@dzhechkov/cloudru-hub 0.1.15 → 0.1.17

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "2b0dbd83deb813844a658814b9a6fa1640f1e5255c676210e61dceaa6b42195b"
+        "sha256": "70bc9263f657739464a56bf220ce370da7baa73dae086565417ccf62b6806078"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "4f6a2d5928fec42f021eb10471677b902e831b99d53096661a821f6460bd55a6"
+        "sha256": "0ca9b07e9194d91645194140c23d715b741a4503ad261305bf1b8af28470c494"
       },
       {
         "path": "THIRD_PARTY_NOTICES.md",
@@ -29,15 +29,15 @@
       },
       {
         "path": "data/pointer-section.md",
-        "sha256": "6f4557d97b90936ef153dc90eac4bdceb6846b6d08d8aec45c86baac328cca60"
+        "sha256": "32845b9cc1ad64f2f6a8d4eeb8b90bf36710590d25db4234e6813793ef63c5d4"
       },
       {
         "path": "data/tools-classification.json",
-        "sha256": "9abb3ca6347b0cd6cd51b23649c59e0a0c816e6c12a325f573b392affa350d0b"
+        "sha256": "0f09cb2fffd2feebfa5e7e97e8503a47ae1b63d1035e309540a4211f0bace477"
       },
       {
         "path": "data/tools-list-snapshot.json",
-        "sha256": "dff98bb859dfbbf8ed2fb6f16f17b767444cc2172ecc7684ca3df8188c95707c"
+        "sha256": "247fe8a6d9c47d3b7c4d218d1047df842e41e3b1880594d7dbc7b3f5e6ce52ed"
       },
       {
         "path": "docs/COST-COMPARE.md",
@@ -45,11 +45,15 @@
       },
       {
         "path": "docs/HERMES-CODEX.md",
-        "sha256": "3605797972f9a7c79c13fbcce0cd9ac8b8fb3a8249abbab938f2b1a45f515420"
+        "sha256": "00a5c9acc3999c5e07f230ba63bc1a0e202d62c8d15d2204620feca762eece8f"
       },
       {
         "path": "docs/LOCAL-TESTING.md",
-        "sha256": "de6f709e820fbb831f390e274238b28ba938644670a8db04fd50d1fa0d86da75"
+        "sha256": "6b2f6b18f863a9a467ad08977b14de4fdf3285a70ae5a35ce855c4f143c05958"
+      },
+      {
+        "path": "docs/WEB-IMAGE.md",
+        "sha256": "690e092bafddc862c20ebd5ff0358a4c57f84881153c235a146e258563459f27"
       },
       {
         "path": "docs/cost-compare.example.json",
@@ -57,7 +61,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "1b355df670fb092da7ce8956141e702f9f78e1e2f2724c6aaba61bbab2acd8c8"
+        "sha256": "7fe766354e40487c5dd90461d41edcde781cf4775d46376daad9c5abbaf8b314"
       },
       {
         "path": "src/classification.js",
@@ -65,7 +69,7 @@
       },
       {
         "path": "src/cli.js",
-        "sha256": "b1bd4a0ce7f1ca869c2873ca1979a74630483ee2909ff8b4f91189622f5aa2a7"
+        "sha256": "590265903b3a242b3d9c1367801ce6ce10e23e18abbc28938c5a26f735ea7d75"
       },
       {
         "path": "src/cost-compare.js",
@@ -85,11 +89,15 @@
       },
       {
         "path": "src/install.js",
-        "sha256": "c928db48febfb4a79884ce1830365a8302122a55fb5d6ada8e771c049396ca89"
+        "sha256": "90af414aabda1c48c82c9c2ecf0dbe4d7dd4744486efdce0d8367182b6a67a38"
       },
       {
         "path": "src/k8s-approval.js",
-        "sha256": "014c2effd1e843d870ae1af4f93f5c82faff9972e9f6ca028ed39d47ec33ee3a"
+        "sha256": "950543b85a7ed2c8e1660b40c2bb50192663e5fe62f8287b9b76ac3f8178c263"
+      },
+      {
+        "path": "src/k8s-image-manifest.js",
+        "sha256": "8a2c519e9bc6677c867758f4b9b56146f2832ee07a5bfd4fefed3317f0d9cf73"
       },
       {
         "path": "src/probe-child.js",
@@ -101,11 +109,11 @@
       },
       {
         "path": "src/safe-mcp.js",
-        "sha256": "4f95cfb9576c411232503b26053ece6d8d186e4b337beff9bd4afd249f74a014"
+        "sha256": "60a5db44db9518835f98f23aa104b86c3621f0b0c030196c2130715f5c19c219"
       },
       {
         "path": "src/toolsets.js",
-        "sha256": "89229c882b6a3f5bb9ee542b31d1a40374b91879747582a3e82e8aadc72decb3"
+        "sha256": "0a66e73476d5f5624908f05f621b150efa51217fc9418938ca126dc0dc2b9518"
       },
       {
         "path": "templates/.claude/hooks/cloudru-ssh-guard.cjs",
@@ -117,7 +125,7 @@
       },
       {
         "path": "test/classification.test.mjs",
-        "sha256": "026e3031180ce9227b4d31775b9c886b10ad0cb418ed0754aed75b12ded84e31"
+        "sha256": "413ddf6d9a4f709d80bce9011094d95bbe56f12c391f72be235c4482a1b40450"
       },
       {
         "path": "test/cost-compare.test.mjs",
@@ -125,7 +133,7 @@
       },
       {
         "path": "test/deploy-approval.test.mjs",
-        "sha256": "d72e4363fd50d0fcc65fd23b40601516bd73368c3659f2a55a394c4d1ed3f85c"
+        "sha256": "3aaf3cdf27c57be9121d7d1727335d0a97064659b3201d34d1e27f5aed631434"
       },
       {
         "path": "test/dialects.test.mjs",
@@ -141,7 +149,7 @@
       },
       {
         "path": "test/k8s-approval.test.mjs",
-        "sha256": "af04d1941fb7aed2cc51b05f65ffed1c440d4d23a7fb26e13261d45e07b0a1f8"
+        "sha256": "acc30164bbafc2d46b404ff8ae87caf42e301e15dd005c424654ee0225af6efd"
       },
       {
         "path": "test/mutation-registry-freshness.test.mjs",
@@ -157,13 +165,13 @@
       },
       {
         "path": "test/resolve.test.mjs",
-        "sha256": "9ad83ba418dee86ef680575a0cc7da4af4be3ae995c00f23f84b336838fbda47"
+        "sha256": "dcaede3dea29d98d93f3c902b8f9f389f24dc7b9a84665d1c206263915282f06"
       },
       {
         "path": "test/safe-mcp.test.mjs",
-        "sha256": "45406dabeee0635ede5cda3d2f4144c5c13886d624287fd223b01252d2859b87"
+        "sha256": "e99200ccdd8368260af18532478addc08e3b6195986cecf68b669e9dc639d119"
       }
     ]
   },
-  "signature": "dwHxhW1FRdiGNeOrlmZDXpWHEV3i/V9QenSrenI7+SvF6HNfxc1cM++fUKzWXZKRvTfbreooCqZHfcipil4vAw=="
+  "signature": "H9IFrg1rkdQ36/YEY4aH9uYXFczQB7h+PSmA5LV+mwEkF08uYlis6QAArIaDBpz6d85no/YvOS97A2rneTFbDw=="
 }

package/CHANGELOG.md

@@ -1,13 +1,53 @@
 # Changelog — @dzhechkov/cloudru-hub
 
-## Unreleased — staged, no version change
+## 0.1.17 — 2026-10-29
+
+- Pin the matched Linux/x64 engine `0.2.8-20261029` (SHA-256
+  `0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08`)
+  as the exact `@dzhechkov/cloudru-vm-linux-x64@0.2.8` optional dependency.
+  The local `tools/list` observation retains the 146 ordered registered catalog
+  names and gate flags; classification permissions and tool schemas are unchanged.
+- Add the source-reviewed, exclusive shared-local project/VM-name claim before
+  VM or static-site security-group mutation. Retain uncertain, partial and empty
+  claims across restart; no expiry, unlock or blind replay. Different roots,
+  hosts, older clients and direct API calls are outside coordination.
+- Add action-scoped, immutable configured-project/exact-cluster delete intent
+  before `k8s_delete`. Duplicate or uncertain attempts refuse another DELETE.
+  Receipt recovery is GET-only; accepted operation and operation completion do
+  not prove cluster absence or cleanup. Existing create/nodepool behavior remains.
+  Both corrections have local synthetic controls, not new paid-cloud acceptance.
+
+## 0.1.16 — 2026-10-29
+
+- Pin the matched Linux/x64 engine `0.2.7-20261029` (SHA-256
+  `94fdba4fe4d1a71e684be998c3d2f94f374ff4e4054db2683bcc04d72bfabc03`).
+  Kubernetes `k8s_plan(preflight:true)` is included and reports time/project-bound
+  observed checks, exact same-project name
+  conflicts and explicit unknowns for inventory completeness, create grants,
+  quota capacity, integration settings and tariffs. It always reports
+  `ready_to_apply:false`; it does not authorize create or promise readiness.
+
+- Include placement resolution and durable Kubernetes create/nodepool intent
+  receipts in the matched engine. `k8s_get` can observe `receipt_id`,
+  `operation_id` and bounded `receipts:true` discovery after a lost reply.
+  No automatic retry is unlocked, and this candidate has no new live
+  Kubernetes deployment or `web-image` acceptance result.
 
