@a5c-ai/krate 5.0.1-staging.0d89dd7c4 → 5.0.1-staging.2d6ea2736

package/dist/krate-controller-ui.json

@@ -19,7 +19,7 @@
       "platformNamespace": "krate-org-default"
     }
   ],
-  "generatedAt": "2026-05-16T09:44:55.208Z",
+  "generatedAt": "2026-05-17T09:58:34.998Z",
   "correlationId": null,
   "controller": {
     "mode": "krate-workspace",
@@ -583,7 +583,7 @@
               "maintainers"
             ],
             "invitedBy": "admin",
-            "expiresAt": "2026-05-23T09:44:55.205Z"
+            "expiresAt": "2026-05-24T09:58:34.995Z"
           },
           "status": {
             "phase": "Pending",
@@ -595,7 +595,7 @@
         "Pending": 1
       },
       "storage": "etcd",
-      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: Invite\nmetadata:\n  namespace: krate-org-default\n  labels:\n    role: member\n  annotations:\n  name: new-user-example-com\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  email: new-user@example.com\n  role: member\n  teams:\n    - maintainers\n  invitedBy: admin\n  expiresAt: 2026-05-23T09:44:55.205Z\nstatus:\n  phase: Pending\n  storage: etcd\n",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: Invite\nmetadata:\n  namespace: krate-org-default\n  labels:\n    role: member\n  annotations:\n  name: new-user-example-com\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  email: new-user@example.com\n  role: member\n  teams:\n    - maintainers\n  invitedBy: admin\n  expiresAt: 2026-05-24T09:58:34.995Z\nstatus:\n  phase: Pending\n  storage: etcd\n",
       "action": {
         "list": "Open Invite records in krate-org-default",
         "watch": "Watch Invite updates in krate-org-default",
@@ -2476,7 +2476,7 @@
           "maintainers"
         ],
         "phase": "Pending",
-        "expiresAt": "2026-05-23T09:44:55.205Z"
+        "expiresAt": "2026-05-24T09:58:34.995Z"
       }
     ],
     "mappings": [
@@ -3082,7 +3082,7 @@
             "maintainers"
           ],
           "phase": "Pending",
-          "expiresAt": "2026-05-23T09:44:55.205Z"
+          "expiresAt": "2026-05-24T09:58:34.995Z"
         }
       ],
       "mappings": [

package/dist/krate-lifecycle.json

@@ -1,7 +1,7 @@
 {
   "project": "Krate",
   "version": "0.1.0",
-  "generatedAt": "2026-05-16T09:44:55.215Z",
+  "generatedAt": "2026-05-17T09:58:35.006Z",
   "status": "ready-for-local-development",
   "components": [
     {

