@a5c-ai/krate 5.0.1-staging.f672fe79b

package/dist/krate-controller-ui.json

@@ -0,0 +1,2407 @@
+{
+  "product": "Krate",
+  "status": "degraded",
+  "namespace": "krate-org-default",
+  "platformNamespace": "krate-org-default",
+  "org": {
+    "name": "default",
+    "slug": "default",
+    "displayName": "Default org",
+    "namespace": "krate-org-default",
+    "platformNamespace": "krate-org-default"
+  },
+  "orgs": [
+    {
+      "name": "default",
+      "slug": "default",
+      "displayName": "Default org",
+      "namespace": "krate-org-default",
+      "platformNamespace": "krate-org-default"
+    }
+  ],
+  "generatedAt": "2026-05-11T20:52:22.916Z",
+  "correlationId": null,
+  "controller": {
+    "mode": "krate-workspace",
+    "endpoints": [
+      {
+        "method": "GET",
+        "path": "/healthz",
+        "purpose": "container and load-balancer health"
+      },
+      {
+        "method": "GET",
+        "path": "/api/controller?org=:org",
+        "purpose": "live Krate org model"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/resources",
+        "purpose": "org-scoped Krate resource listing"
+      },
+      {
+        "method": "POST",
+        "path": "/api/orgs/:org/resources",
+        "purpose": "org-scoped Krate resource apply flow"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/resources/:kind/:name",
+        "purpose": "org-scoped Krate resource detail"
+      },
+      {
+        "method": "DELETE",
+        "path": "/api/orgs/:org/resources/:kind/:name",
+        "purpose": "org-scoped Krate resource delete flow"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/repositories",
+        "purpose": "list org repositories through Krate"
+      },
+      {
+        "method": "POST",
+        "path": "/api/orgs/:org/repositories",
+        "purpose": "create org repositories through Krate"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/repositories/:name",
+        "purpose": "get org repository details through Krate"
+      },
+      {
+        "method": "DELETE",
+        "path": "/api/orgs/:org/repositories/:name",
+        "purpose": "delete org repositories through Krate"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/policies",
+        "purpose": "list Krate policy profiles, templates, bindings, Kyverno health, and exception requests"
+      },
+      {
+        "method": "POST",
+        "path": "/api/orgs/:org/policies",
+        "purpose": "create org policy bindings in audit or enforce mode"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/policy-reports",
+        "purpose": "list normalized Kyverno policy report results"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/policy-exception-requests",
+        "purpose": "list pending and approved Krate policy exception requests"
+      },
+      {
+        "method": "POST",
+        "path": "/api/orgs/:org/policy-exception-requests",
+        "purpose": "request a temporary policy exception through Krate"
+      },
+      {
+        "method": "GET",
+        "path": "/api/watch/orgs/:org/*",
+        "purpose": "org-scoped Krate live event stream bridged to browser updates"
+      },
+      {
+        "method": "POST",
+        "path": "/api/git-proxy",
+        "purpose": "repository streaming proxy when configured"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/stacks",
+        "purpose": "list agent stacks and capability status"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/runs",
+        "purpose": "list agent dispatch runs with queue and status"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/rules",
+        "purpose": "list trigger rules and delivery status"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/sessions",
+        "purpose": "list agent sessions with lifecycle state"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/workspaces",
+        "purpose": "list agent workspaces with lifecycle state"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/approvals",
+        "purpose": "list pending and resolved agent approvals"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/permissions/review",
+        "purpose": "explainable permission check for agent dispatch"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/adapters",
+        "purpose": "list agent adapters and transport bindings"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/providers",
+        "purpose": "list model provider configurations"
+      },
+      {
+        "method": "GET",
+        "path": "/api/orgs/:org/agents/projects",
+        "purpose": "list agent projects with board config"
+      },
+      {
+        "method": "POST",
+        "path": "/api/orgs/:org/agents/dispatch",
+        "purpose": "create manual agent dispatch run"
+      },
+      {
+        "method": "POST",
+        "path": "/api/orgs/:org/agents/approvals/:name/decide",
+        "purpose": "approve or deny a pending agent approval request"
+      },
+      {
+        "method": "POST",
+        "path": "/api/orgs/:org/agents/triggers/process",
+        "purpose": "evaluate an event against trigger rules and dispatch matching agents"
+      }
+    ],
+    "architecture": {
+      "apiController": {
+        "role": "krate-api-controller",
+        "scope": "HTTP route orchestration, request validation, API errors, and workflow affordances; never owns delivery reconciliation loops",
+        "owns": [
+          "/api/controller",
+          "/api/orgs/:org/resources",
+          "/api/orgs/:org/repositories",
+          "/api/watch/orgs/:org/*"
+        ],
+        "delegatesTo": [
+          "krate-resource-gateway",
+          "repository-service"
+        ]
+      },
+      "resourceGateway": {
+        "role": "krate-resource-gateway",
+        "scope": "Narrow application port translating API controller intent into Krate resource-client calls",
+        "namespace": "krate-org-default",
+        "delegatesTo": [
+          "krate-resource-client"
+        ]
+      },
+      "resourceClient": {
+        "role": "krate-resource-client",
+        "scope": "Krate resource operations and live streams; no UI flow ownership",
+        "namespace": "krate-org-default",
+        "owns": [
+          "Krate resources",
+          "aggregated API resources"
+        ]
+      },
+      "deliveryReconciler": {
+        "role": "krate-delivery-reconciler",
+        "scope": "Repository status projection, repository hosting intent, policy projection, and data-plane sync intent; never owns HTTP routes or browser flows",
+        "namespace": "krate-org-default",
+        "delegatesTo": [
+          "krate-resource-gateway",
+          "repository-service"
+        ]
+      },
+      "repositoryService": {
+        "role": "repository-service",
+        "scope": "repository streaming and SSH hosting, object storage, and search indexing",
+        "boundary": "repository service not configured"
+      }
+    },
+    "storage": {
+      "etcd": [
+        "Repository",
+        "BranchProtection",
+        "RefPolicy",
+        "RunnerPool",
+        "WebhookSubscription",
+        "Team",
+        "User",
+        "IdentityMapping",
+        "Invite",
+        "AuthProvider",
+        "AuthProvider"
+      ],
+      "postgres": []
+    },
+    "connection": {
+      "available": false,
+      "context": null,
+      "errors": [
+        "runtime snapshot supplied outside the Krate workspace path"
+      ]
+    },
+    "apiService": null,
+    "commands": []
+  },
+  "metrics": {
+    "components": 8,
+    "resources": 11,
+    "events": 11,
+    "auditEntries": 0,
+    "users": 1,
+    "teams": 1,
+    "invites": 1,
+    "repositories": 1,
+    "pullRequests": 0,
+    "pipelines": 0,
+    "jobs": 0,
+    "runnerPools": 1,
+    "webhookDeliveries": 0,
+    "policyViolations": 0,
+    "policyBindings": 0,
+    "deployments": 0,
+    "releases": 0,
+    "agentStacks": 0,
+    "agentRuns": 0,
+    "agentSessions": 0,
+    "greenChecks": 5,
+    "totalChecks": 6
+  },
+  "components": [
+    {
+      "id": "identity-access",
+      "title": "Identity and access",
+      "area": "identity",
+      "resources": [
+        "User",
+        "Team",
+        "Invite",
+        "IdentityMapping",
+        "AuthProvider"
+      ],
+      "docs": "src/auth.js"
+    },
+    {
+      "id": "api-controller",
+      "title": "Krate API controller",
+      "area": "api",
+      "resources": [
+        "Repository",
+        "PullRequest",
+        "Pipeline"
+      ],
+      "docs": "src/api-controller.js"
+    },
+    {
