Validate HTTP source rollout and retire its release flag

[devantler]

🤖 Generated by the Agentic Engineer

Objective

Retire the short-lived http-source OpenFeature release flag after the reference connector delivered by #45 has real deployment evidence. Part of #4.

Acceptance criteria

• A platform-owned deployment uses an explicitly read-only source credential, a restricted export endpoint, scoped ingress, and restricted source egress.
• Query, OpenAPI contract, source outage/recovery, credential rotation, metrics, and deployment rollback are exercised on the released artifact.
• Record public-safe acceptance evidence on Integrate existing sources and publish standard query contracts #4 without publishing connection details or credentials.
• Remove HTTP_SOURCE_ENABLED and the OpenFeature runtime gate in a focused PR after the evidence passes; retain the optional Helm workload switch and network/credential boundaries.

Blocked by #45. This is a release acceptance gate, not evidence that production integration is already complete.

[devantler]

🤖 Generated by the Agentic Engineer

The implementation dependency #45 is closed by merged #47. Release v1.2.0 points to merge commit ddbaf438404250c5a8aa985136cf6f9e022ab747; all post-merge workflows completed successfully.

Immutable artifacts for the Platform-owned acceptance work:

Artifact	Published reference
Application image	ghcr.io/devantler-tech/data-product-controller@sha256:be409270c586dd70e63c73604e022b9753ff4b226b525ea4183bb75b783a3e75
Helm chart 1.2.0	ghcr.io/devantler-tech/charts/data-product-controller@sha256:2e3788b41c091ffb95b86971b28251c6e6618f4a05e04f1da0d72ed1ab28db5a
Kubernetes manifests	ghcr.io/devantler-tech/data-product-controller/manifests@sha256:59df45314cfcae13add985bca99bb55e1c08c0cfad2f8778943bf3a668d40272

The application publication run pushed and signed the image and manifests. Independent cosign verify calls succeeded for both exact digests, requiring the GitHub Actions OIDC issuer and restricting certificate identity to this release's caller workflow or its pinned reusable publisher. Claims, transparency-log inclusion, and certificate trust checks passed.

The chart publication run pushed, signed, and verified the exact chart digest above with certificate identity https://github.com/devantler-tech/data-product-controller/.github/workflows/publish-chart.yaml@refs/tags/v1.2.0 and issuer https://token.actions.githubusercontent.com.

The connector remains disabled by default. This publication evidence does not satisfy the live rollout, rotation, outage/recovery, or rollback criteria above. No production deployment was changed. Use the operator guide when preparing that separate acceptance work.