 - Add `cost-compare --input <json> [--json]`, an offline VM/Kubernetes cost worksheet
   with explicit topology, dated tariff provenance, exact decimal sums and per-node
   normal/failure capacity bounds. Incomplete prices, insufficient capacity or unknown
   architecture equivalence suppress a winner. The packaged official-rate example
   leaves traffic and equivalence unknown. See `docs/COST-COMPARE.md` for the schema
-  and limits. No engine or MCP tool changes are included.
+  and limits.
+
+- Retain read-only `deploy_reconcile` and
+  `deploy_preflight`. Ordinary VM apply journals intent before create; an
+  ambiguous response requires observation before any retry. A new plan cannot
+  reuse the project and VM name of an earlier run receipt on sequential submission;
+  concurrent distinct VM plans are not serialized.
+- Add a separate `web-image` Kubernetes approval profile for a reviewed,
+  digest-pinned one-pod web workload in an existing namespace. Source build,
+  registry publication and live host acceptance remain separate steps.
 
 ## 0.1.14 — 2026-10-20
 

package/README.md

@@ -2,28 +2,28 @@
 
 Site: https://aicoding.space · Source: https://github.com/djd1m/dz-harness/tree/main/packages/cloudru-hub
 
-> **Linux/x64 distribution:** version 0.1.14 installs the exact optional engine
-> package `@dzhechkov/cloudru-vm-linux-x64@0.2.6`. The `dz guard` `licence-hold`
+> **Linux/x64:** version 0.1.17 names the exact optional engine
+> package `@dzhechkov/cloudru-vm-linux-x64@0.2.8`. The `dz guard` `licence-hold`
 > rule continues to check LICENSE, notices and SPDX on publish.
 
 > **Unofficial. NOT affiliated with, endorsed, or supported by Cloud.ru.** "Cloud.ru" is a
 > trademark of its owner; this launcher merely talks to the public Cloud.ru Evolution API
 > through the `cloudru-vm` engine.
 
-Thin JS launcher for the **`cloudru-vm` MCP engine** — a Go MCP server with **144 tools**
-(MEASURED — live `tools/list` probe, `data/tools-list-snapshot.json`) for Cloud.ru
+Thin JS launcher for the **`cloudru-vm` MCP engine** — a Go MCP server with **146 registered catalog tools**
+(MEASURED — local `tools/list` probe, `data/tools-list-snapshot.json`; this is not 146 live Cloud.ru API tests) for Cloud.ru
 Evolution: VMs, k8s, PostgreSQL/Kafka/Redis, DNS, S3, certificates, billing/FinOps, and a
 docker-compose deploy wizard.
 
-The launcher archive contains no engine binary. On Linux/x64, npm installs the exact
-optional platform package with the pinned Go engine. Run:
+The launcher archive contains no engine binary. npm installs the exact optional
+platform package with the pinned Go engine on Linux/x64. Run:
 
 ```bash
-npm install -g @dzhechkov/cloudru-hub@0.1.14
+npm install -g @dzhechkov/cloudru-hub@0.1.17
 cloudru-hub self-test
 ```
 
-The self-test verifies the engine SHA-256, version, 144 live MCP tools and their
+The self-test verifies the engine SHA-256, version, 146 registered MCP catalog tools and their
 classification without Cloud.ru credentials. On another platform, or if optional
 dependencies were disabled, provide a trusted binary with the same SHA-256.
 
