feat(app-studio): per-workspace tenant access via the GraphQL gateway (#359)

mjudeikis · claude · web-flow · commit 86d36aed31b1 · 2026-06-26T22:50:00.000+03:00
* revert(app-studio): restore /clusters/<path> tenant addressing PR #357's bare-path change routed tenant traffic to the user's DefaultCluster, which is NOT the selected workspace when the user is in any non-default workspace — silently reading/writing the wrong workspace's projects instead of erroring. Restore the original /clusters/<tenantPath> addressing (an honest 403 from the hub proxy) until the GraphQL migration lands proper per-workspace access. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(hub): inject X-Kedge-Cluster (tenant logical-cluster ID) for providers The backend proxy already injects X-Kedge-Tenant (the workspace path), but the GraphQL gateway at /graphql/clusters/{id} keys its per-cluster schema on the logical-cluster ID, not the path. Add an optional cluster resolver that maps the resolved tenant path to its kcp logical-cluster ID (read from the workspace's LogicalCluster object, cached with a TTL) and inject it as X-Kedge-Cluster. Best-effort: a resolve failure drops only this header. Foundation for moving app-studio's tenant access onto the GraphQL gateway, which (unlike the kcp user-proxy) is not DefaultCluster-gated. Also bumps the gateway fork replace to the commit adding the update<Kind>Status mutation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump gateway fork to add <Plural>Yaml list query Adds the list analogue of <Kind>Yaml so app-studio can List/Get against the GraphQL gateway by exchanging serialized objects, without enumerating typed field-selection sets over unstructured resources. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(app-studio): add GraphQL tenant client (gateway-backed) App Studio's per-workspace data path: talk to the hub's embedded GraphQL gateway at <hubBase>/graphql/<clusterID> as the caller, instead of direct kcp access (which the hub user-proxy gates to the caller's DefaultCluster, so it fails in non-default workspaces). Every op exchanges whole serialized objects via the gateway's <Kind>Yaml / <Plural>Yaml queries and applyYaml / applyStatusYaml mutations, so the client needs no typed field-selection set over unstructured resources. GraphQL errors are mapped onto k8s apierrors so callers' IsNotFound/IsConflict checks keep working. Not yet wired into the call sites — follow-up commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(app-studio): back asclient.Client with a ResourceClient interface Introduce ResourceClient (the per-resource subset App Studio uses) and a GraphQL-backed gqlResource implementing it. asclient.Client now resolves resources through Resource(), backed by either the GraphQL tenant Scope (production) or a dynamic client (tests) — both satisfy ResourceClient. Also handles the core ("") API group in the GraphQL query nesting (version sits directly on the root, no group wrapper) for Secret access. No behavior change yet: production still constructs the dynamic path; wiring the GraphQL path + migrating call sites follows. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(app-studio): route tenant access through the GraphQL gateway Activate the GraphQL path: clientFor now builds a tenant.Scope from the X-Kedge-Cluster header (the hub-injected workspace cluster ID) and the caller token, so App Studio reaches its workspace through the hub's gateway — which serves any workspace the caller has access to, unlike the DefaultCluster-gated kcp user-proxy. - http.go reads X-Kedge-Cluster into identity.clusterID - server.go/main.go construct the GraphQL client from KEDGE_HUB_URL - all ~18 c.Dynamic().Resource(gvr) call sites move to c.Resource(descriptor), backed by the GraphQL Scope (prod) or a dynamic client (tests) - tenant_resources.go holds the GraphQL descriptors (Kind/Plural) for Project, Secret, SandboxRunner, and code-provider Connection/Repository - isProjectAPIInitializingError recognises the gateway "schema not ready" shapes (no schema for cluster / Project type missing) for the 503 path Module builds, vets, and the full test suite passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: pin gateway fork to d10b61a (adds applyStatusYaml) The embedded gateway must expose applyStatusYaml, which app-studio calls at runtime for status writes. Bump the replace from a2eab00 to d10b61a so the hub's gateway has all three primitives (update<Kind>Status, <Plural>Yaml, applyStatusYaml). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
diff --git a/go.mod b/go.mod
@@ -327,6 +327,6 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
 )
 
