@intentius/chant-lexicon-k8s 0.41.19 → 0.42.1

package/src/components/index.ts

@@ -19,3 +19,10 @@ export {
   type KubectlApplyInput,
   type KubectlApplyOutcome,
 } from "./kubectl-apply";
+export {
+  kustomizeApplyCapability,
+  createKustomizeApplyCapability,
+  renderCommand,
+  type KustomizeApplyInput,
+  type KustomizeApplyOutcome,
+} from "./kustomize-apply";

package/src/components/kustomize-apply.test.ts

@@ -0,0 +1,98 @@
+/**
+ * `kustomize-apply` (#1548) — the render-then-apply leaf. What must hold:
+ * the capability registers under its kind with the lexicon's own version
+ * (#1505), the render command is exact and falls back to kubectl's vendored
+ * kustomize, the rendered documents reach the applier INLINE (no temp file)
+ * with the deploy-unit stack, and the rollback posture matches kubectl-apply
+ * (server-side apply has no native undo).
+ */
+import { describe, test, expect } from "vitest";
+import { createKustomizeApplyCapability, kustomizeApplyCapability, renderCommand, type KustomizeApplyInput } from "./kustomize-apply";
+import { k8sCapabilityPlugin, K8S_VERB_FAMILIES } from "./capability-plugin";
+import { isCapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+import type { DeployContext } from "@intentius/chant/components/capability";
+
+const ctx = { env: "dev" } as DeployContext;
+
+const RENDERED = `apiVersion: v1
+kind: Namespace
+metadata:
+  name: web
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+  namespace: web
+spec:
+  replicas: 1
+`;
+
+describe("kustomize-apply capability (#1548)", () => {
+  test("registers on the k8s plugin, in the apply family, at the package's own version", () => {
+    expect(isCapabilityPlugin(k8sCapabilityPlugin)).toBe(true);
+    expect(k8sCapabilityPlugin.capabilities().map((c) => c.kind)).toContain("kustomize-apply");
+    expect(K8S_VERB_FAMILIES.apply).toContain("kustomize-apply");
+    // #1505 — never a stale literal.
+    const { version } = JSON.parse(
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      require("node:fs").readFileSync(new URL("../../package.json", import.meta.url), "utf8"),
+    ) as { version: string };
+    expect(k8sCapabilityPlugin.version).toBe(version);
+  });
+
+  test("rollback is needs-opt-out — a server-side apply keeps no previous state", () => {
+    expect(kustomizeApplyCapability.rollbackPolicy).toBe("needs-opt-out");
+  });
+
+  test("renders with kustomize build and hands the parsed documents to the applier inline", async () => {
+    const commands: string[] = [];
+    const applierArgs: unknown[] = [];
+    const cap = createKustomizeApplyCapability(
+      async (command) => {
+        commands.push(command);
+        return { stdout: RENDERED };
+      },
+      async (args) => {
+        applierArgs.push(args);
+        return { fieldManager: "chant:web", applied: [], pruned: [] };
+      },
+    );
+
+    await cap.run(ctx, { dir: "overlays/dev", stack: "web", delete: "owned-only" } as KustomizeApplyInput as never);
+
+    expect(commands).toEqual(["kustomize build 'overlays/dev'"]);
+    expect(applierArgs).toHaveLength(1);
+    const args = applierArgs[0] as { manifest: string; documents: unknown[]; environment: string; stack: string; deleteMode: string };
+    expect(args.manifest).toBe("kustomize:overlays/dev"); // a label, not a path
+    expect(args.documents).toHaveLength(2);
+    expect((args.documents[1] as { kind: string }).kind).toBe("Deployment");
+    expect(args.environment).toBe("dev");
+    expect(args.stack).toBe("web");
+    expect(args.deleteMode).toBe("owned-only");
+  });
+
+  test("falls back to kubectl's vendored kustomize when the binary is missing", async () => {
+    const commands: string[] = [];
+    const cap = createKustomizeApplyCapability(
+      async (command) => {
+        commands.push(command);
+        if (command.startsWith("kustomize ")) throw new Error("spawn kustomize ENOENT");
+        return { stdout: RENDERED };
+      },
+      async () => ({ fieldManager: "chant", applied: [], pruned: [] }),
+    );
+    await cap.run(ctx, { dir: "overlays/dev" } as KustomizeApplyInput as never);
+    expect(commands).toEqual([renderCommand("overlays/dev", "kustomize"), renderCommand("overlays/dev", "kubectl")]);
+  });
+
+  test("a render failure that is NOT a missing binary propagates — a broken overlay is not silently retried", async () => {
+    const cap = createKustomizeApplyCapability(
+      async () => {
+        throw new Error("accumulating resources: missing base ../common");
+      },
+      async () => ({ fieldManager: "chant", applied: [], pruned: [] }),
+    );
+    await expect(cap.run(ctx, { dir: "overlays/dev" } as KustomizeApplyInput as never)).rejects.toThrow("missing base");
+  });
+});

