openshift · blublinsky · Jun 30, 2026
diff --git a/.ai/spec/what/agentic-console-ui.md b/.ai/spec/what/agentic-console-ui.md
@@ -61,6 +61,7 @@ Resource names match the prior `lightspeed-agentic-operator` deployment for upgr
 | `spec.ols.deployment.agenticConsole.tolerations` | Pod tolerations |
 | `spec.ols.deployment.agenticConsole.nodeSelector` | Node selector constraints |
 | `--agentic-console-image` (operator flag) | Container image override at operator startup |
+| `related_images.json` entry `lightspeed-agentic-console-plugin` | Default image for flag and CSV; optional `snapshot_component`, `konflux_prefix`, `stable_prefix` for `hack/snapshot_to_image_list.sh` |
 
 ## Constraints
 
@@ -74,4 +75,4 @@ Resource names match the prior `lightspeed-agentic-operator` deployment for upgr
 
 | Ticket | Summary |
 |---|---|
-| OLS-3236 | [PLANNED] OLM bundle/CSV: add `--agentic-console-image` to operator deployment and `related_images.json` entry |
+| OLS-3236 | Remove duplicate agentic console deployment from agentic-operator CSV; productize `lightspeed-agentic-console-plugin` image to SHA-pinned `registry.redhat.io` |
diff --git a/.ai/spec/what/bundle-composition.md b/.ai/spec/what/bundle-composition.md
@@ -31,13 +31,13 @@ The lightspeed-operator OLM bundle installs both the lightspeed-operator control
 
 ### Console Plugins
 
-14. [PLANNED: OLS-3236] The lightspeed-operator deploys both console plugins: the Lightspeed chat console plugin and the agentic console plugin. The agentic-operator does not deploy any console plugins.
-15. Prior to OLS-3236, the agentic-operator deployed the agentic console plugin via a fire-and-forget `RunnableFunc`. This is being migrated to the lightspeed-operator for full reconciliation lifecycle management.
+14. The lightspeed-operator deploys both console plugins: the Lightspeed chat console plugin and the agentic console plugin (`internal/controller/agenticconsole/`). The agentic-operator CSV must stop deploying the agentic console plugin ([PLANNED: OLS-3236]) so only the lightspeed-operator owns that operand.
+15. Before this migration, the agentic-operator deployed the agentic console plugin via a fire-and-forget `RunnableFunc`. That path is superseded by lightspeed-operator reconciliation (Phase 1/2, `AgenticConsolePluginReady`, finalizer cleanup via `agenticconsole.RemoveAgenticConsole()`).
 
 ### Agentic Operand Deployment
 
-16. The lightspeed-operator reconciles the agentic alerts adapter as a fully managed operand (OLS-3348, opt-in via `spec.ols.deployment.alertsAdapter.configMapRef`): Phase 1/2 reconciliation when enabled, `AlertsAdapterReady` status condition (`NotConfigured` when disabled), health monitoring, operand teardown on disable, ConfigMap watcher restarts, and finalizer cleanup via `RemoveAlertsAdapter()`. The agentic console plugin remains [PLANNED: OLS-3236].
-17. Agentic operand images default to `:main` tags until Konflux onboarding provides SHA-pinned productized images. The `--alerts-adapter-image` flag is implemented on the lightspeed-operator binary; wiring it into the CSV deployment spec is [PLANNED: OLS-3236]. The `--agentic-console-image` flag is [PLANNED: OLS-3236].
+16. The lightspeed-operator reconciles the agentic console plugin as a fully managed operand: Phase 1/2 reconciliation, `AgenticConsolePluginReady` status condition, health monitoring, and finalizer cleanup via `RemoveAgenticConsole()`. The lightspeed-operator reconciles the agentic alerts adapter as a fully managed operand (OLS-3348, opt-in via `spec.ols.deployment.alertsAdapter.configMapRef`): Phase 1/2 reconciliation when enabled, `AlertsAdapterReady` status condition (`NotConfigured` when disabled), health monitoring, operand teardown on disable, ConfigMap watcher restarts, and finalizer cleanup via `RemoveAlertsAdapter()`.
+17. Agentic operand images default from `related_images.json` (via `GetDefaultImage` in `constants.go`) and are passed to the operator through CSV deployment args: `--agentic-console-image` (`lightspeed-agentic-console-plugin`) and `--alerts-adapter-image` (`lightspeed-agentic-alerts-adapter`). Images are substituted by `hack/update_bundle.sh` from `hack/image_placeholders.json` and `config/default/deployment-patch.yaml`. Until Konflux productizes both operands, images may use interim Konflux `:main` or other non-`registry.redhat.io` references.
 