-replace github.com/platform-mesh/kubernetes-graphql-gateway => github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260612154300-f9c2b298c4cd
+replace github.com/platform-mesh/kubernetes-graphql-gateway => github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626182922-d10b61a76a93
 
 replace github.com/kcp-dev/multicluster-provider/client => github.com/kcp-dev/multicluster-provider/client v0.8.0
diff --git a/go.sum b/go.sum
@@ -144,6 +144,12 @@ github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
 github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260612154300-f9c2b298c4cd h1:c/SnMtn9/6CXoB/+EATPqP87gOt5ENSFLq6xzGWqNOM=
 github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260612154300-f9c2b298c4cd/go.mod h1:FTy6tfcfD1XoN081U3WaG+4t1GpgWNRYPYy+AcDYRKU=
+github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626173633-9c3bfe012c22 h1:MGjoHiISmJLY+lMbfaeA8qIUG6PhfKqOCotXyZt1ygY=
+github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626173633-9c3bfe012c22/go.mod h1:FTy6tfcfD1XoN081U3WaG+4t1GpgWNRYPYy+AcDYRKU=
+github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626181934-a2eab00748ed h1:3s49oo4zW5ElcRDgxcWsxKWieqMhlNx+wVde/0BOP1Q=
+github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626181934-a2eab00748ed/go.mod h1:FTy6tfcfD1XoN081U3WaG+4t1GpgWNRYPYy+AcDYRKU=
+github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626182922-d10b61a76a93 h1:Ex8FjE9zP4KBWU5wVjKVs9YX57D/ZpGCO0vsG5m6AiA=
+github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626182922-d10b61a76a93/go.mod h1:FTy6tfcfD1XoN081U3WaG+4t1GpgWNRYPYy+AcDYRKU=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
diff --git a/pkg/hub/provider_cluster_resolver.go b/pkg/hub/provider_cluster_resolver.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2026 The Faros Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package hub
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+
+	"github.com/faroshq/faros-kedge/pkg/apiurl"
+)
+
+// logicalClusterGVR addresses the well-known per-workspace LogicalCluster
+// object named "cluster", whose kcp.io/cluster annotation is the workspace's
+// logical-cluster ID.
+var logicalClusterGVR = schema.GroupVersionResource{
+	Group: "core.kcp.io", Version: "v1alpha1", Resource: "logicalclusters",
+}
+
+// clusterIDResolverTTL bounds how long a (tenantPath → clusterID) mapping is
+// cached. The mapping is effectively stable for a workspace's lifetime, so a
+// generous TTL keeps the warm path free of kcp round-trips while still letting
+// a deleted-and-recreated workspace's stale ID age out.
+const clusterIDResolverTTL = 10 * time.Minute
+
+// newClusterIDResolver returns a function mapping a tenant workspace path
+// (root:kedge:tenants:<org>[:<ws>]) to its kcp logical-cluster ID, for the
+// backend proxy to inject as X-Kedge-Cluster. It reads the workspace's
+// LogicalCluster "cluster" object via the hub's kcp admin config, scoping the
+// host to /clusters/<path> through the front-proxy (which resolves paths).
+//
+// Results are cached per path with a TTL; resolution failures are not cached so
+// a transient kcp hiccup self-heals on the next request.
+func newClusterIDResolver(kcpConfig *rest.Config) func(ctx context.Context, tenantPath string) (string, error) {
+	type entry struct {
+		id        string
+		expiresAt time.Time
+	}
+	var (
+		mu  sync.RWMutex
+		hot = map[string]entry{}
+	)
+
+	return func(ctx context.Context, tenantPath string) (string, error) {
+		now := time.Now()
+
+		mu.RLock()
+		e, ok := hot[tenantPath]
+		mu.RUnlock()
+		if ok && now.Before(e.expiresAt) {
+			return e.id, nil
+		}
+
+		cfg := rest.CopyConfig(kcpConfig)
+		cfg.Host = apiurl.KCPClusterURL(cfg.Host, tenantPath)
+		dyn, err := dynamic.NewForConfig(cfg)
+		if err != nil {
+			return "", fmt.Errorf("dynamic client for %q: %w", tenantPath, err)
+		}
+		lc, err := dyn.Resource(logicalClusterGVR).Get(ctx, "cluster", metav1.GetOptions{})
+		if err != nil {
+			return "", fmt.Errorf("getting LogicalCluster for %q: %w", tenantPath, err)
+		}
+		id := lc.GetAnnotations()["kcp.io/cluster"]
+		if id == "" {
+			return "", fmt.Errorf("LogicalCluster for %q has no kcp.io/cluster annotation", tenantPath)
+		}
+
+		mu.Lock()
+		hot[tenantPath] = entry{id: id, expiresAt: now.Add(clusterIDResolverTTL)}
+		mu.Unlock()
+		return id, nil
+	}
+}
diff --git a/pkg/hub/providers/proxy.go b/pkg/hub/providers/proxy.go
@@ -18,6 +18,7 @@ package providers
 
