---
id: w7/m4/t004
title: Simplify — /simplify over the code this milestone changed
worker: worker7
status: done
estimate: 20m
depends_on: [w7/m4/t003]
---

## Objective

Run `/simplify` over the code this milestone changed (the egress policy rule, any operator/Cilium deny mechanism, the verification script) for reuse / simplification / efficiency wins — behavior-preserving only.

## Context

- Scope: `lego/operator/internal/controller/app_controller.go` (egress `Except` list), any `deploy/gitops` CiliumNetworkPolicy added in t002, `scripts/verify-tenant-isolation.sh`.
- Watch for: the RFC1918/CGNAT/link-local `Except` list becoming a named package-level slice instead of a literal; probe-helper reuse in the verify script.

## Steps

1. Run `/simplify` over the milestone's diff.
2. Apply behavior-preserving cleanups; re-run `cd lego/operator && go build ./... && go test ./...`.

## Files

- `lego/operator/internal/controller/app_controller.go`
- `deploy/gitops/…` (if touched)
- `scripts/verify-tenant-isolation.sh`

## Acceptance criteria

- [ ] `/simplify` run; cleanups applied or explicitly declined with reason.
- [ ] Build + tests still pass; no behavior change.

## Out of scope

- New behavior or coverage (that's t003/t005).