 ## Configuration Surface
 
@@ -48,8 +48,8 @@ The lightspeed-operator OLM bundle installs both the lightspeed-operator control
 | Agentic controller startup flags | CSV deployment spec args | Operand image overrides for the agentic controller |
 | Agentic controller `--sandbox-mode` | CSV deployment spec args | `bare-pod` (default) or `sandbox-claim` — selects sandbox provisioning strategy |
 | Agentic controller `--agentic-sandbox-image` | CSV deployment spec args | [PLANNED: OLS-3236] Sandbox container image (default: `:main` tag, overridable) |
-| Lightspeed controller `--alerts-adapter-image` | `cmd/main.go` flag (implemented); CSV deployment spec args [PLANNED: OLS-3236] | Alerts adapter container image (default: Konflux `:main` tag) |
-| Lightspeed controller `--agentic-console-image` | CSV deployment spec args | [PLANNED: OLS-3236] Agentic console plugin container image (default: `:main` tag) |
+| Lightspeed controller `--alerts-adapter-image` | `cmd/main.go` flag; CSV deployment spec args; `related_images.json` (`lightspeed-agentic-alerts-adapter`) | Alerts adapter container image (interim tags until productized) |
+| Lightspeed controller `--agentic-console-image` | CSV deployment spec args; `related_images.json` (`lightspeed-agentic-console-plugin`) | Agentic console plugin container image (interim `:main` until productized) |
 
 ## Constraints
 
@@ -61,4 +61,4 @@ The lightspeed-operator OLM bundle installs both the lightspeed-operator control
 
 | Ticket | Summary |
 |---|---|
-| OLS-3236 | Migrate agentic console deployment from agentic-operator to lightspeed-operator. Wire `--alerts-adapter-image` and `--agentic-console-image` into lightspeed-operator CSV deployment. Remove `--agentic-console-image` from agentic-operator CSV deployment. |
+| OLS-3236 | Remove agentic console deployment from agentic-operator CSV (lightspeed-operator now reconciles the plugin and wires `--agentic-console-image` / `--alerts-adapter-image` in its CSV). Productize agentic operand images to SHA-pinned `registry.redhat.io` entries. |
diff --git a/.ai/spec/what/crd-api.md b/.ai/spec/what/crd-api.md
@@ -137,7 +137,7 @@ Field path (relative to `spec.ols.deployment`) | JSON key | Go type | Notes
 `alertsAdapter` | `alertsAdapter` | `AlertsAdapterSpec` | Agentic alerts adapter deployment and user-managed runtime config reference. Replicas forced to 1
 
 `AlertsAdapterSpec` embeds `Config` (deployment scheduling/resources) and optional `configMapRef` (`LocalObjectReference`). Setting `configMapRef` **enables** the alerts adapter operand. The referenced ConfigMap name is `configMapRef.name` (commonly `alerts-adapter-config`; see [adapter manifests](https://github.com/openshift/lightspeed-agentic-alerts-adapter/tree/main/manifests)). The operator does not create or validate ConfigMap content. When the ConfigMap exists, it is mounted at `/etc/alerts-adapter`; when absent, no config volume is mounted. The adapter reads `config.yaml` from that path and uses built-in defaults when the file is missing or invalid.
-`agenticConsole` | `agenticConsole` | `Config` | [PLANNED: OLS-3236] Agentic console plugin container. Replicas forced to 1
+`agenticConsole` | `agenticConsole` | `Config` | Agentic console plugin container. Replicas forced to 1
 
 20. Replicas are only user-configurable for the API container (`spec.ols.deployment.api.replicas`). For console, database, alerts adapter, and agentic console, the operator always overrides replicas to 1 regardless of spec value.
 
@@ -307,7 +307,7 @@ Condition types used by the operator:
 - `CacheReady` -- PostgreSQL cache deployment health
 - `ConsolePluginReady` -- Console UI plugin deployment health
 - `AlertsAdapterReady` -- Agentic alerts adapter deployment health
-- `AgenticConsolePluginReady` -- [PLANNED: OLS-3236] Agentic console plugin deployment health
+- `AgenticConsolePluginReady` -- Agentic console plugin deployment health
 - `ResourceReconciliation` -- Overall resource reconciliation status (set directly, not deployment-based)
 
