zelyo-ai
diff --git a/‎internal/anomaly/detector.go‎
Lines changed: 7 additions & 1 deletion b/‎internal/anomaly/detector.go‎
Lines changed: 7 additions & 1 deletion
diff --git a/‎internal/controller/clusterscan_controller.go‎
Lines changed: 37 additions & 5 deletions b/‎internal/controller/clusterscan_controller.go‎
Lines changed: 37 additions & 5 deletions
diff --git a/‎internal/controller/remediationpolicy_controller.go‎
Lines changed: 20 additions & 0 deletions b/‎internal/controller/remediationpolicy_controller.go‎
Lines changed: 20 additions & 0 deletions
diff --git a/‎internal/controller/securitypolicy_controller.go‎
Lines changed: 2 additions & 0 deletions b/‎internal/controller/securitypolicy_controller.go‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎internal/controller/zelyoconfig_controller.go‎
Lines changed: 33 additions & 3 deletions b/‎internal/controller/zelyoconfig_controller.go‎
Lines changed: 33 additions & 3 deletions
diff --git a/‎internal/correlator/engine.go‎
Lines changed: 59 additions & 27 deletions b/‎internal/correlator/engine.go‎
Lines changed: 59 additions & 27 deletions
@@ -145,7 +145,10 @@ func (d *Detector) Observe(key string, value float64) *Anomaly {
 	}
 }
 
-// GetBaseline returns the current baseline for a key, or nil if not found.
+// GetBaseline returns a copy of the current baseline for key, or nil if
+// not found. The Values slice is deep-copied: the previous shallow struct
+// copy aliased the backing array, so a caller iterating Values raced with
+// the next Observe() `append` mutating the same memory.
 func (d *Detector) GetBaseline(key string) *Baseline {
 	d.mu.RLock()
 	defer d.mu.RUnlock()
@@ -154,6 +157,9 @@ func (d *Detector) GetBaseline(key string) *Baseline {
 		return nil
 	}
 	result := *b
+	if len(b.Values) > 0 {
+		result.Values = append([]float64(nil), b.Values...)
+	}
 	return &result
 }
 
 
@@ -258,7 +258,7 @@ func (r *ClusterScanReconciler) executeScan(ctx context.Context, scan *zelyov1al
 		for i := range results {
 			f := &results[i]
 			finding := zelyov1alpha1.Finding{
-				ID:          fmt.Sprintf("%s-%s-%s-%s", f.RuleType, f.ResourceNamespace, f.ResourceName, f.Title[:min(len(f.Title), 20)]),
+				ID:          fmt.Sprintf("%s-%s-%s-%s", f.RuleType, f.ResourceNamespace, f.ResourceName, truncateRunes(f.Title, 20)),
 				Severity:    f.Severity,
 				Category:    f.RuleType,
 				Title:       f.Title,
@@ -354,11 +354,15 @@ func (r *ClusterScanReconciler) evaluateCompliance(ctx context.Context, scan *ze
 func (r *ClusterScanReconciler) createScanReport(ctx context.Context, scan *zelyov1alpha1.ClusterScan, findings []zelyov1alpha1.Finding, summary *zelyov1alpha1.ScanSummary, complianceResults []zelyov1alpha1.ComplianceResult) (string, error) {
 	log := logf.FromContext(ctx)
 
-	reportName := fmt.Sprintf("%s-%d", scan.Name, time.Now().Unix())
+	// Use GenerateName (not Name) so the API server appends a 5-char random
+	// suffix: this guarantees the result never exceeds the DNS-1123 label
+	// limit of 63 chars regardless of scan.Name length, and stays unique
+	// even when two scans complete in the same second (the unix-timestamp
+	// approach previously collided under parallel execution).
 	report := &zelyov1alpha1.ScanReport{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      reportName,
-			Namespace: scan.Namespace,
+			GenerateName: scanReportBasename(scan.Name),
+			Namespace:    scan.Namespace,
 			Labels: map[string]string{
 				"zelyo.ai/scan": scan.Name,
 			},
@@ -388,7 +392,21 @@ func (r *ClusterScanReconciler) createScanReport(ctx context.Context, scan *zely
 		log.Error(err, "Failed to update ScanReport status")
 	}
 
