@neat.is/core 0.9.13-dev.20260901 → 0.9.13

package/dist/cli.cjs

@@ -1953,6 +1953,11 @@ function isSaturated(ctx) {
 function isBoundaryTimeoutSymptom(ctx) {
   return ctx.errorsEmittedHere > 0 && ctx.boundaryTimeout === true && ctx.errorsFromCallers === 0 && ctx.hasOutboundDeps === true && ctx.observedErroringDownstream !== true;
 }
+var UNREACHABLE_INBOUND_ERROR_RATE = 0.5;
+var UNREACHABLE_MIN_INBOUND = 3;
+function isUnreachableSeed(ctx) {
+  return ctx.callCount >= UNREACHABLE_MIN_INBOUND && ctx.errorsFromCallers > 0 && ctx.errorsFromCallers >= UNREACHABLE_INBOUND_ERROR_RATE * ctx.callCount && ctx.errorsEmittedHere === 0 && ctx.outboundVolume === 0;
+}
 function classifyNode(ctx) {
   if (ctx.errorsEmittedHere > 0) {
     if ((ctx.stale || isSaturated(ctx)) && ctx.errorsFromCallers >= ctx.errorsEmittedHere) {
@@ -1961,6 +1966,7 @@ function classifyNode(ctx) {
     if (isBoundaryTimeoutSymptom(ctx)) return "symptom-only";
     return "primary-failure";
   }
+  if (isUnreachableSeed(ctx)) return "unreachable";
   if (ctx.errorsFromCallers > 0) return "symptom-only";
   return "unrelated";
 }
@@ -2247,6 +2253,16 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
       confidence: Math.min(legacy.confidence, 0.4),
       ...lastProv ? { provenance: lastProv } : {}
     });
+  } else if (seedCtx && isUnreachableSeed(seedCtx)) {
+    const name = displayNameOf(seedNode);
+    candidates.push({
+      node: seedNode,
+      classification: "unreachable",
+      reason: `${name} is unreachable: its callers' requests fail (${seedCtx.errorsFromCallers} erroring inbound calls) and it produced no telemetry of its own \u2014 no server spans, no outbound calls \u2014 so it never served. The failure is observed, but its cause is not in the trace: a startup failure, a crash before the first span, or an unschedulable / unhealthy pod. Inspect ${name}'s deploy state and logs \u2014 there is no code fault to find in the graph here.`,
+      context: seedCtx,
+      confidence: legacy.confidence,
+      provenance: import_types.Provenance.OBSERVED
+    });
   } else if (seedCtx && isBoundaryTimeoutSymptom(seedCtx)) {
     const pointer = structuralUpstreamPointer(graph, seedNode, incidents);
     const seedName = displayNameOf(seedNode);
@@ -6045,8 +6061,8 @@ function pickContainingSymbol(candidates, fn) {
     return b.symbol.span.startLine - a.symbol.span.startLine;
   };
   if (fn) {
-    const named = candidates.filter((c) => terminalName(c.symbol.qualname) === fn);
-    if (named.length > 0) return [...named].sort(bySpan)[0].id;
+    const named2 = candidates.filter((c) => terminalName(c.symbol.qualname) === fn);
+    if (named2.length > 0) return [...named2].sort(bySpan)[0].id;
   }
   return [...candidates].sort(bySpan)[0].id;
 }
@@ -6306,6 +6322,14 @@ function mergeColumnsAt(graph, tableNodeId, columns, provenance, confidence) {
 function mergeObservedColumns(graph, tableNodeId, columns) {
   mergeColumnsAt(graph, tableNodeId, columns, import_types8.Provenance.OBSERVED, OBSERVED_COLUMN_CONFIDENCE);
 }
+function mergeObservedDeployState(graph, serviceNodeId, state) {
+  if (!graph.hasNode(serviceNodeId)) return;
+  const attrs = {};
+  if (typeof state.image === "string" && state.image.length > 0) attrs["observedImage"] = state.image;
+  if (typeof state.readyReplicas === "number") attrs["observedReadyReplicas"] = state.readyReplicas;
+  if (Object.keys(attrs).length === 0) return;
+  graph.mergeNodeAttributes(serviceNodeId, attrs);
+}
 function ensureDatabaseNode(graph, host, engine) {
   const id = (0, import_types8.databaseId)(host);
   if (graph.hasNode(id)) return id;
@@ -9465,10 +9489,10 @@ function collectNamedImports(root) {
           const clause = node.namedChild(i);