package/src/components/kustomize-apply.ts

@@ -0,0 +1,133 @@
+/**
+ * `kustomize-apply` — the kustomize leaf for the component model (#1548).
+ *
+ * Kustomize is a RENDERER, not a substrate: `kustomize build <dir>` emits
+ * exactly the Kubernetes manifests the existing apply pipeline was built for.
+ * So this capability is a render step in front of `kubectl-apply`'s machinery
+ * — the rendered documents go straight to the same server-side applier
+ * (inline, no temp file), which stamps the deploy-unit stack (#1539), prunes
+ * marker-scoped, retakes chant's own field conflicts (#1541/#1542), and is
+ * observed by the same `describeStackStatus` label sweep. An estate that
+ * keeps its overlay tree gets components-status honesty without adopting a
+ * single typed manifest.
+ *
+ * `stack` doubles as the ownership identity and the deploy unit, exactly as
+ * `kubectl-apply` — one name, both jobs.
+ *
+ * Renderer resolution: `kustomize build`, falling back to
+ * `kubectl kustomize` (the same renderer vendored into kubectl) when the
+ * standalone binary is absent. Both run through an injectable runner so tests
+ * assert the exact command without either binary installed. The 64MiB
+ * maxBuffer mirrors helm-upgrade's — a big overlay renders megabytes.
+ *
+ * The #1074 boundary applies as it does to kubectl-apply: nothing exported
+ * from the lexicon entry point may statically import the API-client chain, so
+ * the applier is reached by dynamic import inside `run()` and its argument
+ * shape is a structural mirror.
+ */
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { loadAll } from "js-yaml";
+import type { Capability, DeployContext } from "@intentius/chant/components/capability";
+
+const execAsync = promisify(exec);
+
+/** Injectable shell runner — the helm-upgrade seam, same buffer bound. */
+export type KustomizeRunner = (command: string) => Promise<{ stdout: string }>;
+const defaultRunner: KustomizeRunner = (command) => execAsync(command, { maxBuffer: 64 * 1024 * 1024 });
+
+/** Single-quote shell escaping, as helm-upgrade quotes its argv. */
+function q(v: string): string {
+  return `'${v.replace(/'/g, "'\\''")}'`;
+}
+
+/** Structural mirrors of the activity module's shapes (see the module doc). */
+interface AppliedRef {
+  apiVersion: string;
+  kind: string;
+  name: string;
+  namespace?: string;
+}
+
+export interface KustomizeApplyOutcome {
+  fieldManager: string;
+  applied: AppliedRef[];
+  pruned: AppliedRef[];
+}
+
+interface ApplierArgs {
+  manifest: string;
+  documents?: Array<Record<string, unknown>>;
+  environment?: string;
+  stack?: string;
+  context?: string;
+  deleteMode?: "never" | "owned-only" | "gated";
+}
+
+type Applier = (args: ApplierArgs) => Promise<KustomizeApplyOutcome>;
+
+export interface KustomizeApplyInput {
+  /** The kustomization directory (holds `kustomization.yaml`) — an overlay or a base. */