package/dist/krate-runtime-snapshot.json

@@ -465,7 +465,7 @@
                 "maintainers"
               ],
               "invitedBy": "admin",
-              "expiresAt": "2026-05-23T09:44:55.205Z"
+              "expiresAt": "2026-05-24T09:58:34.995Z"
             },
             "status": {
               "phase": "Pending",
@@ -547,7 +547,7 @@
       },
       "auditLog": [
         {
-          "at": "2026-05-16T09:44:55.203Z",
+          "at": "2026-05-17T09:58:34.994Z",
           "operation": "create",
           "user": "admin@example.com",
           "groups": [
@@ -559,7 +559,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.204Z",
+          "at": "2026-05-17T09:58:34.995Z",
           "operation": "create",
           "user": "admin@example.com",
           "groups": [
@@ -571,7 +571,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.204Z",
+          "at": "2026-05-17T09:58:34.995Z",
           "operation": "create",
           "user": "admin@example.com",
           "groups": [
@@ -583,7 +583,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.204Z",
+          "at": "2026-05-17T09:58:34.995Z",
           "operation": "create",
           "user": "platform@example.com",
           "groups": [
@@ -595,7 +595,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.204Z",
+          "at": "2026-05-17T09:58:34.995Z",
           "operation": "create",
           "user": "admin@example.com",
           "groups": [
@@ -607,7 +607,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.204Z",
+          "at": "2026-05-17T09:58:34.995Z",
           "operation": "create",
           "user": "platform@example.com",
           "groups": [
@@ -619,7 +619,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.205Z",
+          "at": "2026-05-17T09:58:34.995Z",
           "operation": "create",
           "user": "platform@example.com",
           "groups": [
@@ -631,7 +631,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.205Z",
+          "at": "2026-05-17T09:58:34.995Z",
           "operation": "create",
           "user": "platform@example.com",
           "groups": [
@@ -643,7 +643,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.205Z",
+          "at": "2026-05-17T09:58:34.996Z",
           "operation": "create",
           "user": "admin@example.com",
           "groups": [
@@ -655,7 +655,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.205Z",
+          "at": "2026-05-17T09:58:34.996Z",
           "operation": "create",
           "user": "platform@example.com",
           "groups": [
@@ -667,7 +667,7 @@
           "allowed": true
         },
         {
-          "at": "2026-05-16T09:44:55.205Z",
+          "at": "2026-05-17T09:58:34.996Z",
           "operation": "create",
           "user": "platform@example.com",
           "groups": [
@@ -915,7 +915,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.203Z",
+            "at": "2026-05-17T09:58:34.994Z",
             "operation": "create",
             "user": "admin@example.com",
             "groups": [
@@ -956,7 +956,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.204Z",
+            "at": "2026-05-17T09:58:34.995Z",
             "operation": "create",
             "user": "admin@example.com",
             "groups": [
@@ -992,7 +992,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.204Z",
+            "at": "2026-05-17T09:58:34.995Z",
             "operation": "create",
             "user": "admin@example.com",
             "groups": [
@@ -1037,7 +1037,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.204Z",
+            "at": "2026-05-17T09:58:34.995Z",
             "operation": "create",
             "user": "platform@example.com",
             "groups": [
@@ -1081,7 +1081,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.204Z",
+            "at": "2026-05-17T09:58:34.995Z",
             "operation": "create",
             "user": "admin@example.com",
             "groups": [
@@ -1129,7 +1129,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.204Z",
+            "at": "2026-05-17T09:58:34.995Z",
             "operation": "create",
             "user": "platform@example.com",
             "groups": [
@@ -1179,7 +1179,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.205Z",
+            "at": "2026-05-17T09:58:34.995Z",
             "operation": "create",
             "user": "platform@example.com",
             "groups": [
@@ -1230,7 +1230,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.205Z",
+            "at": "2026-05-17T09:58:34.995Z",
             "operation": "create",
             "user": "platform@example.com",
             "groups": [
@@ -1265,7 +1265,7 @@
                 "maintainers"
               ],
               "invitedBy": "admin",
-              "expiresAt": "2026-05-23T09:44:55.205Z"
+              "expiresAt": "2026-05-24T09:58:34.995Z"
             },
             "status": {
               "phase": "Pending",
@@ -1273,7 +1273,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.205Z",
+            "at": "2026-05-17T09:58:34.996Z",
             "operation": "create",
             "user": "admin@example.com",
             "groups": [
@@ -1324,7 +1324,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.205Z",
+            "at": "2026-05-17T09:58:34.996Z",
             "operation": "create",
             "user": "platform@example.com",
             "groups": [
@@ -1375,7 +1375,7 @@
             }
           },
           "audit": {
-            "at": "2026-05-16T09:44:55.205Z",
+            "at": "2026-05-17T09:58:34.996Z",
             "operation": "create",
             "user": "platform@example.com",
             "groups": [
@@ -1810,7 +1810,7 @@
             "maintainers"
           ],
           "invitedBy": "admin",
-          "expiresAt": "2026-05-23T09:44:55.205Z"
+          "expiresAt": "2026-05-24T09:58:34.995Z"
         },
         "status": {
           "phase": "Pending",
@@ -2515,7 +2515,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.203Z",
+        "at": "2026-05-17T09:58:34.994Z",
         "operation": "create",
         "user": "admin@example.com",
         "groups": [
@@ -2556,7 +2556,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.204Z",
+        "at": "2026-05-17T09:58:34.995Z",
         "operation": "create",
         "user": "admin@example.com",
         "groups": [
@@ -2592,7 +2592,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.204Z",
+        "at": "2026-05-17T09:58:34.995Z",
         "operation": "create",
         "user": "admin@example.com",
         "groups": [
@@ -2637,7 +2637,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.204Z",
+        "at": "2026-05-17T09:58:34.995Z",
         "operation": "create",
         "user": "platform@example.com",
         "groups": [
@@ -2681,7 +2681,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.204Z",
+        "at": "2026-05-17T09:58:34.995Z",
         "operation": "create",
         "user": "admin@example.com",
         "groups": [
@@ -2729,7 +2729,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.204Z",
+        "at": "2026-05-17T09:58:34.995Z",
         "operation": "create",
         "user": "platform@example.com",
         "groups": [
@@ -2779,7 +2779,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.205Z",
+        "at": "2026-05-17T09:58:34.995Z",
         "operation": "create",
         "user": "platform@example.com",
         "groups": [
@@ -2830,7 +2830,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.205Z",
+        "at": "2026-05-17T09:58:34.995Z",
         "operation": "create",
         "user": "platform@example.com",
         "groups": [
@@ -2865,7 +2865,7 @@
             "maintainers"
           ],
           "invitedBy": "admin",
-          "expiresAt": "2026-05-23T09:44:55.205Z"
+          "expiresAt": "2026-05-24T09:58:34.995Z"
         },
         "status": {
           "phase": "Pending",
@@ -2873,7 +2873,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.205Z",
+        "at": "2026-05-17T09:58:34.996Z",
         "operation": "create",
         "user": "admin@example.com",
         "groups": [
@@ -2924,7 +2924,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.205Z",
+        "at": "2026-05-17T09:58:34.996Z",
         "operation": "create",
         "user": "platform@example.com",
         "groups": [
@@ -2975,7 +2975,7 @@
         }
       },
       "audit": {
-        "at": "2026-05-16T09:44:55.205Z",
+        "at": "2026-05-17T09:58:34.996Z",
         "operation": "create",
         "user": "platform@example.com",
         "groups": [
@@ -2990,7 +2990,7 @@
   ],
   "auditLog": [
     {
-      "at": "2026-05-16T09:44:55.203Z",
+      "at": "2026-05-17T09:58:34.994Z",
       "operation": "create",
       "user": "admin@example.com",
       "groups": [
@@ -3002,7 +3002,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.204Z",
+      "at": "2026-05-17T09:58:34.995Z",
       "operation": "create",
       "user": "admin@example.com",
       "groups": [
@@ -3014,7 +3014,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.204Z",
+      "at": "2026-05-17T09:58:34.995Z",
       "operation": "create",
       "user": "admin@example.com",
       "groups": [
@@ -3026,7 +3026,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.204Z",
+      "at": "2026-05-17T09:58:34.995Z",
       "operation": "create",
       "user": "platform@example.com",
       "groups": [
@@ -3038,7 +3038,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.204Z",
+      "at": "2026-05-17T09:58:34.995Z",
       "operation": "create",
       "user": "admin@example.com",
       "groups": [
@@ -3050,7 +3050,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.204Z",
+      "at": "2026-05-17T09:58:34.995Z",
       "operation": "create",
       "user": "platform@example.com",
       "groups": [
@@ -3062,7 +3062,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.205Z",
+      "at": "2026-05-17T09:58:34.995Z",
       "operation": "create",
       "user": "platform@example.com",
       "groups": [
@@ -3074,7 +3074,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.205Z",
+      "at": "2026-05-17T09:58:34.995Z",
       "operation": "create",
       "user": "platform@example.com",
       "groups": [
@@ -3086,7 +3086,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.205Z",
+      "at": "2026-05-17T09:58:34.996Z",
       "operation": "create",
       "user": "admin@example.com",
       "groups": [
@@ -3098,7 +3098,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.205Z",
+      "at": "2026-05-17T09:58:34.996Z",
       "operation": "create",
       "user": "platform@example.com",
       "groups": [
@@ -3110,7 +3110,7 @@
       "allowed": true
     },
     {
-      "at": "2026-05-16T09:44:55.205Z",
+      "at": "2026-05-17T09:58:34.996Z",
       "operation": "create",
       "user": "platform@example.com",
       "groups": [