           if (clause?.type !== "import_clause") continue;
           for (let j = 0; j < clause.namedChildCount; j++) {
-            const named = clause.namedChild(j);
-            if (named?.type !== "named_imports") continue;
-            for (let k = 0; k < named.namedChildCount; k++) {
-              const spec = named.namedChild(k);
+            const named2 = clause.namedChild(j);
+            if (named2?.type !== "named_imports") continue;
+            for (let k = 0; k < named2.namedChildCount; k++) {
+              const spec = named2.namedChild(k);
               if (spec?.type !== "import_specifier") continue;
               let isType = false;
               for (let t = 0; t < spec.childCount; t++) {
@@ -12102,8 +12126,8 @@ function parseImportBindings(content) {
       out.push({ local: ns[1], kind: "namespace", specifier: spec });
       continue;
     }
-    const named = /\{([^}]*)\}/.exec(clause);
-    if (named) parseDestructure(named[1], spec, out);
+    const named2 = /\{([^}]*)\}/.exec(clause);
+    if (named2) parseDestructure(named2[1], spec, out);
     const def = /^(\w+)\s*(?:,|$)/.exec(clause);
     if (def && !clause.startsWith("{")) out.push({ local: def[1], kind: "default", specifier: spec });
   }
@@ -12123,8 +12147,8 @@ function fileExportsOf(content, pluralizeOn) {
   for (const d of defs) if (d.varName) byVar.set(d.varName, d.resolved.name);
   const byName = new Map(byVar);
   let def;
-  const named = /(?:module\.exports|export\s+default)\s*=\s*(\w+)\b/.exec(content);
-  if (named && byVar.has(named[1])) def = byVar.get(named[1]);
+  const named2 = /(?:module\.exports|export\s+default)\s*=\s*(\w+)\b/.exec(content);
+  if (named2 && byVar.has(named2[1])) def = byVar.get(named2[1]);
   if (!def) {
     const inline = /(?:module\.exports|export\s+default)\s*=\s*(?:await\s+)?(?:\w+\s*\.\s*)?model\s*\(\s*['"`]([\w$]+)['"`]/.exec(content);
     if (inline) def = pluralizeOn ? pluralizeCollection(inline[1]) : inline[1];
@@ -16494,6 +16518,25 @@ function detectColumnDrift(node) {
   }
   return out;
 }
+var RECOMMENDATION_DEPLOY_IMAGE_MISMATCH = "The running image differs from the manifest-declared image \u2014 the rollout has not taken (the old ReplicaSet is still serving). Re-apply the deployment or investigate why the new image failed to roll out.";
+var DEPLOY_DIVERGENCE_CONFIDENCE = 0.9;
+function detectDeployDivergence(svc) {
+  const out = [];
+  if (typeof svc.declaredImage === "string" && typeof svc.observedImage === "string" && svc.declaredImage !== svc.observedImage) {
+    out.push({
+      type: "deploy-mismatch",
+      kind: "image",
+      source: svc.id,
+      target: svc.id,
+      declaredImage: svc.declaredImage,
+      observedImage: svc.observedImage,
+      confidence: DEPLOY_DIVERGENCE_CONFIDENCE,
+      reason: `Service ${svc.name} declares image ${svc.declaredImage} but its running pods report ${svc.observedImage} \u2014 the deploy has not taken (the old version is still serving), so no incident fires.`,
+      recommendation: RECOMMENDATION_DEPLOY_IMAGE_MISMATCH
+    });
+  }
+  return out;
+}
 var SYMBOL_MISMATCH_PATTERNS = [
   {
     // "'ListProductsResponse' object has no attribute 'products_list'" and kin.
@@ -16821,6 +16864,7 @@ function computeDivergences(graph, opts = {}) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+      for (const d of detectDeployDivergence(svc)) all.push(d);
       return;
     }
     if (n.type === import_types59.NodeType.InfraNode && n.kind === "sql-table") {
@@ -16861,7 +16905,12 @@ function computeDivergences(graph, opts = {}) {
     // orders last so at equal confidence the structural and symbol divergences
     // lead, per the contract ("rank below the definitive structural and symbol
     // divergences").
