[NaveCohenMonday]

Summary

Periodic CSI republish reapplies the default recursive fsGroup ownership change, replacing groups assigned by a running sandbox. Helpers then lose access to their working directory and archived tool results. Set OnRootMismatch in both existing Kubernetes pod group setup paths so initialized volumes retain workload-owned groups.

Task-ID: 33.09.06

Related Issue

No issue required: localized bug fix to existing volume permission setup, assigned directly by Nave and recorded in Workspace task 33.09.06.

Changes

• Preserve initial fsGroup preparation and skip recursive group changes once the volume root matches.
• Cover sidecar and persistent-workspace pod construction, without application-specific conditions or additional capabilities.
• Document the ownership policy.

The Kubernetes compute driver owns this pod setting. Per-command permission repairs would race kubelet; giving the helper the private runtime group would break isolation. This is the smallest generic change at the owning boundary.

Testing

• mise run pre-commit passes.
• All 224 Kubernetes driver unit tests pass, including policy assertions for both paths.
• Local Kubernetes persistent-volume check: OnRootMismatch preserved helper directory/archive groups across three remounts; Always reproduced the group overwrite.
• Isolated staging Azure SAN fixture: OnRootMismatch retained group 1001 across three confirmed CSI republish calls and 310 seconds; Always reproduced the overwrite to 1000 within 20 seconds. No existing agent was altered, and the fixture was deleted.
• Full mise run ci attempted; stopped on 22 existing Go SDK lint findings outside this change. Rust clippy passed. No unrelated Go changes included.
• Real local Sol 5.6 helper completed the Drive/Docs/Sheets/Slides workshop workflow in 58 shell calls with no computer errors; verified formula result 120, file placement and contents. A follow-up Sol 5.6 helper completed 61 calls, updated the formula result to 130 and inserted the break in Doc/Slides. Both runs returned completion to main; all four practice items were then trashed and verified. Staging adoption is pending the provider release.

Checklist

• Conventional Commit with DCO sign-off.
• Architecture documentation updated.