package/dist/krate-summary.json

@@ -3,7 +3,7 @@
   "description": "Kubernetes-native forge runtime with Argo CD and Krate-managed repository hosting",
   "package": {
     "name": "@a5c-ai/krate",
-    "version": "5.0.1-staging.0d89dd7c4",
+    "version": "5.0.1-staging.2d6ea2736",
     "private": true
   },
   "entrypoints": {
@@ -162,7 +162,7 @@
   "lifecycle": {
     "project": "Krate",
     "version": "0.1.0",
-    "generatedAt": "2026-05-16T09:44:55.215Z",
+    "generatedAt": "2026-05-17T09:58:35.006Z",
     "status": "ready-for-local-development",
     "components": [
       {
@@ -464,7 +464,7 @@
     "ok": true,
     "assertions": []
   },
-  "generatedAt": "2026-05-16T09:44:55.215Z",
+  "generatedAt": "2026-05-17T09:58:35.006Z",
   "controller": {
     "status": "degraded",
     "namespace": "krate-org-default",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a5c-ai/krate",
-  "version": "5.0.1-staging.0d89dd7c4",
+  "version": "5.0.1-staging.2d6ea2736",
   "description": "a5c.ai Krate: Kubernetes-native forge runtime with Argo CD GitOps and Gitea-backed Git hosting.",
   "type": "module",
   "main": "./src/index.js",

package/scripts/validate-ui.mjs

@@ -37,6 +37,7 @@ const required = [
   'apps/web/app/api/auth/callback/[provider]/route.js',
   'apps/web/app/api/auth/logout/route.js',
   'apps/web/app/api/auth/delegated/route.js',
+  'apps/web/app/api/orgs/[org]/agents/events/stream/route.js',
   'src/api-controller.js',
   'src/kubernetes-resource-gateway.js',
   'src/kubernetes-controller.js',
@@ -104,7 +105,7 @@ for (const token of ['export function proxy', 'NextResponse.redirect', 'KRATE_AU
 for (const token of ['spawnSync', 'spawn(', 'kubectl', 'getControllerSnapshot', 'listResource', 'getResource', 'applyResource', 'deleteResource', 'createRepository', 'watchResource', 'auth', 'can-i']) {
   if (!files['src/kubernetes-controller.js'].includes(token)) failures.push(`kubernetes controller missing ${token}`);
 }
-for (const token of ['createKubernetesResourceGateway', 'controller.snapshot()', 'createControllerUiModel']) {
+for (const token of ['getControllerSnapshotAsync', 'fallbackSnapshot', 'controller.snapshot()', 'createControllerUiModel']) {
   if (!files['src/controller-client.js'].includes(token)) failures.push(`controller client missing ${token}`);
 }
 for (const token of ['createKrateApiController', 'resourceGateway', 'withArchitecture', 'krate-api-controller', 'kubernetes-resource-gateway', 'kubernetes-resource-client', 'git-data-plane', 'never owns Kubernetes reconciliation loops', 'KRATE_API_CONTROLLER_BOUNDARY', 'listRepositoriesForForge', 'getRepositoryForgeView', 'krate-kubernetes-reconciler']) {
@@ -133,8 +134,18 @@ for (const token of ['DegradedBanner', 'No repositories are available yet.', 'No
 for (const token of ['KrateControllerRecovery', 'KrateLoadingView', 'KRATE_LOADING_MESSAGES', '/api/controller', 'setRecovered(true)', 'router.refresh()', 'sessionStorage']) {
   if (!(webUiSource() + files['apps/web/app/components/krate-loading.jsx']).includes(token)) failures.push(`recovery loading UI missing ${token}`);
 }
+for (const token of ['KrateRouteLoadingOverlay', 'krate-route-loading-refresh']) {
+  if ((webUiSource() + files['apps/web/app/components/krate-loading.jsx']).includes(token)) failures.push(`route transitions must not render recovery loading UI token ${token}`);
+}
+if (!files['apps/web/app/loading.jsx'].includes('routeLoading') || !files['apps/web/app/loading.jsx'].includes('krateLoadingBar animated')) failures.push('route loading UI must render immediate non-overlay loading feedback');
+if (files['apps/web/app/loading.jsx'].includes('KrateDelayedRouteLoading') || files['apps/web/app/loading.jsx'].includes('return null')) failures.push('route loading UI must not delay or render a blank fallback');
+if (!files['apps/web/app/globals.css'].includes('krateRouteLoadingProgress') || !files['apps/web/app/globals.css'].includes('krateRouteLoadingPhase')) failures.push('route loading UI must animate progress and phase text without client hydration');
+if (!files['apps/web/app/lib/krate-ui.jsx'].includes('useCache: true') || files['apps/web/app/lib/krate-ui.jsx'].includes('useCache: false')) failures.push('Krate page loader must use cached controller snapshots');
 if ((webUiSource() + files['apps/web/app/components/krate-loading.jsx']).includes('Krate workspace degraded or empty')) failures.push('degraded workspace copy should be replaced by recovery loading UI');
 if ((webUiSource() + files['apps/web/app/components/krate-loading.jsx']).includes('window.location.reload')) failures.push('recovery loading UI must not reload the page');
+for (const token of ['text/event-stream', 'globalEventBus', 'KRATE_CONTROLLER_URL', "type: 'connected'"]) {
+  if (!files['apps/web/app/api/orgs/[org]/agents/events/stream/route.js'].includes(token)) failures.push(`events stream route missing ${token}`);
+}
 if (!/\.krateRecoveryOverlay\s*\{[\s\S]*?position:\s*fixed;[\s\S]*?inset:\s*0;/.test(files['apps/web/app/globals.css'])) failures.push('recovery loading UI must be fixed overlay');
 for (const token of ['duplex', 'KRATE_GITEA_HTTP_URL', 'fetch(target', 'degraded']) {
   if (!files['apps/web/app/api/git-proxy/route.js'].includes(token)) failures.push(`git proxy route missing ${token}`);

