Spike: Component Dependencies (Follow-Up to Spike #167)

[rebEllieous]

During the spike initiated under ADR-011 "component-dependencies", we documented a proposed solution to ingest OCM ComponentReferences and represent them as distinct ComponentVersion records within the Solar catalog. Following team discussions, the proposed design was deemed too complex to handle purely within Solar's internal controllers. We concluded that handling most of these lifecycle and dependency management problems upstream is the superior solution.

We brought our questions and friction points to the OCM community call. The current status from the OCM maintainers is: the project is not hard-committed to a definitive execution path for runtime dependencies yet; the landscape remains open for discussion.

To implement Dependency Managemement in a way tot benefit both OSCP as well as ODD we are focusing on upstream implementation by extending ocm-kit. This way we have a base to present to and continue working with the ocm team and include this feature as part of ocm-kit in ocm v2.

For this purpose we have opened PR #60 which cointains an rfc outlining a component schema declaring required and provided capabilities / ressources.

ACs:

• review the OCM-Kit RFC, include oscp into the discussion to make sure their requirements are being met
• implement PoC in OCM-Kit for one Solar usecase (e.g. CertManager)

[AlexHardAtWork]

Solar-side GC follow-up (from ADR 015).

Once the ocm-kit dependency capability lands, Solar's retention janitor(see #755) must become dependency-aware: a ComponentVersion pulled only as a dependency must be retained while any consumer exists. This needs the dependency closure at catalog time plus cross-namespace reference counting (finalizer + ReferencedBy/consumerCount), enriching the janitor's
"unreferenced" test.

Until then Solar's GC stays conservative — it never deletes on a missing artifact and only removes entries that are unreferenced and aged out - which is inherently dependency-safe, so nothing here blocks the ADR 015 work. Blocked by ocm-kit dependency RFC #60.