 import (
 	"bytes"
+	"context"
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
@@ -114,6 +115,7 @@ func NewBackendProxy(reg *Registry, log logr.Logger) *ProviderProxy {
 	p.setHeaders = func(req *http.Request, name, _ string) {
 		req.Header.Del("X-Kedge-User")
 		req.Header.Del("X-Kedge-Tenant")
+		req.Header.Del("X-Kedge-Cluster")
 		if p.tenantResolver == nil {
 			// V(2) so tests / non-bootstrapper hubs don't spam, but
 			// devs can flip on verbosity to see the dropped path.
@@ -150,6 +152,17 @@ func NewBackendProxy(reg *Registry, log logr.Logger) *ProviderProxy {
 		} else {
 			p.log.Info("tenant resolved but tenantPath empty — forwarding without X-Kedge-Tenant", "provider", name, "user", user, "hint", "user may not have a personal Organization workspace bootstrapped yet")
 		}
+		// Resolve the workspace path to its kcp logical-cluster ID and inject
+		// X-Kedge-Cluster. Best-effort: a resolve failure drops only this
+		// header (the provider still has X-Kedge-Tenant), so a provider that
+		// doesn't need the ID is unaffected.
+		if tenantPath != "" && p.clusterResolver != nil {
+			if clusterID, err := p.clusterResolver(req.Context(), tenantPath); err != nil {
+				p.log.Info("cluster-id resolve failed — forwarding without X-Kedge-Cluster", "provider", name, "tenant", tenantPath, "err", err.Error())
+			} else if clusterID != "" {
+				req.Header.Set("X-Kedge-Cluster", clusterID)
+			}
+		}
 	}
 	return p
 }
@@ -163,6 +176,14 @@ func (p *ProviderProxy) SetTenantResolver(r TenantResolver) {
 	p.tenantResolver = r
 }
 
+// SetClusterResolver installs an optional resolver mapping a tenant workspace
+// path to its kcp logical-cluster ID, injected as X-Kedge-Cluster on
+// backend-proxied requests. Wire alongside SetTenantResolver; without it the
+// header is simply omitted (and any inbound value is still stripped).
+func (p *ProviderProxy) SetClusterResolver(f func(ctx context.Context, tenantPath string) (string, error)) {
+	p.clusterResolver = f
+}
+
 // ProviderProxy is the shared implementation backing both proxies. Exported
 // so the server can call SetFallback on the UI proxy after the portal SPA
 // handler is built (the two are constructed at different points in Server.Run).
@@ -188,6 +209,14 @@ type ProviderProxy struct {
 	// UI proxy serves static assets and has no use for caller identity.
 	// See SetTenantResolver.
 	tenantResolver TenantResolver
+
+	// clusterResolver, when set, maps the resolved tenant workspace path to
+	// its kcp logical-cluster ID, injected as X-Kedge-Cluster. Providers need
+	// the ID (not the path) to address per-workspace surfaces that key on it —
+	// notably the hub's GraphQL gateway at /graphql/clusters/{id}, whose
+	// per-cluster schema lookup only matches a cluster ID. See
+	// SetClusterResolver.
+	clusterResolver func(ctx context.Context, tenantPath string) (string, error)
 }
 
