Rename back to catalogue-agent; stop owning the shared namespace

catalog-agent was one rename too aggressive: 'catalogue' is accepted, and the
Keycloak client, its audience scope and the Vault key that names it were never
renamed to match — leaving an inconsistency between what Kubernetes and
Keycloak call the same agent. Keycloak carries more weight to move, so this
side moves back.

k8s/namespace.yaml is out of this Kustomization's inventory. It was in
2026-08-31 when renaming the Kustomization pruned the old one — which owned
the namespace three agents share — and took all three down. A namespace shared
across repos should not be owned by any one of them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -129,7 +129,7 @@ running library:
   conversation history lives in the process, and so does a pending write waiting
   for approval. Moving either out is what would allow a second replica.
 - The Keycloak client is still named `classic-models-agent-catalogue` while the
-  Kubernetes objects say `catalog-agent`. Either is fine — pick one.
+  Kubernetes objects say `catalogue-agent`. Either is fine — pick one.
 
 Everything this section used to list is done: the Keycloak client exists, writes
 and the A2A call to the supply agent work, and `k8s/` deploys through Flux.

dev/bootstrap-kustomization.yaml

@@ -22,12 +22,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: catalog-agent-bootstrap
+  name: catalogue-agent-bootstrap
   namespace: agents
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
-    name: catalog-agent
+    name: catalogue-agent
   path: ./dev
   prune: true

dev/flux-kustomization.yaml

@@ -1,13 +1,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: catalog-agent
+  name: catalogue-agent
   namespace: agents
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
-    name: catalog-agent
+    name: catalogue-agent
   path: ./k8s
   prune: true
   wait: true

dev/gitrepository.yaml

@@ -9,7 +9,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
-  name: catalog-agent
+  name: catalogue-agent
   namespace: agents
 spec:
   interval: 5m

k8s/configmap.yaml

@@ -1,10 +1,10 @@
 # Everything here is an endpoint or a public identifier. The one secret the
-# agent holds arrives through catalog-agent-secrets; nothing in this file is
+# agent holds arrives through catalogue-agent-secrets; nothing in this file is
 # sensitive, which is the point of keeping the split visible.
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: catalog-agent-config
+  name: catalogue-agent-config
   namespace: agents
 data:
   CATALOGUE_KEYCLOAK_REALM_URL: https://keycloak.sttlab.local/realms/classic-models
@@ -23,7 +23,7 @@ data:
   # What other agents dial, so it is the Service DNS name and not the bind
   # address. It is advertised in the Agent Card; get it wrong and A2A callers
   # are pointed at nothing.
-  CATALOGUE_PUBLIC_URL: http://catalog-agent.agents.svc.cluster.local:8080/
+  CATALOGUE_PUBLIC_URL: http://catalogue-agent.agents.svc.cluster.local:8080/
   # The peer's Service name, overriding the default in config.py — set here so
   # the rename took effect without rebuilding an image.
   CATALOGUE_SUPPLY_URL: http://supply-agent.agents.svc.cluster.local:8080/

k8s/deployment.yaml

@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: catalog-agent
+  name: catalogue-agent
   namespace: agents
 spec:
   # One replica, and that is a constraint rather than a default. Conversation
@@ -12,11 +12,11 @@ spec:
   replicas: 1
   selector:
     matchLabels:
-      app: catalog-agent
+      app: catalogue-agent
   template:
     metadata:
       labels:
-        app: catalog-agent
+        app: catalogue-agent
     spec:
       securityContext:
         runAsNonRoot: true
@@ -36,9 +36,9 @@ spec:
               containerPort: 8080
           envFrom:
             - configMapRef:
-                name: catalog-agent-config
+                name: catalogue-agent-config
             - secretRef:
-                name: catalog-agent-secrets
+                name: catalogue-agent-secrets
           volumeMounts:
             - name: sttlab-ca
               mountPath: /etc/sttlab-ca

k8s/externalsecret.yaml

@@ -8,7 +8,7 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: catalog-agent-secrets
+  name: catalogue-agent-secrets
   namespace: agents
 spec:
   refreshInterval: 1h
@@ -16,7 +16,7 @@ spec:
     kind: ClusterSecretStore
     name: vault-keycloak
   target:
-    name: catalog-agent-secrets
+    name: catalogue-agent-secrets
   data:
     - secretKey: CATALOGUE_CLIENT_SECRET
       remoteRef:

k8s/ingress.yaml

@@ -27,12 +27,12 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: catalog-agent-tls
+  name: catalogue-agent-tls
   namespace: agents
 spec:
-  secretName: catalog-agent-tls
+  secretName: catalogue-agent-tls
   dnsNames:
-    - catalog-agent.sttlab.local
+    - catalogue-agent.sttlab.local
   issuerRef:
     name: sttlab-local-ca
     kind: ClusterIssuer
@@ -40,7 +40,7 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: catalog-agent
+  name: catalogue-agent
   namespace: agents
   annotations:
     nginx.ingress.kubernetes.io/auth-url: http://keycloak.keycloak.svc.cluster.local:8080/realms/classic-models/protocol/openid-connect/userinfo
@@ -55,16 +55,16 @@ spec:
   ingressClassName: nginx
   tls:
     - hosts:
-        - catalog-agent.sttlab.local
-      secretName: catalog-agent-tls
+        - catalogue-agent.sttlab.local
+      secretName: catalogue-agent-tls
   rules:
-    - host: catalog-agent.sttlab.local
+    - host: catalogue-agent.sttlab.local
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: catalog-agent
+                name: catalogue-agent
                 port:
                   number: 8080

k8s/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
   - ca-configmap.yaml
   - externalsecret.yaml
   - configmap.yaml

k8s/namespace.yaml

@@ -1,3 +1,11 @@
+# The `agents` namespace is shared by three agents from three repos.
+# Applied once, by hand, and deliberately NOT in this repo's Kustomization
+# inventory: a namespace owned by one repo's self-managing Kustomization gets
+# deleted — and every other agent in it with it — the moment that repo renames
+# its Kustomization or GitRepository, which prunes the old one. Learned the hard
+# way on 2026-08-31.
+#
+# kubectl apply -f k8s/namespace.yaml   # once, before anything else
 # One namespace for the whole agent estate rather than one per agent. The agents
 # share nothing but a trust boundary — no data, no storage, no service mesh
 # policy — and splitting them would multiply the CA ConfigMap and the

k8s/service.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: catalog-agent
+  name: catalogue-agent
   namespace: agents
 spec:
   selector:
-    app: catalog-agent
+    app: catalogue-agent
   ports:
     - name: http
       port: 8080