package/src/controller-client.js

@@ -1,72 +1,112 @@
-import { createControllerUiModel } from './controller-ui.js';
-import { createKrateApiController } from './api-controller.js';
-import { createKubernetesResourceGateway } from './kubernetes-resource-gateway.js';
-import { clearSnapshotCache, staleWhileRevalidate } from './snapshot-cache.js';
+import { createControllerUiModel } from './controller-ui.js';
+import { clearSnapshotCache, staleWhileRevalidate } from './snapshot-cache.js';
 import { getControllerSnapshotAsync } from './kubernetes-controller-async.js';
 
 export { clearSnapshotCache };
 
 const CONTROLLER_REQUEST_TIMEOUT_MS = Number(process.env.KRATE_CONTROLLER_REQUEST_TIMEOUT_MS || 5_000);
 
-export async function fetchControllerUiModel({ controllerUrl = process.env.KRATE_CONTROLLER_URL, fetchImpl = globalThis.fetch, controller = createKrateApiController({ resourceGateway: createKubernetesResourceGateway() }), organization = process.env.KRATE_ORG || null, localFallback = true, requestTimeoutMs = CONTROLLER_REQUEST_TIMEOUT_MS, useCache = true, swrOptions = {} } = {}) {
-  const revalidateFn = async () => {
-    if (controllerUrl) {
-      try {
-        const target = new URL('/api/controller', controllerUrl);
-        if (organization) target.searchParams.set('org', organization);
+export async function fetchControllerUiModel({ controllerUrl = process.env.KRATE_CONTROLLER_URL, fetchImpl = globalThis.fetch, controller = null, organization = process.env.KRATE_ORG || null, localFallback = true, requestTimeoutMs = CONTROLLER_REQUEST_TIMEOUT_MS, useCache = true, swrOptions = {}, fallbackSnapshot = getControllerSnapshotAsync } = {}) {
+  const revalidateFn = async () => {
+    if (controllerUrl) {
+      try {
+        const target = new URL('/api/controller', controllerUrl);
+        if (organization) target.searchParams.set('org', organization);
         const signal = requestTimeoutMs > 0 && globalThis.AbortSignal?.timeout ? AbortSignal.timeout(requestTimeoutMs) : undefined;
         const response = await fetchImpl(target, { cache: 'no-store', ...(signal ? { signal } : {}) });
-        if (!response.ok) throw new Error(`controller API ${response.status}`);
-        return await response.json();
-      } catch (error) {
-        return createControllerUiModel({
-          source: 'kubernetes',
-          namespace: process.env.KRATE_NAMESPACE || 'krate-system',
-          kubectl: { available: false, context: null, errors: [error.message] },
-          resources: {}, crds: [], events: [], permissions: [], storage: {}, commands: []
-        }, { organization });
-      }
-    }
-    if (!localFallback) return unavailableControllerModel('KRATE_CONTROLLER_URL is not configured', organization);
-    return fallbackControllerModel(controller, null, organization);
-  };
+        if (!response.ok) throw new Error(`controller API ${response.status}`);
+        const remoteModel = await response.json();
+        if (localFallback && shouldFallbackFromRemoteModel(remoteModel)) {
+          return fallbackControllerModel({ controller, connectionError: new Error(remoteControllerError(remoteModel) || 'controller returned degraded empty data'), organization, fallbackSnapshot });
+        }
+        if (localFallback && shouldProbeLocalModel(remoteModel)) {
+          const localModel = await fallbackControllerModel({ controller, organization, fallbackSnapshot });
+          if (modelResourceScore(localModel) > modelResourceScore(remoteModel)) return localModel;
+        }
+        return remoteModel;
+      } catch (error) {
+        if (localFallback) return fallbackControllerModel({ controller, connectionError: error, organization, fallbackSnapshot });
+        return unavailableControllerModel(error.message, organization);
+      }
+    }
+    if (!localFallback) return unavailableControllerModel('KRATE_CONTROLLER_URL is not configured', organization);
+    return fallbackControllerModel({ controller, organization, fallbackSnapshot });
+  };
 