 #### Overall Status (status.overallStatus)
@@ -398,7 +398,7 @@ Path | Type | Default | Required | Validation | Description
 `spec.ols.deployment.alertsAdapter.resources` | `*ResourceRequirements` | -- | No | -- | Alerts adapter resources
 `spec.ols.deployment.alertsAdapter.tolerations` | `[]Toleration` | -- | No | -- | Alerts adapter tolerations
 `spec.ols.deployment.alertsAdapter.nodeSelector` | `map[string]string` | -- | No | -- | Alerts adapter node selector
-`spec.ols.deployment.agenticConsole` | `Config` | -- | No | -- | [PLANNED: OLS-3236] Agentic console deployment
+`spec.ols.deployment.agenticConsole` | `Config` | -- | No | -- | Agentic console deployment
 `spec.ols.deployment.agenticConsole.replicas` | `*int32` | `1` | No | Min=0 | Agentic console replicas (operator forces 1)
 `spec.ols.deployment.agenticConsole.resources` | `*ResourceRequirements` | -- | No | -- | Agentic console resources
 `spec.ols.deployment.agenticConsole.tolerations` | `[]Toleration` | -- | No | -- | Agentic console tolerations

diff --git a/.ai/spec/what/reconciliation.md b/.ai/spec/what/reconciliation.md
@@ -17,17 +17,17 @@ The operator reconciles the OLSConfig CR into Kubernetes resources through a two
 8. Step 6 (Phase 2): Reconcile deployments and dependent resources -- Deployments, Services, TLS certificates, ServiceMonitors, PrometheusRules. After reconciliation, check deployment health and update CR status.
 
 ### Phase 1: Independent Resources
-9. Four component groups are reconciled in Phase 1: Console UI, PostgreSQL, the application server, and (when enabled) the agentic alerts adapter. The agentic console plugin is [PLANNED: OLS-3236].
+9. Five component groups are reconciled in Phase 1: chat Console UI, agentic console plugin, PostgreSQL, the application server, and (when enabled) the agentic alerts adapter.
 10. All Phase 1 resource groups are independent and can be reconciled in any order.
 11. If any Phase 1 resource fails, the operator continues reconciling the remaining resources, then reports all failures in the CR status with ResourceReconciliation conditions.
 11a. Alerts adapter (OLS-3348) is **opt-in** via `spec.ols.deployment.alertsAdapter.configMapRef`. When unset, `ReconcileAlertsAdapterResources()` calls `RemoveAlertsAdapter()` to delete operator-managed operand resources (deployment, SA, namespaced RBAC, NetworkPolicy, monitoring RoleBinding; proposals ClusterRole/ClusterRoleBinding when the platform allows delete) and Phase 2 is skipped with `AlertsAdapterReady=True`, `Reason=NotConfigured`.
 11b. When `configMapRef` is set, Phase 1 reconciles: ServiceAccount, ClusterRole (`agentic.openshift.io/proposals`: create, list, get), ClusterRoleBinding, legacy config Role/RoleBinding cleanup, RoleBinding in `openshift-monitoring` (binds SA to `monitoring-alertmanager-view`), NetworkPolicy. The operator does not create, update, or validate ConfigMap data. When the referenced ConfigMap exists, Phase 2 mounts it at `/etc/alerts-adapter`; when absent, no config volume is mounted. The adapter reads `config.yaml` and uses built-in defaults when the file is missing or invalid.
-11c. Agentic console Phase 1 resources [PLANNED: OLS-3236]: ServiceAccount, ConfigMap (nginx.conf), NetworkPolicy.
+11c. Agentic console Phase 1 resources: ServiceAccount, ConfigMap (nginx.conf), NetworkPolicy.
 