+      "id": "krate-resource-client",
+      "title": "Krate resource client",
+      "area": "control-plane",
+      "resources": [
+        "Repository",
+        "BranchProtection",
+        "RefPolicy"
+      ],
+      "docs": "src/kubernetes-controller.js"
+    },
+    {
+      "id": "repository-service",
+      "title": "Repository service",
+      "area": "data-plane",
+      "resources": [
+        "Repository",
+        "BranchProtection",
+        "RefPolicy"
+      ],
+      "docs": "src/data-plane.js"
+    },
+    {
+      "id": "runners-ci",
+      "title": "Runner scheduler",
+      "area": "ci",
+      "resources": [
+        "RunnerPool",
+        "Pipeline",
+        "Job"
+      ],
+      "docs": "src/kubernetes-controller.js"
+    },
+    {
+      "id": "hooks-events",
+      "title": "Webhook bus",
+      "area": "events",
+      "resources": [
+        "WebhookSubscription",
+        "WebhookDelivery"
+      ],
+      "docs": "src/kubernetes-controller.js"
+    },
+    {
+      "id": "policy-engine",
+      "title": "Kyverno policy engine",
+      "area": "policy",
+      "resources": [
+        "PolicyProfile",
+        "PolicyTemplate",
+        "PolicyBinding",
+        "PolicyExceptionRequest"
+      ],
+      "docs": "docs/todo-kyverno"
+    },
+    {
+      "id": "agent-orchestration",
+      "title": "Agent orchestration",
+      "area": "agents",
+      "resources": [
+        "AgentStack",
+        "AgentDispatchRun",
+        "AgentTriggerRule",
+        "AgentSession",
+        "AgentWorkspace",
+        "AgentApproval",
+        "AgentAdapter",
+        "AgentProviderConfig",
+        "AgentProject"
+      ],
+      "docs": "docs/agents/"
+    }
+  ],
+  "resources": [
+    {
+      "kind": "Organization",
+      "plural": "organizations",
+      "apiResource": "organizations.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open Organization records in krate-org-default",
+        "watch": "Watch Organization updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Organization in krate-org-default"
+      }
+    },
+    {
+      "kind": "OrgNamespaceBinding",
+      "plural": "orgnamespacebindings",
+      "apiResource": "orgnamespacebindings.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open OrgNamespaceBinding records in krate-org-default",
+        "watch": "Watch OrgNamespaceBinding updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete OrgNamespaceBinding in krate-org-default"
+      }
+    },
+    {
+      "kind": "User",
+      "plural": "users",
+      "apiResource": "users.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "admin"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "User",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {
+              "role": "admin"
+            },
+            "annotations": {},
+            "name": "admin",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "displayName": "Admin",
+            "email": "admin@example.com",
+            "username": "admin",
+            "teams": [
+              "maintainers"
+            ],
+            "admin": true,
+            "disabled": false
+          },
+          "status": {
+            "phase": "Active",
+            "lastLoginProvider": "sso",
+            "groups": [
+              "system:authenticated",
+              "krate:users",
+              "krate:platform-engineers"
+            ],
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Active": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: User\nmetadata:\n  namespace: krate-org-default\n  labels:\n    role: admin\n  annotations:\n  name: admin\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  displayName: Admin\n  email: admin@example.com\n  username: admin\n  teams:\n    - maintainers\n  admin: true\n  disabled: false\nstatus:\n  phase: Active\n  lastLoginProvider: sso\n  groups:\n    - system:authenticated\n    - krate:users\n    - krate:platform-engineers\n  storage: etcd\n",
+      "action": {
+        "list": "Open User records in krate-org-default",
+        "watch": "Watch User updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete User in krate-org-default"
+      }
+    },
+    {
+      "kind": "Team",
+      "plural": "teams",
+      "apiResource": "teams.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "maintainers"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "Team",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {},
+            "annotations": {},
+            "name": "maintainers",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "displayName": "Maintainers",
+            "members": [
+              "admin"
+            ],
+            "maintainers": [
+              "admin"
+            ],
+            "repositoryGrants": [
+              {
+                "repository": "krate-demo",
+                "permission": "admin"
+              }
+            ]
+          },
+          "status": {
+            "phase": "Active",
+            "memberCount": 1,
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Active": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: Team\nmetadata:\n  namespace: krate-org-default\n  labels:\n  annotations:\n  name: maintainers\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  displayName: Maintainers\n  members:\n    - admin\n  maintainers:\n    - admin\n  repositoryGrants:\n    - repository: krate-demo\n      permission: admin\nstatus:\n  phase: Active\n  memberCount: 1\n  storage: etcd\n",
+      "action": {
+        "list": "Open Team records in krate-org-default",
+        "watch": "Watch Team updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Team in krate-org-default"
+      }
+    },
+    {
+      "kind": "Invite",
+      "plural": "invites",
+      "apiResource": "invites.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "new-user-example-com"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "Invite",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {
+              "role": "member"
+            },
+            "annotations": {},
+            "name": "new-user-example-com",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "email": "new-user@example.com",
+            "role": "member",
+            "teams": [
+              "maintainers"
+            ],
+            "invitedBy": "admin",
+            "expiresAt": "2026-05-18T20:52:22.913Z"
+          },
+          "status": {
+            "phase": "Pending",
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Pending": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: Invite\nmetadata:\n  namespace: krate-org-default\n  labels:\n    role: member\n  annotations:\n  name: new-user-example-com\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  email: new-user@example.com\n  role: member\n  teams:\n    - maintainers\n  invitedBy: admin\n  expiresAt: 2026-05-18T20:52:22.913Z\nstatus:\n  phase: Pending\n  storage: etcd\n",
+      "action": {
+        "list": "Open Invite records in krate-org-default",
+        "watch": "Watch Invite updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Invite in krate-org-default"
+      }
+    },
+    {
+      "kind": "IdentityMapping",
+      "plural": "identitymappings",
+      "apiResource": "identitymappings.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "sso-admin"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "IdentityMapping",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {},
+            "annotations": {},
+            "name": "sso-admin",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "user": "admin",
+            "provider": "sso",
+            "subject": "user:admin",
+            "email": "admin@example.com",
+            "workspaceIdentity": {
+              "name": "admin@example.com",
+              "uid": "user:admin",
+              "groups": [
+                "system:authenticated",
+                "krate:users",
+                "krate:platform-engineers"
+              ]
+            },
+            "repositoryIdentity": {
+              "username": "admin",
+              "email": "admin@example.com"
+            }
+          },
+          "status": {
+            "phase": "Synced",
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Synced": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: IdentityMapping\nmetadata:\n  namespace: krate-org-default\n  labels:\n  annotations:\n  name: sso-admin\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  user: admin\n  provider: sso\n  subject: user:admin\n  email: admin@example.com\n  workspaceIdentity:\n    name: admin@example.com\n    uid: user:admin\n    groups:\n      - system:authenticated\n      - krate:users\n      - krate:platform-engineers\n  repositoryIdentity:\n    username: admin\n    email: admin@example.com\nstatus:\n  phase: Synced\n  storage: etcd\n",