   if (!useCache) return revalidateFn();
   return staleWhileRevalidate(organization, revalidateFn, swrOptions);
-}
-
-async function fallbackControllerModel(controller, connectionError = null, organization = null) {
-  try {
-    const snapshot = await getControllerSnapshotAsync().catch(() => controller.snapshot());
-    const model = createControllerUiModel(snapshot, { organization });
-    if (connectionError) model.controller.connection.errors = [connectionError.message, ...(model.controller.connection.errors || [])];
-    return model;
-  } catch (error) {
-    return createControllerUiModel({
-      source: 'kubernetes',
-      namespace: process.env.KRATE_NAMESPACE || 'krate-system',
-      kubectl: { available: false, context: null, errors: [connectionError?.message, error.message].filter(Boolean) },
-      resources: {},
-      crds: [],
-      events: [],
-      permissions: [],
-      storage: {},
-      commands: []
-    }, { organization });
-  }
-}
-
-function unavailableControllerModel(messages, organization = null) {
-  const errors = Array.isArray(messages) ? messages : [messages];
-  return createControllerUiModel({
-    source: 'kubernetes',
-    namespace: process.env.KRATE_NAMESPACE || 'krate-system',
-    kubectl: { available: false, context: null, errors: errors.filter(Boolean) },
-    resources: {},
-    crds: [],
-    events: [],
-    permissions: [],
-    storage: {},
-    commands: []
-  }, { organization });
-}
+}
+
+async function fallbackControllerModel({ controller = null, connectionError = null, organization = null, fallbackSnapshot = getControllerSnapshotAsync } = {}) {
+  try {
+    const snapshot = controller ? await controller.snapshot() : await fallbackSnapshot();
+    const model = createControllerUiModel(snapshot, { organization });
+    if (connectionError) model.controller.connection.errors = [connectionError.message, ...(model.controller.connection.errors || [])];
+    return model;
+  } catch (error) {
+    return createControllerUiModel({
+      source: 'kubernetes',
+      namespace: process.env.KRATE_NAMESPACE || 'krate-system',
+      kubectl: { available: false, context: null, errors: [connectionError?.message, error.message].filter(Boolean) },
+      resources: {},
+      crds: [],
+      events: [],
+      permissions: [],
+      storage: {},
+      commands: []
+    }, { organization });
+  }
+}
+
+
+function shouldProbeLocalModel(model) {
+  if (!model || model.status !== 'ready') return false;
+  const hasLiveConnection = Boolean(model.controller?.connection?.available || model.controller?.apiService);
+  if (!hasLiveConnection) return false;
+  const summaries = Array.isArray(model.resources) ? model.resources : [];
+  const crdKinds = new Set(['Repository', 'RunnerPool', 'Pipeline', 'Job']);
+  const crdItems = summaries
+    .filter((resource) => crdKinds.has(resource?.kind))
+    .reduce((count, resource) => count + Number(resource?.count || resource?.items?.length || 0), 0);
+  return crdItems === 0;
+}
+
+function modelResourceScore(model) {
+  if (!model) return 0;
+  const metricCount = Number(model.metrics?.resources || 0);
+  const summaryCount = Array.isArray(model.resources)
+    ? model.resources.reduce((count, resource) => count + Number(resource?.count || resource?.items?.length || 0), 0)
+    : 0;
+  const dashboardCount = Number(model.views?.dashboard?.repositories?.length || 0);
+  return metricCount + summaryCount + dashboardCount;
+}
+
+function shouldFallbackFromRemoteModel(model) {
+  if (!model || model.status !== 'degraded') return false;
+  const hasLiveConnection = Boolean(model.controller?.connection?.available || model.controller?.apiService);
+  if (hasLiveConnection) return false;
+  const resourceCount = Number(model.metrics?.resources || 0);
+  const hasResourceItems = Array.isArray(model.resources) && model.resources.some((resource) => Number(resource?.count || 0) > 0 || resource?.items?.length);
+  const hasDashboardItems = Number(model.views?.dashboard?.repositories?.length || 0) > 0;
+  const errors = model.controller?.connection?.errors || [];
+  return resourceCount === 0 && !hasResourceItems && !hasDashboardItems && errors.length > 0;
+}
+
+function remoteControllerError(model) {
+  return (model?.controller?.connection?.errors || []).filter(Boolean).join('; ');
+}
+
+function unavailableControllerModel(messages, organization = null) {
+  const errors = Array.isArray(messages) ? messages : [messages];
+  return createControllerUiModel({
+    source: 'kubernetes',
+    namespace: process.env.KRATE_NAMESPACE || 'krate-system',
+    kubectl: { available: false, context: null, errors: errors.filter(Boolean) },
+    resources: {},
+    crds: [],
+    events: [],
+    permissions: [],
+    storage: {},
+    commands: []
+  }, { organization });
+}

package/src/controller-ui.js

@@ -264,13 +264,14 @@ function filterResourceItemsForOrg(definition, items = [], org) {
   return filterByOrg(items, org);
 }
 
-function filterByOrg(items = [], org) {
-  if (!org) return items;
-  return items.filter((item) => {
-    const itemOrg = item.spec?.organizationRef || item.metadata?.labels?.[KRATE_ORG_LABEL];
-    return itemOrg === org;
-  });
-}
+function filterByOrg(items = [], org) {
+  if (!org) return items;
+  const orgNamespace = orgNamespaceName(org);
+  return items.filter((item) => {
+    const itemOrg = item.spec?.organizationRef || item.metadata?.labels?.[KRATE_ORG_LABEL];
+    return itemOrg === org || item.metadata?.namespace === orgNamespace;
+  });
+}
 
 function normalizeSnapshot(source = {}) {
   const raw = typeof source.snapshot === 'function' ? source.snapshot() : source;

package/src/kubernetes-controller-async.js

@@ -53,6 +53,19 @@ function kubectlArgs(args, env) {
   return extra ? [...extra, ...args] : args;
 }
 
+function currentContextResult(env) {
+  if (!inClusterArgs(env)) return null;
+  return {
+    ok: true,
+    status: 0,
+    signal: null,
+    stdout: 'in-cluster\n',
+    stderr: '',
+    error: null,
+    command: 'kubectl config current-context'
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Low-level async kubectl runner
 // ---------------------------------------------------------------------------
@@ -155,8 +168,9 @@ export async function getControllerSnapshotAsync(options = {}) {
 
   try {
     // Phase 1: context + version in parallel
+    const inClusterContext = currentContextResult(env);
     const [contextResult, versionResult] = await Promise.all([
-      runKubectlAsync(['config', 'current-context'], { kubectl, timeoutMs, env, allowFailure: true }),
+      inClusterContext || runKubectlAsync(['config', 'current-context'], { kubectl, timeoutMs, env, allowFailure: true }),
       runKubectlAsync(['version', '--client=true', '-o', 'json'], { kubectl, timeoutMs, env, allowFailure: true })
     ]);
 
@@ -198,7 +212,7 @@ export async function getControllerSnapshotAsync(options = {}) {
     // Fetch platform-scoped resources first so we can derive org namespaces
     const platformResults = await Promise.all(
       platformScopedDefs
-        .filter((d) => discoveredPluralSet.has(`${d.group || KRATE_API_GROUP}/${d.plural}`))
+        .filter((d) => shouldListSnapshotDefinition(d, discoveredPluralSet))
         .map(async (definition) => {
           const resourceNamespace = definition.namespace || namespace;
           const result = await runKubectlAsync(
@@ -218,7 +232,7 @@ export async function getControllerSnapshotAsync(options = {}) {
     // Fetch org-scoped resources in parallel
     const orgResults = await Promise.all(
       orgScopedDefs
-        .filter((d) => discoveredPluralSet.has(`${d.group || KRATE_API_GROUP}/${d.plural}`))
+        .filter((d) => shouldListSnapshotDefinition(d, discoveredPluralSet))
         .map(async (definition) => {
           const namespaces = definition.namespaced === false
             ? [null]
@@ -434,6 +448,12 @@ function namespaceArgs(definition, namespace) {
   return definition.namespaced === false ? [] : ['-n', namespace];
 }
 