-    "observed-failing": 6
+    "observed-failing": 6,
+    // Deploy mismatch (ADR-225) is a definitive structural declared-vs-observed
+    // divergence carrying high confidence (0.9), so the confidence sort already
+    // places it among the structural leaders; this slot only breaks an exact
+    // confidence tie and sits last as a stable tiebreaker.
+    "deploy-mismatch": 7
   };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
@@ -17956,11 +18005,11 @@ async function resolveEntities(graph, question, searchIndex, maxNodes) {
     if (labelTokens.size === 0) return;
     let matched = 0;
     for (const t of qTokens) if (labelTokens.has(t)) matched += 1;
-    const named = body.length >= 2 && normalized.includes(body.toLowerCase()) || name.length >= 2 && normalized.includes(name.toLowerCase());
-    if (matched === 0 && !named) return;
+    const named2 = body.length >= 2 && normalized.includes(body.toLowerCase()) || name.length >= 2 && normalized.includes(name.toLowerCase());
+    if (matched === 0 && !named2) return;
     const coverage = qTokens.length > 0 ? matched / qTokens.length : 0;
-    const via = named ? "id" : matched > 0 && tokens(name).some((t) => qTokens.includes(t)) ? "label" : "token";
-    const score = named ? Math.max(0.9, coverage) : Math.min(0.85, 0.3 + 0.7 * coverage);
+    const via = named2 ? "id" : matched > 0 && tokens(name).some((t) => qTokens.includes(t)) ? "label" : "token";
+    const score = named2 ? Math.max(0.9, coverage) : Math.min(0.85, 0.3 + 0.7 * coverage);
     consider({ nodeId: id, label: name, via, score: Math.min(1, score) });
   });
   if (searchIndex) {
@@ -19300,6 +19349,11 @@ async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
       unresolved++;
       continue;
     }
+    if (signal.deployState) {
+      ensureServiceNode(graph, resolved.serviceName, NO_ENV);
+      mergeObservedDeployState(graph, resolved.targetNodeId, signal.deployState);
+      continue;
+    }
     if (signal.incident) {
       ensureServiceNode(graph, resolved.serviceName, NO_ENV);
       if (!ctx.errorsPath || !graph.hasNode(resolved.targetNodeId)) {
@@ -19833,7 +19887,7 @@ function tableNameFromQueryText(query) {
   if (SYSTEM_SCHEMA_PREFIXES.some((prefix) => lower.startsWith(prefix))) return null;
   return name;
 }
-function diffPgStatStatementsToSignals(rows, previous, nowIso2) {
+function diffPgStatStatementsToSignals(rows, previous, nowIso3) {
   const signals = [];
   const seen = /* @__PURE__ */ new Set();
   if (!Array.isArray(rows)) return signals;
@@ -19855,7 +19909,7 @@ function diffPgStatStatementsToSignals(rows, previous, nowIso2) {
       targetName: table,
       callCount: delta,
       errorCount: 0,
-      lastObservedIso: nowIso2,
+      lastObservedIso: nowIso3,
       ...columns.length > 0 ? { columns } : {}
     });
   }
@@ -22751,11 +22805,11 @@ function serializeGraph(graph) {
 }
 function projectFromReq(req, singleProject) {
   const params = req.params;
-  const named = params.project;
+  const named2 = params.project;
   if (singleProject) {
-    return named === void 0 || named === DEFAULT_PROJECT ? singleProject : named;
+    return named2 === void 0 || named2 === DEFAULT_PROJECT ? singleProject : named2;
   }
-  return named ?? DEFAULT_PROJECT;
+  return named2 ?? DEFAULT_PROJECT;
 }
 function resolveProject(registry, req, reply, bootstrap, singleProject) {
   const name = projectFromReq(req, singleProject);
@@ -23654,42 +23708,482 @@ async function buildApi(opts) {
 init_auth();
 init_otel();
 
-// src/daemon.ts
-init_cjs_shims();
-var import_node_fs43 = require("fs");
-var import_node_path79 = __toESM(require("path"), 1);
-var import_node_module = require("module");
-init_otel();
-
 // src/connectors/kubernetes/index.ts
 init_cjs_shims();
 
 // src/connectors/kubernetes/client.ts
 init_cjs_shims();
 var import_node_https = require("https");
