: nothing of this object can exist in Coder, so the finalizer goes at once (as before).
2. The control plane is gone: nothing can delete the config any more. The finalizer goes without a Coder request, and the controller logs the slug and config ID (ControlPlaneGone).
3. The control plane has no operator access yet: the finalizer stays, and the controller retries every 60 s.
4. With a config ID: one DELETE by ID, in the pinned organization. A 204 or Coder's own 404 (CoderMCPServer: trust only Coder's own 404 before clearing the config ID (gate before M9) #337) releases the finalizer. A proxy 404, Route not found., or any other error keeps it and retries every 60 s.
5. With only a create marker (the create answer was lost): the slug read decides.
   • A config with this object's nonce is deleted.
   • Someone else's config with the slug is never touched, and the finalizer goes: no create of this object committed.
   • No config: a missing config proves nothing unless the operator is a site owner, and a create sent less than 2 minutes ago can still commit. The controller waits until both hold, then releases.
6. The control plane is being deleted, for example with its namespace: one DELETE attempt bounded at 10 s, then the finalizer goes, also when that attempt fails. This is the rule of CoderAIProvider (AI providers, chat models and AI policies as controller CRDs #154 D12).
7. The scope gate never blocks a delete: a withdrawn opt-in still deletes the config.

This follows the CoderAIProvider delete path (coderaiprovider_delete.go).

Validation

New tests in internal/controller/codermcpserver_delete_test.go:

• TestCoderMCPServerDeleteDeletesTheConfig: with the opt-in in place and with it withdrawn, one DELETE, the config is gone, and the finalizer goes.
• TestCoderMCPServerDeleteAnswers: a config already gone (Coder's own 404) releases. An HTML 404, Route not found. and a 502 keep the finalizer, report CoderUnavailable with a 60 s requeue, and the retry deletes the config.
• TestCoderMCPServerDeletePendingCreate: with only a create marker, a config with the nonce is deleted, someone else's config is kept, a recent create waits with ConfirmingCreate (at most 2 minutes), and an old create releases.
• TestCoderMCPServerDeleteWhileControlPlaneDeletes: a Terminating control plane gets exactly one DELETE attempt, then the finalizer goes. This holds when the attempt succeeds, fails with 502, or hangs (released in about 12 s).
• TestCoderMCPServerDeleteForgetsSentCredentials: the released object's credential hashes leave the map.
• TestCoderMCPServerFinalizer (updated): an object with a config ID whose control plane is gone releases its finalizer with no Coder request.
• Mutation checks: each of these 6 changes makes a test fail: any 404 counts as gone, no nonce check, no settle wait, no release after a failed attempt on a Terminating control plane, hashes kept, and an unbounded attempt.
• Local gates on this head: make verify-vendor, make build, make lint, GOFLAGS=-mod=vendor go tool govulncheck ./..., make test, make test-integration, go test -race ./internal/controller/, and make docs-check pass. make codegen, make manifests, make build-installer and make docs-reference leave no diff.

Size

407 lines added and 16 removed, all hand-written: 138 in codermcpserver_delete.go, 15 changed lines in the reconciler, 8 in the test export file, and 262 in tests.

Refs #155

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $201.29

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T15:02:13.995109Z	a7c4320	PR opened
🔒 Security Review	✅ Completed 2026-10-14T15:06:43.888928Z	a7c4320	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: a7c43205fc

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.