@@ -38,7 +38,7 @@ The JS launcher remains MIT-licensed; its archive contains no Go engine bytes.
 | Piece | Where | What it does |
 |---|---|---|
 | Launcher | `bin/cloudru-hub.js` | resolves the engine binary at **runtime** (never bundled): `$CLOUDRU_VM_BIN` → `~/.cloudru-hub/config.json` `enginePath` → optional platform package `@dzhechkov/cloudru-vm-linux-x64`; verifies sha256 against the pin in `package.json.cloudruHub.binaryHashes` |
-| Paid-step brake (ADR-004) | `src/install.js`, `templates/.claude/hooks/` | emits `permissions` **ask** rules for every mutating-or-shell-reaching tool (64 tools — MEASURED, `data/tools-classification.json` counts), **deny** for `secret_value`/`cert_private_key`, **allow** for 78 behaviour-audited read-only tools, in BOTH `mcp__cloudru-vm__`/`mcp__cloudru_vm__` spellings (prefix normalization not yet live-probed), plus a PreToolUse veto hook (ssh-guard + the kubectl `rollout` hole) — and **executes** the veto probe before declaring install success |
+| Paid-step brake (ADR-004) | `src/install.js`, `templates/.claude/hooks/` | emits `permissions` **ask** rules for every mutating-or-shell-reaching tool (64 tools — MEASURED, `data/tools-classification.json` counts), **deny** for `secret_value`/`cert_private_key`, **allow** for 80 behaviour-audited read-only tools, in BOTH `mcp__cloudru-vm__`/`mcp__cloudru_vm__` spellings (prefix normalization not yet live-probed), plus a PreToolUse veto hook (ssh-guard + the kubectl `rollout` hole) — and **executes** the veto probe before declaring install success |
 | Target integration | `src/install.js`, `src/safe-mcp.js` | Codex, OpenCode and Pi get project MCP configs using a pinned proxy; Hermes gets a guarded `$HERMES_HOME/config.yaml` entry with a verified engine path. Claude Code's general install keeps its permissions and hook probe. The opt-in `vm-deploy` profile requires an exact-plan approval and confines remote commands to the returned VM. Codex, Hermes, OpenCode and Pi each completed both live static-site scenarios on 2026-10-20 with HTTP byte checks and exact resource cleanup. The `k8s-deploy` profile uses a separate exact-manifest approval and create-only Kubernetes operation; the same four hosts completed live Kubernetes deployment, readiness, exact-byte HTTP and cleanup checks. Claude Code has installer/registration checks but no live inference pass. |
 | Skill dialect compiler (ADR-006) | `src/dialects.js`, `data/dialects.json` | generates per-target variants of the canonical skill tree (which is NOT shipped — point `--canonical` at an engine distribution); hard-fails if any Hermes-dialect token survives AND if the engine codename survives in any case in any emitted file (positive invariant, not just the enumerated denylist); unlinks dangling links; enforces the 12 000-char router cap on lossy layouts; byte-deterministic |
 | Golden classification | `data/tools-classification.json` | every engine tool → allow/ask/deny; `allow` requires a BEHAVIOUR audit of the handler (read-only proven at the pinned baseline, engine file:line cited per entry). The previous `stack_status` behavior was unsafe; the imported engine now makes it observational and tests that invariant. A live tool unknown to the classifier is a drift finding. |
@@ -54,8 +54,9 @@ cloudru-hub mcp                     # run the engine as an MCP stdio server (wha
 cloudru-hub mcp-safe --toolsets inventory   # pinned MCP proxy with a small allow-classified surface
 cloudru-hub install --target codex --toolsets billing  # read-only balance, consumption and FinOps
 cloudru-hub install --target codex --toolsets vm-deploy  # guarded VM deployment profile
-cloudru-hub install --target codex --toolsets k8s-deploy # bounded existing-cluster Snake profile
+cloudru-hub install --target codex --toolsets k8s-deploy # bounded existing-cluster profile
 cloudru-hub k8s-approve --cluster-id <uuid> --namespace snake-pilot --manifest <snake.yaml> --manifest-sha256 <digest>
+cloudru-hub k8s-approve --cluster-id <uuid> --namespace lesson-app --manifest <web.yaml> --manifest-sha256 <digest> --profile web-image
 cloudru-hub approve --plan-id <id> --max-monthly-rub <cap>  # one reviewed SSH plan
 cloudru-hub approve --plan-id <id> --max-monthly-rub <cap> --site-sha256 <digest>  # reviewed static-site artifact
 cloudru-hub install --target claude-code   # emit .mcp.json + permission brake + veto hook, PROBE the veto
@@ -81,7 +82,7 @@ node bin/cloudru-hub.js self-test
 ```
 
 Expected: 5 green steps ending `self-test: ALL GREEN` (resolution, sha256 match against
-the pinned baseline `4463b093…97a97c9b6`, engine version, 144 live tools, full
+the pinned baseline `0095d391…db8be08`, engine version, 146 registered catalog tools, full
 classification coverage). Full walkthrough incl. `npm link` and MCP registration:
 [`docs/LOCAL-TESTING.md`](docs/LOCAL-TESTING.md).
 
@@ -89,9 +90,77 @@ Host setup, checks and limits: [`docs/HERMES-CODEX.md`](docs/HERMES-CODEX.md). T
 
 For billing through `mcp-safe`, add the optional `"agreement_id":"…"` to the owner-only `~/.config/cloudru-hub/credentials.json` alongside `key_id`, `secret` and `project_id`. The proxy forwards it to the Go child as `CLOUDRU_AGREEMENT_ID`. Existing environment-only billing setups remain supported when no credential file is configured. The current consumption tool reports the agreement-wide total; its output should not be presented as a per-project bill. See the [Cloud.ru instructions for locating the agreement ID](https://cloud.ru/docs/billing/ug/topics/faq__api_id_agreement).
 
-The `vm-deploy` and `k8s-deploy` profiles are included in the launcher as **opt-in previews**. They require the matching pinned Go binary and temporary credentials in a private local file. On Linux/x64, a normal npm installation supplies that binary through the optional platform package. A static site can be planned from a local HTML file or a bounded ZIP snapshot with `deploy_plan(static_site_source=...)`; the operator checks the source digest shown in the plan and supplies that digest to `approve`. Every included ZIP file is served publicly, so review the file list in the plan and keep credentials out of the artifact. Planning requires an existing available floating IP, whose ID is bound to the approval. Apply creates a dedicated TCP-80 security group, boots the VM from fixed Cloud-init data, and reports the site as verified only after the approved IP is attached to that VM and exact-byte HTTP checks pass. A private run journal keeps resource IDs for interrupted-run recovery and blocks blind replay. The estimate covers compute and disk; a public IP may have a separate charge. The static-site route does not authorize `vm_exec` over SSH. See the two-Snake acceptance procedure in `features/cloudru-cli-vm-deploy/SNAKE-ACCEPTANCE.md` in the private source tree.
-
-The Kubernetes preview accepts only one reviewed manifest containing a ConfigMap, a non-root single-pod Deployment and a ClusterIP Service in an existing namespace. `k8s-approve` binds exact manifest bytes, cluster, namespace, project and a ten-minute single-use approval. The agent passes only the approval ID; the proxy forwards `create_only=true`, so an existing resource name is a conflict instead of being patched. Kubernetes `create` is not transactional across three documents: inspect and clean up any partially created resources by exact name before trying again. Use a dedicated namespace with no pre-existing resources matching the app label or the three approved names. The profile does not create a cluster, namespace, nodes, NAT, ingress or load balancer. The example, local evidence and four-host live acceptance are in `features/cloudru-k8s-snake-deploy/` in private source. The service account's initial 403 was resolved by granting the Kubernetes role; Claude Code inference remains unavailable for a live host test.
+The `vm-deploy` and `k8s-deploy` profiles are opt-in previews requiring a matching pinned Go binary and credentials in a private local file. `deploy_plan` resolves a VM and a compute/disk estimate; `deploy_preflight(plan_id)` observes live name collisions and available quota usage, naming unknown create rights, capacity and billed tariffs. After an exact-plan approval, `deploy_apply` writes a private run intent before VM creation. If the API outcome is uncertain, `deploy_reconcile(plan_id)` reads the receipt and project inventory; it never adopts a same-name VM or authorizes a retry. A prior receipt for the same project and VM name also blocks a new plan, even if the cloud inventory has not caught up; inspect the prior run and choose a new name. The static-site route still snapshots approved HTML/ZIP bytes, uses fixed Cloud-init and a dedicated TCP-80 group, and reports verified only after exact-byte HTTP checks against the approved IP. Every public file must be reviewed; a public IP may incur additional charges. Static sites do not grant `vm_exec` SSH access.
+
+**Published versions `cloudru-hub@0.1.16` and `cloudru-vm-linux-x64@0.2.7`:** concurrent distinct VM plans for the same project and VM name are not serialized. Avoid launching those plans together; the prior-receipt check protects sequential submissions and is not an atomic name reservation.
+
+**Matched `cloudru-hub@0.1.17` / `cloudru-vm-linux-x64@0.2.8`:** the initial deployment checkpoint exclusively claims the exact project/VM-name pair in private shared local state before either a VM or static-site security group is mutated. The claim remains after process exit, an uncertain provider response, or a later checkpoint failure; even an empty or partial claim blocks another plan. There is no TTL, unlock, forced replay or name-based adoption. Inspect the retained claim and run receipt in the shared state root, reconcile live project inventory and known resource IDs, then choose a new name for a separate deployment if needed. Coordination covers upgraded processes sharing one local state root. Old clients, raw engine paths, different roots or hosts, and direct Cloud.ru API calls remain outside it; this is not distributed idempotency. Local synthetic race, restart and I/O-fault controls cover this correction; no new live VM creation was used for these controls.
+
+In the previous `0.2.7-20261029` engine (retained in `0.2.8-20261029`), operator `k8s_plan` resolves a supported zone name or ID to `zone_id`/`zones`, and `k8s_create` explicitly sends that ID for control-plane placement. The VIP subnet must match the same zone. This does not establish why a worker pool may fail to register nodes.
+
+The matched engine also accepts `k8s_plan` with
+`{"preflight":true}` to collect read-only observations before a possible paid
+cluster creation. It is separate from VM `deploy_preflight(plan_id)`. The
+versioned report includes its observation time and configured project, with
+`observed_checks`, `observed_conflicts` and `unknowns`. It attempts exact
+zone/subnet resolution, checks returned project cluster rows for an exact name
+collision, and reads project-filtered quota usage. A matching cluster with an
+explicit same-project identity is a conflict; an empty or unmatched response
+does not prove the name is free because inventory completeness is unknown.
+Denied, malformed or unavailable quota responses remain unknown; usage does
+not prove create capacity. Failed probes leave the established findings intact.
+
+Every diagnostic report says `ready_to_apply:false`. Authentication, successful
+listing and JWT scope roles do not prove effective caller or cluster service
+account create grants. The [Cloud.ru cluster service-account role guide](https://cloud.ru/docs/kubernetes-evolution/ug/topics/concepts__roles-for-cluster-sa) lists
+`k8s.user`, `nlb.user` and `vpc.user` as base dependencies; `auditlog.writer`, `logaas.writer`
+and `monaas.write` depend on the actual audit, logging and monitoring settings,
+which this report cannot inspect. Verify assignments and settings in IAM before
+a separate paid-operation approval. Exact placement resolution also does not
+prove region-wide availability or runtime readiness. Prospective tariffs are
+not supplied: include compute, control plane, disk, public IP, SNAT, load
+balancer and traffic, then run `cloudru-hub cost-compare --input <json> --json`
+separately with verified tariff inputs. This diagnostic does not create an
+approval or unlock a retry.
+
+Kubernetes create/nodepool recovery was included in the previous `0.2.7-20261029` engine and is retained in `0.2.8-20261029`.
+The operator flow records a private durable intent before
+`k8s_create` or `k8s_add_nodepool`, then saves known operation/resource IDs.
+After a lost reply, `k8s_get` supports `receipt_id`, `operation_id` and
+bounded `receipts:true` discovery in addition to its existing cluster lookup.
+These observations distinguish provider operation state from resource presence;
+they do not check Ready Nodes or application HTTP. This release adds no new
+live Kubernetes deployment or `web-image` acceptance result.
+
+The first recovery increment keeps the same project/kind/parent/name blocked