+function deploymentsPath(namespace) {
+  return `/apis/apps/v1/namespaces/${namespace}/deployments`;
+}
+function podsPath(namespace) {
+  return `/api/v1/namespaces/${namespace}/pods`;
+}
+function makeK8sFetchImpl(transport) {
+  const agent = new import_node_https.Agent({
+    ...transport.ca ? { ca: transport.ca } : {},
+    ...transport.clientCert ? { cert: transport.clientCert } : {},
+    ...transport.clientKey ? { key: transport.clientKey } : {},
+    rejectUnauthorized: !transport.insecureSkipTlsVerify
+  });
+  return ((url, init) => new Promise((resolve, reject) => {
+    const u = new URL(String(url));
+    const req = (0, import_node_https.request)(
+      u,
+      {
+        method: (init?.method ?? "GET").toUpperCase(),
+        headers: init?.headers ?? {},
+        agent
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          const body = Buffer.concat(chunks).toString("utf8");
+          const status2 = res.statusCode ?? 0;
+          resolve({
+            ok: status2 >= 200 && status2 < 300,
+            status: status2,
+            statusText: res.statusMessage ?? "",
+            json: async () => JSON.parse(body),
+            text: async () => body
+          });
+        });
+      }
+    );
+    req.on("error", reject);
+    const signal = init?.signal;
+    if (signal) {
+      if (signal.aborted) req.destroy(new Error("aborted"));
+      else signal.addEventListener("abort", () => req.destroy(new Error("aborted")), { once: true });
+    }
+    req.end();
+  }));
+}
+async function listResource(transport, namespace, path96, opts = {}) {
+  const base = opts.apiUrl ?? transport.server;
+  const url = `${base.replace(/\/$/, "")}${path96}`;
+  const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "application/json" } },
+    // accountKey: the (cluster, namespace) pair — an identifier, safe to log, the
+    // rate-limit bucket for one namespace on one cluster (ADR-131).
+    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(`kubernetes ${path96} failed: ${res.status} ${res.statusText}`);
+  }
+  const json = await res.json();
+  return Array.isArray(json.items) ? json.items : [];
+}
+function safeHost(server) {
+  try {
+    return new URL(server).host;
+  } catch {
+    return "cluster";
+  }
+}
+async function fetchDeployments(transport, namespace, opts = {}) {
+  return listResource(transport, namespace, deploymentsPath(namespace), opts);
+}
+async function fetchPods(transport, namespace, opts = {}) {
+  return listResource(transport, namespace, podsPath(namespace), opts);
+}
 
 // src/connectors/kubernetes/kubeconfig.ts
 init_cjs_shims();
 var import_node_fs41 = require("fs");
 var import_yaml4 = require("yaml");
+function pemFrom(dataField, pathField) {
+  if (typeof dataField === "string" && dataField.length > 0) {
+    return Buffer.from(dataField, "base64").toString("utf8");
+  }
+  if (typeof pathField === "string" && pathField.length > 0) {
+    return (0, import_node_fs41.readFileSync)(pathField, "utf8");
+  }
+  return void 0;
+}
+function named(list, name) {
+  if (!Array.isArray(list)) return void 0;
+  const hit = list.find((e) => e && e.name === name);
+  return hit;
+}
+function parseKubeconfig(kubeconfig) {
+  const looksInline = /\n/.test(kubeconfig) || /(^|\s)clusters\s*:/.test(kubeconfig);
+  const text = looksInline ? kubeconfig : (0, import_node_fs41.readFileSync)(kubeconfig, "utf8");
+  let doc;
+  try {
+    doc = (0, import_yaml4.parse)(text);
+  } catch {
+    throw new Error("kubernetes connector: kubeconfig is not valid YAML");
+  }
+  if (!doc || typeof doc !== "object") {
+    throw new Error("kubernetes connector: kubeconfig is empty or malformed");
+  }
+  const currentContext = doc["current-context"];
+  if (typeof currentContext !== "string" || currentContext.length === 0) {
+    throw new Error("kubernetes connector: kubeconfig has no current-context");
+  }