 // SetFallback installs the portal SPA handler invoked for non-asset paths
diff --git a/pkg/hub/server.go b/pkg/hub/server.go
@@ -533,6 +533,10 @@ func (s *Server) Run(ctx context.Context) error {
 			// resolver (lives here to avoid a providers→proxy→kcp→providers
 			// import cycle).
 			backendProxy.SetTenantResolver(newKCPTenantResolver(kcpProxy, userClient))
+			// Inject X-Kedge-Cluster (the resolved tenant's logical-cluster
+			// ID) so providers can address per-workspace surfaces that key on
+			// the ID — notably the GraphQL gateway at /graphql/clusters/{id}.
+			backendProxy.SetClusterResolver(newClusterIDResolver(kcpConfig))
 
 			// Step 10: Org / Workspace / Membership / User REST
 			apiMgr := restapi.NewManager(userClient, bootstrapper)
diff --git a/providers/app-studio/api/code_repository.go b/providers/app-studio/api/code_repository.go
@@ -101,7 +101,7 @@ func (s *Server) prepareProjectRepository(ctx context.Context, c *asclient.Clien
 
 func selectCodeConnection(ctx context.Context, c *asclient.Client, requested string) (string, error) {
 	if requested != "" {
-		conn, err := c.Dynamic().Resource(codeConnectionsGVR).Get(ctx, requested, metav1.GetOptions{})
+		conn, err := c.Resource(codeConnectionResource, "").Get(ctx, requested, metav1.GetOptions{})
 		if err != nil {
 			return "", codeProviderRequestError("get Code connection", err)
 		}
@@ -111,7 +111,7 @@ func selectCodeConnection(ctx context.Context, c *asclient.Client, requested str
 		return requested, nil
 	}
 
-	list, err := c.Dynamic().Resource(codeConnectionsGVR).List(ctx, metav1.ListOptions{})
+	list, err := c.Resource(codeConnectionResource, "").List(ctx, metav1.ListOptions{})
 	if err != nil {
 		return "", codeProviderRequestError("list Code connections", err)
 	}
@@ -142,7 +142,7 @@ func repositoryName(ctx context.Context, c *asclient.Client, requested, displayN
 		if i > 0 {
 			name = dns1123LabelWithSuffix(base, uuid.NewString()[:6])
 		}
-		if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {
+		if _, err := c.Resource(codeRepositoryResource, "").Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {
 			return name, nil
 		} else if err != nil {
 			return "", codeProviderRequestError("get Code repository", err)
@@ -169,7 +169,7 @@ func (s *Server) createProjectRepository(ctx context.Context, c *asclient.Client
 		"description":   plan.Description,
 		"autoInit":      true,
 	}
-	if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Create(ctx, repo, metav1.CreateOptions{}); err != nil {
+	if _, err := c.Resource(codeRepositoryResource, "").Create(ctx, repo, metav1.CreateOptions{}); err != nil {
 		if apierrors.IsAlreadyExists(err) {
 			return newValidationError(fmt.Sprintf("Code repository %q already exists", plan.Ref))
 		}
@@ -183,10 +183,10 @@ func projectRepositoryView(ctx context.Context, c *asclient.Client, p *aiv1alpha
 	var list codeResourceLister
 	if c != nil {
 		get = func(ctx context.Context, gvr schema.GroupVersionResource, name string) (*unstructured.Unstructured, error) {
-			return c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})
+			return c.Resource(codeResourceFor(gvr), "").Get(ctx, name, metav1.GetOptions{})
 		}
 		list = func(ctx context.Context, gvr schema.GroupVersionResource, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {
-			return c.Dynamic().Resource(gvr).List(ctx, opts)
+			return c.Resource(codeResourceFor(gvr), "").List(ctx, opts)
 		}
 	}
 	return projectRepositoryViewFromResources(ctx, p, get, list)
diff --git a/providers/app-studio/api/development_runtime.go b/providers/app-studio/api/development_runtime.go
@@ -68,7 +68,7 @@ func (s *Server) runtimeTargetForProject(ctx context.Context, c *asclient.Client
 	if strings.TrimSpace(name) == "" {
 		return runtimeTarget{}, nil, fmt.Errorf("sandbox runner name is empty")
 	}
-	obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})
+	obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
 		return runtimeTarget{}, nil, err
 	}
@@ -332,14 +332,14 @@ func patchLastSync(ctx context.Context, c *asclient.Client, name string, t metav
 	if c == nil {
 		return nil
 	}
-	obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})
+	obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
 		return err
 	}
 	if err := unstructured.SetNestedField(obj.Object, t.Format("2006-01-02T15:04:05Z07:00"), "status", "lastSyncTime"); err != nil {
 		return err
 	}
-	_, err = c.Dynamic().Resource(sandboxRunnerGVR).UpdateStatus(ctx, obj, metav1.UpdateOptions{})
+	_, err = c.Resource(sandboxRunnerResource, "").UpdateStatus(ctx, obj, metav1.UpdateOptions{})
 	if apierrors.IsNotFound(err) || apierrors.IsForbidden(err) {
 		return nil
 	}
diff --git a/providers/app-studio/api/development_sync.go b/providers/app-studio/api/development_sync.go
@@ -457,8 +457,8 @@ func (s *Server) scheduleDevelopmentSyncAfterMutation(id identity, p *aiv1alpha1
 }
 