+after any submitted intent, including an ambiguous outcome or later deletion.
+Changing a request's size does not permit another submission. There is no
+automatic retry, force flag or receipt-removal procedure. A different name is a
+separate deployment with possible duplicate cost. Diagnostics do not create a
+cluster, and existing guarded profiles still deny infrastructure create tools.
+
+**Matched `cloudru-hub@0.1.17` / `cloudru-vm-linux-x64@0.2.8`:**
+before one confirmed `k8s_delete` DELETE, the engine writes a private, durable
+`cluster-delete` intent scoped to the action, configured project and exact
+cluster ID. That target is immutable. A duplicate call or restart after an
+uncertain outcome refuses another DELETE through the shared store, including
+when the receipt is unreadable. A valid accepted response reports `deleting`;
+malformed or uncertain responses report `unknown_outcome` and retain only
+unambiguous operation correlation. For `unknown_outcome` or
+`recovery_required`, inspect `k8s_get(receipt_id)` or bounded `receipts:true`
+discovery. Recovery is GET-only for the exact target and any known operation
+under the configured project. A scoped exact-cluster 404 observes absence;
+403, errors, malformed or mismatched JSON remain unknown. Operation `done`
+does not prove cluster absence, application readiness, dependent cleanup or
+zero cost. There is no TTL, receipt removal, forced retry or distributed
+guarantee; other hosts, state roots and direct API callers do not coordinate.
+Existing create and nodepool recovery behavior is retained. Local synthetic
+replay, restart and I/O-fault controls cover this correction; no new paid-cluster
+test was used. Broader operation recovery remains work in progress.
+
+The Kubernetes preview has two explicit profiles. The default `snake` profile retains its exact ConfigMap, non-root Deployment and ClusterIP Service. `web-image` accepts one reviewed digest-pinned OCI image in a bounded one-pod Deployment and internal ClusterIP Service. It requires a `/health` endpoint on port 8080, a dedicated namespace, non-root UID 10001, a read-only root filesystem and bounded CPU/RAM. The image must already be built, pushed and pullable by the existing cluster. This package does not build code from a repository or prove that an image digest corresponds to a source commit. `k8s-approve` binds exact manifest bytes, cluster, namespace, project and a ten-minute single-use approval. The proxy uses `create_only=true`; inspect partial resources before retrying because Kubernetes multi-document create is not transactional. Neither profile creates a cluster, namespace, nodes, NAT, ingress or load balancer. Earlier four-host live application acceptance covered only Snake; `web-image` currently has deterministic local tests.
+
+See the [web-image procedure](docs/WEB-IMAGE.md) for authored code and pinned repository inputs.
 
 ## Safety properties (all layer-1, discrimination-proven)
 
@@ -134,7 +203,7 @@ protections proven:
 
 ## Platform package status
 
-The separate `@dzhechkov/cloudru-vm-linux-x64@0.2.6` package is installed
+The separate `@dzhechkov/cloudru-vm-linux-x64@0.2.8` package is installed
 automatically on Linux/x64 unless optional dependencies are disabled. Its static
 build reproduces the pinned SHA-256 and bundles the license and NOTICE files
 of linked Go modules. `CLOUDRU_VM_BIN` and `~/.cloudru-hub/config.json` remain

package/data/pointer-section.md

@@ -1,7 +1,7 @@
 # Cloud.ru Evolution — указатель (pointer-only таргет)
 
 Этот инструмент НЕ несёт на данном таргете ни MCP-тулов Cloud.ru, ни исполняемых
-инструкций деплоя. Полная связка (MCP-сервер `cloudru-vm` на 144 тула + скилл +
+инструкций деплоя. Полная связка (MCP-сервер `cloudru-vm` на 146 тулов + скилл +
 детерминированный тормоз платных шагов) доставляется только на таргеты, где её можно
 поставить честно: Claude Code (полный путь) и codex (после живого veto-probe).
 

package/data/tools-classification.json

@@ -1,11 +1,11 @@
 {
   "$comment": "Golden classification of every cloudru-vm engine tool. allow requires a BEHAVIOUR audit of the handler at the pinned engine SHA proving both axes: (1) observational with no cloud mutation, job advancement or secret return (a local plan write is disclosed), and (2) no user-controlled argument reaching shell/exec/SSH. Shell-reaching tools remain ask even when arguments are quoted. Schema shape alone never proves allow. The old baseline had two hazards: stack_status advanced planned jobs into paid actions and logs inserted an unescaped service into a shell command. In the pinned engine, stack_status reads persisted state only; stack_apply explicitly advances jobs, and logs shell-quotes service. The specific regression tests are in go/cloudru-vm/internal/mcp/stack_status_test.go and internal/engine/logs_test.go. Any unknown live tool fails drift checks; deny by default.",
-  "engineSha256": "4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6",
-  "toolCount": 144,
+  "engineSha256": "0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08",
+  "toolCount": 146,
   "counts": {
     "ask": 64,
     "deny": 2,
-    "allow": 78
+    "allow": 80
   },
   "tools": {
     "deploy": {
@@ -73,6 +73,16 @@
       "permission": "ask",
       "why": "engine schema declares confirmed prop (gated upstream; belt-plus-braces per ADR-004 §3)"
     },
+    "deploy_reconcile": {
+      "effect": "read-only",
+      "permission": "allow",
+      "why": "behaviour-audited read-only: handleDeployReconcile (tools_deploy.go:259) reads a local receipt and project-scoped VM inventory; ReconcileRun only compares observed identities and never writes state or reaches shell."
+    },
+    "deploy_preflight": {
+      "effect": "read-only",
+      "permission": "allow",
+      "why": "behaviour-audited read-only: handleDeployPreflight (tools_deploy.go:278) reads a saved plan, VM inventory and quota usage with HTTP GET; EvaluatePreflight does not create cloud resources, write state or reach shell."
+    },
     "list_flavors": {
       "effect": "read-only",
       "permission": "allow",

package/data/tools-list-snapshot.json

@@ -1,9 +1,9 @@
 {
-  "capturedAt": "2026-10-20",
-  "engineVersion": "cloudru-vm 0.2.6-20261020",
-  "engineSha256": "4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6",
+  "capturedAt": "2026-10-29",
+  "engineVersion": "cloudru-vm 0.2.8-20261029",
+  "engineSha256": "0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08",
   "method": "JSON-RPC tools/list via src/probe-child.js against locally built private engine",
-  "toolCount": 144,
+  "toolCount": 146,
   "tools": [
     {
       "name": "deploy",
@@ -57,6 +57,14 @@
       "name": "deploy_apply",
       "gated": true
     },
+    {
+      "name": "deploy_reconcile",
+      "gated": false
+    },
+    {
+      "name": "deploy_preflight",
+      "gated": false
+    },
     {
       "name": "list_flavors",
       "gated": false

package/docs/HERMES-CODEX.md

@@ -1,8 +1,8 @@
 # Cloud.ru tools in Codex, Hermes, OpenCode and Pi
 
-`cloudru-hub mcp-safe` is the common process boundary. It starts only the binary whose SHA-256 matches the package pin and the classification baseline. Its default profile advertises the 78 golden `allow` tools and rejects `ask`, `deny`, unknown tools and unsupported MCP methods before forwarding a call. Some planning tools may still write local plan files. Filesystem and shell access granted separately to an agent remain outside this MCP boundary.
+`cloudru-hub mcp-safe` is the common process boundary. It starts only the binary whose SHA-256 matches the package pin and the classification baseline. Its default profile advertises the 80 golden `allow` tools and rejects `ask`, `deny`, unknown tools and unsupported MCP methods before forwarding a call. Some planning tools may still write local plan files. Filesystem and shell access granted separately to an agent remain outside this MCP boundary.
 
-Installers default to the smaller `inventory` toolset (11 tools). Select comma-separated groups with `--toolsets inventory,billing`; the available groups are `inventory`, `compute`, `kubernetes`, `data`, `network`, `storage`, and `billing`. `--toolsets all` exposes all 78 allow-classified tools. The proxy checks the chosen set on every `tools/call`, so a tool hidden from discovery cannot be invoked directly.
+Installers default to the smaller `inventory` toolset (11 tools). Select comma-separated groups with `--toolsets inventory,billing`; the available groups are `inventory`, `compute`, `kubernetes`, `data`, `network`, `storage`, and `billing`. `--toolsets all` exposes all 80 allow-classified tools. The proxy checks the chosen set on every `tools/call`, so a tool hidden from discovery cannot be invoked directly.
 
 For the read-only billing tools, put `agreement_id` in the same owner-only credential file as `key_id`, `secret` and `project_id`, then select `--toolsets billing` or `inventory,billing`. The safe proxy passes `agreement_id` to the Go engine as `CLOUDRU_AGREEMENT_ID`; Codex installation inherits the credential-file path and billing environment variables. If the file is absent, an existing environment-only setup still works. An explicitly configured but missing or invalid file is an error. `billing_consumption` currently returns an agreement-wide aggregate. The Cloud.ru API documents project filtering, but this adapter has not implemented or live-verified that filter; do not label its total as a project-only charge.
 
@@ -10,11 +10,11 @@ The separate `--toolsets vm-deploy` profile allows one reviewed VM plan and remo
 
 This local approval is an operator workflow, not a hard security boundary against an agent with unrestricted shell access as the same Unix user: such an agent could invoke `approve` or edit the local files itself. Use process/user isolation and cloud IAM limits if the deployment agent is untrusted. The cost number is an estimate, and the operator cap controls the reviewed plan, not Cloud.ru's final bill.
 
-The launcher archive does **not bundle** the engine. A Linux/x64 npm install pulls `@dzhechkov/cloudru-vm-linux-x64@0.2.6` as an exact optional dependency. On other platforms, or when optional dependencies are disabled, set `CLOUDRU_VM_BIN` to a trusted copy whose hash matches `package.json.cloudruHub.binaryHashes`. Run `cloudru-hub self-test --json` first. A missing or changed binary makes `mcp-safe` refuse startup.
+The launcher archive does **not bundle** the engine. A Linux/x64 npm install pulls `@dzhechkov/cloudru-vm-linux-x64@0.2.7` as an exact optional dependency. On other platforms, or when optional dependencies are disabled, set `CLOUDRU_VM_BIN` to a trusted copy whose hash matches `package.json.cloudruHub.binaryHashes`. Run `cloudru-hub self-test --json` first. A missing or changed binary makes `mcp-safe` refuse startup.
 
 | Host | Setup | Activation check |
 |---|---|---|
-| Codex | `cloudru-hub install --target codex --dir /trusted/project --toolsets vm-deploy` writes `.codex/config.toml` with `required=true`, 12 enabled tools, an explicit 1200-second timeout and inherited paths for the pinned engine and credentials file | Trust the project; in a fresh session call local-only `status` before planning. The profile requests host `auto`, but `codex exec` with approval policy `never` blocked even `status` in the local probe; `--approve-for-me` allowed it. The proxy still requires a separate plan-bound approval for `deploy_apply` |
+| Codex | `cloudru-hub install --target codex --dir /trusted/project --toolsets vm-deploy` writes `.codex/config.toml` with `required=true`, 14 enabled tools, an explicit 1200-second timeout and inherited paths for the pinned engine and credentials file | Trust the project; in a fresh session call local-only `status` before planning. The profile requests host `auto`, but `codex exec` with approval policy `never` blocked even `status` in the local probe; `--approve-for-me` allowed it. The proxy still requires a separate plan-bound approval for `deploy_apply` |
 | OpenCode | `cloudru-hub install --target opencode --dir /trusted/project` writes `opencode.json` with a local server | `opencode mcp list`, then inspect tools in a session; installer refuses an existing `opencode.jsonc` to avoid conflicting configs |
 | Pi | `cloudru-hub install --target pi --dir /trusted/project` writes `.pi/mcp.json` | Use a Pi release with built-in MCP, trust the project, run `pi mcp list`, then `/mcp` in a session; an older Pi may require an adapter |
 | Hermes | With a hash-verified engine available, `cloudru-hub install --target hermes` adds a guarded entry to `$HERMES_HOME/config.yaml` with an explicit nonempty include list and `CLOUDRU_VM_BIN` path; `--hermes-home` selects a test directory | Run `hermes mcp test cloudru_hub`; complex YAML and existing Cloud.ru entries are refused for manual review |

package/docs/LOCAL-TESTING.md

@@ -19,8 +19,8 @@ EOF
 # c) no override: the installed Linux/x64 optional platform package
 ```
 