+  const ctxEntry = named(doc["contexts"], currentContext);
+  const ctx = ctxEntry?.context;
+  if (!ctx) {
+    throw new Error(`kubernetes connector: kubeconfig context "${currentContext}" not found`);
+  }
+  const clusterEntry = named(doc["clusters"], String(ctx["cluster"] ?? ""));
+  const cluster = clusterEntry?.cluster;
+  if (!cluster || typeof cluster["server"] !== "string") {
+    throw new Error("kubernetes connector: kubeconfig current context has no cluster server");
+  }
+  const userEntry = named(doc["users"], String(ctx["user"] ?? ""));
+  const user = userEntry?.user ?? {};
+  const transport = {
+    server: cluster["server"],
+    insecureSkipTlsVerify: cluster["insecure-skip-tls-verify"] === true
+  };
+  const ca = pemFrom(cluster["certificate-authority-data"], cluster["certificate-authority"]);
+  if (ca) transport.ca = ca;
+  if (typeof user["token"] === "string" && user["token"].length > 0) transport.token = user["token"];
+  const clientCert = pemFrom(user["client-certificate-data"], user["client-certificate"]);
+  const clientKey = pemFrom(user["client-key-data"], user["client-key"]);
+  if (clientCert) transport.clientCert = clientCert;
+  if (clientKey) transport.clientKey = clientKey;
+  return transport;
+}
+function resolveK8sTransport(creds, config) {
+  if (creds.kubeconfig) return parseKubeconfig(creds.kubeconfig);
+  if (!config.apiServerUrl) {
+    throw new Error("kubernetes connector: options.apiServerUrl is required with a token credential");
+  }
+  const transport = {
+    server: config.apiServerUrl,
+    insecureSkipTlsVerify: config.insecureSkipTlsVerify === true
+  };
+  if (creds.token) transport.token = creds.token;
+  if (config.caCert) transport.ca = config.caCert;
+  return transport;
+}
 
 // src/connectors/kubernetes/map.ts
 init_cjs_shims();
 
 // src/connectors/kubernetes/types.ts
 init_cjs_shims();
+function readK8sCredentials(raw) {
+  const token = typeof raw["token"] === "string" && raw["token"].length > 0 ? raw["token"] : void 0;
+  const kubeconfig = typeof raw["kubeconfig"] === "string" && raw["kubeconfig"].length > 0 ? raw["kubeconfig"] : void 0;
+  if (!token && !kubeconfig) {
+    throw new Error("kubernetes connector: credentials must carry a token or a kubeconfig");
+  }
+  const out = {};
+  if (token) out.token = token;
+  if (kubeconfig) out.kubeconfig = kubeconfig;
+  return out;
+}
+var IMAGE_PULL_REASONS = /* @__PURE__ */ new Set(["ImagePullBackOff", "ErrImagePull", "InvalidImageName"]);
+var CRASH_LOOP_REASON = "CrashLoopBackOff";
+var FIELD_SEP5 = "\0";
+var K8S_TARGET_KIND = "k8s-workload";
+var K8S_DEPLOY_STATE = "deploy-state";
+function packK8sTargetName(identity) {
+  return [identity.serviceName, identity.fault].join(FIELD_SEP5);
+}
+function parseK8sTargetName(targetName) {
+  const sep = targetName.indexOf(FIELD_SEP5);
+  if (sep === -1) return null;
+  const serviceName = targetName.slice(0, sep);
+  const fault = targetName.slice(sep + 1);
+  if (!serviceName || !fault) return null;
+  return { serviceName, fault };
+}
+
+// src/connectors/kubernetes/map.ts
+function serviceNameFor(deployment, config) {
+  const name = deployment.metadata?.name ?? "";
+  return config.serviceMap?.[name] ?? name;
+}
+function podMatchesSelector(pod, selector) {
+  if (!selector || Object.keys(selector).length === 0) return false;
+  const labels = pod.metadata?.labels ?? {};
+  return Object.entries(selector).every(([k, v]) => labels[k] === v);
+}
+function podsForDeployment(deployment, pods) {
+  const selector = deployment.spec?.selector?.matchLabels;
+  return pods.filter((p) => podMatchesSelector(p, selector));
+}
+function nowIso2() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function podLevelFault(deployment, pods) {
+  const name = deployment.metadata?.name ?? "";
+  const owned = podsForDeployment(deployment, pods);
+  let crash = null;