+  dir: string;
+  /**
+   * The deploy unit / ownership stack — same double duty as kubectl-apply's.
+   * Omitted derives from the project's `ownership.stack`, but then the unit is
+   * invisible to `components status --live`. Name it.
+   */
+  stack?: string;
+  /** kubectl context. Omitted resolves `k8s.profiles.<ctx.env>.context`. */
+  context?: string;
+  /** Same delete vocabulary as kubectl-apply; default `never`. */
+  delete?: "never" | "owned-only";
+}
+
+/** The exact render command, standalone binary first. Pure; exported for tests. */
+export function renderCommand(dir: string, tool: "kustomize" | "kubectl" = "kustomize"): string {
+  return tool === "kustomize" ? `kustomize build ${q(dir)}` : `kubectl kustomize ${q(dir)}`;
+}
+
+/** Render the overlay, falling back to kubectl's vendored kustomize when the
+ * standalone binary is missing (ENOENT/127), and parse the emitted YAML. */
+async function renderDocuments(dir: string, run: KustomizeRunner): Promise<Array<Record<string, unknown>>> {
+  let stdout: string;
+  try {
+    ({ stdout } = await run(renderCommand(dir, "kustomize")));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!/ENOENT|not found|command not found|127/.test(message)) throw err;
+    ({ stdout } = await run(renderCommand(dir, "kubectl")));
+  }
+  const documents: Array<Record<string, unknown>> = [];
+  for (const doc of loadAll(stdout)) {
+    if (doc && typeof doc === "object" && !Array.isArray(doc)) documents.push(doc as Record<string, unknown>);
+  }
+  return documents;
+}
+
+/** Factory with injectable renderer + applier, so tests assert the render
+ * command and the exact applier delegation without kustomize or a cluster. */
+export function createKustomizeApplyCapability(
+  run: KustomizeRunner = defaultRunner,
+  apply?: Applier,
+): Capability<KustomizeApplyInput, KustomizeApplyOutcome> {
+  return {
+    kind: "kustomize-apply",
+    // Server-side apply keeps no previous object state, and kustomize adds no
+    // undo of its own — same posture as kubectl-apply.
+    rollbackPolicy: "needs-opt-out",
+    async run(ctx: DeployContext, input: KustomizeApplyInput): Promise<KustomizeApplyOutcome> {
+      const documents = await renderDocuments(input.dir, run);
+      const applier: Applier = apply ?? ((await import("../op/activities/kubectl")).applyManifest as unknown as Applier);
+      return applier({
+        manifest: `kustomize:${input.dir}`,
+        documents,
+        environment: ctx.env,
+        ...(input.stack !== undefined ? { stack: input.stack } : {}),
+        ...(input.context !== undefined ? { context: input.context } : {}),
+        ...(input.delete !== undefined ? { deleteMode: input.delete } : {}),
+      });
+    },
+  };
+}
+
+export const kustomizeApplyCapability = createKustomizeApplyCapability();