-The pinned binary identifies itself as `cloudru-vm 0.2.6-20261020` and has SHA-256
-`4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6`.
+The pinned binary identifies itself as `cloudru-vm 0.2.8-20261029` and has SHA-256
+`0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08`.
 
 ## 2. Self-test (end-to-end, no credentials required)
 
@@ -29,18 +29,26 @@ cd packages/@dzhechkov/cloudru-hub
 node bin/cloudru-hub.js self-test
 ```
 
-Expected output for the current private build:
+Example output from the verified engine (installation path varies):
 
 ```
 ✓ resolve: …/cloudru-vm-linux-x64/native/cloudru-vm (source: env)
-✓ sha256: 4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6 — MATCHES pinned baseline
-✓ engine-version: cloudru-vm 0.2.6-20261020
-✓ tools-list: 144 tools live (snapshot: 144)
-✓ classification-coverage: every live tool is classified (144 golden entries)
+✓ sha256: 0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08 — MATCHES pinned baseline
+✓ engine-version: cloudru-vm 0.2.8-20261029
+✓ tools-list: 146 tools live (snapshot: 146)
+✓ classification-coverage: every live tool is classified (146 golden entries)
 self-test: ALL GREEN
 ```
 
-`tools/list` needs no Cloud.ru credentials. For `--toolsets vm-deploy`, place temporary keys in the owner-only JSON file described in `HERMES-CODEX.md`; the proxy maps them to the Go child's environment without shell evaluation.
+The tool's word “live” means a real local MCP catalog observation: 146
+registered tools, without Cloud.ru credentials or cloud API calls. It does
+not mean 146 cloud operations were exercised. A sandbox that prohibits child
+processes can instead report `spawnSync /usr/bin/node EPERM`; run the same
+self-test where the engine can start, rather than treating that refusal as a pass.
+
+For `--toolsets vm-deploy`, place
+temporary keys in the owner-only JSON file described in `HERMES-CODEX.md`;
+the proxy maps them to the Go child's environment without shell evaluation.
 
 ## 3. Optional: `npm link` for a global `cloudru-hub`
 
@@ -66,4 +74,4 @@ appears; note which prefix spelling the runtime used.
 
 ## 5. Testing from another server (`npm install` path)
 
-On Linux/x64, install `@dzhechkov/cloudru-hub@0.1.14` normally and run `cloudru-hub self-test` without setting `CLOUDRU_VM_BIN`. npm installs the exact optional engine package. If optional dependencies were disabled or the platform is unsupported, provide a matching trusted binary explicitly.
+On Linux/x64, install `@dzhechkov/cloudru-hub@0.1.17` normally and run `cloudru-hub self-test` without setting `CLOUDRU_VM_BIN`. npm installs the exact `@dzhechkov/cloudru-vm-linux-x64@0.2.8` optional engine package. If optional dependencies were disabled or the platform is unsupported, provide a matching trusted binary explicitly.

package/docs/WEB-IMAGE.md

@@ -0,0 +1,57 @@
+# Existing-cluster web-image profile
+
+This profile applies a reviewed image to an existing Cloud.ru Kubernetes cluster. It does not create a cluster, build an image or prove source-to-image provenance. The `snake` profile remains the default and keeps its previous exact manifest contract.
+
+## From authored code or a repository
+
+1. For a repository, record its URL and immutable commit SHA. For authored code, record the exact source tree or release artifact used by the build.
+2. Build and publish the image in your trusted CI. Record the resulting registry digest, not a mutable tag. Confirm that the target cluster can pull it. This package does not run an untrusted Dockerfile or store registry credentials.
+3. Prepare a two-document YAML manifest with the image digest. Use a dedicated namespace that already exists, and ensure the app answers `GET /health` on port 8080 as UID 10001 with a read-only root filesystem. Example shape:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata: {name: lesson-web, namespace: lesson-app}
+spec:
+  replicas: 1
+  selector: {matchLabels: {app: lesson-web}}
+  template:
+    metadata: {labels: {app: lesson-web}}
+    spec:
+      automountServiceAccountToken: false
+      securityContext: {runAsNonRoot: true}
+      containers:
+        - name: lesson-web
+          image: registry.example.com/lesson-web@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+          ports: [{containerPort: 8080}]
+          readinessProbe: {httpGet: {path: /health, port: 8080}}
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {cpu: 200m, memory: 256Mi}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            capabilities: {drop: [ALL]}
+---
+apiVersion: v1
+kind: Service
+metadata: {name: lesson-web, namespace: lesson-app}
+spec:
+  type: ClusterIP
+  selector: {app: lesson-web}
+  ports: [{port: 80, targetPort: 8080}]
+```
+
+The registry and digest above are placeholders. Replace them with a real, pullable digest before approval. The exact byte sequence of the final manifest is what the approval binds.
+
+4. Compute `sha256sum web.yaml`, review the file and its resource footprint, then run:
+
+```bash
+cloudru-hub k8s-approve --cluster-id <uuid> --namespace lesson-app --manifest web.yaml --manifest-sha256 <sha256> --profile web-image
+```
+
+5. The agent calls `k8s_apply` with only the returned `approval_id`. The proxy forwards the approved manifest with `create_only=true`. Use the bounded `k8s_kubectl` queries for pods, deployment, service and rollout. An API success is not evidence of a healthy application; inspect the rollout and workload health.
+
+Kubernetes creation across the two documents is not transactional. If one resource is created and the next fails, inspect the exact named resources before cleanup or another attempt. The profile exposes only a ClusterIP; a public endpoint requires a separate, reviewed ingress decision. Cluster and worker charges are outside this approval.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/cloudru-hub",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "licenseHold": {
     "adr": "features/hermes-claude-adaptation/03_adr/001-licence-and-provenance-precondition.md",
     "note": "SATISFIED hold. Timur is credited for substantial Cloud.ru API testing. The 2026-10-20 correction is in the historical grant record. This field keeps the dz guard licence-hold rule checking LICENSE, THIRD_PARTY_NOTICES and SPDX on every publish."
@@ -26,9 +26,9 @@
   ],
   "cloudruHub": {
     "binaryHashes": {
-      "linux-x64": "4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6"
+      "linux-x64": "0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08"
     },
-    "engineVersion": "cloudru-vm 0.2.6-20261020",
+    "engineVersion": "cloudru-vm 0.2.8-20261029",
     "platformPackages": {
       "linux-x64": "@dzhechkov/cloudru-vm-linux-x64"
     }
@@ -53,10 +53,7 @@
     "yaml": "^2.9.0"
   },
   "optionalDependencies": {
-    "@dzhechkov/cloudru-vm-linux-x64": "0.2.6"
-  },
-  "scripts": {
-    "test": "node --test 'test/*.test.mjs'"
+    "@dzhechkov/cloudru-vm-linux-x64": "0.2.8"
   },
   "repository": {
     "type": "git",
@@ -69,5 +66,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "test": "node --test 'test/*.test.mjs'"
   }
-}
+}

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2b0dbd83deb813844a658814b9a6fa1640f1e5255c676210e61dceaa6b42195b"
+          "content": "70bc9263f657739464a56bf220ce370da7baa73dae086565417ccf62b6806078"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4f6a2d5928fec42f021eb10471677b902e831b99d53096661a821f6460bd55a6"
+          "content": "0ca9b07e9194d91645194140c23d715b741a4503ad261305bf1b8af28470c494"
         }
       ]
     },
@@ -75,7 +75,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6f4557d97b90936ef153dc90eac4bdceb6846b6d08d8aec45c86baac328cca60"
+          "content": "32845b9cc1ad64f2f6a8d4eeb8b90bf36710590d25db4234e6813793ef63c5d4"
         }
       ]
     },
@@ -85,7 +85,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9abb3ca6347b0cd6cd51b23649c59e0a0c816e6c12a325f573b392affa350d0b"
+          "content": "0f09cb2fffd2feebfa5e7e97e8503a47ae1b63d1035e309540a4211f0bace477"
         }
       ]
     },
@@ -95,7 +95,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dff98bb859dfbbf8ed2fb6f16f17b767444cc2172ecc7684ca3df8188c95707c"
+          "content": "247fe8a6d9c47d3b7c4d218d1047df842e41e3b1880594d7dbc7b3f5e6ce52ed"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3605797972f9a7c79c13fbcce0cd9ac8b8fb3a8249abbab938f2b1a45f515420"
+          "content": "00a5c9acc3999c5e07f230ba63bc1a0e202d62c8d15d2204620feca762eece8f"
         }
       ]
     },
@@ -125,7 +125,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "de6f709e820fbb831f390e274238b28ba938644670a8db04fd50d1fa0d86da75"
+          "content": "6b2f6b18f863a9a467ad08977b14de4fdf3285a70ae5a35ce855c4f143c05958"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "docs/WEB-IMAGE.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "690e092bafddc862c20ebd5ff0358a4c57f84881153c235a146e258563459f27"
         }
       ]
     },
@@ -149,7 +159,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "1b355df670fb092da7ce8956141e702f9f78e1e2f2724c6aaba61bbab2acd8c8"
+          "value": "7fe766354e40487c5dd90461d41edcde781cf4775d46376daad9c5abbaf8b314"
         }
       ]
     },
@@ -169,7 +179,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b1bd4a0ce7f1ca869c2873ca1979a74630483ee2909ff8b4f91189622f5aa2a7"
+          "content": "590265903b3a242b3d9c1367801ce6ce10e23e18abbc28938c5a26f735ea7d75"
         }
       ]
     },
@@ -219,7 +229,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c928db48febfb4a79884ce1830365a8302122a55fb5d6ada8e771c049396ca89"