+  for (const pod of owned) {
+    for (const cs of pod.status?.containerStatuses ?? []) {
+      const reason = cs.state?.waiting?.reason;
+      if (typeof reason !== "string") continue;
+      if (IMAGE_PULL_REASONS.has(reason)) {
+        const image = typeof cs.image === "string" ? cs.image : "unknown image";
+        const attrs = { "k8s.image": image, "k8s.waitingReason": reason };
+        const wm = cs.state?.waiting?.message;
+        if (typeof wm === "string" && wm.length > 0) attrs["k8s.waitingMessage"] = wm;
+        return {
+          fault: "image-pull",
+          message: `Deployment ${name} cannot pull image ${image} (${reason})`,
+          timestamp: pod.status?.startTime ?? nowIso2(),
+          attributes: attrs
+        };
+      }
+      if (reason === CRASH_LOOP_REASON && !crash) crash = { cs, pod };
+    }
+  }
+  if (crash) {
+    const { cs, pod } = crash;
+    const term = cs.lastState?.terminated;
+    const termReason = typeof term?.reason === "string" ? term.reason : void 0;
+    const termMsg = typeof term?.message === "string" ? term.message.trim() : void 0;
+    const restarts = typeof cs.restartCount === "number" ? cs.restartCount : 0;
+    const detail = termReason ? `last terminated: ${termReason}${termMsg ? ` \u2014 ${termMsg}` : ""}${typeof term?.exitCode === "number" ? ` (exit ${term.exitCode})` : ""}` : "no last-termination detail reported";
+    const attrs = { "k8s.waitingReason": CRASH_LOOP_REASON, "k8s.restartCount": restarts };
+    if (termReason) attrs["k8s.terminatedReason"] = termReason;
+    if (termMsg) attrs["k8s.terminatedMessage"] = termMsg;
+    if (typeof term?.exitCode === "number") attrs["k8s.exitCode"] = term.exitCode;
+    if (typeof cs.image === "string") attrs["k8s.image"] = cs.image;
+    return {
+      fault: "crash-loop",
+      message: `Deployment ${name} is crashlooping (restarts: ${restarts}); ${detail}`,
+      timestamp: term?.finishedAt ?? pod.status?.startTime ?? nowIso2(),
+      attributes: attrs
+    };
+  }
+  return null;
+}
+function classifyDeployment(deployment, pods, expectedZero) {
+  const name = deployment.metadata?.name ?? "";
+  const desired = typeof deployment.spec?.replicas === "number" ? deployment.spec.replicas : 1;
+  const ready = typeof deployment.status?.readyReplicas === "number" ? deployment.status.readyReplicas : 0;
+  if (desired === 0) {
+    if (expectedZero?.has(name)) return null;
+    return {
+      fault: "scaled-to-zero",
+      message: `Deployment ${name} is scaled to 0 \u2014 no running pods (desired 0)`,
+      timestamp: nowIso2(),
+      attributes: { "k8s.desiredReplicas": 0, "k8s.readyReplicas": ready }
+    };
+  }
+  if (ready >= desired) return null;
+  const podFault = podLevelFault(deployment, pods);
+  if (podFault) {
+    podFault.attributes["k8s.desiredReplicas"] = desired;
+    podFault.attributes["k8s.readyReplicas"] = ready;
+    return podFault;
+  }
+  return {
+    fault: "no-ready-replicas",
+    message: `Deployment ${name} has no ready replicas (desired ${desired}, ready ${ready})`,
+    timestamp: nowIso2(),
+    attributes: { "k8s.desiredReplicas": desired, "k8s.readyReplicas": ready }
+  };
+}
+function mapDeploymentToSignal(deployment, pods, config) {
+  const name = deployment.metadata?.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
+  const finding = classifyDeployment(deployment, pods, expectedZero);
+  if (!finding) return null;
+  const serviceName = serviceNameFor(deployment, config);
+  const namespace = deployment.metadata?.namespace ?? config.namespace;
+  const attributes = {
+    "k8s.namespace": namespace,
+    "k8s.deployment": name,
+    "k8s.fault": finding.fault,
+    ...finding.attributes
+  };
+  return {
+    targetKind: K8S_TARGET_KIND,
+    targetName: packK8sTargetName({ serviceName, fault: finding.fault }),
+    // Incident-only — no edge, so no call/error count to replay.
