What
findImmutablePaths (apps/console/src/lib/immutable-paths.ts) recognises a parent as immutable when any oneOf/anyOf/allOf branch carries the CEL rule itself, but does NOT descend into a branch's own properties to discover per-field immutability inside the branch.
Why it matters
CRDs that use allOf for property composition (less common than direct properties, but legal and present in some upstream CRDs) won't have their inner immutable fields flagged. The UI will render those fields as editable and the overlay won't protect them.
Pinned
Current behaviour is pinned by the FIXME test in apps/console/src/lib/immutable-paths.test.ts ("FIXME: does NOT walk into properties beneath oneOf/anyOf/allOf branches"). Flip the assertion when the walker is extended.
What
findImmutablePaths(apps/console/src/lib/immutable-paths.ts) recognises a parent as immutable when anyoneOf/anyOf/allOfbranch carries the CEL rule itself, but does NOT descend into a branch's ownpropertiesto discover per-field immutability inside the branch.Why it matters
CRDs that use
allOffor property composition (less common than directproperties, but legal and present in some upstream CRDs) won't have their inner immutable fields flagged. The UI will render those fields as editable and the overlay won't protect them.Pinned
Current behaviour is pinned by the
FIXMEtest inapps/console/src/lib/immutable-paths.test.ts("FIXME: does NOT walk into properties beneath oneOf/anyOf/allOf branches"). Flip the assertion when the walker is extended.