+          "content": "90af414aabda1c48c82c9c2ecf0dbe4d7dd4744486efdce0d8367182b6a67a38"
         }
       ]
     },
@@ -229,7 +239,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "014c2effd1e843d870ae1af4f93f5c82faff9972e9f6ca028ed39d47ec33ee3a"
+          "content": "950543b85a7ed2c8e1660b40c2bb50192663e5fe62f8287b9b76ac3f8178c263"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/k8s-image-manifest.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "8a2c519e9bc6677c867758f4b9b56146f2832ee07a5bfd4fefed3317f0d9cf73"
         }
       ]
     },
@@ -259,7 +279,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4f95cfb9576c411232503b26053ece6d8d186e4b337beff9bd4afd249f74a014"
+          "content": "60a5db44db9518835f98f23aa104b86c3621f0b0c030196c2130715f5c19c219"
         }
       ]
     },
@@ -269,7 +289,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "89229c882b6a3f5bb9ee542b31d1a40374b91879747582a3e82e8aadc72decb3"
+          "content": "0a66e73476d5f5624908f05f621b150efa51217fc9418938ca126dc0dc2b9518"
         }
       ]
     },
@@ -299,7 +319,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "026e3031180ce9227b4d31775b9c886b10ad0cb418ed0754aed75b12ded84e31"
+          "content": "413ddf6d9a4f709d80bce9011094d95bbe56f12c391f72be235c4482a1b40450"
         }
       ]
     },
@@ -319,7 +339,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d72e4363fd50d0fcc65fd23b40601516bd73368c3659f2a55a394c4d1ed3f85c"
+          "content": "3aaf3cdf27c57be9121d7d1727335d0a97064659b3201d34d1e27f5aed631434"
         }
       ]
     },
@@ -359,7 +379,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "af04d1941fb7aed2cc51b05f65ffed1c440d4d23a7fb26e13261d45e07b0a1f8"
+          "content": "acc30164bbafc2d46b404ff8ae87caf42e301e15dd005c424654ee0225af6efd"
         }
       ]
     },
@@ -399,7 +419,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9ad83ba418dee86ef680575a0cc7da4af4be3ae995c00f23f84b336838fbda47"
+          "content": "dcaede3dea29d98d93f3c902b8f9f389f24dc7b9a84665d1c206263915282f06"
         }
       ]
     },
@@ -409,7 +429,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "45406dabeee0635ede5cda3d2f4144c5c13886d624287fd223b01252d2859b87"
+          "content": "e99200ccdd8368260af18532478addc08e3b6195986cecf68b669e9dc639d119"
         }
       ]
     }

package/src/cli.js

@@ -38,7 +38,8 @@ Commands:
                            Authorize one exact VM plan for ten minutes within a RUB/month cap.
                            Static sites require the artifact digest shown by deploy_plan.
   k8s-approve --cluster-id <uuid> --namespace <name> --manifest <file> --manifest-sha256 <digest>
-                           Authorize one exact three-resource Snake manifest on an existing cluster.
+              [--profile snake|web-image]
+                           Authorize one exact bounded manifest on an existing cluster.
   cost-compare --input <json> [--json]
                            Offline VM vs Kubernetes cost worksheet; no engine or credentials.
   install --target <t>     claude-code: permissions + executed hook probe;
@@ -190,7 +191,7 @@ function main(argv, write = (s) => process.stdout.write(s + '\n')) {
     case 'k8s-approve': {
       try {
         const approval = issueK8sApproval(opts.get('cluster-id'), opts.get('namespace'),
-          opts.get('manifest'), opts.get('manifest-sha256'));
+          opts.get('manifest'), opts.get('manifest-sha256'), process.env, Date.now(), opts.get('profile') || 'snake');
         write(flags.has('json') ? JSON.stringify(approval, null, 2) :
           `approved ${approval.approvalId}: cluster ${approval.clusterId}, namespace ${approval.namespace}, SHA-256 ${approval.manifestSha256}; expires ${new Date(approval.expiresAt).toISOString()}`);
         return 0;

package/src/install.js

@@ -45,7 +45,7 @@ const TIERS = {
 const DEGRADED_REASONS = {
   openclaude: 'all three legs exist upstream (.mcp.json, PreToolUse deny, .openclaude/skills) but NOTHING has been probed live — degraded-until-proven (ADR-005).',
   cursor: 'veto hooks documented only; R3 broken by the .mdc adapter, R4 truncation history (~40 tools) unresolved (ADR-005).',
-  windsurf: 'R4 FAILS as-is: Cascade budget 100 tools < 144 — needs the engine tool-profile before any delivery (ADR-005).',
+  windsurf: 'R4 FAILS as-is: Cascade budget 100 tools < 146 — needs the engine tool-profile before any delivery (ADR-005).',
   copilot: 'only Copilot CLI is a candidate; the coding agent fails R2 by construction ("will not ask for your approval" + hook timeout fail-open) (ADR-005).',
 };
 

package/src/k8s-approval.js

@@ -10,6 +10,7 @@ const { isDeepStrictEqual } = require('util');
 const YAML = require('yaml');
 const { readCredentials, UUID } = require('./credentials');
 const { approvalRoot } = require('./deploy-approval');
+const { validateImageManifest } = require('./k8s-image-manifest');
 
 const APPROVAL_ID = /^k8s-[0-9a-f]{12}$/;
 const DNS_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -49,7 +50,9 @@ function privateJson(file) {
   return JSON.parse(fs.readFileSync(file, 'utf8'));
 }
 
-function validateManifest(raw, namespace) {
+function validateManifest(raw, namespace, profile = 'snake') {
+  if (profile === 'web-image') return validateImageManifest(raw, namespace);
+  if (profile !== 'snake') throw new Error('unsupported Kubernetes profile');
   if (typeof raw !== 'string' || Buffer.byteLength(raw) < 1 || Buffer.byteLength(raw) > MAX_MANIFEST) {
     throw new Error('manifest must be non-empty and at most 64 KiB');
   }
@@ -143,7 +146,7 @@ function approvalFile(id, env = process.env) {
   return path.join(approvalRoot(env), `${id}.json`);
 }
 
-function issueK8sApproval(clusterId, namespace, manifestFile, reviewedSha256, env = process.env, now = Date.now()) {
+function issueK8sApproval(clusterId, namespace, manifestFile, reviewedSha256, env = process.env, now = Date.now(), profile = 'snake') {
   if (!UUID.test(clusterId || '')) throw new Error('cluster_id must be a UUID');
   if (!DIGEST.test(reviewedSha256 || '')) throw new Error('reviewed manifest SHA-256 is required');
   const st = fs.lstatSync(manifestFile);
@@ -151,17 +154,17 @@ function issueK8sApproval(clusterId, namespace, manifestFile, reviewedSha256, en
     throw new Error('manifest source must be a bounded regular file');
   }
   const manifest = fs.readFileSync(manifestFile, 'utf8');
-  const details = validateManifest(manifest, namespace);
+  const details = validateManifest(manifest, namespace, profile);
   const digest = sha256(manifest);
   if (digest !== reviewedSha256) throw new Error('manifest digest differs from reviewed SHA-256');
   const credentials = readCredentials(env);
   const root = approvalRoot(env);
   privateDir(root);
   const id = `k8s-${crypto.randomBytes(6).toString('hex')}`;
-  const record = { id, projectId: credentials.projectId, clusterId, namespace, manifest, digest,
+  const record = { id, projectId: credentials.projectId, clusterId, namespace, manifest, digest, profile,
     app: details.app, issuedAt: now, expiresAt: now + 10 * 60_000 };
   fs.writeFileSync(approvalFile(id, env), JSON.stringify(record) + '\n', { flag: 'wx', mode: 0o600 });
-  return { approvalId: id, projectId: record.projectId, clusterId, namespace, manifestSha256: digest,
+  return { approvalId: id, projectId: record.projectId, clusterId, namespace, manifestSha256: digest, profile,
     resources: details.resources, image: details.image, expiresAt: record.expiresAt,
     estimateScope: 'existing cluster only; no cluster, worker, NAT or public load balancer is created' };
 }
@@ -172,7 +175,7 @@ function consumeK8sApproval(id, env = process.env, now = Date.now()) {
   const credentials = readCredentials(env);
   if (a.id !== id || a.projectId !== credentials.projectId || !UUID.test(a.clusterId || '') ||
       !Number.isFinite(a.expiresAt) || a.expiresAt <= now || !DIGEST.test(a.digest || '') ||
-      sha256(a.manifest) !== a.digest || validateManifest(a.manifest, a.namespace).app !== a.app) {
+      sha256(a.manifest) !== a.digest || validateManifest(a.manifest, a.namespace, a.profile).app !== a.app) {
     throw new Error('Kubernetes approval does not match manifest, project or time');
   }
   const spent = path.join(approvalRoot(env), `${id}.used-${crypto.randomBytes(8).toString('hex')}.json`);

package/src/k8s-image-manifest.js

@@ -0,0 +1,75 @@
+'use strict';
+
+// A narrow generic web workload: one digest-pinned image, one Deployment and
+// one internal Service. The reviewed digest is the security boundary; source
+// build and image registry publication are separate operator steps.
+const YAML = require('yaml');
+const { isDeepStrictEqual } = require('util');
+const DNS = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const SERVICE_NAME = /^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const IMAGE = /^[a-z0-9][a-z0-9._:/-]*@sha256:[a-f0-9]{64}$/;
+const isRecord = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+const fields = (obj, allowed, label) => {
+  if (!isRecord(obj) || Object.keys(obj).some((key) => !allowed.includes(key))) throw new Error(`${label} contains unsupported fields`);
+};
+const equal = (actual, expected, label) => {
+  if (!isDeepStrictEqual(actual, expected)) throw new Error(`${label} differs from the reviewed web-image profile`);
+};
+
+function validateImageManifest(raw, namespace) {
+  if (typeof raw !== 'string' || Buffer.byteLength(raw) < 1 || Buffer.byteLength(raw) > 64 * 1024) throw new Error('manifest must be 1..65536 bytes');
+  if (typeof namespace !== 'string' || !DNS.test(namespace) || namespace.length > 63 || namespace === 'default' || namespace === 'kube-system') {