package/src/deep-observe-hooks.ts

@@ -44,6 +44,7 @@
 import { createRequire } from "module";
 import type { DeepArrayElement, DeepNode, DeepNormalizationHooks } from "@intentius/chant/lexicon";
 import { K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS, k8sListMapOrderKey } from "@intentius/chant/managed-fields";
+import { LABEL_OWNERSHIP_KEYS, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 
 // This module ships as ESM (tsx strips types from src/ directly), where a bare
 // `require` is not defined — the same reason serializer.ts and the LSP modules
@@ -86,13 +87,64 @@ export const K8S_SERVICE_DEFAULTS: Record<string, Record<string, unknown>> = {
     "spec.template.spec.restartPolicy": "Always",
     "spec.template.spec.terminationGracePeriodSeconds": 30,
     "spec.template.spec.schedulerName": "default-scheduler",
+    // Widened on the CC canonical estate (#1214): a container declaring an
+    // httpGet probe, a named port, or nothing about termination gets exactly
+    // these from the API server. SSA attributes a server-defaulted field to no
+    // manager, so the managed-fields prune deliberately leaves them diffable
+    // (see ./deep-observe.ts) — this table is where they subtract.
+    "spec.template.spec.containers[].livenessProbe.failureThreshold": 3,
+    "spec.template.spec.containers[].livenessProbe.periodSeconds": 10,
+    "spec.template.spec.containers[].livenessProbe.successThreshold": 1,
+    "spec.template.spec.containers[].livenessProbe.timeoutSeconds": 1,
+    "spec.template.spec.containers[].livenessProbe.httpGet.scheme": "HTTP",
+    "spec.template.spec.containers[].readinessProbe.failureThreshold": 3,
+    "spec.template.spec.containers[].readinessProbe.periodSeconds": 10,
+    "spec.template.spec.containers[].readinessProbe.successThreshold": 1,
+    "spec.template.spec.containers[].readinessProbe.timeoutSeconds": 1,
+    "spec.template.spec.containers[].readinessProbe.httpGet.scheme": "HTTP",
+    "spec.template.spec.containers[].ports[].protocol": "TCP",
+    "spec.template.spec.containers[].terminationMessagePath": "/dev/termination-log",
+    "spec.template.spec.containers[].terminationMessagePolicy": "File",
+    "spec.template.spec.securityContext": {},
   },
   "K8s::Core::Service": {
     "spec.sessionAffinity": "None",
     "spec.type": "ClusterIP",
+    "spec.internalTrafficPolicy": "Cluster",
+    "spec.ipFamilyPolicy": "SingleStack",
+    "spec.ports[].protocol": "TCP",
   },
 };
 
+/**
+ * Server-ASSIGNED fields — populated by the API server with a value that
+ * varies per object (an allocated ClusterIP, the resolved IP family list), so
+ * unlike {@link K8S_SERVICE_DEFAULTS} there is no fixed value to compare
+ * against. Counterpart-gated like the defaults table: a declared `clusterIP`
+ * is still compared, only the purely server-filled appearance is noise.
+ */
+export const K8S_SERVER_ASSIGNED_PATTERNS: Record<string, ReadonlySet<string>> = {
+  "K8s::Core::Service": new Set(["spec.clusterIP", "spec.clusterIPs", "spec.ipFamilies"]),
+};
+
+/**
+ * chant's own ownership marker, as label paths (#1214 — the k8s edition of
+ * azure's #1213 rule). The build stamps `app.kubernetes.io/managed-by` +
+ * `chant.intentius.io/{stack,env}` into every manifest it emits, so a managed
+ * object always carries them live while the declared *source* the diff
+ * compares does not — chant reading its own signature back as drift. The
+ * managed-fields prune cannot subtract them: they are in the applied config,
+ * so chant's field manager owns them, and chant-owned is always diffable.
+ * Counterpart-gated at the call site; managed-by is additionally gated on the
+ * value `"chant"`, so `managed-by: helm` appearing out of band still surfaces.
+ */
+const K8S_OWNERSHIP_LABEL_PATTERNS: ReadonlySet<string> = new Set([
+  `metadata.labels.${LABEL_OWNERSHIP_KEYS.stack}`,
+  `metadata.labels.${LABEL_OWNERSHIP_KEYS.env}`,
+]);
+
+const K8S_MANAGED_BY_LABEL_PATTERN = `metadata.labels.${LABEL_OWNERSHIP_KEYS.managedBy}`;
+
 /** Stable JSON with sorted keys — the fallback ordering key for a set-like array without a natural identity field. */
 function canonicalJson(value: unknown): string {
   return (
@@ -206,6 +258,14 @@ export const k8sDeepNormalizationHooks: DeepNormalizationHooks = {
     if (K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has(node.pattern)) return true;
 