-	return reportName, nil
+	return report.Name, nil
+}
+
+// scanReportBasename returns a GenerateName prefix that leaves at least
+// 6 chars for the API server's random suffix while respecting the 63-char
+// DNS-1123 label limit. ScanReports use the scan name as a prefix so
+// human operators can still correlate reports to their scan in `kubectl
+// get scanreports`.
+func scanReportBasename(scanName string) string {
+	const maxPrefix = 56 // 63 - 5 suffix - 1 dash - 1 safety = plenty.
+	base := scanName
+	if len(base) > maxPrefix {
+		base = base[:maxPrefix]
+	}
+	return base + "-"
 }
 
 // resolveTargetPods lists running pods matching the scan's scope.
@@ -499,3 +517,17 @@ func (r *ClusterScanReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Named("clusterscan").
 		Complete(r)
 }
+
+// truncateRunes returns s truncated to at most maxRunes runes. Slicing a
+// string by byte index (s[:n]) chops mid-codepoint on multi-byte UTF-8
+// input, producing invalid sequences in downstream Finding IDs.
+func truncateRunes(s string, maxRunes int) string {
+	if maxRunes <= 0 {
+		return ""
+	}
+	r := []rune(s)
+	if len(r) <= maxRunes {
+		return s
+	}
+	return string(r[:maxRunes])
+}
@@ -19,6 +19,7 @@ package controller
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	corev1 "k8s.io/api/core/v1"
@@ -112,18 +113,37 @@ func (r *RemediationPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Re
 		fmt.Sprintf("GitOpsRepository %q is available (phase: %s)", repo.Name, repo.Status.Phase), policy.Generation)
 
 	// ── Step 2: Validate targeted SecurityPolicies ──
+	// Non-NotFound errors previously fell through silently; track missing
+	// and errored targets explicitly so we can mark a degraded condition
+	// and requeue with backoff.
+	var missingTargets []string
 	if len(policy.Spec.TargetPolicies) > 0 {
 		for _, policyName := range policy.Spec.TargetPolicies {
 			sp := &zelyov1alpha1.SecurityPolicy{}
 			spKey := types.NamespacedName{Name: policyName, Namespace: policy.Namespace}
 			if err := r.Get(ctx, spKey, sp); err != nil {
 				if errors.IsNotFound(err) {
+					missingTargets = append(missingTargets, policyName)
 					r.Recorder.Event(policy, corev1.EventTypeWarning, zelyov1alpha1.EventReasonReconcileError,
 						fmt.Sprintf("Target SecurityPolicy %q not found", policyName))
+					continue
 				}
+				return ctrl.Result{}, fmt.Errorf("fetching target SecurityPolicy %q: %w", policyName, err)
 			}
 		}
 	}
+	if len(missingTargets) > 0 {
+		conditions.MarkFalse(&policy.Status.Conditions, zelyov1alpha1.ConditionReady,
+			zelyov1alpha1.ReasonReconcileFailed,
+			fmt.Sprintf("target SecurityPolicies not found: %s", strings.Join(missingTargets, ", ")),
+			policy.Generation)
+		policy.Status.Phase = zelyov1alpha1.PhaseError
+		policy.Status.ObservedGeneration = policy.Generation
+		if err := r.Status().Update(ctx, policy); err != nil {
+			return ctrl.Result{}, fmt.Errorf("updating status: %w", err)
+		}
+		return ctrl.Result{RequeueAfter: 2 * time.Minute}, nil
+	}
 
 	// ── Step 3: Query correlator for open incidents ──
 	var prsCreated int32
 
@@ -70,8 +70,10 @@ type SecurityPolicyReconciler struct {
 // +kubebuilder:rbac:groups=zelyo.ai,resources=securitypolicies,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=zelyo.ai,resources=securitypolicies/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=zelyo.ai,resources=securitypolicies/finalizers,verbs=update
+// +kubebuilder:rbac:groups=zelyo.ai,resources=notificationchannels,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=namespaces,verbs=get;list;watch
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 
 // Reconcile implements the main reconciliation loop for SecurityPolicy.
 