+function shouldListSnapshotDefinition(definition, discoveredPluralSet) {
+  const group = definition.group || KRATE_API_GROUP;
+  if (discoveredPluralSet.has(`${group}/${definition.plural}`)) return true;
+  return group === KRATE_API_GROUP;
+}
+
 function parseKubernetesList(stdout) {
   const parsed = safeJson(stdout);
   if (!parsed) return { items: [] };

package/src/kubernetes-controller.js

@@ -445,7 +445,7 @@ export async function getControllerSnapshot(options = {}) {
   const orgScopedDefinitions = snapshotResources.filter((definition) => !definition.platformScoped);
 
   for (const definition of platformScopedDefinitions) {
-    if (!discoveredPluralSet.has(`${definition.group || KRATE_API_GROUP}/${definition.plural}`)) continue;
+    if (!shouldListSnapshotDefinition(definition, discoveredPluralSet)) continue;
     const resourceNamespace = definition.namespace || namespace;
     const result = runKubectl(['get', apiResourceName(definition), ...namespaceArgs(definition, resourceNamespace), '-o', 'json', '--ignore-not-found'], { kubectl, timeoutMs, env, allowFailure: true });
     listResults.push({ definition, result });
@@ -454,7 +454,7 @@ export async function getControllerSnapshot(options = {}) {
 
   const orgNamespaces = organizationNamespaces(resources.Organization, resources.OrgNamespaceBinding, namespace);
   for (const definition of orgScopedDefinitions) {
-    if (!discoveredPluralSet.has(`${definition.group || KRATE_API_GROUP}/${definition.plural}`)) continue;
+    if (!shouldListSnapshotDefinition(definition, discoveredPluralSet)) continue;
     const namespaces = definition.namespaced === false ? [null] : [definition.namespace || null].filter(Boolean).concat(definition.namespace ? [] : orgNamespaces);
     resources[definition.kind] = namespaces.flatMap((resourceNamespace) => {
       const effectiveNamespace = resourceNamespace || namespace;
@@ -819,6 +819,12 @@ function organizationNamespaces(organizations = [], bindings = [], fallbackNames
   return fallbackOrgs.size ? [...fallbackOrgs] : [fallbackNamespace];
 }
 
+function shouldListSnapshotDefinition(definition, discoveredPluralSet) {
+  const group = definition.group || KRATE_API_GROUP;
+  if (discoveredPluralSet.has(`${group}/${definition.plural}`)) return true;
+  return group === KRATE_API_GROUP;
+}
+
 function parseKubernetesList(stdout) {
   const parsed = safeJson(stdout);
   if (!parsed) return { items: [] };

package/tests/controller-client.test.js

@@ -0,0 +1,133 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { fetchControllerUiModel, createControllerUiModel, createResource } from '../src/index.js';
+
+function degradedRemoteModel() {
+  return createControllerUiModel({
+    source: 'controller-api',
+    namespace: 'krate-staging',
+    kubectl: { available: false, context: null, errors: ['fetch failed'] },
+    resources: {},
+    crds: [],
+    events: [],
+    permissions: [],
+    storage: {},
+    commands: []
+  }, { organization: 'default' });
+}
+
+function liveSnapshot() {
+  return {
+    source: 'kubernetes',
+    namespace: 'krate-staging',
+    kubectl: { available: true, context: 'aks-krate-staging', errors: [] },
+    apiService: { metadata: { name: 'v1alpha1.krate.a5c.ai' } },
+    crds: [{ metadata: { name: 'repositories.krate.a5c.ai' } }],
+    resources: {
+      Organization: [createResource('Organization', { name: 'default', namespace: 'krate-system' }, { slug: 'default', namespaceName: 'krate-org-default', displayName: 'Default org' })],
+      Repository: [createResource('Repository', { name: 'test2', namespace: 'krate-org-default' }, { organizationRef: 'default', visibility: 'internal', defaultBranch: 'main' })]
+    },
+    events: [],
+    permissions: [],
+    storage: {},
+    commands: []
+  };
+}
+
+test('fetchControllerUiModel falls back to local snapshot when remote controller returns degraded empty data', async () => {
+  const calls = [];
+  const model = await fetchControllerUiModel({
+    controllerUrl: 'http://krate-api.krate-staging.svc.cluster.local',
+    organization: 'default',
+    useCache: false,
+    fetchImpl: async () => ({ ok: true, json: async () => degradedRemoteModel() }),
+    controller: { async snapshot() { calls.push('snapshot'); return liveSnapshot(); } }
+  });
+
+  assert.deepEqual(calls, ['snapshot']);
+  assert.equal(model.status, 'ready');
+  assert.equal(model.metrics.repositories, 1);
+  assert.equal(model.views.dashboard.repositories[0].metadata.name, 'test2');
+  assert.ok(model.controller.connection.errors.length > 0);
+});
+
+test('fetchControllerUiModel falls back to local snapshot when remote controller fetch throws', async () => {
+  const model = await fetchControllerUiModel({
+    controllerUrl: 'http://krate-api.krate-staging.svc.cluster.local',
+    organization: 'default',
+    useCache: false,
+    fetchImpl: async () => { throw new Error('connect ECONNREFUSED'); },
+    controller: { async snapshot() { return liveSnapshot(); } }
+  });
+
+  assert.equal(model.status, 'ready');
+  assert.equal(model.metrics.repositories, 1);
+  assert.match(model.controller.connection.errors[0], /ECONNREFUSED/);
+});
+test('fetchControllerUiModel uses bounded async fallback when remote controller hangs', async () => {
+  const calls = [];
+  const model = await fetchControllerUiModel({
+    controllerUrl: 'http://krate-api.krate-staging.svc.cluster.local',
+    organization: 'default',
+    requestTimeoutMs: 10,
+    useCache: false,
+    fetchImpl: async (_target, options = {}) => new Promise((_resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error('remote controller hung')), 25);
+      options.signal?.addEventListener('abort', () => {
+        clearTimeout(timer);
+        reject(new Error('remote controller hung'));
+      }, { once: true });
+    }),
+    fallbackSnapshot: async () => { calls.push('fallbackSnapshot'); return liveSnapshot(); }
+  });
+
+  assert.deepEqual(calls, ['fallbackSnapshot']);
+  assert.equal(model.status, 'ready');
+  assert.equal(model.metrics.repositories, 1);
+  assert.match(model.controller.connection.errors.join('; '), /remote controller hung/);
+});
+
+test('fetchControllerUiModel uses async fallback for degraded empty remote data without constructing sync controller', async () => {
+  const calls = [];
+  const model = await fetchControllerUiModel({
+    controllerUrl: 'http://krate-api.krate-staging.svc.cluster.local',
+    organization: 'default',
+    useCache: false,
+    fetchImpl: async () => ({ ok: true, json: async () => degradedRemoteModel() }),
+    fallbackSnapshot: async () => { calls.push('fallbackSnapshot'); return liveSnapshot(); }
+  });
+
+  assert.deepEqual(calls, ['fallbackSnapshot']);
+  assert.equal(model.status, 'ready');
+  assert.equal(model.views.dashboard.repositories[0].metadata.name, 'test2');
+  assert.ok(model.controller.connection.errors.length > 0);
+});
+
+
+test('fetchControllerUiModel probes local snapshot when remote controller is ready but missing CRD-backed resources', async () => {
+  const calls = [];
+  const emptyRemote = createControllerUiModel({
+    source: 'kubernetes',
+    namespace: 'krate-staging',
+    kubectl: { available: true, context: 'aks-krate-staging', errors: [] },
+    apiService: { metadata: { name: 'v1alpha1.krate.a5c.ai' } },
+    resources: {},
+    crds: [],
+    events: [],
+    permissions: [],
+    storage: {},
+    commands: []
+  }, { organization: 'default' });
+
+  const model = await fetchControllerUiModel({
+    controllerUrl: 'http://krate-api.krate-staging.svc.cluster.local',
+    organization: 'default',
+    useCache: false,
+    fetchImpl: async () => ({ ok: true, json: async () => emptyRemote }),
+    fallbackSnapshot: async () => { calls.push('fallbackSnapshot'); return liveSnapshot(); }
+  });
+
+  assert.deepEqual(calls, ['fallbackSnapshot']);
+  assert.equal(model.metrics.repositories, 1);
+  assert.equal(model.views.dashboard.repositories[0].metadata.name, 'test2');
+});