 func (s *Server) syncDevelopmentAfterMutation(id identity, p *aiv1alpha1.Project, name string) {
-	if s.clients == nil {
-		klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant client factory is not configured", projectToolBaseName(name), p.Name)
+	if s.gql == nil {
+		klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant GraphQL client is not configured", projectToolBaseName(name), p.Name)
 		return
 	}
 	c, err := s.clientFor(id)
diff --git a/providers/app-studio/api/http.go b/providers/app-studio/api/http.go
@@ -31,6 +31,7 @@ import (
 // headers (defense in depth — a spoofed header cannot mis-scope storage).
 type identity struct {
 	tenantPath    string // X-Kedge-Tenant, e.g. root:kedge:orgs:<org>:<ws>
+	clusterID     string // X-Kedge-Cluster, the workspace's kcp logical-cluster ID
 	orgUUID       string // parsed from tenantPath
 	workspaceUUID string // parsed from tenantPath ("" when the path is org-only)
 	user          string // X-Kedge-User
@@ -50,6 +51,7 @@ func identityFromRequest(w http.ResponseWriter, r *http.Request) (identity, bool
 	org, ws := parseTenantPath(tenantPath)
 	return identity{
 		tenantPath:    tenantPath,
+		clusterID:     strings.TrimSpace(r.Header.Get("X-Kedge-Cluster")),
 		orgUUID:       org,
 		workspaceUUID: ws,
 		user:          strings.TrimSpace(r.Header.Get("X-Kedge-User")),
diff --git a/providers/app-studio/api/llm.go b/providers/app-studio/api/llm.go
@@ -1279,7 +1279,7 @@ func firstSSELine(body []byte) (json.RawMessage, bool) {
 
 func readProjectLLMSettings(ctx context.Context, c *asclient.Client) (projectLLMSettings, error) {
 	settings := defaultProjectLLMSettings()
-	secret, err := c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
+	secret, err := c.Resource(secretResource, projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
 	if apierrors.IsNotFound(err) {
 		return settings, nil
 	}
@@ -1301,16 +1301,16 @@ func readProjectLLMSettings(ctx context.Context, c *asclient.Client) (projectLLM
 