+    throw new Error('a dedicated DNS namespace is required');
+  }
+  const docs = YAML.parseAllDocuments(raw, { uniqueKeys: true, maxAliasCount: 0 });
+  if (docs.length !== 2 || docs.some((doc) => doc.errors.length)) throw new Error('web-image manifest needs exactly Deployment and Service');
+  const resources = docs.map((doc) => doc.toJS({ maxAliasCount: 0 }));
+  const deployment = resources.find((r) => r?.kind === 'Deployment');
+  const service = resources.find((r) => r?.kind === 'Service');
+  if (!deployment || !service || deployment === service) throw new Error('web-image manifest needs Deployment and Service');
+  for (const [r, kind, api] of [[deployment, 'Deployment', 'apps/v1'], [service, 'Service', 'v1']]) {
+    fields(r, ['apiVersion', 'kind', 'metadata', 'spec'], kind);
+    if (r.apiVersion !== api || r.kind !== kind) throw new Error(`invalid ${kind} API`);
+    fields(r.metadata, ['name', 'namespace'], `${kind} metadata`);
+    if (!SERVICE_NAME.test(r.metadata.name || '') || r.metadata.namespace !== namespace) throw new Error(`${kind} must use the reviewed namespace and a Service-compatible name`);
+  }
+  const app = deployment.metadata.name;
+  if (service.metadata.name !== app) throw new Error('Service name must match Deployment');
+  const spec = deployment.spec;
+  fields(spec, ['replicas', 'selector', 'template'], 'Deployment spec');
+  if (spec.replicas !== 1) throw new Error('only one replica is allowed');
+  fields(spec.selector, ['matchLabels'], 'selector');
+  equal(spec.selector.matchLabels, { app }, 'selector');
+  fields(spec.template, ['metadata', 'spec'], 'pod template');
+  fields(spec.template.metadata, ['labels'], 'pod metadata');
+  equal(spec.template.metadata.labels, { app }, 'pod labels');
+  const pod = spec.template.spec;
+  fields(pod, ['automountServiceAccountToken', 'securityContext', 'containers'], 'pod spec');
+  if (pod.automountServiceAccountToken !== false) throw new Error('service account token must be disabled');
+  equal(pod.securityContext, { runAsNonRoot: true }, 'pod security context');
+  if (!Array.isArray(pod.containers) || pod.containers.length !== 1) throw new Error('exactly one container is required');
+  const container = pod.containers[0];
+  fields(container, ['name', 'image', 'ports', 'readinessProbe', 'resources', 'securityContext'], 'container');
+  if (container.name !== app || !IMAGE.test(container.image || '') || container.image.includes('://') || container.image.includes('//')) throw new Error('container needs a digest-pinned OCI image');
+  equal(container.ports, [{ containerPort: 8080 }], 'container ports');
+  equal(container.readinessProbe, { httpGet: { path: '/health', port: 8080 } }, 'readiness probe');
+  equal(container.securityContext, { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true,
+    runAsUser: 10001, runAsGroup: 10001, capabilities: { drop: ['ALL'] } }, 'container security context');
+  const requests = container.resources?.requests;
+  const limits = container.resources?.limits;
+  fields(container.resources, ['requests', 'limits'], 'resources');
+  fields(requests, ['cpu', 'memory'], 'requests');
+  fields(limits, ['cpu', 'memory'], 'limits');
+  const cpu = (v, max) => typeof v === 'string' && /^[1-9][0-9]{0,3}m$/.test(v) && Number.parseInt(v, 10) <= max;
+  const mem = (v, max) => typeof v === 'string' && /^[1-9][0-9]{0,3}Mi$/.test(v) && Number.parseInt(v, 10) <= max;
+  if (!cpu(requests.cpu, 500) || !cpu(limits.cpu, 1000) || !mem(requests.memory, 512) || !mem(limits.memory, 1024) ||
+      Number.parseInt(requests.cpu, 10) > Number.parseInt(limits.cpu, 10) ||
+      Number.parseInt(requests.memory, 10) > Number.parseInt(limits.memory, 10)) throw new Error('resources exceed bounded web-image limits');
+  fields(service.spec, ['type', 'selector', 'ports'], 'Service spec');
+  if (service.spec.type !== 'ClusterIP') throw new Error('Service must be internal ClusterIP');
+  equal(service.spec.selector, { app }, 'Service selector');
+  equal(service.spec.ports, [{ port: 80, targetPort: 8080 }], 'Service ports');
+  return { app, image: container.image, resources: [{ kind: 'Deployment', name: app }, { kind: 'Service', name: app }] };
+}
+
+module.exports = { validateImageManifest };

package/src/safe-mcp.js

@@ -6,13 +6,18 @@ const { spawn } = require('child_process');
 const { loadClassification } = require('./classification');
 const { resolveEngine } = require('./resolve');
 const { selectedToolNames } = require('./toolsets');
-const { readCredentials, readOptionalCredentials } = require('./credentials');
+const { readCredentials, readOptionalCredentials, UUID } = require('./credentials');
 const { consumeApproval, recordDeployedVM, approvedVM } = require('./deploy-approval');
 const { consumeK8sApproval, k8sSession, verificationArgs } = require('./k8s-approval');
 
 const MAX_LINE = 1024 * 1024;
 const idKey = (id) => JSON.stringify(id);
 const errorResponse = (id, message, code = -32000) => ({ jsonrpc: '2.0', id, error: { code, message } });
+const uncertainDeploy = (id, approval, reason) => ({ jsonrpc: '2.0', id,
+  result: { isError: true, content: [{ type: 'text', text: JSON.stringify({
+    status: 'recovery_required', plan_id: approval.planId, verdict: 'unknown',
+    reason, next: 'Call deploy_reconcile with this plan_id; inspect live inventory before any new plan or mutation.',
+  }) }] } });
 
 function redactDeploySecrets(value) {
   if (Array.isArray(value)) return value.map(redactDeploySecrets);
@@ -81,8 +86,10 @@ function runSafeMcp(options = {}) {
     if (stopped) return;
     stopped = true;
     stderr.write(`cloudru-hub mcp-safe: ${reason}\n`);
-    for (const key of pending.keys()) {
-      emit(errorResponse(JSON.parse(key), 'Cloud.ru engine connection closed'));
+    for (const [key, request] of pending) {
+      const id = JSON.parse(key);
+      emit(request.approval ? uncertainDeploy(id, request.approval, 'Cloud.ru engine connection closed during deploy_apply') :
+        errorResponse(id, 'Cloud.ru engine connection closed'));
     }
     pending.clear();
     stdin.destroy();
@@ -210,10 +217,10 @@ function runSafeMcp(options = {}) {
         tool && typeof tool.name === 'string' && selected.has(tool.name)).map((tool) => {
         if (!k8sProfile) return tool;
         if (tool.name === 'k8s_apply') return { ...tool,
-          description: 'Apply one locally reviewed Snake manifest to one existing cluster. Pass only the local approval ID.',
+          description: 'Apply one locally reviewed bounded Snake or web-image manifest to one existing cluster. Pass only the local approval ID.',
           inputSchema: { type: 'object', properties: { approval_id: { type: 'string' } }, required: ['approval_id'], additionalProperties: false } };
         if (tool.name === 'k8s_kubectl') return { ...tool,
-          description: 'Read only pods, deployment, service or rollout status for the previously approved Snake workload.',
+          description: 'Read only pods, deployment, service or rollout status for the previously approved workload.',
           inputSchema: { type: 'object', properties: { approval_id: { type: 'string' },
             query: { type: 'string', enum: ['pods', 'deployment', 'service', 'rollout'] } },
           required: ['approval_id', 'query'], additionalProperties: false } };
@@ -226,7 +233,11 @@ function runSafeMcp(options = {}) {
     if (method === 'initialize' && message.result && message.result.capabilities) {
       message.result = { ...message.result, capabilities: { tools: message.result.capabilities.tools || {} } };
     }
-    if (approval && !message.error) {
+    if (approval && message.error) {
+      emit(uncertainDeploy(message.id, approval, 'Cloud.ru engine returned an error after approval was consumed'));
+      closeIfDone(); return;
+    }
+    if (approval) {
       // The engine returns an MCP text result containing its JSON deploy result.
       // Keep the model from seeing a generated login password: vm_exec uses the
       // engine-managed SSH key. Ambiguous responses require inspection.
@@ -234,28 +245,32 @@ function runSafeMcp(options = {}) {
       let deploy;
       try { deploy = JSON.parse(item?.text || ''); }
       catch {
-        message.result = { isError: true, content: [{ type: 'text', text: 'deploy_apply returned an unreadable outcome; inspect the live VM inventory before retrying' }] };
-        emit(message); closeIfDone(); return;
+        emit(uncertainDeploy(message.id, approval, 'deploy_apply returned an unreadable outcome'));
+        closeIfDone(); return;
       }
       if (!deploy || typeof deploy !== 'object' || Array.isArray(deploy)) {
-        message.result = { isError: true, content: [{ type: 'text', text: 'deploy_apply returned an invalid outcome; inspect the live VM inventory before retrying' }] };
-        emit(message); closeIfDone(); return;
+        emit(uncertainDeploy(message.id, approval, 'deploy_apply returned an invalid outcome'));
+        closeIfDone(); return;
       }
       const safe = redactDeploySecrets(deploy);
-      if (!message.result?.isError && approval.siteMode && deploy.status === 'running' && deploy.http_verification?.verified === true) {
+      safe.operation = { plan_id: approval.planId, verdict: 'unknown', observed_at: new Date().toISOString() };
+      if (!message.result?.isError && approval.siteMode && deploy.status === 'running' && deploy.http_verification?.verified === true &&
+          UUID.test(deploy.vm_id || '')) {
         // Static-site delivery is verified over HTTP. It does not imply SSH is
