Integrate relationship and convergence fixes into v3

[estivate]

Summary

This draft brings the current main-line relationship attribution fix from PR #143, the pending convergence-identity safety boundary from PR #170, and the pending stale many-relationship reconciliation fix from PR #172 into feature/v3-develop.

The integration reconciles the v3 execution model rather than merely resolving text conflicts: live sync, tiered sync, and saved-plan apply use the actual Infrahub upsert key (HFID, then default_filter), refuse lossy creates before destination writes, preserve ID-addressed live updates, and retain exact nested identity diagnostics. Saved-plan refusals use the plan error taxonomy and retain partial-apply context. The classic update path fetches lazy many-relationship peers before computing removals, while the saved replace-set path remains separate.

This PR is intentionally draft and depends on teammate review/merge of PRs #170 and #172. Their source commits are pinned and qualified here; after either source changes or merges, this branch must be requalified against the final source SHA before this PR is readied.

Conflict resolutions

• Retain v3's standalone CLI and saved-plan lifecycle.
• Apply the convergence guard to both classic live writes and v3 saved create/update writes.
• Preflight every retained tier diff before the first tier writes.
• Treat HFID/default filter as the convergence key; uniqueness constraints are diagnostics only.
• Validate recursive relationship identities and null/empty rendered keys.
• Compute an omitted/falsy live diff once, validate that exact diff, and pass the same object to DiffSync.
• Preserve PR fix: attribute source/owner on relationships in update_node #143's relationship source/owner attribution and resource-pool from_pool behavior.
• Adapt PR fix: fetch many-relationship peers before reconciliation #172's fetch-before-compare repair to the classic v3 path without changing the planned replace-set mechanism.
• Omit a duplicate SYNC-38 changelog fragment because the source fragment will arrive through normal main-to-v3 synchronization.

Verification

• Full test suite: 1296 passed, 20 skipped, 1 xfailed
• Focused integration matrix: 409 passed, 1 skipped
• Ruff: clean
• Changed production/test files: ty clean
• CLI --help and list: passed
• Live v3 classic path: remote A/B → desired A/C; second reconciliation empty; throwaway branch deleted
• Live saved replace-set integration: passed
• Three independent T2 judges: unanimous PASS at 59260bb654d24fecb32514e46d26fe63d75c58bb

Repository-wide Pylint/ty still surface established optional Prefect/FastAPI dependency and baseline findings; the changed surfaces add no new diagnostic. The develop GitHub workflow currently fails before lint because it cannot authenticate uv to the private opsmill/prefect-extras Git dependency; that workflow issue is not mixed into this feature integration.

Depends on #170 and #172.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b199cd5a-950d-4c51-ba00-80e58f466d24

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying infrahub-sync with    Cloudflare Pages

Latest commit:	59260bb
Status:	✅  Deploy successful!
Preview URL:	https://f380148b.infrahub-sync.pages.dev
Branch Preview URL:	https://feature-v3-integrate-sync30.infrahub-sync.pages.dev

View logs

[estivate]

CI note: the first develop-workflow run fails before lint starts because uv sync --extra managed cannot authenticate to the private opsmill/prefect-extras Git dependency (fatal: could not read Username for https://github.com). This is inherited workflow/dependency authentication, not a candidate test or lint failure. I have not mixed a cross-repository credential change into this integration PR; local full/focused verification remains documented in the PR body.

[estivate]

Closing as superseded. This draft captured the then-current reconciliation of the relationship-attribution, convergence-identity, and relationship-fetch fixes into V3, but its base and source heads have moved and the branch is now conflicting. We will not repair or merge this branch. After the maintained-line source PRs reach their accepted final commits, we will create and requalify a fresh reconciliation from the then-current feature/v3-develop head. This closed PR and its branch remain available as historical conflict-resolution evidence.