 func writeProjectLLMSettings(ctx context.Context, c *asclient.Client, settings projectLLMSettings) error {
 	secret := projectLLMSettingsSecret(settings)
-	existing, err := c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
+	existing, err := c.Resource(secretResource, projectLLMSecretNamespace).Get(ctx, projectLLMSecretName, metav1.GetOptions{})
 	if apierrors.IsNotFound(err) {
-		_, err = c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Create(ctx, secret, metav1.CreateOptions{})
+		_, err = c.Resource(secretResource, projectLLMSecretNamespace).Create(ctx, secret, metav1.CreateOptions{})
 		return err
 	}
 	if err != nil {
 		return err
 	}
 	secret.SetResourceVersion(existing.GetResourceVersion())
-	_, err = c.Dynamic().Resource(secretGVR).Namespace(projectLLMSecretNamespace).Update(ctx, secret, metav1.UpdateOptions{})
+	_, err = c.Resource(secretResource, projectLLMSecretNamespace).Update(ctx, secret, metav1.UpdateOptions{})
 	return err
 }
 
diff --git a/providers/app-studio/api/projects.go b/providers/app-studio/api/projects.go
@@ -167,10 +167,20 @@ func writeProjectError(w http.ResponseWriter, err error) {
 }
 
 func isProjectAPIInitializingError(err error) bool {
-	if !apierrors.IsNotFound(err) {
+	if err == nil {
 		return false
 	}
-	return strings.Contains(strings.ToLower(err.Error()), "server could not find the requested resource")
+	low := strings.ToLower(err.Error())
+	// kcp dynamic path: the Project API isn't served in the workspace yet.
+	if apierrors.IsNotFound(err) && strings.Contains(low, "server could not find the requested resource") {
+		return true
+	}
+	// GraphQL path: either the gateway has no schema for the workspace cluster
+	// yet, or the schema lacks the Project type (APIBinding not established) —
+	// both surface while the workspace is still being provisioned.
+	return strings.Contains(low, "workspace initializing") ||
+		strings.Contains(low, "cannot query field") ||
+		strings.Contains(low, "unknown field")
 }
 
 func (s *Server) listProjects(w http.ResponseWriter, r *http.Request) {
@@ -297,7 +307,7 @@ func (s *Server) cleanupCreatedProjectSetup(ctx context.Context, c *asclient.Cli
 	_ = s.deleteProjectProviderResources(ctx, c, p, id)
 	if p.Spec.Repository != nil {
 		if ref := strings.TrimSpace(p.Spec.Repository.RepositoryRef); ref != "" {
-			_ = c.Dynamic().Resource(codeRepositoriesGVR).Delete(ctx, ref, metav1.DeleteOptions{})
+			_ = c.Resource(codeRepositoryResource, "").Delete(ctx, ref, metav1.DeleteOptions{})
 		}
 	}
 	if name := strings.TrimSpace(p.Name); name != "" {
diff --git a/providers/app-studio/api/provider_resources.go b/providers/app-studio/api/provider_resources.go
@@ -89,7 +89,7 @@ func ensureProjectProviderResource(ctx context.Context, c *asclient.Client, p *a
 	if owner := projectProviderResourceOwnerRef(p); owner != nil {
 		want.SetOwnerReferences([]metav1.OwnerReference{*owner})
 	}
-	res := c.Dynamic().Resource(gvr)
+	res := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "")
 	existing, err := res.Get(ctx, name, metav1.GetOptions{})
 	if apierrors.IsNotFound(err) {
 		return res.Create(ctx, want, metav1.CreateOptions{})
@@ -138,7 +138,7 @@ func (s *Server) deleteProjectProviderResources(ctx context.Context, c *asclient
 			}
 			runtimeNamespace := ""
 			if isSandboxRunnerBinding(binding) && s != nil && s.runtimeClient != nil {
-				obj, err := c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})
+				obj, err := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Get(ctx, name, metav1.GetOptions{})
 				if err != nil && !apierrors.IsNotFound(err) {
 					return err
 				}
@@ -149,7 +149,7 @@ func (s *Server) deleteProjectProviderResources(ctx context.Context, c *asclient
 					}
 				}
 			}
-			err = c.Dynamic().Resource(gvr).Delete(ctx, name, metav1.DeleteOptions{})
+			err = c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Delete(ctx, name, metav1.DeleteOptions{})
 			if err != nil && !apierrors.IsNotFound(err) {
 				return err
 			}
@@ -291,7 +291,7 @@ func projectProviderBindingStatus(ctx context.Context, c *asclient.Client, p *ai
 		status.Phase = "Invalid"
 		return status
 	}
-	obj, err := c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})
+	obj, err := c.Resource(providerBindingResource(gvr, binding.ResourceRef.Kind), "").Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
 		status.Phase = "Pending"
 		return status
diff --git a/providers/app-studio/api/server.go b/providers/app-studio/api/server.go
diff --git a/providers/app-studio/api/tenant_resources.go b/providers/app-studio/api/tenant_resources.go
diff --git a/providers/app-studio/client/client.go b/providers/app-studio/client/client.go
diff --git a/providers/app-studio/main.go b/providers/app-studio/main.go
diff --git a/providers/app-studio/tenant/graphql.go b/providers/app-studio/tenant/graphql.go

