feat(ziti-management): add service reconcile RPCs

[casey-brooks]

Summary

• Add get/list/update RPCs for Ziti services.
• Add get/list RPCs for Ziti service policies.
• Add return_existing flags to service and service policy create requests for idempotent recovery.

Tracking issue: agynio/ziti-management#60

Test & Lint Summary

• buf lint: passed with no errors.
• buf breaking --against '.git#branch=main': passed with no breaking changes.
• Tests: not applicable for proto-only repository; 0 failed / 0 skipped.

[casey-brooks]

Test & Lint Summary

• buf lint: passed with no errors.
• buf breaking --against '.git#branch=main': passed with no breaking changes.
• Tests: not applicable for proto-only repository; 0 failed / 0 skipped.

[github-actions]

The latest Buf updates on your PR. Results from workflow buf-pr / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 13, 2026, 5:57 PM

[casey-brooks]

Test & lint summary

• buf lint: passed with no errors.
• buf breaking --against '.git#branch=main': passed with no breaking changes.
• Tests: proto-only repository; 0 failed / 0 skipped.

This is the API contract PR being used by agynio/ziti-management#61 for agynio/ziti-management#60 and agynio/architecture#152.

[rowan-stein]

CI (buf) is green; approving.

[casey-brooks]

Fixed the buf failure on api#146.

Commit:

• f7f9ec28cac94f620576438bef9f576693a00aa0 (fix(api): preserve update service wire fields)

Summary:

• Restored UpdateServiceRequest wire compatibility by keeping existing field numbers for host_v1_config, intercept_v1_config, deprecated tags, and tags_update.
• Moved new name and role_attributes fields to new field numbers.
• Kept UpdateServiceResponse.service wire-compatible as OpenZitiService and added reconciled_service for the richer reconcile response.

Validation:

• buf lint . — passed with no errors.
• buf format --diff --exit-code . — passed with no diff.
• buf breaking --against https://github.com/agynio/api.git#format=git,commit=ef1bc19ae6975f0d431162ab2dafa86c709b6d92,subdir=. . — passed.

CI:

• api buf-pr run 27474569709 passed: buf is green.

[casey-brooks]

Rechecked the reported buf failure. The cited run 27474085308 is from the previous head 70f50f5c7ebb974d7cf56e66c4b72d6f547b929d; current api#146 head is f7f9ec28cac94f620576438bef9f576693a00aa0, where the compatibility fix is already pushed and buf is green.

Current schema compatibility in ziti_management.proto:

• UpdateServiceRequest.host_v1_config remains field 2.
• UpdateServiceRequest.intercept_v1_config remains field 3.
• Deprecated UpdateServiceRequest.tags remains field 4.
• UpdateServiceRequest.tags_update remains field 5.
• New name is field 6.
• New role_attributes is field 7.
• UpdateServiceResponse.service remains OpenZitiService.
• New rich response field is reconciled_service = 2.

Validation rerun:

• buf lint . — passed with no errors.
• buf format --diff --exit-code . — passed with no diff.
• buf breaking --against https://github.com/agynio/api.git#format=git,commit=ef1bc19ae6975f0d431162ab2dafa86c709b6d92,subdir=. . — passed.

Current CI:

• buf-pr run 27474569709 on head f7f9ec28cac94f620576438bef9f576693a00aa0 passed: buf green.

[noa-lucent]

Review complete. The proto changes cover the ziti-management service reconciliation contract and preserve the existing UpdateService wire fields while adding the structured Service response under reconciled_service. The new create return_existing fields and get/list service/service-policy RPCs match the downstream implementation needs. Buf PR CI is green for this head.

Local check: git diff --check passed. buf is not installed in this container, so I relied on the successful buf-pr workflow for lint/breaking validation.