+      "action": {
+        "list": "Open IdentityMapping records in krate-org-default",
+        "watch": "Watch IdentityMapping updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete IdentityMapping in krate-org-default"
+      }
+    },
+    {
+      "kind": "AuthProvider",
+      "plural": "authproviders",
+      "apiResource": "authproviders.krate.a5c.ai",
+      "count": 2,
+      "names": [
+        "github",
+        "sso"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "AuthProvider",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {},
+            "annotations": {},
+            "name": "github",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "type": "github",
+            "label": "GitHub",
+            "enabled": true,
+            "scopes": "read:user user:email",
+            "delegatedIdentity": {
+              "enabled": false,
+              "userHeader": "x-forwarded-user",
+              "groupsHeader": "x-forwarded-groups",
+              "emailHeader": "x-forwarded-email",
+              "localDevelopment": {
+                "enabled": true,
+                "user": "local-developer",
+                "email": "",
+                "groups": "krate:repo-admins"
+              }
+            }
+          },
+          "status": {
+            "phase": "Configured",
+            "clientConfigured": false,
+            "storage": "etcd"
+          }
+        },
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "AuthProvider",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {},
+            "annotations": {},
+            "name": "sso",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "type": "oidc",
+            "label": "Workspace SSO",
+            "enabled": false,
+            "scopes": "openid profile email groups",
+            "delegatedIdentity": {
+              "enabled": false,
+              "userHeader": "x-forwarded-user",
+              "groupsHeader": "x-forwarded-groups",
+              "emailHeader": "x-forwarded-email",
+              "localDevelopment": {
+                "enabled": true,
+                "user": "local-developer",
+                "email": "",
+                "groups": "krate:repo-admins"
+              }
+            }
+          },
+          "status": {
+            "phase": "Disabled",
+            "clientConfigured": false,
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Configured": 1,
+        "Disabled": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: AuthProvider\nmetadata:\n  namespace: krate-org-default\n  labels:\n  annotations:\n  name: github\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  type: github\n  label: GitHub\n  enabled: true\n  scopes: read:user user:email\n  delegatedIdentity:\n    enabled: false\n    userHeader: x-forwarded-user\n    groupsHeader: x-forwarded-groups\n    emailHeader: x-forwarded-email\n    localDevelopment:\n      enabled: true\n      user: local-developer\n      email: \n      groups: krate:repo-admins\nstatus:\n  phase: Configured\n  clientConfigured: false\n  storage: etcd\n",
+      "action": {
+        "list": "Open AuthProvider records in krate-org-default",
+        "watch": "Watch AuthProvider updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete AuthProvider in krate-org-default"
+      }
+    },
+    {
+      "kind": "Repository",
+      "plural": "repositories",
+      "apiResource": "repositories.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "krate-demo"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "Repository",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {
+              "gitBackend": "gitea"
+            },
+            "annotations": {},
+            "name": "krate-demo",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "visibility": "private",
+            "gitHosting": {
+              "backend": "gitea",
+              "owner": "krate",
+              "repository": "krate-demo",
+              "branch": "main",
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git",
+              "deployKeyTitle": "krate-argocd",
+              "organization": {
+                "kind": "Organization",
+                "name": "krate",
+                "delegatedTo": "Gitea /api/v1/orgs"
+              },
+              "sshKeys": {
+                "kind": "SSHKey",
+                "scopes": [
+                  "user",
+                  "deploy",
+                  "argocd"
+                ],
+                "delegatedTo": "Gitea /api/v1/user/keys and /repos/{owner}/{repo}/keys"
+              },
+              "permissions": {
+                "kind": "RepositoryPermission",
+                "defaultCollaborator": "write",
+                "adminTeam": "maintainers",
+                "delegatedTo": "Gitea collaborators and team repository APIs"
+              },
+              "forgeRecords": {
+                "issues": "Gitea /repos/{owner}/{repo}/issues",
+                "pullRequests": "Gitea /repos/{owner}/{repo}/pulls"
+              },
+              "webhookUrl": "http://krate-webhook-worker/repositories/krate-org-default/krate-demo",
+              "integrationPlan": {
+                "backend": "gitea",
+                "operations": [
+                  {
+                    "action": "createOrganization",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "createRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo"
+                  },
+                  {
+                    "action": "ensureUserMappings",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "addDeployKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "krate-argocd",
+                    "readOnly": false
+                  },
+                  {
+                    "action": "addUserSshKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "developer key"
+                  },
+                  {
+                    "action": "addCollaborator",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "permission": "write"
+                  },
+                  {
+                    "action": "addTeamRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "team": "maintainers",
+                    "permission": "admin"
+                  },
+                  {
+                    "action": "protectBranch",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "branch": "main"
+                  },
+                  {
+                    "action": "createWebhook",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "url": "http://krate-webhook-worker/repositories/krate-org-default/krate-demo"
+                  }
+                ]
+              }
+            },
+            "storage": {
+              "mode": "gitea",
+              "persistentVolumeClaim": "krate-gitea-data",
+              "owner": "krate",
+              "repository": "krate-demo",
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git"
+            },
+            "objectStorage": {
+              "lfs": true,
+              "artifacts": true
+            },
+            "search": {
+              "provider": "zoekt",
+              "enabled": false
+            }
+          },
+          "status": {
+            "ready": true,
+            "route": {
+              "repositoryName": "krate-demo",
+              "backend": "gitea",
+              "owner": "krate",
+              "store": "gitea-primary",
+              "receivePackReady": true,
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git"
+            },
+            "gitHosting": {
+              "backend": "gitea",
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git",
+              "integrationPlan": {
+                "backend": "gitea",
+                "operations": [
+                  {
+                    "action": "createOrganization",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "createRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo"
+                  },
+                  {
+                    "action": "ensureUserMappings",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "addDeployKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "krate-argocd",
+                    "readOnly": false
+                  },
+                  {
+                    "action": "addUserSshKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "developer key"