     if (node.side !== "live" || node.counterpart !== "absent") return false;
+
+    // chant's own ownership marker is not drift (see the sets' docs).
+    if (K8S_OWNERSHIP_LABEL_PATTERNS.has(node.pattern)) return true;
+    if (node.pattern === K8S_MANAGED_BY_LABEL_PATTERN && node.value === OWNERSHIP_MANAGED_BY_VALUE) return true;
+
+    // A server-assigned value nobody declared is allocation, not drift.
+    if (K8S_SERVER_ASSIGNED_PATTERNS[node.entityType]?.has(node.pattern)) return true;
+
     const defaults = K8S_SERVICE_DEFAULTS[node.entityType];
     if (!defaults || !Object.prototype.hasOwnProperty.call(defaults, node.pattern)) return false;
     return canonicalJson(defaults[node.pattern]) === canonicalJson(node.value);

package/src/deep-observe.test.ts

@@ -96,6 +96,120 @@ describe("k8sDeepNormalizationHooks — the static rules", () => {
     expect(declaredExplicit).toEqual({ spec: { strategy: strategyDefault, replicas: 3 } });
   });
 
+  test("chant's own stamped labels are not drift; a foreign managed-by and a user label still are", () => {
+    const live = {
+      metadata: {
+        name: "web",
+        labels: {
+          "app.kubernetes.io/managed-by": "chant",
+          "chant.intentius.io/stack": "cc-azure-canonical",
+          "chant.intentius.io/env": "local",
+          team: "platform",
+        },
+      },
+    };
+    const out = normalizeDeepProperties(live, {
+      entityType: "K8s::Apps::Deployment",
+      side: "live",
+      hooks: k8sDeepNormalizationHooks,
+      counterpartPaths: new Set(["metadata", "metadata.name"]),
+    });
+    expect(out).toEqual({ metadata: { name: "web", labels: { team: "platform" } } });
+
+    const foreign = normalizeDeepProperties(
+      { metadata: { name: "web", labels: { "app.kubernetes.io/managed-by": "helm" } } },
+      {
+        entityType: "K8s::Apps::Deployment",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set(["metadata", "metadata.name"]),
+      },
+    );
+    expect(foreign).toEqual({ metadata: { name: "web", labels: { "app.kubernetes.io/managed-by": "helm" } } });
+  });
+
+  test("a server-assigned ClusterIP nobody declared subtracts; a declared one is compared", () => {
+    const undeclared = normalizeDeepProperties(
+      { spec: { clusterIP: "10.43.201.161", clusterIPs: ["10.43.201.161"], ipFamilies: ["IPv4"], selector: { app: "web" } } },
+      {
+        entityType: "K8s::Core::Service",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set(["spec", "spec.selector", "spec.selector.app"]),
+      },
+    );
+    expect(undeclared).toEqual({ spec: { selector: { app: "web" } } });
+
+    const declared = normalizeDeepProperties(
+      { spec: { clusterIP: "10.43.0.10" } },
+      {
+        entityType: "K8s::Core::Service",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set(["spec", "spec.clusterIP"]),
+      },
+    );
+    expect(declared).toEqual({ spec: { clusterIP: "10.43.0.10" } });
+  });
+
+  test("probe and termination defaults subtract inside a declared container", () => {
+    const out = normalizeDeepProperties(
+      {
+        spec: {
+          template: {
+            spec: {
+              securityContext: {},
+              containers: [
+                {
+                  name: "api",
+                  image: "example:1",
+                  terminationMessagePath: "/dev/termination-log",
+                  terminationMessagePolicy: "File",
+                  livenessProbe: { httpGet: { path: "/", port: 8080, scheme: "HTTP" }, failureThreshold: 3, periodSeconds: 10, successThreshold: 1, timeoutSeconds: 1 },
+                  ports: [{ containerPort: 8080, name: "http", protocol: "TCP" }],
+                },
+              ],
+            },
+          },
+        },
+      },
+      {
+        entityType: "K8s::Apps::Deployment",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set([
+          "spec", "spec.template", "spec.template.spec",
+          "spec.template.spec.containers", "spec.template.spec.containers[]",
+          "spec.template.spec.containers[].name", "spec.template.spec.containers[].image",
+          "spec.template.spec.containers[].livenessProbe",
+          "spec.template.spec.containers[].livenessProbe.httpGet",
+          "spec.template.spec.containers[].livenessProbe.httpGet.path",
+          "spec.template.spec.containers[].livenessProbe.httpGet.port",
+          "spec.template.spec.containers[].ports",
+          "spec.template.spec.containers[].ports[]",
+          "spec.template.spec.containers[].ports[].containerPort",
+          "spec.template.spec.containers[].ports[].name",
+        ]),
+      },
+    );
+    expect(out).toEqual({
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              {
+                name: "api",
+                image: "example:1",
+                livenessProbe: { httpGet: { path: "/", port: 8080 } },
+                ports: [{ containerPort: 8080, name: "http" }],
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+
   test("a one-sided pass never subtracts defaults — the reader has no declared tree yet", () => {
     const out = normalizeDeepProperties(
       { spec: { strategy: { type: "RollingUpdate", rollingUpdate: { maxSurge: "25%", maxUnavailable: "25%" } } } },