 ### Phase 2: Deployments and Status
-12. Deployments reconciled in Phase 2: Console UI (condition: `ConsolePluginReady`), PostgreSQL (condition: `CacheReady`), the active backend (condition: `ApiReady`), and (when `configMapRef` set) the agentic alerts adapter (condition: `AlertsAdapterReady`). The agentic console plugin (condition: `AgenticConsolePluginReady`) is [PLANNED: OLS-3236].
+12. Deployments reconciled in Phase 2: chat Console UI (condition: `ConsolePluginReady`), agentic console plugin (condition: `AgenticConsolePluginReady`), PostgreSQL (condition: `CacheReady`), the active backend (condition: `ApiReady`), and (when `configMapRef` set) the agentic alerts adapter (condition: `AlertsAdapterReady`).
 12a. Alerts adapter Phase 2 (OLS-3348): Deployment (1 replica, `ALERTMANAGER_URL` env hardcoded to `https://alertmanager-main.openshift-monitoring.svc:9094`, `POD_NAMESPACE` via downward API).
-12b. Agentic console Phase 2 [PLANNED: OLS-3236]: Deployment (1 replica, nginx with TLS via service-ca cert), Service (port 9443, serving-cert annotation), ConsolePlugin CR, Console CR activation.
+12b. Agentic console Phase 2: Deployment (1 replica, nginx with TLS via service-ca cert), Service (port 9443, serving-cert annotation), ConsolePlugin CR, Console CR activation.
 13. After each deployment reconciliation, the operator checks the deployment's health status.
 14. Deployment health has three states: Ready (Available condition true), Progressing (not yet available, no terminal failures), Failed (terminal pod failures detected).
 15. Terminal pod failures include: CrashLoopBackOff, ImagePullBackOff, ErrImagePull, OOMKilled, and containers terminated with non-zero exit codes after CrashLoopBackOff.
@@ -38,12 +38,12 @@ The operator reconciles the OLSConfig CR into Kubernetes resources through a two
 ### Finalizer Lifecycle
 19. On CR creation: add finalizer, return immediately (controller-runtime auto-requeues).
 20. On CR deletion: run finalizer cleanup before removing finalizer.
-21. Finalizer cleanup sequence: remove Console UI from Console CR, delete ConsolePlugin CR, remove agentic console plugin from Console CR [PLANNED: OLS-3236], delete agentic ConsolePlugin CR [PLANNED: OLS-3236], delete alerts adapter operand resources via `alertsadapter.RemoveAlertsAdapter()` (deployment, namespaced RBAC, SA, NetworkPolicy, monitoring RoleBinding; proposals ClusterRole/ClusterRoleBinding when permitted), list all owned resources by owner reference, explicitly delete them, wait for deletion (polling with timeout).
+21. Finalizer cleanup sequence: remove chat Console UI from Console CR, delete chat ConsolePlugin CR, remove agentic console plugin from Console CR, delete agentic ConsolePlugin CR (`agenticconsole.RemoveAgenticConsole()`), delete alerts adapter operand resources via `alertsadapter.RemoveAlertsAdapter()` (deployment, namespaced RBAC, SA, NetworkPolicy, monitoring RoleBinding; proposals ClusterRole/ClusterRoleBinding when permitted), list all owned resources by owner reference, explicitly delete them, wait for deletion (polling with timeout).
 22. If cleanup times out, the finalizer is removed anyway to prevent the CR from being stuck in Terminating state.
 23. Console UI and agentic component removal errors during finalization are logged but do not block finalization.
 
 ### Status Conditions
-24. The operator sets these condition types: `ApiReady`, `CacheReady`, `ConsolePluginReady`, `AlertsAdapterReady` (`NotConfigured` when `configMapRef` unset; does not block `OverallStatus=Ready`), `AgenticConsolePluginReady` [PLANNED: OLS-3236], `ResourceReconciliation`.
+24. The operator sets these condition types: `ApiReady`, `CacheReady`, `ConsolePluginReady`, `AgenticConsolePluginReady`, `AlertsAdapterReady` (`NotConfigured` when `configMapRef` unset; does not block `OverallStatus=Ready`), `ResourceReconciliation`.
 25. OverallStatus is Ready only when all deployment conditions are True.
 26. OverallStatus is NotReady if any condition is False.
 27. When deployments are not ready, diagnosticInfo is populated with per-pod failure details including container name, reason, message, exit code, and diagnostic type.
@@ -68,4 +68,4 @@ Reconciliation behavior is not directly user-configurable. It is driven by the O
 
 | Ticket | Summary |
 |---|---|
-| OLS-3236 | [PLANNED] Add agentic-console as a reconciled operand with Phase 1/2 steps, `AgenticConsolePluginReady` status condition, and finalizer cleanup for Console CR / ConsolePlugin CR |
+| OLS-3236 | Remove duplicate agentic console deployment from agentic-operator CSV; productize agentic operand images |
diff --git a/Makefile b/Makefile
@@ -131,7 +131,7 @@ vet: ## Run go vet against code.
 
 .PHONY: test
 test: manifests generate fmt vet envtest test-crds ## Run local tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./internal/... -coverprofile cover.out -p 8 -timeout 10m
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./internal/... -coverprofile cover.out -p 6 -timeout 10m
 
 # Use 4.18 release branch for CRDs in unit tests
 OS_CONSOLE_CRD_URL = https://raw.githubusercontent.com/openshift/api/refs/heads/release-4.18/operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles.crd.yaml