@@ -18,6 +18,7 @@ package controller
 
 import (
 	"context"
+	stderrors "errors"
 	"fmt"
 	"os"
 	"time"
@@ -254,13 +255,20 @@ func (r *ZelyoConfigReconciler) reconcileRemediationEngine(ctx context.Context,
 				if ns == "" {
 					ns = "zelyo-system"
 				}
+				// Events and Conditions are visible to anyone with namespace
+				// read access; upstream *APIError.Error() includes the raw
+				// provider response body which can echo request fragments or
+				// header prefixes on 401/403. Use a redacted status-code-only
+				// summary for any externally-visible surface. Full detail
+				// stays in the operator log above.
+				probeSummary := redactLLMProbeError(probeErr)
 				r.Recorder.Event(config, corev1.EventTypeWarning, "LLMKeyVerificationFailed",
-					fmt.Sprintf("LLM API key verification failed: %v. Verify your key with: kubectl get secret %s -n %s -o jsonpath='{.data.api-key}' | base64 -d",
-						probeErr, config.Spec.LLM.APIKeySecret, ns))
+					fmt.Sprintf("LLM API key verification failed: %s. Verify your key with: kubectl get secret %s -n %s -o jsonpath='{.data.api-key}' | base64 -d",
+						probeSummary, config.Spec.LLM.APIKeySecret, ns))
 				config.Status.LLMKeyStatus = "Invalid"
 				conditions.MarkFalse(&config.Status.Conditions, zelyov1alpha1.ConditionLLMKeyVerified,
 					zelyov1alpha1.ReasonLLMKeyInvalid,
-					fmt.Sprintf("API key probe failed: %v", probeErr), config.Generation)
+					fmt.Sprintf("API key probe failed: %s", probeSummary), config.Generation)
 			} else {
 				now := metav1.Now()
 				config.Status.LLMKeyStatus = "Verified"
@@ -297,3 +305,25 @@ func (r *ZelyoConfigReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Named("zelyoconfig").
 		Complete(r)
 }
+
+// redactLLMProbeError returns a short status-code-only summary for the
+// LLM probe error, suitable for Kubernetes Events and Condition messages.
+// The full error (including upstream provider response body) stays in the
+// operator log; Events are visible to any namespace reader and must not
+// carry raw upstream bodies that may echo prompts or header prefixes.
+func redactLLMProbeError(err error) string {
+	if err == nil {
+		return ""
+	}
+	var apiErr *llm.APIError
+	if stderrors.As(err, &apiErr) {
+		if apiErr.StatusCode == 429 {
+			return "rate limited by provider"
+		}
+		if apiErr.StatusCode >= 400 && apiErr.StatusCode < 500 {
+			return fmt.Sprintf("provider returned HTTP %d (auth/config error)", apiErr.StatusCode)
+		}
+		return fmt.Sprintf("provider returned HTTP %d", apiErr.StatusCode)
+	}
+	return "provider unreachable"
+}
@@ -83,18 +83,26 @@ func NewEngine(cfg *Config) *Engine {
 }
 
 // Ingest adds an event and attempts to correlate it.
+//
+// The onIncident callback is invoked OUTSIDE the engine lock so callbacks
+// that call back into the engine (ResolveIncident, GetOpenIncidents) do
+// not deadlock. Both the callback payload and the returned *Incident are
+// independent copies snapshotted WHILE the lock is held — a concurrent
+// Ingest must not be able to append to incident.Events between our
+// snapshot and the callback/return.
 func (e *Engine) Ingest(event *Event) *Incident {
-	e.mu.Lock()
-	defer e.mu.Unlock()
+	var notifySnapshot *Incident
+	var result *Incident
 
+	e.mu.Lock()
 	if event.Timestamp.IsZero() {
 		event.Timestamp = time.Now()
 	}
 
 	e.events = append(e.events, event)
 	e.pruneOldEvents()
 
-	for id, incident := range e.incidents {
+	for _, incident := range e.incidents {
 		if incident.Resolved {
 			continue
 		}
@@ -104,50 +112,74 @@ func (e *Engine) Ingest(event *Event) *Incident {
 			if severityOrder(event.Severity) > severityOrder(incident.Severity) {
 				incident.Severity = event.Severity
 			}
-			if e.onIncident != nil {
-				e.onIncident(incident)
-			}
-			return e.incidents[id]
+			notifySnapshot = copyIncident(incident)
+			result = copyIncident(incident)
+			break
 		}
 	}
 