+    callCount: 0,
+    errorCount: 0,
+    lastObservedIso: finding.timestamp,
+    incident: {
+      id: `k8s:deploy:${namespace}:${name}:${finding.fault}`,
+      timestamp: finding.timestamp,
+      service: serviceName,
+      errorType: "k8s-deploy-failure",
+      errorMessage: finding.message,
+      attributes
+    }
+  };
+}
+function observedDeployState(deployment, pods) {
+  const readyReplicas = typeof deployment.status?.readyReplicas === "number" ? deployment.status.readyReplicas : 0;
+  let image;
+  for (const pod of podsForDeployment(deployment, pods)) {
+    for (const cs of pod.status?.containerStatuses ?? []) {
+      if (cs.state?.running && typeof cs.image === "string" && cs.image.length > 0) {
+        image = cs.image;
+        break;
+      }
+    }
+    if (image) break;
+  }
+  return image !== void 0 ? { image, readyReplicas } : { readyReplicas };
+}
+function deployStateSignal(deployment, pods, config) {
+  const name = deployment.metadata?.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  const serviceName = serviceNameFor(deployment, config);
+  return {
+    targetKind: K8S_TARGET_KIND,
+    targetName: packK8sTargetName({ serviceName, fault: K8S_DEPLOY_STATE }),
+    callCount: 0,
+    errorCount: 0,
+    lastObservedIso: nowIso2(),
+    deployState: observedDeployState(deployment, pods)
+  };
+}
+function mapWorkloadsToSignals(deployments, pods, config) {
+  const out = [];
+  for (const deployment of deployments) {
+    const deployState = deployStateSignal(deployment, pods, config);
+    if (deployState) out.push(deployState);
+    const incident = mapDeploymentToSignal(deployment, pods, config);
+    if (incident) out.push(incident);
+  }
+  return out;
+}
 
 // src/connectors/kubernetes/resolve.ts
 init_cjs_shims();
 var import_types103 = require("@neat.is/types");
+var NO_ENV3 = "unknown";
+function createK8sResolveTarget(graph) {
+  return (signal) => {
+    if (signal.targetKind !== K8S_TARGET_KIND) return null;
+    const identity = parseK8sTargetName(signal.targetName);
+    if (!identity) return null;
+    const { serviceName } = identity;
+    return {
+      targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV3),
+      serviceName,
+      edgeType: import_types103.EdgeType.CALLS
+    };
+  };
+}
 
 // src/connectors/kubernetes/substrate.ts
 init_cjs_shims();
 var import_promises = require("fs/promises");
 var import_node_os5 = __toESM(require("os"), 1);
 var import_node_path77 = __toESM(require("path"), 1);
+function defaultHome() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path77.default.resolve(override);
+  return import_node_path77.default.join(import_node_os5.default.homedir(), ".neat");
+}
+function k8sSubstrateConfigPath(home = defaultHome()) {
+  return import_node_path77.default.join(home, "k8s.json");
+}
+async function readK8sSubstrateConfig(home = defaultHome()) {
+  let raw;
+  try {
+    raw = await (0, import_promises.readFile)(k8sSubstrateConfigPath(home), "utf8");
+  } catch {
+    return { version: 1, deployments: [] };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || !Array.isArray(parsed.deployments)) return { version: 1, deployments: [] };
+    return parsed;
+  } catch {
+    return { version: 1, deployments: [] };
+  }
+}
+async function startK8sSubstratePolling(input) {
+  const config = await readK8sSubstrateConfig(input.home);
+  const env = input.env ?? process.env;
+  const stops = [];
+  for (const entry2 of config.deployments) {
+    if (entry2.project !== void 0 && entry2.project !== input.project) continue;
+    if (typeof entry2.namespace !== "string" || entry2.namespace.length === 0) {
+      input.onSkip?.(entry2, "missing namespace");
+      continue;
+    }
+    let credentials;
+    try {
+      const resolved = resolveCredential(entry2.credential, env);
+      credentials = resolved.kind === "fields" ? { ...resolved.fields } : { token: resolved.value };
+    } catch (err) {
+      input.onSkip?.(entry2, err.message);
+      continue;
+    }
+    const cfg = {
+      namespace: entry2.namespace,
+      ...entry2.apiServerUrl ? { apiServerUrl: entry2.apiServerUrl } : {},