package/tests/deployment.test.js

@@ -222,8 +222,10 @@ test('web UI is wired to the Kubernetes controller API instead of a static local
   assert.ok(client.includes('AbortSignal.timeout'));
   assert.ok(client.includes('if (!useCache) return revalidateFn();'));
   assert.ok(client.includes('staleWhileRevalidate(organization, revalidateFn, swrOptions)'));
-  assert.ok(client.includes('createKrateApiController'));
-  assert.ok(client.includes('createKubernetesResourceGateway'));
+  assert.ok(client.includes('getControllerSnapshotAsync'));
+  assert.ok(client.includes('fallbackSnapshot'));
+  assert.ok(!client.includes('createKubernetesResourceGateway'));
+  assert.ok(!client.includes('createKrateApiController')); 
   assert.ok(apiController.includes('resourceGateway'));
   assert.ok(apiController.includes('withArchitecture'));
   assert.ok(apiController.includes('kubernetes-resource-gateway'));
@@ -234,7 +236,7 @@ test('web UI is wired to the Kubernetes controller API instead of a static local
   assert.ok(gateway.includes('repositoryManifest'));
   assert.ok(shell.includes('/api/controller'));
   assert.ok(webControllerRoute.includes('KRATE_CONTROLLER_URL'));
-  assert.ok(!webControllerRoute.includes('createKrateApiController'), 'web API route proxies the controller service instead of shelling out through local kubectl');
+  assert.ok(webControllerRoute.includes('hydrateOrgResourceSummaries'), 'web API route hydrates empty controller summaries from org-scoped resources');
   assert.ok(shell.includes('ArchitectureMap'));
   assert.ok(shell.includes('Repository home'));
   assert.ok(shell.includes('IssueWorkspace'));

package/tests/e2e/lifecycle.test.js

@@ -43,7 +43,8 @@ test('chart package contains the MVP Kubernetes install surface', () => {
 
   for (const file of requiredChartFiles) assert.equal(existsSync(file), true, `${file} exists`);
 
-  const chart = requiredChartFiles.map((file) => readFileSync(file, 'utf8')).join('\n');
+  const chart = requiredChartFiles.map((file) => readFileSync(file, 'utf8')).join('\n');
+  const values = readFileSync('../charts/values.yaml', 'utf8');
 
   for (const kind of ['CustomResourceDefinition', 'Deployment', 'Service', 'ServiceAccount', 'ClusterRole', 'NetworkPolicy', 'PersistentVolumeClaim']) assert.ok(chart.includes(`kind: ${kind}`), `chart includes ${kind}`);
 
@@ -64,6 +65,8 @@ test('chart package contains the MVP Kubernetes install surface', () => {
   assert.ok(chart.includes('repositorypermissions.krate.a5c.ai'), 'package includes Gitea permission reconciliation resources');
   assert.ok(chart.includes('revoked'), 'package access CRDs allow revocation state');
   assert.ok(chart.includes('KRATE_CONTROLLER_URL'), 'web deployment points at the in-cluster controller API');
+  assert.ok(values.includes('port: 80'), 'controller API service exposes an HTTP service port for in-cluster web fetches');
+  assert.ok(!values.includes('port: 443'), 'controller API does not expose plain HTTP through a TLS-looking service port');
   assert.ok(chart.includes('containerPort: 2222'), 'rootless Gitea SSH service targets port 2222');
   assert.ok(chart.includes('krate.fullname') && chart.includes('gitea-http'), 'Gitea and Argo CD URLs derive the release-scoped service name');
   assert.ok(chart.includes('krate.a5c.ai/gitops-engine: argocd'), 'package labels Argo CD GitOps engine');

package/tests/krate.test.js

@@ -329,6 +329,29 @@ test('Delegated identity route redirects localhost fallback even when Kubernetes
   }
 });
 