-	related := e.findRelated(event)
-	if len(related) >= 2 {
-		e.incidentSeq++
-		incident := &Incident{
-			ID:        fmt.Sprintf("INC-%06d", e.incidentSeq),
-			Severity:  highestSeverity(related),
-			Title:     fmt.Sprintf("Correlated incident on %s/%s", event.Namespace, event.Resource),
-			Events:    related,
-			Namespace: event.Namespace,
-			Resource:  event.Resource,
-			CreatedAt: time.Now(),
-			UpdatedAt: time.Now(),
-		}
-		e.incidents[incident.ID] = incident
-		if e.onIncident != nil {
-			e.onIncident(incident)
+	if result == nil {
+		related := e.findRelated(event)
+		if len(related) >= 2 {
+			e.incidentSeq++
+			incident := &Incident{
+				ID:        fmt.Sprintf("INC-%06d", e.incidentSeq),
+				Severity:  highestSeverity(related),
+				Title:     fmt.Sprintf("Correlated incident on %s/%s", event.Namespace, event.Resource),
+				Events:    related,
+				Namespace: event.Namespace,
+				Resource:  event.Resource,
+				CreatedAt: time.Now(),
+				UpdatedAt: time.Now(),
+			}
+			e.incidents[incident.ID] = incident
+			notifySnapshot = copyIncident(incident)
+			result = copyIncident(incident)
 		}
-		return incident
 	}
+	cb := e.onIncident
+	e.mu.Unlock()
 
-	return nil
+	if notifySnapshot != nil && cb != nil {
+		cb(notifySnapshot)
+	}
+	return result
 }
 
-// GetOpenIncidents returns all unresolved incidents.
+// GetOpenIncidents returns copies of all unresolved incidents. Returning
+// copies keeps the internal *Incident records from being aliased into
+// caller code, where a concurrent Ingest appending to incident.Events
+// would race with a range-loop reader.
 func (e *Engine) GetOpenIncidents() []*Incident {
 	e.mu.Lock()
 	defer e.mu.Unlock()
 
 	result := make([]*Incident, 0)
 	for _, inc := range e.incidents {
 		if !inc.Resolved {
-			result = append(result, inc)
+			result = append(result, copyIncident(inc))
 		}
 	}
 	return result
 }
 
+// copyIncident returns a shallow-deep copy of the incident: a new
+// *Incident with a new Events slice header containing the same *Event
+// pointers. Events themselves are treated as immutable once ingested;
+// cloning the slice header is sufficient to shield callers from future
+// `append`s mutating the engine's backing array.
+func copyIncident(inc *Incident) *Incident {
+	if inc == nil {
+		return nil
+	}
+	cp := *inc
+	if len(inc.Events) > 0 {
+		cp.Events = make([]*Event, len(inc.Events))
+		copy(cp.Events, inc.Events)
+	}
+	return &cp
+}
+
 // ResolveIncident marks an incident as resolved.
 func (e *Engine) ResolveIncident(id string) {
 	e.mu.Lock()
Original file line number	Diff line number	Diff line change
`@@ -145,7 +145,10 @@ func (d Detector) Observe(key string, value float64) Anomaly {`
`145`	`145`	`}`
`146`	`146`	`}`
`147`	`147`
`148`		`-// GetBaseline returns the current baseline for a key, or nil if not found.`
	`148`	`+// GetBaseline returns a copy of the current baseline for key, or nil if`
	`149`	`+// not found. The Values slice is deep-copied: the previous shallow struct`
	`150`	`+// copy aliased the backing array, so a caller iterating Values raced with`
	`151`	+// the next Observe() `append` mutating the same memory.
`149`	`152`	`func (d Detector) GetBaseline(key string) Baseline {`
`150`	`153`	`d.mu.RLock()`
`151`	`154`	`defer d.mu.RUnlock()`
`@@ -154,6 +157,9 @@ func (d Detector) GetBaseline(key string) Baseline {`
`154`	`157`	`return nil`
`155`	`158`	`}`
`156`	`159`	`result := *b`
	`160`	`+ if len(b.Values) > 0 {`
	`161`	`+ result.Values = append([]float64(nil), b.Values...)`
	`162`	`+ }`
`157`	`163`	`return &result`
`158`	`164`	`}`
`159`	`165`