package/src/describe-resources.test.ts

@@ -573,6 +573,135 @@ describe("k8s describeResources", () => {
       expect(result.resources["prod/hand-made"]).toBeUndefined();
     });
 
+    test("a Flux-managed Deployment is attributed to its declared Kustomization by the controller's labels (#1549)", async () => {
+      // Flux stamps managed objects with name+namespace labels instead of
+      // ownerReferences, so the chain walk reaches nothing — the label
+      // channel resolves against the DECLARED CR, exactly. The workload also
+      // lives in a namespace the estate never declares an entity in: the
+      // Kustomization's own spec.targetNamespace is what puts it in scope.
+      const kustomization = {
+        apiVersion: "kustomize.toolkit.fluxcd.io/v1",
+        kind: "Kustomization",
+        metadata: { name: "apps", namespace: "flux-system", uid: "ks-uid" },
+        status: { conditions: [{ type: "Ready", status: "True" }] },
+      };
+      const managed = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: {
+          name: "web",
+          namespace: "prod",
+          uid: "dep-uid",
+          labels: { "kustomize.toolkit.fluxcd.io/name": "apps", "kustomize.toolkit.fluxcd.io/namespace": "flux-system" },
+        },
+        status: { readyReplicas: 1, replicas: 1 },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("kustomize.toolkit.fluxcd.io/v1", "Kustomization", "apps", "flux-system")]: kustomization,
+          [objectKey("apps/v1", "Deployment", "web", "prod")]: managed,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["apps"],
+          entities: makeEntities([
+            {
+              name: "apps",
+              entityType: "K8s::Flux::Kustomization",
+              props: { metadata: { name: "apps", namespace: "flux-system" }, spec: { targetNamespace: "prod", sourceRef: { kind: "GitRepository", name: "infra" } } },
+            },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["prod/web"]).toMatchObject({
+        type: "K8s::Apps::Deployment",
+        ownerChain: { root: "declared", entity: "apps" },
+      });
+    });
+
+    test("Argo's bare instance label claims only a UNIQUE declared Application (#1549)", async () => {
+      const app = (name: string) => ({
+        apiVersion: "argoproj.io/v1alpha1",
+        kind: "Application",
+        metadata: { name, namespace: "argocd", uid: `${name}-uid` },
+        status: { health: { status: "Healthy" }, sync: { status: "Synced" } },
+      });
+      const managed = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: "web", namespace: "prod", uid: "dep-uid", labels: { "app.kubernetes.io/instance": "web" } },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("argoproj.io/v1alpha1", "Application", "web", "argocd")]: app("web"),
+          [objectKey("apps/v1", "Deployment", "web", "prod")]: managed,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["webApp"],
+          entities: makeEntities([
+            {
+              name: "webApp",
+              entityType: "K8s::Argo::Application",
+              props: { metadata: { name: "web", namespace: "argocd" }, spec: { destination: { namespace: "prod" } } },
+            },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["prod/web"]).toMatchObject({
+        type: "K8s::Apps::Deployment",
+        ownerChain: { root: "declared", entity: "webApp" },
+      });
+    });
+
+    test("a generic instance label matching NO declared Application claims nothing — not an inventory (#1549)", async () => {
+      // `app.kubernetes.io/instance` is also what plain helm sets; on an
