# Changelog

## 2026-09-27 00:02 CEST — Read-only cluster-inspector credentials next to the agent

- Moved inspector RBAC from `configs/rbac/` to `.claude/cluster-inspector/` with `make-kubeconfig.sh`
  (applies RBAC once, mints a short-lived TokenRequest token, writes gitignored
  `kubeconfigs/<name>.kubeconfig`, runs `can-i` checks) and a setup README.
- Dropped the long-lived `service-account-token` Secret; tokens default to 7 days, refresh by re-running.
- `cluster-inspector` agent now reads only `.claude/cluster-inspector/kubeconfigs/*`; `.gitignore`
  covers that dir and `.claude/settings.local.json`.
- Files: `.claude/cluster-inspector/`, `.claude/agents/cluster-inspector.md`, `CLAUDE.md`, `README.md`,
  `.gitignore`, `docs/decisions.md`.

## 2026-09-26 23:55 CEST — Project history conventions

- Adopted plan / execution-log / prompt / review / changelog conventions from
  egress-proxies-operator, plus new `docs/decisions.md` (back-filled) and `docs/sessions/`.
- Git flow: docs straight to `main`, phase-3 code via `feat/` branch + `tea` MR; `/ship` command.
- Files: `CLAUDE.md`, `docs/decisions.md`, `docs/sessions/`, `.claude/`.