+
+
+test('controller UI model keeps namespace-scoped resources visible for their org', () => {
+  const model = createControllerUiModel({
+    source: 'kubernetes',
+    namespace: 'krate-system',
+    generatedAt: 'test-time',
+    kubectl: { available: true, context: 'kind-krate', errors: [] },
+    crds: [],
+    resources: {
+      Organization: [{ apiVersion: 'krate.a5c.ai/v1alpha1', kind: 'Organization', metadata: { name: 'default', namespace: 'krate-system' }, spec: { slug: 'default', namespaceName: 'krate-org-default' } }],
+      RunnerPool: [{ apiVersion: 'krate.a5c.ai/v1alpha1', kind: 'RunnerPool', metadata: { name: 'default', namespace: 'krate-org-default' }, spec: { image: 'ubuntu:24.04' } }]
+    },
+    events: [],
+    permissions: [],
+    storage: {},
+    commands: []
+  }, { organization: 'default' });
+
+  assert.equal(model.metrics.runnerPools, 1);
+  assert.deepEqual(model.resources.find((resource) => resource.kind === 'RunnerPool').names, ['default']);
+});
+
 test('Krate delivery resources surface through controller UI model', () => {
   const model = createControllerUiModel({
     source: 'kubernetes',

package/tests/snapshot-performance.test.js

@@ -3,6 +3,9 @@
  */
 
 import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import test from 'node:test';
 import { runKubectlAsync, getPartialSnapshot, getControllerSnapshotAsync } from '../src/kubernetes-controller-async.js';
 import {
@@ -83,6 +86,71 @@ test('runKubectlAsync rejects on timeout when allowFailure is not set', async ()
   );
 });
 
+
+test('getControllerSnapshotAsync uses in-cluster service account instead of kubeconfig current-context', async () => {
+  const tempDir = await mkdtemp(path.join(tmpdir(), 'krate-sa-'));
+  const kubectlPath = path.join(tempDir, process.platform === 'win32' ? 'kubectl.cmd' : 'kubectl');
+  const kubectlScript = process.platform === 'win32'
+    ? '@echo off\r\nnode -e "const args=process.argv.slice(1); if(args.includes(\'version\')){console.log(JSON.stringify({clientVersion:{gitVersion:\'v1.32.2\'}})); process.exit(0)} if(args.includes(\'current-context\')){console.error(\'current-context should not be called\'); process.exit(9)} console.log(JSON.stringify({items:[]}));" -- %*\r\n'
+    : '#!/usr/bin/env sh\nnode -e "const args=process.argv.slice(1); if(args.includes(\'version\')){console.log(JSON.stringify({clientVersion:{gitVersion:\'v1.32.2\'}})); process.exit(0)} if(args.includes(\'current-context\')){console.error(\'current-context should not be called\'); process.exit(9)} console.log(JSON.stringify({items:[]}));" -- "$@"\n';
+
+  try {
+    await writeFile(path.join(tempDir, 'token'), 'token');
+    await writeFile(path.join(tempDir, 'ca.crt'), 'ca');
+    await writeFile(kubectlPath, kubectlScript, { mode: 0o755 });
+
+    const snapshot = await getControllerSnapshotAsync({
+      kubectl: kubectlPath,
+      timeoutMs: 500,
+      env: {
+        KUBERNETES_SERVICE_HOST: '10.0.0.1',
+        KUBERNETES_SERVICE_PORT: '443',
+        KRATE_SERVICE_ACCOUNT_DIR: tempDir
+      }
+    });
+
+    assert.equal(snapshot.kubectl.context, 'in-cluster');
+    if (process.platform !== 'win32') assert.equal(snapshot.kubectl.available, true);
+    assert.doesNotMatch((snapshot.kubectl.errors || []).join('; '), /current-context/);
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+
+test('full async snapshot lists known Krate CRDs even when CRD discovery is empty', async () => {
+  const tempDir = await mkdtemp(path.join(tmpdir(), 'krate-known-crds-'));
+  const fakePath = path.join(tempDir, 'fake-kubectl.cjs');
+  const fakeScript = `
+const args = process.argv.slice(1);
+const joined = args.join(' ');
+const has = (value) => args.includes(value) || joined.includes(value);
+if (has('current-context')) { console.log('kind-krate'); process.exit(0); }
+if (has('version')) { console.log(JSON.stringify({ clientVersion: { gitVersion: 'v1.test' } })); process.exit(0); }
+if (has('apiservice')) { console.log(JSON.stringify({ metadata: { name: 'v1alpha1.krate.a5c.ai' } })); process.exit(0); }
+if (has('crd')) { console.error('crd discovery unavailable'); process.exit(1); }
+if (has('runnerpools.krate.a5c.ai')) {
+  console.log(JSON.stringify({ items: [{ apiVersion: 'krate.a5c.ai/v1alpha1', kind: 'RunnerPool', metadata: { name: 'default', namespace: 'krate-org-default', labels: { 'krate.a5c.ai/org': 'default' } }, spec: { organizationRef: 'default', image: 'ubuntu:24.04' } }] }));
+  process.exit(0);
+}
+console.log(JSON.stringify({ items: [] }));
+process.exit(0);
+`;
+
+  try {
+    await writeFile(fakePath, fakeScript);
+    const snapshot = await getControllerSnapshotAsync({
+      kubectl: process.execPath,
+      timeoutMs: 1000,
+      env: { KRATE_ORG: 'default', NODE_OPTIONS: `--require ${fakePath}` }
+    });
+    assert.equal(snapshot.resources.RunnerPool.length, 1);
+    assert.equal(snapshot.resources.RunnerPool[0].metadata.name, 'default');
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
 // ---------------------------------------------------------------------------
 // getPartialSnapshot
 // ---------------------------------------------------------------------------