Original file line number	Diff line number	Diff line change
`@@ -327,6 +327,6 @@ require (`
`327`	`327`	`sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect`
`328`	`328`	`)`
`329`	`329`
`330`		`-replace github.com/platform-mesh/kubernetes-graphql-gateway => github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260612154300-f9c2b298c4cd`
	`330`	`+replace github.com/platform-mesh/kubernetes-graphql-gateway => github.com/faroshq/kubernetes-graphql-gateway v0.0.0-20260626182922-d10b61a76a93`
`331`	`331`
`332`	`332`	`replace github.com/kcp-dev/multicluster-provider/client => github.com/kcp-dev/multicluster-provider/client v0.8.0`
Original file line number	Diff line number	Diff line change
`@@ -101,7 +101,7 @@ func (s Server) prepareProjectRepository(ctx context.Context, c asclient.Clien`
`101`	`101`
`102`	`102`	`func selectCodeConnection(ctx context.Context, c *asclient.Client, requested string) (string, error) {`
`103`	`103`	`if requested != "" {`
`104`		`- conn, err := c.Dynamic().Resource(codeConnectionsGVR).Get(ctx, requested, metav1.GetOptions{})`
	`104`	`+ conn, err := c.Resource(codeConnectionResource, "").Get(ctx, requested, metav1.GetOptions{})`
`105`	`105`	`if err != nil {`
`106`	`106`	`return "", codeProviderRequestError("get Code connection", err)`
`107`	`107`	`}`
`@@ -111,7 +111,7 @@ func selectCodeConnection(ctx context.Context, c *asclient.Client, requested str`
`111`	`111`	`return requested, nil`
`112`	`112`	`}`
`113`	`113`
`114`		`- list, err := c.Dynamic().Resource(codeConnectionsGVR).List(ctx, metav1.ListOptions{})`
	`114`	`+ list, err := c.Resource(codeConnectionResource, "").List(ctx, metav1.ListOptions{})`
`115`	`115`	`if err != nil {`
`116`	`116`	`return "", codeProviderRequestError("list Code connections", err)`
`117`	`117`	`}`
`@@ -142,7 +142,7 @@ func repositoryName(ctx context.Context, c *asclient.Client, requested, displayN`
`142`	`142`	`if i > 0 {`
`143`	`143`	`name = dns1123LabelWithSuffix(base, uuid.NewString()[:6])`
`144`	`144`	`}`
`145`		`- if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {`
	`145`	`+ if _, err := c.Resource(codeRepositoryResource, "").Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {`
`146`	`146`	`return name, nil`
`147`	`147`	`} else if err != nil {`
`148`	`148`	`return "", codeProviderRequestError("get Code repository", err)`
`@@ -169,7 +169,7 @@ func (s Server) createProjectRepository(ctx context.Context, c asclient.Client`
`169`	`169`	`"description": plan.Description,`
`170`	`170`	`"autoInit": true,`
`171`	`171`	`}`
`172`		`- if _, err := c.Dynamic().Resource(codeRepositoriesGVR).Create(ctx, repo, metav1.CreateOptions{}); err != nil {`
	`172`	`+ if _, err := c.Resource(codeRepositoryResource, "").Create(ctx, repo, metav1.CreateOptions{}); err != nil {`
`173`	`173`	`if apierrors.IsAlreadyExists(err) {`
`174`	`174`	`return newValidationError(fmt.Sprintf("Code repository %q already exists", plan.Ref))`
`175`	`175`	`}`
`@@ -183,10 +183,10 @@ func projectRepositoryView(ctx context.Context, c asclient.Client, p aiv1alpha`