+      // estate declaring a Flux CR (so the widened sweep runs), a foreign
+      // helm-installed Deployment must not be attributed.
+      const kustomization = {
+        apiVersion: "kustomize.toolkit.fluxcd.io/v1",
+        kind: "Kustomization",
+        metadata: { name: "apps", namespace: "flux-system", uid: "ks-uid" },
+      };
+      const foreign = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name: "cert-manager", namespace: "flux-system", uid: "cm-uid", labels: { "app.kubernetes.io/instance": "cert-manager" } },
+      };
+      const cluster = fakeCluster({
+        objects: {
+          [objectKey("kustomize.toolkit.fluxcd.io/v1", "Kustomization", "apps", "flux-system")]: kustomization,
+          [objectKey("apps/v1", "Deployment", "cert-manager", "flux-system")]: foreign,
+        },
+      });
+
+      const result = await describeResources(
+        {
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["apps"],
+          entities: makeEntities([
+            { name: "apps", entityType: "K8s::Flux::Kustomization", props: { metadata: { name: "apps", namespace: "flux-system" } } },
+          ]),
+        },
+        cluster.connector,
+      );
+
+      expect(result.resources["flux-system/cert-manager"]).toBeUndefined();
+    });
+
     test("a core-only estate sweeps no extra groups — Pods stay the core representative", async () => {
       const svc = { apiVersion: "v1", kind: "Service", metadata: { name: "web", namespace: "prod", uid: "svc-uid" } };
       const cluster = fakeCluster({
@@ -880,6 +1009,36 @@ describe("statusFromObject — the most specific failing signal (#1397)", () =>
     expect(statusFromObject({ status: { readyReplicas: 1, replicas: 3 } } as never)).toBe("PROGRESSING(1/3)");
     expect(statusFromObject({} as never)).toBe("PRESENT");
   });
+
+  test("a conditions-first CR reads its Ready condition, not PRESENT (#1549)", () => {
+    // A wedged Flux Kustomization/HelmRelease has no phase and no replica
+    // counts, so it fell straight to PRESENT — a wedged reconciler read
+    // exactly like a healthy one.
+    expect(
+      statusFromObject({ status: { conditions: [{ type: "Ready", status: "False", reason: "BuildFailed" }] } } as never),
+    ).toBe("BuildFailed");
+    expect(
+      statusFromObject({ status: { conditions: [{ type: "Ready", status: "False" }] } } as never),
+    ).toBe("NOT-READY");
+    expect(
+      statusFromObject({ status: { conditions: [{ type: "Ready", status: "True", reason: "ReconciliationSucceeded" }] } } as never),
+    ).toBe("READY");
+  });
+
+  test("the Ready rung never changes a Pod or workload word — phase and replicas rank above it (#1549)", () => {
+    expect(
+      statusFromObject({ status: { phase: "Running", conditions: [{ type: "Ready", status: "False" }] } } as never),
+    ).toBe("Running");
+    expect(
+      statusFromObject({ status: { readyReplicas: 1, replicas: 3, conditions: [{ type: "Ready", status: "False" }] } } as never),
+    ).toBe("PROGRESSING(1/3)");
+  });
+
+  test("an Argo Application reads health/sync (#1549)", () => {
+    expect(statusFromObject({ status: { health: { status: "Degraded" }, sync: { status: "Synced" } } } as never)).toBe("Degraded");
+    expect(statusFromObject({ status: { health: { status: "Healthy" }, sync: { status: "OutOfSync" } } } as never)).toBe("OutOfSync");
+    expect(statusFromObject({ status: { health: { status: "Healthy" }, sync: { status: "Synced" } } } as never)).toBe("READY");
+  });
 });
 
 // #1401 — #1397 made the status WORD honest; this carries the part that says