+                  },
+                  {
+                    "action": "addCollaborator",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "permission": "write"
+                  },
+                  {
+                    "action": "addTeamRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "team": "maintainers",
+                    "permission": "admin"
+                  },
+                  {
+                    "action": "protectBranch",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "branch": "main"
+                  },
+                  {
+                    "action": "createWebhook",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "url": "http://krate-webhook-worker/repositories/krate-org-default/krate-demo"
+                  }
+                ]
+              }
+            },
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Ready": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: Repository\nmetadata:\n  namespace: krate-org-default\n  labels:\n    gitBackend: gitea\n  annotations:\n  name: krate-demo\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  visibility: private\n  gitHosting:\n    backend: gitea\n    owner: krate\n    repository: krate-demo\n    branch: main\n    httpUrl: http://krate-gitea-http:3000/krate/krate-demo.git\n    sshUrl: ssh://git@krate-gitea-ssh/krate/krate-demo.git\n    deployKeyTitle: krate-argocd\n    organization:\n      kind: Organization\n      name: krate\n      delegatedTo: Gitea /api/v1/orgs\n    sshKeys:\n      kind: SSHKey\n      scopes:\n        - user\n        - deploy\n        - argocd\n      delegatedTo: Gitea /api/v1/user/keys and /repos/{owner}/{repo}/keys\n    permissions:\n      kind: RepositoryPermission\n      defaultCollaborator: write\n      adminTeam: maintainers\n      delegatedTo: Gitea collaborators and team repository APIs\n    forgeRecords:\n      issues: Gitea /repos/{owner}/{repo}/issues\n      pullRequests: Gitea /repos/{owner}/{repo}/pulls\n    webhookUrl: http://krate-webhook-worker/repositories/krate-org-default/krate-demo\n    integrationPlan:\n      backend: gitea\n      operations:\n        - action: createOrganization\n          owner: krate\n        - action: createRepository\n          owner: krate\n          repo: krate-demo\n        - action: ensureUserMappings\n          owner: krate\n        - action: addDeployKey\n          owner: krate\n          repo: krate-demo\n          title: krate-argocd\n          readOnly: false\n        - action: addUserSshKey\n          owner: krate\n          repo: krate-demo\n          title: developer key\n        - action: addCollaborator\n          owner: krate\n          repo: krate-demo\n          permission: write\n        - action: addTeamRepository\n          owner: krate\n          repo: krate-demo\n          team: maintainers\n          permission: admin\n        - action: protectBranch\n          owner: krate\n          repo: krate-demo\n          branch: main\n        - action: createWebhook\n          owner: krate\n          repo: krate-demo\n          url: http://krate-webhook-worker/repositories/krate-org-default/krate-demo\n  storage:\n    mode: gitea\n    persistentVolumeClaim: krate-gitea-data\n    owner: krate\n    repository: krate-demo\n    httpUrl: http://krate-gitea-http:3000/krate/krate-demo.git\n    sshUrl: ssh://git@krate-gitea-ssh/krate/krate-demo.git\n  objectStorage:\n    lfs: true\n    artifacts: true\n  search:\n    provider: zoekt\n    enabled: false\nstatus:\n  ready: true\n  route:\n    repositoryName: krate-demo\n    backend: gitea\n    owner: krate\n    store: gitea-primary\n    receivePackReady: true\n    httpUrl: http://krate-gitea-http:3000/krate/krate-demo.git\n    sshUrl: ssh://git@krate-gitea-ssh/krate/krate-demo.git\n  gitHosting:\n    backend: gitea\n    httpUrl: http://krate-gitea-http:3000/krate/krate-demo.git\n    sshUrl: ssh://git@krate-gitea-ssh/krate/krate-demo.git\n    integrationPlan:\n      backend: gitea\n      operations:\n        - action: createOrganization\n          owner: krate\n        - action: createRepository\n          owner: krate\n          repo: krate-demo\n        - action: ensureUserMappings\n          owner: krate\n        - action: addDeployKey\n          owner: krate\n          repo: krate-demo\n          title: krate-argocd\n          readOnly: false\n        - action: addUserSshKey\n          owner: krate\n          repo: krate-demo\n          title: developer key\n        - action: addCollaborator\n          owner: krate\n          repo: krate-demo\n          permission: write\n        - action: addTeamRepository\n          owner: krate\n          repo: krate-demo\n          team: maintainers\n          permission: admin\n        - action: protectBranch\n          owner: krate\n          repo: krate-demo\n          branch: main\n        - action: createWebhook\n          owner: krate\n          repo: krate-demo\n          url: http://krate-webhook-worker/repositories/krate-org-default/krate-demo\n  storage: etcd\n",
+      "action": {
+        "list": "Open Repository records in krate-org-default",
+        "watch": "Watch Repository updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Repository in krate-org-default"
+      }
+    },
+    {
+      "kind": "SSHKey",
+      "plural": "sshkeys",
+      "apiResource": "sshkeys.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open SSHKey records in krate-org-default",
+        "watch": "Watch SSHKey updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete SSHKey in krate-org-default"
+      }
+    },
+    {
+      "kind": "RepositoryPermission",
+      "plural": "repositorypermissions",
+      "apiResource": "repositorypermissions.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open RepositoryPermission records in krate-org-default",
+        "watch": "Watch RepositoryPermission updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete RepositoryPermission in krate-org-default"
+      }
+    },
+    {
+      "kind": "BranchProtection",
+      "plural": "branchprotections",
+      "apiResource": "branchprotections.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "main-protection"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "BranchProtection",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {},
+            "annotations": {},
+            "name": "main-protection",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "refs": [
+              "refs/heads/main"
+            ],
+            "requirePullRequest": true,
+            "requiredChecks": [
+              "test"
+            ],
+            "requiredApprovals": 1
+          },
+          "status": {
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Unspecified": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: BranchProtection\nmetadata:\n  namespace: krate-org-default\n  labels:\n  annotations:\n  name: main-protection\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  refs:\n    - refs/heads/main\n  requirePullRequest: true\n  requiredChecks:\n    - test\n  requiredApprovals: 1\nstatus:\n  storage: etcd\n",
+      "action": {
+        "list": "Open BranchProtection records in krate-org-default",
+        "watch": "Watch BranchProtection updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete BranchProtection in krate-org-default"
+      }
+    },
+    {
+      "kind": "RefPolicy",
+      "plural": "refpolicies",
+      "apiResource": "refpolicies.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "deny-internal-refs"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "RefPolicy",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {},
+            "annotations": {},
+            "name": "deny-internal-refs",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "deny": [
+              "refs/internal/"
+            ]
+          },
+          "status": {
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Unspecified": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: RefPolicy\nmetadata:\n  namespace: krate-org-default\n  labels:\n  annotations:\n  name: deny-internal-refs\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  deny:\n    - refs/internal/\nstatus:\n  storage: etcd\n",
+      "action": {
+        "list": "Open RefPolicy records in krate-org-default",
+        "watch": "Watch RefPolicy updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete RefPolicy in krate-org-default"
+      }
+    },
+    {
+      "kind": "PolicyProfile",
+      "plural": "policyprofiles",