         // available, so never create a vm_exec session for this VM.
+        safe.operation.verdict = 'http_verified';
       } else if (!message.result?.isError && !approval.siteMode && deploy.status === 'running') {
         try {
           const session = recordDeployedVM(approval, deploy, options.env || process.env);
           safe.approved_vm_session_expires_at = new Date(session.expiresAt).toISOString();
+          safe.operation.verdict = 'vm_running';
         } catch (error) {
           message.result.isError = true;
           safe.recovery = `VM may exist but the approved execution session was not recorded: ${error.message}. Inspect VM inventory before retrying.`;
         }
       } else {
         message.result.isError = true;
-        safe.recovery = 'A VM may exist. Inspect the returned VM UUID and live inventory before retrying; a fresh plan and approval may be needed.';
+        safe.recovery = 'A VM may exist. Call deploy_reconcile with the plan_id. Inspect live inventory before retrying; a fresh plan and approval may be needed.';
       }
       item.text = JSON.stringify(safe);
     }

package/src/toolsets.js

@@ -15,7 +15,7 @@ const GROUPS = Object.freeze({
 // A separate, opt-in workflow. Mutators pass the proxy's local plan/VM guard;
 // combining this with a read-only group would blur that boundary.
 const VM_DEPLOY = Object.freeze([
-  'deploy_plan', 'deploy_apply', 'vm_exec', 'vm_list', 'vm_get',
+  'deploy_plan', 'deploy_preflight', 'deploy_apply', 'deploy_reconcile', 'vm_exec', 'vm_list', 'vm_get',
   'list_zones', 'list_images', 'list_flavors', 'list_disk_types',
   'list_subnets', 'list_security_groups', 'status',
 ]);

package/test/classification.test.mjs

@@ -16,15 +16,15 @@ test('every snapshot tool is classified, and nothing extra', () => {
   const snapNames = snap.tools.map((t) => t.name).sort();
   const clsNames = Object.keys(cls.tools).sort();
   assert.deepEqual(clsNames, snapNames);
-  assert.equal(snapNames.length, 144);
+  assert.equal(snapNames.length, 146);
 });
 
-test('counts are the reviewed golden split: 64 ask / 2 deny / 78 allow', () => {
-  assert.deepEqual(cls.counts, { ask: 64, deny: 2, allow: 78 });
+test('counts are the reviewed golden split: 64 ask / 2 deny / 80 allow', () => {
+  assert.deepEqual(cls.counts, { ask: 64, deny: 2, allow: 80 });
   const by = namesByPermission(cls);
   assert.equal(by.ask.length, 64);
   assert.equal(by.deny.length, 2);
-  assert.equal(by.allow.length, 78);
+  assert.equal(by.allow.length, 80);
 });
 
 // The imported engine now makes status observational. The Go regression test
@@ -121,7 +121,7 @@ test('permissionRules expands every name in BOTH prefix spellings (unverified no
   assert.equal(SERVER_PREFIXES.length, 2);
   assert.equal(rules.ask.length, 64 * 2);
   assert.equal(rules.deny.length, 2 * 2);
-  assert.equal(rules.allow.length, 78 * 2);
+  assert.equal(rules.allow.length, 80 * 2);
   assert.ok(rules.ask.includes('mcp__cloudru-vm__deploy'));
   assert.ok(rules.ask.includes('mcp__cloudru_vm__deploy'));
   assert.ok(rules.deny.includes('mcp__cloudru-vm__secret_value'));

package/test/deploy-approval.test.mjs

@@ -110,6 +110,18 @@ test('partial deploy preserves its VM UUID for recovery and redacts nested secre
   assert.ok(denied.responses[0].error);
 });
 
+test('unreadable apply result names the consumed plan and requires read-only reconciliation', () => {
+  const id = 'plan-555555555555';
+  fs.writeFileSync(path.join(path.dirname(planFile), `${id}.json`), JSON.stringify({ ...plan, plan_id: id }));
+  issueApproval(id, 50, env);
+  const out = run([rpc(1, 'deploy_apply', { plan_id: id })], { FAKE_DEPLOY_OUTCOME: JSON.stringify('unreadable') });
+  const result = JSON.parse(out.responses[0].result.content[0].text);
+  assert.equal(out.responses[0].result.isError, true);
+  assert.equal(result.plan_id, id);
+  assert.equal(result.verdict, 'unknown');
+  assert.match(result.next, /deploy_reconcile/);
+});
+
 test('static site requires the reviewed digest and never grants an SSH command session', () => {
   const id = 'plan-aabbccddeeff';
   const digest = 'a'.repeat(64);

package/test/k8s-approval.test.mjs

@@ -67,6 +67,46 @@ test('unexpected mutators, exposure, privilege, image and namespace are rejected
   }
 });
 
+test('web-image profile accepts a reviewed digest-pinned application and refuses privilege or exposure drift', () => {
+  const app = 'lesson-web';
+  const image = `registry.example.com/lesson-web@sha256:${'a'.repeat(64)}`;
+  const web = [
+    { apiVersion: 'apps/v1', kind: 'Deployment', metadata: { name: app, namespace: 'lesson-app' }, spec: {
+      replicas: 1, selector: { matchLabels: { app } }, template: { metadata: { labels: { app } }, spec: {
+        automountServiceAccountToken: false, securityContext: { runAsNonRoot: true },
+        containers: [{ name: app, image, ports: [{ containerPort: 8080 }], readinessProbe: { httpGet: { path: '/health', port: 8080 } },
+          resources: { requests: { cpu: '50m', memory: '64Mi' }, limits: { cpu: '200m', memory: '256Mi' } },
+          securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, runAsUser: 10001,
+            runAsGroup: 10001, capabilities: { drop: ['ALL'] } } }],
+      } } } },
+    { apiVersion: 'v1', kind: 'Service', metadata: { name: app, namespace: 'lesson-app' },
+      spec: { type: 'ClusterIP', selector: { app }, ports: [{ port: 80, targetPort: 8080 }] } },
+  ];
+  const raw = serialize(web);
+  assert.equal(validateManifest(raw, 'lesson-app', 'web-image').image, image);
+  assert.throws(() => validateManifest(raw, 'lesson-app'), /three valid YAML documents/);
+  for (const mutate of [
+    (r) => { r[0].spec.template.spec.containers[0].image = 'registry.example.com/lesson-web:latest'; },
+    (r) => { r[0].spec.template.spec.containers[0].image = `https://registry.example.com/lesson-web@sha256:${'a'.repeat(64)}`; },
+    (r) => { r[0].spec.template.spec.hostNetwork = true; },
+    (r) => { r[0].spec.template.spec.containers[0].securityContext.privileged = true; },
+    (r) => { r[1].spec.type = 'LoadBalancer'; },
+    (r) => { r[0].metadata.namespace = 'default'; },
+    (r) => { r[0].metadata.name = r[1].metadata.name = '123'; r[0].spec.selector.matchLabels.app = r[0].spec.template.metadata.labels.app = r[1].spec.selector.app = '123'; r[0].spec.template.spec.containers[0].name = '123'; },
+  ]) {
+    const changed = structuredClone(web); mutate(changed);
+    assert.throws(() => validateManifest(serialize(changed), 'lesson-app', 'web-image'));
+  }
+  const source = path.join(scratch, 'lesson-app.yaml');
+  fs.writeFileSync(source, raw);
+  const reviewed = require('crypto').createHash('sha256').update(raw).digest('hex');
+  const approval = issueK8sApproval(clusterId, 'lesson-app', source, reviewed, env, Date.now(), 'web-image');
+  assert.equal(approval.profile, 'web-image');
+  assert.equal(consumeK8sApproval(approval.approvalId, env).manifest, raw);
+  fs.writeFileSync(source, serialize([{ ...web[0], metadata: { name: 'changed', namespace: 'lesson-app' } }, web[1]]));
+  assert.throws(() => issueK8sApproval(clusterId, 'lesson-app', source, reviewed, env, Date.now(), 'web-image'), /digest differs|must match/);
+});
+
 test('digest, project, expiry and single-use approval bind the exact manifest', () => {
   assert.throws(() => issueK8sApproval(clusterId, 'snake-pilot', manifestFile, '0'.repeat(64), env), /digest differs/);
   const a = issueK8sApproval(clusterId, 'snake-pilot', manifestFile, digest, env, 1000);

package/test/resolve.test.mjs

@@ -125,6 +125,6 @@ test('sha256File matches node crypto', () => {
 test('the pinned linux-x64 hash is the rebuilt private engine sha256', () => {
   assert.equal(
     PKG.cloudruHub.binaryHashes['linux-x64'],
-    '4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6',
+    '0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08',
   );
 });

package/test/safe-mcp.test.mjs

@@ -47,6 +47,26 @@ test('safe proxy filters listed tools and blocks ask, deny, unknown and other me
   assert.deepEqual(out.forwarded.filter((m) => m.method === 'tools/call').map((m) => m.params.name), ['vm_list']);
 });
 
+test('k8s_get recovery selectors pass existing read profiles while paid creates stay denied', () => {
+  const snapshot = JSON.parse(fs.readFileSync(path.join(pkg, 'data/tools-list-snapshot.json'), 'utf8'));
+  assert.equal(snapshot.toolCount, 146);
+  assert.equal(snapshot.tools.length, 146);
+  for (const profile of ['all', 'kubernetes', 'k8s-deploy']) {
+    const out = run([
+      msg(1, 'tools/call', { name: 'k8s_get', arguments: { receipts: true, limit: 10 } }),
+      msg(2, 'tools/call', { name: 'k8s_get', arguments: { receipt_id: 'a'.repeat(64) } }),
+      msg(3, 'tools/call', { name: 'k8s_create', arguments: { confirmed: true } }),
+      msg(4, 'tools/call', { name: 'k8s_add_nodepool', arguments: { confirmed: true } }),
+    ], profile);
+    const byId = Object.fromEntries(out.responses.map((r) => [r.id, r]));
+    assert.match(byId[1].result.content[0].text, /executed k8s_get/);
+    assert.match(byId[2].result.content[0].text, /executed k8s_get/);
+    assert.ok(byId[3].error, `${profile}: k8s_create must be denied`);
+    assert.ok(byId[4].error, `${profile}: k8s_add_nodepool must be denied`);
+    assert.deepEqual(out.forwarded.map((m) => m.params.name), ['k8s_get', 'k8s_get']);
+  }
+});
+
 test('Hermes keepalive gets the filtered tool list while the serial engine is busy', async () => {
   const serial = path.join(scratch, 'serial-engine');
   const serialLog = path.join(scratch, 'serial-forwarded.jsonl');