Profiles sync is always performed at each `update-status` hook

[dariofaccin]

Bug Description

The charm exposes a sync-period config option (default 60, seconds),
documented as "how long to wait between sync attempts". However, sync-period is not
the effective throttle: the charm also runs a full sync/reconcile on every
update_status hook (reconcile_on_update_status=True), independently of sync-period.

Because of this, raising sync-period does not reduce how often the charm actually
syncs with the PMR and reconciles cluster state — a full sync still fires on every
update_status, i.e. on the model's update-status-hook-interval (~5 minutes by default).
There is no way to slow down or pause syncing via sync-period alone.

Expected behavior

sync-period should be the effective minimum interval between syncs. A full sync should
run at most once per sync-period, regardless of which event (the timer,
update_status, etc.) wakes the charm. Concretely, one of:

• Record the timestamp of the last successful sync and skip syncing on update_status
  (and other events) when less than sync-period has elapsed; or
• Drive syncing solely from the dedicated sync-period timer and stop reconciling on
  update_status (reconcile_on_update_status=False).

Either way, setting a large sync-period should effectively pause syncing.

Impact

• sync-period is misleading and ineffective as a throttle: operators cannot slow down or
  pause syncing with it, because update_status keeps forcing full syncs on the model's
  update-status cadence.
• Concrete fallout in the Charmed Kubeflow M2M identity UATs: even after raising
  sync-period, an update_status-driven sync still runs mid-test and removes the
  contributor RoleBinding / AuthorizationPolicy the test created (for a Profile not in
  the PMR), so the authorized client is denied (403 via_upstream at the mesh waypoint)
  and test_authorized_token_reaches_inferenceservice fails. The only reliable mitigation
  today is to also raise the model's update-status-hook-interval or scale the charm to 0.

To Reproduce

1. Deploy the charm and set a large sync-period, e.g.
   juju config github-profiles-automator sync-period=86400.
2. Leave the model idle so no config-changed / relation events fire.
3. Watch the unit log across a few update_status hooks (default every ~5 minutes).

Environment

• Deployment: charmed-kubeflow-solutions, ambient + Identity Platform (kubeflow-ambient-iam) test bundle
• Juju: 3.6.28, MicroK8s
• Relevant config: sync-period (default 60, seconds)

Relevant Log Output

2026-09-16 13:54:40 INFO juju-log CharmReconciler.update_status executing full charm reconcile because reconcile_on_update_status=True
2026-09-16 13:54:40 INFO juju-log Removing access to all stale Profiles.
2026-09-16 13:54:40 INFO juju-log Profile test-m2m-93650e8b not in PMR. Will remove access.

Additional Context

No response

[syncronize-issues-to-jira]

Thank you for reporting your feedback to us!

The internal ticket has been created: https://warthogs.atlassian.net/browse/KF-9017.

This message was autogenerated