+      "apiResource": "policyprofiles.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open PolicyProfile records in krate-org-default",
+        "watch": "Watch PolicyProfile updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete PolicyProfile in krate-org-default"
+      }
+    },
+    {
+      "kind": "PolicyTemplate",
+      "plural": "policytemplates",
+      "apiResource": "policytemplates.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open PolicyTemplate records in krate-org-default",
+        "watch": "Watch PolicyTemplate updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete PolicyTemplate in krate-org-default"
+      }
+    },
+    {
+      "kind": "PolicyBinding",
+      "plural": "policybindings",
+      "apiResource": "policybindings.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open PolicyBinding records in krate-org-default",
+        "watch": "Watch PolicyBinding updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete PolicyBinding in krate-org-default"
+      }
+    },
+    {
+      "kind": "PolicyExceptionRequest",
+      "plural": "policyexceptionrequests",
+      "apiResource": "policyexceptionrequests.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open PolicyExceptionRequest records in krate-org-default",
+        "watch": "Watch PolicyExceptionRequest updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete PolicyExceptionRequest in krate-org-default"
+      }
+    },
+    {
+      "kind": "WebhookSubscription",
+      "plural": "webhooksubscriptions",
+      "apiResource": "webhooksubscriptions.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "chatops"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "WebhookSubscription",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {},
+            "annotations": {},
+            "name": "chatops",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "url": "https://hooks.example.test/krate",
+            "events": [
+              "pullrequest.created",
+              "pullrequest.merged"
+            ],
+            "signing": {
+              "algorithm": "hmac-sha256",
+              "secretRef": "chatops-secret"
+            },
+            "mode": "active"
+          },
+          "status": {
+            "ready": true,
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Ready": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: WebhookSubscription\nmetadata:\n  namespace: krate-org-default\n  labels:\n  annotations:\n  name: chatops\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  url: https://hooks.example.test/krate\n  events:\n    - pullrequest.created\n    - pullrequest.merged\n  signing:\n    algorithm: hmac-sha256\n    secretRef: chatops-secret\n  mode: active\nstatus:\n  ready: true\n  storage: etcd\n",
+      "action": {
+        "list": "Open WebhookSubscription records in krate-org-default",
+        "watch": "Watch WebhookSubscription updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete WebhookSubscription in krate-org-default"
+      }
+    },
+    {
+      "kind": "RunnerPool",
+      "plural": "runnerpools",
+      "apiResource": "runnerpools.krate.a5c.ai",
+      "count": 1,
+      "names": [
+        "trusted-linux"
+      ],
+      "items": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "RunnerPool",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {
+              "trustTier": "trusted"
+            },
+            "annotations": {},
+            "name": "trusted-linux",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "image": "ubuntu:24.04",
+            "warmReplicas": 1,
+            "maxReplicas": 4,
+            "trustTier": "trusted",
+            "cache": {
+              "type": "object-storage"
+            },
+            "scalingMetric": "queueDepth"
+          },
+          "status": {
+            "readyReplicas": 1,
+            "queueDepth": 0,
+            "storage": "etcd"
+          }
+        }
+      ],
+      "phases": {
+        "Unspecified": 1
+      },
+      "storage": "etcd",
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: RunnerPool\nmetadata:\n  namespace: krate-org-default\n  labels:\n    trustTier: trusted\n  annotations:\n  name: trusted-linux\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  image: ubuntu:24.04\n  warmReplicas: 1\n  maxReplicas: 4\n  trustTier: trusted\n  cache:\n    type: object-storage\n  scalingMetric: queueDepth\nstatus:\n  readyReplicas: 1\n  queueDepth: 0\n  storage: etcd\n",
+      "action": {
+        "list": "Open RunnerPool records in krate-org-default",
+        "watch": "Watch RunnerPool updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete RunnerPool in krate-org-default"
+      }
+    },
+    {
+      "kind": "PullRequest",
+      "plural": "pullrequests",
+      "apiResource": "pullrequests.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "postgres",
+      "yaml": null,
+      "action": {
+        "list": "Open PullRequest records in krate-org-default",
+        "watch": "Watch PullRequest updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete PullRequest in krate-org-default"
+      }
+    },
+    {
+      "kind": "Issue",
+      "plural": "issues",
+      "apiResource": "issues.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "postgres",
+      "yaml": null,
+      "action": {
+        "list": "Open Issue records in krate-org-default",
+        "watch": "Watch Issue updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Issue in krate-org-default"
+      }
+    },
+    {
+      "kind": "Review",
+      "plural": "reviews",
+      "apiResource": "reviews.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "postgres",
+      "yaml": null,
+      "action": {
+        "list": "Open Review records in krate-org-default",
+        "watch": "Watch Review updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Review in krate-org-default"
+      }
+    },
+    {
+      "kind": "Pipeline",
+      "plural": "pipelines",
+      "apiResource": "pipelines.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "postgres",
+      "yaml": null,
+      "action": {
+        "list": "Open Pipeline records in krate-org-default",
+        "watch": "Watch Pipeline updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Pipeline in krate-org-default"
+      }
+    },
+    {
+      "kind": "Job",
+      "plural": "jobs",
+      "apiResource": "jobs.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "postgres",
+      "yaml": null,
+      "action": {
+        "list": "Open Job records in krate-org-default",
+        "watch": "Watch Job updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Job in krate-org-default"
+      }
+    },
+    {
+      "kind": "WebhookDelivery",
+      "plural": "webhookdeliveries",
+      "apiResource": "webhookdeliveries.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "postgres",
+      "yaml": null,
+      "action": {
+        "list": "Open WebhookDelivery records in krate-org-default",
+        "watch": "Watch WebhookDelivery updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete WebhookDelivery in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaApplication",
+      "plural": "applications",
+      "apiResource": "applications.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaApplication records in krate-org-default",
+        "watch": "Watch KubeVelaApplication updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaApplication in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaApplicationRevision",
+      "plural": "applicationrevisions",
+      "apiResource": "applicationrevisions.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaApplicationRevision records in krate-org-default",
+        "watch": "Watch KubeVelaApplicationRevision updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaApplicationRevision in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaComponentDefinition",
+      "plural": "componentdefinitions",
+      "apiResource": "componentdefinitions.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaComponentDefinition records in krate-org-default",
+        "watch": "Watch KubeVelaComponentDefinition updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaComponentDefinition in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaWorkloadDefinition",
+      "plural": "workloaddefinitions",
+      "apiResource": "workloaddefinitions.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaWorkloadDefinition records in krate-org-default",
+        "watch": "Watch KubeVelaWorkloadDefinition updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaWorkloadDefinition in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaTraitDefinition",