`183`	`183`	`var list codeResourceLister`
`184`	`184`	`if c != nil {`
`185`	`185`	`get = func(ctx context.Context, gvr schema.GroupVersionResource, name string) (*unstructured.Unstructured, error) {`
`186`		`- return c.Dynamic().Resource(gvr).Get(ctx, name, metav1.GetOptions{})`
	`186`	`+ return c.Resource(codeResourceFor(gvr), "").Get(ctx, name, metav1.GetOptions{})`
`187`	`187`	`}`
`188`	`188`	`list = func(ctx context.Context, gvr schema.GroupVersionResource, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {`
`189`		`- return c.Dynamic().Resource(gvr).List(ctx, opts)`
	`189`	`+ return c.Resource(codeResourceFor(gvr), "").List(ctx, opts)`
`190`	`190`	`}`
`191`	`191`	`}`
`192`	`192`	`return projectRepositoryViewFromResources(ctx, p, get, list)`
Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ func (s Server) runtimeTargetForProject(ctx context.Context, c asclient.Client`
`68`	`68`	`if strings.TrimSpace(name) == "" {`
`69`	`69`	`return runtimeTarget{}, nil, fmt.Errorf("sandbox runner name is empty")`
`70`	`70`	`}`
`71`		`- obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})`
	`71`	`+ obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})`
`72`	`72`	`if err != nil {`
`73`	`73`	`return runtimeTarget{}, nil, err`
`74`	`74`	`}`
`@@ -332,14 +332,14 @@ func patchLastSync(ctx context.Context, c *asclient.Client, name string, t metav`
`332`	`332`	`if c == nil {`
`333`	`333`	`return nil`
`334`	`334`	`}`
`335`		`- obj, err := c.Dynamic().Resource(sandboxRunnerGVR).Get(ctx, name, metav1.GetOptions{})`
	`335`	`+ obj, err := c.Resource(sandboxRunnerResource, "").Get(ctx, name, metav1.GetOptions{})`
`336`	`336`	`if err != nil {`
`337`	`337`	`return err`
`338`	`338`	`}`
`339`	`339`	`if err := unstructured.SetNestedField(obj.Object, t.Format("2006-01-02T15:04:05Z07:00"), "status", "lastSyncTime"); err != nil {`
`340`	`340`	`return err`
`341`	`341`	`}`
`342`		`- _, err = c.Dynamic().Resource(sandboxRunnerGVR).UpdateStatus(ctx, obj, metav1.UpdateOptions{})`
	`342`	`+ _, err = c.Resource(sandboxRunnerResource, "").UpdateStatus(ctx, obj, metav1.UpdateOptions{})`
`343`	`343`	`if apierrors.IsNotFound(err) \|\| apierrors.IsForbidden(err) {`
`344`	`344`	`return nil`
`345`	`345`	`}`
Original file line number	Diff line number	Diff line change
`@@ -457,8 +457,8 @@ func (s Server) scheduleDevelopmentSyncAfterMutation(id identity, p aiv1alpha1`
`457`	`457`	`}`
`458`	`458`
`459`	`459`	`func (s Server) syncDevelopmentAfterMutation(id identity, p aiv1alpha1.Project, name string) {`
`460`		`- if s.clients == nil {`
`461`		`- klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant client factory is not configured", projectToolBaseName(name), p.Name)`
	`460`	`+ if s.gql == nil {`
	`461`	`+ klog.V(2).Infof("development sandbox sync after %s skipped for project %s: tenant GraphQL client is not configured", projectToolBaseName(name), p.Name)`
`462`	`462`	`return`
`463`	`463`	`}`
`464`	`464`	`c, err := s.clientFor(id)`