I want a Kubernetes operator written in Go that turns governance documents into files served at well known URLs. The idea is that instead of someone hand maintaining ConfigMaps, they declare a custom resource saying what kind of document it is, which well known path it belongs at, and the JSON payload itself. The operator validates it and keeps a matching ConfigMap in sync, named after the resource, with the payload stored under the filename from the path, labelled by document type, and owned by the custom resource so it gets cleaned up automatically.
Supported types should be an AEO doc, an agent card, a tool card, and a generic disclosure. If the type is wrong, the path is bad, or the JSON is malformed, reject it clearly through status conditions rather than publishing something broken. Status should also report whether it is valid and which ConfigMap was published.
Please keep the validation and desired state logic separate from the cluster code so it can be unit tested on its own, and test the reconciler with a fake client so everything passes without a real cluster. Include a Helm chart that installs the CRD, a least privilege role, a non root service account and the manager, plus a small distroless Dockerfile and a sample resource. AGPL license.