+      "plural": "traitdefinitions",
+      "apiResource": "traitdefinitions.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaTraitDefinition records in krate-org-default",
+        "watch": "Watch KubeVelaTraitDefinition updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaTraitDefinition in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaScopeDefinition",
+      "plural": "scopedefinitions",
+      "apiResource": "scopedefinitions.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaScopeDefinition records in krate-org-default",
+        "watch": "Watch KubeVelaScopeDefinition updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaScopeDefinition in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaPolicyDefinition",
+      "plural": "policydefinitions",
+      "apiResource": "policydefinitions.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaPolicyDefinition records in krate-org-default",
+        "watch": "Watch KubeVelaPolicyDefinition updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaPolicyDefinition in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaPolicy",
+      "plural": "policies",
+      "apiResource": "policies.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaPolicy records in krate-org-default",
+        "watch": "Watch KubeVelaPolicy updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaPolicy in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaWorkflowStepDefinition",
+      "plural": "workflowstepdefinitions",
+      "apiResource": "workflowstepdefinitions.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaWorkflowStepDefinition records in krate-org-default",
+        "watch": "Watch KubeVelaWorkflowStepDefinition updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaWorkflowStepDefinition in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaWorkflow",
+      "plural": "workflows",
+      "apiResource": "workflows.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaWorkflow records in krate-org-default",
+        "watch": "Watch KubeVelaWorkflow updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaWorkflow in krate-org-default"
+      }
+    },
+    {
+      "kind": "KubeVelaResourceTracker",
+      "plural": "resourcetrackers",
+      "apiResource": "resourcetrackers.core.oam.dev",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "kubevela",
+      "yaml": null,
+      "action": {
+        "list": "Open KubeVelaResourceTracker records in krate-org-default",
+        "watch": "Watch KubeVelaResourceTracker updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete KubeVelaResourceTracker in krate-org-default"
+      }
+    },
+    {
+      "kind": "View",
+      "plural": "views",
+      "apiResource": "views.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open View records in krate-org-default",
+        "watch": "Watch View updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete View in krate-org-default"
+      }
+    },
+    {
+      "kind": "Selector",
+      "plural": "selectors",
+      "apiResource": "selectors.krate.a5c.ai",
+      "count": 0,
+      "names": [],
+      "items": [],
+      "phases": {},
+      "storage": "etcd",
+      "yaml": null,
+      "action": {
+        "list": "Open Selector records in krate-org-default",
+        "watch": "Watch Selector updates in krate-org-default",
+        "apply": "Save resource changes",
+        "delete": "Delete Selector in krate-org-default"
+      }
+    }
+  ],
+  "events": [
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    },
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    },
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    },
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    },
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    },
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    },
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    },
+    {
+      "type": "create",
+      "storage": "kubernetes",
+      "actor": "kubernetes",
+      "allowed": true,
+      "message": ""
+    }
+  ],
+  "auditLog": [],
+  "delivery": {
+    "installed": false,
+    "specVersion": "v0.3.0",
+    "counts": {
+      "applications": 0,
+      "releases": 0,
+      "components": 0,
+      "workloads": 0,
+      "traits": 0,
+      "scopes": 0,
+      "policyDefinitions": 0,
+      "policies": 0,
+      "automationSteps": 0,
+      "automations": 0,
+      "managedResources": 0
+    },
+    "capabilityCatalog": {
+      "components": [],
+      "workloads": [],
+      "traits": [],
+      "scopes": [],
+      "policyDefinitions": [],
+      "policies": [],
+      "automationSteps": []
+    },
+    "applications": [],
+    "runtime": {
+      "releases": [],
+      "automations": [],
+      "policies": [],
+      "managedResources": []
+    }
+  },
+  "policyEngine": {
+    "engine": "kyverno",
+    "mode": "disabled",
+    "health": "disabled",
+    "detected": false,
+    "namespace": "kyverno",
+    "policyNamespace": "krate-org-default",
+    "requireForEnforceMode": true,
+    "org": "default",
+    "profiles": [],
+    "templates": [],
+    "bindings": [],
+    "exceptionRequests": [],
+    "kyvernoResources": {},
+    "controllers": [],
+    "permissions": [],
+    "reports": {
+      "policyReports": 0,
+      "clusterPolicyReports": 0,
+      "results": []
+    },
+    "violations": [],
+    "degraded": [],
+    "emptyState": "Kyverno integration is disabled. Krate native RefPolicy and BranchProtection remain available."
+  },
+  "agents": {
+    "org": "default",
+    "stacks": {
+      "count": 0,
+      "items": []
+    },
+    "runs": {
+      "count": 0,
+      "items": [],
+      "active": []
+    },
+    "rules": {
+      "count": 0,
+      "items": []
+    },
+    "sessions": {
+      "count": 0,
+      "items": []
+    },
+    "workspaces": {
+      "count": 0,
+      "items": []
+    },
+    "approvals": {
+      "count": 0,
+      "items": [],
+      "pending": []
+    },
+    "adapters": {
+      "count": 0,
+      "items": []
+    },
+    "providers": {
+      "count": 0,
+      "items": []
+    },
+    "projects": {
+      "count": 0,
+      "items": []
+    },
+    "gateway": null,
+    "transcripts": {
+      "count": 0,
+      "items": []
+    }
+  },
+  "identity": {
+    "counts": {
+      "users": 1,
+      "teams": 1,
+      "pendingInvites": 1,
+      "mappings": 1,
+      "repositoryGrants": 0,
+      "sshKeys": 0
+    },
+    "providers": [
+      {
+        "name": "github",
+        "label": "GitHub",
+        "type": "github",
+        "enabled": true,
+        "phase": "Configured"
+      },
+      {
+        "name": "sso",
+        "label": "Workspace SSO",
+        "type": "oidc",
+        "enabled": false,
+        "phase": "Disabled"
+      }
+    ],
+    "users": [
+      {
+        "name": "admin",
+        "displayName": "Admin",
+        "email": "admin@example.com",
+        "teams": [
+          "maintainers"
+        ],
+        "admin": true,
+        "disabled": false,
+        "phase": "Active"
+      }
+    ],
+    "teams": [
+      {
+        "name": "maintainers",
+        "displayName": "Maintainers",
+        "members": [
+          "admin"
+        ],
+        "maintainers": [
+          "admin"
+        ],
+        "repositoryGrants": [
+          {
+            "repository": "krate-demo",
+            "permission": "admin"
+          }
+        ]
+      }
+    ],
+    "invites": [
+      {
+        "name": "new-user-example-com",
+        "email": "new-user@example.com",
+        "role": "member",
+        "teams": [
+          "maintainers"
+        ],
+        "phase": "Pending",
+        "expiresAt": "2026-05-18T20:52:22.913Z"
+      }
+    ],
+    "mappings": [
+      {
+        "name": "sso-admin",
+        "user": "admin",
+        "provider": "sso",
+        "workspaceIdentity": "admin@example.com",
+        "repositoryIdentity": "admin",
+        "phase": "Synced"
+      }
+    ],
+    "permissions": [],
+    "sshKeys": [],
+    "reconciliation": {
+      "counts": {
+        "User": 1,
+        "Team": 1,
+        "Invite": 1,
+        "IdentityMapping": 1
+      },
+      "phases": {
+        "Active": 2,
+        "Pending": 1,
+        "Synced": 1
+      },
+      "statuses": [
+        {
+          "kind": "User",
+          "name": "admin",
+          "phase": "Active",
+          "checks": [
+            "User Observed: ready",
+            "Workspace Identity Projected: ready",
