bugfixes; research subproc; higher sandbox limits

deploy/k8s/base/gateway-rbac.yaml

@@ -1,6 +1,6 @@
-# RBAC for gateway to CREATE sandbox deployments only
-# Principle of least privilege: gateway can ONLY create deployments/services/PVCs
-# in the sandbox namespace. Deletion is handled by the lifecycle sidecar.
+# RBAC for gateway to manage sandbox deployments
+# Principle of least privilege: gateway can create/delete deployments in the
+# sandbox namespace. PVC deletion is still handled by the lifecycle sidecar.
 # No pods, secrets, exec, or cross-namespace access.
 ---
 apiVersion: v1
@@ -15,10 +15,10 @@ metadata:
   name: sandbox-creator
   namespace: sandbox
 rules:
-  # Deployments: create and read only (deletion handled by sidecar)
+  # Deployments: full management (delete used for license tier changes; PVC deletion still via sidecar)
   - apiGroups: ["apps"]
     resources: ["deployments"]
-    verbs: ["create", "get", "list", "watch", "patch", "update"]
+    verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
 
   # PVCs: create and read (deletion handled by sidecar)
   - apiGroups: [""]
@@ -41,7 +41,6 @@ rules:
     verbs: ["get"]
 
   # Explicitly NOT included:
-  # - deployments/delete - handled by lifecycle sidecar
   # - pvc/delete - handled by lifecycle sidecar
   # - services/delete - handled by lifecycle sidecar
   # - pods (create/delete) - must go through deployments

deploy/k8s/base/gateway.yaml

@@ -83,10 +83,10 @@ spec:
 
           resources:
             requests:
-              memory: "256Mi"
+              memory: "512Mi"
               cpu: "100m"
             limits:
-              memory: "512Mi"
+              memory: "2Gi"
               cpu: "500m"
 
           livenessProbe:

deploy/k8s/base/sandbox-quotas.yaml

@@ -19,8 +19,8 @@ spec:
         cpu: "100m"
       # Maximum any single container can request
       max:
-        memory: "2Gi"
-        cpu: "2000m"
+        memory: "8Gi"
+        cpu: "4000m"
       min:
         memory: "32Mi"
         cpu: "10m"