chore(server): remove the resources_config_path boot loader flow

[rohilsurana]

⚠️ Draft — do not merge until the deprecation window elapses (~v0.112.0) and all deployments have migrated to the reconcile flow

Stacked on #1766 (dead-cache removal); rebase onto main once that merges.

What

Removes the app.resources_config_path boot loader end to end. Custom permissions and role
overrides are now managed through the reconcile flow (the Permission and Role kinds),
so the server no longer reads a resource config file at startup.

• cmd/serve.go: drop the resource blob load and the SchemaConfigRepository wiring.
• internal/bootstrap: drop the FileService (schemaConfig) dependency. MigrateSchema
  now re-applies the base schema merged with the permissions already in the DB (via
  AppendSchema, which already preserves them) instead of reading a config file;
  MigrateRoles no longer creates config-defined custom roles (reconcile owns them); and
  BuiltinPermissions (the permission delete-guard) reports only base-schema permissions.
• pkg/server/config.go: remove the resources_config_path / resources_config_path_secret
  fields. internal/store/blob/schema_repository.go: removed (no longer used).
• config/sample.config.yaml: drop the sample entries.

Existing custom permissions survive across boots because they live in the database and
AppendSchema merges them back into the schema. Existing role overrides survive because
MigrateRoles is skip-if-exists. So on a server that has already migrated, this is a no-op;
on one that has not, it would stop seeding from the config — which is exactly why it is gated.

Why this is gated

• This is a breaking change for upstream frontier users still on resources_config_path.
  Per the RFC (docs/rfcs/0001-declarative-reconcile.md), the loader is deprecated for two
  minor versions before removal. That window started at v0.110.0, so removal lands ~v0.112.0.
• Deployments must have cut over first — running the reconcile flow so roles/permissions
  are owned there, and dropping resources_config_path from their own configs.

Build, go build ./..., and tests for internal/bootstrap, pkg/server, core/resource,
internal/api/v1beta1connect, and cmd all pass; lint clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 17, 2026 8:58am

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: eb1e4d28-3e53-4ff3-8164-24ecb6ac9836

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 29568253588

Coverage decreased (-0.02%) to 46.092%

Details

• Coverage decreased (-0.02%) from the base build.
• Patch coverage: 6 uncovered changes across 2 files (0 of 6 lines covered, 0.0%).
• 17 coverage regressions across 3 files.

Uncovered Changes

File	Changed	Covered	%
internal/bootstrap/service.go	5	0	0.0%
cmd/serve.go	1	0	0.0%

Coverage Regressions

17 previously-covered lines in 3 files lost coverage.

File	Lines Losing Coverage	Coverage
internal/store/blob/blob.go	15	0.0%
cmd/serve.go	1	0.0%
internal/bootstrap/service.go	1	22.51%

---

Coverage Stats

Relevant Lines:	38263
Covered Lines:	17636
Line Coverage:	46.09%
Coverage Strength:	13.34 hits per line

---

💛 - Coveralls