+            "Repository Identity Projected: ready"
+          ]
+        },
+        {
+          "kind": "Team",
+          "name": "maintainers",
+          "phase": "Active",
+          "checks": [
+            "Team Observed: ready",
+            "Team Membership Projected: ready",
+            "Repository Grants Projected: ready"
+          ]
+        },
+        {
+          "kind": "Invite",
+          "name": "new-user-example-com",
+          "phase": "Pending",
+          "checks": [
+            "Invite Observed: ready",
+            "Invite Lifecycle Tracked: ready"
+          ]
+        },
+        {
+          "kind": "IdentityMapping",
+          "name": "sso-admin",
+          "phase": "Synced",
+          "checks": [
+            "Identity Mapping Observed: ready",
+            "Workspace Identity Projected: ready",
+            "Repository Identity Projected: ready"
+          ]
+        }
+      ],
+      "nextActions": [
+        "ensure user: admin",
+        "ensure repository user: admin",
+        "sync team membership: maintainers",
+        "sync team repository grant: maintainers",
+        "send invite: workspace access",
+        "link identity: admin",
+        "link repository identity: admin"
+      ]
+    },
+    "org": "default"
+  },
+  "validation": [
+    {
+      "name": "Krate workspace is connected",
+      "passed": false,
+      "evidence": "runtime snapshot supplied outside the Krate workspace path"
+    },
+    {
+      "name": "Krate API surface is discoverable",
+      "passed": true,
+      "evidence": "0 Krate resources discovered"
+    },
+    {
+      "name": "Repository management uses org-scoped Krate actions",
+      "passed": true,
+      "evidence": "/api/orgs/:org/repositories and /api/orgs/:org/resources call src/kubernetes-controller.js"
+    },
+    {
+      "name": "Krate API is separated from delivery execution",
+      "passed": true,
+      "evidence": "src/api-controller.js delegates resource operations through the Krate gateway"
+    },
+    {
+      "name": "Live streams use Krate watch",
+      "passed": true,
+      "evidence": "/api/watch/orgs/:org/* uses Krate live updates"
+    },
+    {
+      "name": "UI renders live and empty states without demo data",
+      "passed": true,
+      "evidence": "apps/web Server Components consume fetchControllerUiModel() only"
+    }
+  ],
+  "permissions": [],
+  "views": {
+    "dashboard": {
+      "repositories": [
+        {
+          "apiVersion": "krate.a5c.ai/v1alpha1",
+          "kind": "Repository",
+          "metadata": {
+            "namespace": "krate-org-default",
+            "labels": {
+              "gitBackend": "gitea"
+            },
+            "annotations": {},
+            "name": "krate-demo",
+            "resourceVersion": "1"
+          },
+          "spec": {
+            "organizationRef": "default",
+            "visibility": "private",
+            "gitHosting": {
+              "backend": "gitea",
+              "owner": "krate",
+              "repository": "krate-demo",
+              "branch": "main",
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git",
+              "deployKeyTitle": "krate-argocd",
+              "organization": {
+                "kind": "Organization",
+                "name": "krate",
+                "delegatedTo": "Gitea /api/v1/orgs"
+              },
+              "sshKeys": {
+                "kind": "SSHKey",
+                "scopes": [
+                  "user",
+                  "deploy",
+                  "argocd"
+                ],
+                "delegatedTo": "Gitea /api/v1/user/keys and /repos/{owner}/{repo}/keys"
+              },
+              "permissions": {
+                "kind": "RepositoryPermission",
+                "defaultCollaborator": "write",
+                "adminTeam": "maintainers",
+                "delegatedTo": "Gitea collaborators and team repository APIs"
+              },
+              "forgeRecords": {
+                "issues": "Gitea /repos/{owner}/{repo}/issues",
+                "pullRequests": "Gitea /repos/{owner}/{repo}/pulls"
+              },
+              "webhookUrl": "http://krate-webhook-worker/repositories/krate-org-default/krate-demo",
+              "integrationPlan": {
+                "backend": "gitea",
+                "operations": [
+                  {
+                    "action": "createOrganization",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "createRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo"
+                  },
+                  {
+                    "action": "ensureUserMappings",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "addDeployKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "krate-argocd",
+                    "readOnly": false
+                  },
+                  {
+                    "action": "addUserSshKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "developer key"
+                  },
+                  {
+                    "action": "addCollaborator",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "permission": "write"
+                  },
+                  {
+                    "action": "addTeamRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "team": "maintainers",
+                    "permission": "admin"
+                  },
+                  {
+                    "action": "protectBranch",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "branch": "main"
+                  },
+                  {
+                    "action": "createWebhook",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "url": "http://krate-webhook-worker/repositories/krate-org-default/krate-demo"
+                  }
+                ]
+              }
+            },
+            "storage": {
+              "mode": "gitea",
+              "persistentVolumeClaim": "krate-gitea-data",
+              "owner": "krate",
+              "repository": "krate-demo",
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git"
+            },
+            "objectStorage": {
+              "lfs": true,
+              "artifacts": true
+            },
+            "search": {
+              "provider": "zoekt",
+              "enabled": false
+            }
+          },
+          "status": {
+            "ready": true,
+            "route": {
+              "repositoryName": "krate-demo",
+              "backend": "gitea",
+              "owner": "krate",
+              "store": "gitea-primary",
+              "receivePackReady": true,
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git"
+            },
+            "gitHosting": {
+              "backend": "gitea",
+              "httpUrl": "http://krate-gitea-http:3000/krate/krate-demo.git",
+              "sshUrl": "ssh://git@krate-gitea-ssh/krate/krate-demo.git",
+              "integrationPlan": {
+                "backend": "gitea",
+                "operations": [
+                  {
+                    "action": "createOrganization",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "createRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo"
+                  },
+                  {
+                    "action": "ensureUserMappings",
+                    "owner": "krate"
+                  },
+                  {
+                    "action": "addDeployKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "krate-argocd",
+                    "readOnly": false
+                  },
+                  {
+                    "action": "addUserSshKey",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "title": "developer key"
+                  },
+                  {
+                    "action": "addCollaborator",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "permission": "write"
+                  },
+                  {
+                    "action": "addTeamRepository",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "team": "maintainers",
+                    "permission": "admin"
+                  },
+                  {
+                    "action": "protectBranch",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "branch": "main"
+                  },
+                  {
+                    "action": "createWebhook",
+                    "owner": "krate",
+                    "repo": "krate-demo",
+                    "url": "http://krate-webhook-worker/repositories/krate-org-default/krate-demo"
+                  }
+                ]
+              }
+            },
+            "storage": "etcd"
+          }
+        }
+      ],
+      "excellentFlows": [
+        "Create or import a repository",
+        "Browse code and copy clone commands",
+        "Review and merge a pull request",
+        "Debug a failing pipeline run",
+        "Edit runner pool capacity",
+        "Inspect and replay webhook deliveries",
+        "Save a triage View"
+      ],
+      "cards": [
+        {
+          "label": "Repositories",
+          "value": 1,
+          "href": "/repositories"
+        },
+        {
+          "label": "Pull requests",
+          "value": 0,
+          "href": "/inbox"
+        },
+        {
+          "label": "Runs",
+          "value": 0,
+          "href": "/runs"
+        },
+        {
+          "label": "Runner pools",
+          "value": 1,
+          "href": "/runners-ci"
+        },
+        {
+          "label": "Webhook deliveries",
+          "value": 0,
+          "href": "/hooks-events"
+        }
+      ]
+    },
+    "pullRequestReview": null,
+    "failingRun": null,
+    "runnerPoolEditor": {
+      "resource": {
+        "apiVersion": "krate.a5c.ai/v1alpha1",
+        "kind": "RunnerPool",
+        "metadata": {
+          "namespace": "krate-org-default",
+          "labels": {
+            "trustTier": "trusted"
+          },
+          "annotations": {},
+          "name": "trusted-linux",
+          "resourceVersion": "1"
+        },
+        "spec": {
+          "organizationRef": "default",
+          "image": "ubuntu:24.04",
+          "warmReplicas": 1,
+          "maxReplicas": 4,
+          "trustTier": "trusted",
+          "cache": {
+            "type": "object-storage"
+          },
+          "scalingMetric": "queueDepth"
+        },
+        "status": {
+          "readyReplicas": 1,
+          "queueDepth": 0,
+          "storage": "etcd"
+        }
+      },
+      "fields": [
+        "image",
+        "resources",
+        "warmReplicas",
+        "maxReplicas",
+        "trustTier",
+        "cache"
+      ],
+      "saveModes": [
+        "save capacity",
+        "open review"
+      ],
+      "yaml": "apiVersion: krate.a5c.ai/v1alpha1\nkind: RunnerPool\nmetadata:\n  namespace: krate-org-default\n  labels:\n    trustTier: trusted\n  annotations:\n  name: trusted-linux\n  resourceVersion: 1\nspec:\n  organizationRef: default\n  image: ubuntu:24.04\n  warmReplicas: 1\n  maxReplicas: 4\n  trustTier: trusted\n  cache:\n    type: object-storage\n  scalingMetric: queueDepth\nstatus:\n  readyReplicas: 1\n  queueDepth: 0\n  storage: etcd\n"
+    },
+    "webhookInspector": {
+      "subscription": {
+        "apiVersion": "krate.a5c.ai/v1alpha1",
+        "kind": "WebhookSubscription",
+        "metadata": {
+          "namespace": "krate-org-default",
+          "labels": {},
+          "annotations": {},
+          "name": "chatops",
+          "resourceVersion": "1"
+        },
+        "spec": {
+          "organizationRef": "default",
+          "url": "https://hooks.example.test/krate",
+          "events": [
+            "pullrequest.created",
+            "pullrequest.merged"
+          ],
+          "signing": {
+            "algorithm": "hmac-sha256",
+            "secretRef": "chatops-secret"
+          },
+          "mode": "active"
+        },
+        "status": {
+          "ready": true,
+          "storage": "etcd"
+        }
+      },
+      "deliveries": [],
+      "columns": [
+        "phase",
+        "signature",
+        "attempts",
+        "response",
+        "latency"
+      ],
+      "actions": [
+        "replay",
+        "disable subscription",
+        "copy curl"
+      ]
+    },
+    "triageView": null,
+    "identityAdmin": {
+      "counts": {
+        "users": 1,
+        "teams": 1,
+        "pendingInvites": 1,
+        "mappings": 1,
+        "repositoryGrants": 0,
+        "sshKeys": 0
+      },
+      "providers": [
+        {
+          "name": "github",
+          "label": "GitHub",
+          "type": "github",
+          "enabled": true,
+          "phase": "Configured"
+        },
+        {
+          "name": "sso",
+          "label": "Workspace SSO",
+          "type": "oidc",
+          "enabled": false,
+          "phase": "Disabled"
+        }
+      ],
+      "users": [
+        {
+          "name": "admin",
+          "displayName": "Admin",
+          "email": "admin@example.com",
+          "teams": [
+            "maintainers"
+          ],
+          "admin": true,
+          "disabled": false,
+          "phase": "Active"
+        }
+      ],
+      "teams": [
+        {
+          "name": "maintainers",
+          "displayName": "Maintainers",
+          "members": [
+            "admin"
+          ],
+          "maintainers": [
+            "admin"
+          ],
+          "repositoryGrants": [
+            {
+              "repository": "krate-demo",
+              "permission": "admin"
+            }
+          ]
+        }
+      ],
+      "invites": [
+        {
+          "name": "new-user-example-com",
+          "email": "new-user@example.com",
+          "role": "member",
+          "teams": [
+            "maintainers"
+          ],
+          "phase": "Pending",
+          "expiresAt": "2026-05-18T20:52:22.913Z"
+        }
+      ],
+      "mappings": [
+        {
+          "name": "sso-admin",
+          "user": "admin",
+          "provider": "sso",
+          "workspaceIdentity": "admin@example.com",
+          "repositoryIdentity": "admin",
+          "phase": "Synced"
+        }
+      ],
+      "permissions": [],
+      "sshKeys": [],
+      "reconciliation": {
+        "counts": {
+          "User": 1,
+          "Team": 1,
+          "Invite": 1,
+          "IdentityMapping": 1
+        },
+        "phases": {
+          "Active": 2,
+          "Pending": 1,
+          "Synced": 1
+        },
+        "statuses": [
+          {
+            "kind": "User",
+            "name": "admin",
+            "phase": "Active",
+            "checks": [
+              "User Observed: ready",
+              "Workspace Identity Projected: ready",
+              "Repository Identity Projected: ready"
+            ]
+          },
+          {
+            "kind": "Team",
+            "name": "maintainers",
+            "phase": "Active",
+            "checks": [
+              "Team Observed: ready",
+              "Team Membership Projected: ready",
+              "Repository Grants Projected: ready"
+            ]
+          },
+          {
+            "kind": "Invite",
+            "name": "new-user-example-com",
+            "phase": "Pending",
+            "checks": [
+              "Invite Observed: ready",
+              "Invite Lifecycle Tracked: ready"
+            ]
+          },
+          {
+            "kind": "IdentityMapping",
+            "name": "sso-admin",
+            "phase": "Synced",
+            "checks": [
+              "Identity Mapping Observed: ready",
+              "Workspace Identity Projected: ready",
+              "Repository Identity Projected: ready"
+            ]
+          }
+        ],
+        "nextActions": [
+          "ensure user: admin",
+          "ensure repository user: admin",
+          "sync team membership: maintainers",
+          "sync team repository grant: maintainers",
+          "send invite: workspace access",
+          "link identity: admin",
+          "link repository identity: admin"
+        ]
+      },
+      "org": "default"
+    },
+    "policyCenter": {
+      "engine": "kyverno",
+      "mode": "disabled",
+      "health": "disabled",
+      "detected": false,
+      "namespace": "kyverno",
+      "policyNamespace": "krate-org-default",
+      "requireForEnforceMode": true,
+      "org": "default",
+      "profiles": [],
+      "templates": [],
+      "bindings": [],
+      "exceptionRequests": [],
+      "kyvernoResources": {},
+      "controllers": [],
+      "permissions": [],
+      "reports": {
+        "policyReports": 0,
+        "clusterPolicyReports": 0,
+        "results": []
+      },
+      "violations": [],
+      "degraded": [],
+      "emptyState": "Kyverno integration is disabled. Krate native RefPolicy and BranchProtection remain available."
+    }
+  },
+  "operations": {
+    "image": "ghcr.io/<owner>/<repo>/krate-controller",
+    "chart": "charts/krate",
+    "installCommands": [
+      "Install Krate release package",
+      "Apply the demo workspace configuration"
+    ],
+    "releaseGates": [
+      "npm run check",
+      "docker build",
+      "helm package charts/krate",
+      "npm pack --json"
+    ]
+  }
+}