+      ...entry2.caCert ? { caCert: entry2.caCert } : {},
+      ...entry2.insecureSkipTlsVerify ? { insecureSkipTlsVerify: true } : {},
+      ...entry2.serviceMap ? { serviceMap: entry2.serviceMap } : {},
+      ...entry2.expectedZero ? { expectedZero: entry2.expectedZero } : {}
+    };
+    const { connector, resolveTarget } = createKubernetesConnector(input.graph, cfg, input.fetchImpl);
+    const stop = startConnectorPollLoop(
+      connector,
+      {
+        projectDir: input.projectDir,
+        project: input.project,
+        credentials,
+        ...input.errorsPath ? { errorsPath: input.errorsPath } : {}
+      },
+      input.graph,
+      resolveTarget,
+      { connectorId: `k8s:${entry2.id}`, ...entry2.intervalMs ? { intervalMs: entry2.intervalMs } : {} }
+    );
+    stops.push(stop);
+  }
+  return () => {
+    for (const stop of stops) stop();
+  };
+}
+
+// src/connectors/kubernetes/index.ts
+var KubernetesConnector = class {
+  constructor(config, fetchImpl) {
+    this.config = config;
+    this.fetchImpl = fetchImpl;
+  }
+  config;
+  fetchImpl;
+  provider = "kubernetes";
+  async poll(ctx) {
+    const creds = readK8sCredentials(ctx.credentials);
+    const transport = resolveK8sTransport(creds, this.config);
+    const namespace = this.config.namespace;
+    const opts = {
+      ...this.config.apiUrl ? { apiUrl: this.config.apiUrl } : {},
+      ...this.fetchImpl ? { fetchImpl: this.fetchImpl } : {}
+    };
+    const [deployments, pods] = await Promise.all([
+      fetchDeployments(transport, namespace, opts),
+      fetchPods(transport, namespace, opts)
+    ]);
+    return mapWorkloadsToSignals(deployments, pods, this.config);
+  }
+};
+function createKubernetesConnector(graph, config, fetchImpl) {
+  return {
+    connector: new KubernetesConnector(config, fetchImpl),
+    resolveTarget: createK8sResolveTarget(graph)
+  };
+}
 
 // src/daemon.ts
+init_cjs_shims();
+var import_node_fs43 = require("fs");
+var import_node_path79 = __toESM(require("path"), 1);
+var import_node_module = require("module");
+init_otel();
 init_auth();
 
 // src/unrouted.ts
@@ -24364,6 +24858,14 @@ async function startWatch(graph, opts) {
       `neat watch: connector "${skipped.id}" (${skipped.provider}) skipped for project "${projectName}" \u2014 ${reason}`
     )
   });
+  const stopK8sSubstrate = await startK8sSubstratePolling({
+    project: projectName,
+    graph,
+    projectDir: opts.scanPath,
+    errorsPath: opts.errorsPath,
+    ...opts.neatHome ? { home: opts.neatHome } : {},
+    onSkip: (skipped, reason) => console.warn(`neat watch: k8s substrate "${skipped.id}" skipped for project "${projectName}" \u2014 ${reason}`)
+  });
   const auth = readAuthEnv();
   const host = opts.host ?? (auth.authToken ? "0.0.0.0" : "127.0.0.1");
   assertBindAuthority(host, auth.authToken);
@@ -24550,6 +25052,7 @@ async function startWatch(graph, opts) {
     }
     await watcher.close();
     stopConnectors();
+    stopK8sSubstrate();
     stopStaleness();
     stopPersist();
     detachEventBus();
@@ -28008,8 +28511,8 @@ async function waitForPeerDaemon(restPort, project, timeoutMs) {
 async function healthIsForProject(restPort, project) {
   const body = await fetchDaemonHealth(restPort);
   if (body === null) return false;
-  const named = body.project;
-  if (typeof named === "string") return named === project;
+  const named2 = body.project;
+  if (typeof named2 === "string") return named2 === project;
   if (Array.isArray(body.projects)) {
     return body.projects.some((p) => p.name === project);
   }
@@ -29178,6 +29681,12 @@ function formatDivergenceLine(d) {
       const at = d.location ? ` at ${d.location}` : "";
       return `  \u2022 [${d.type}] ${d.source}${at} (${d.failureKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
     }
+    case "deploy-mismatch": {
+      if (d.kind === "image") {
+        return `  \u2022 [${d.type}] ${d.source} \u2014 declared image ${d.declaredImage ?? "?"}, running ${d.observedImage ?? "?"} \u2014 confidence ${d.confidence.toFixed(2)}`;
+      }
+      return `  \u2022 [${d.type}] ${d.source} \u2014 declared ${d.declaredReplicas ?? "?"} replicas, ${d.observedReplicas ?? "?"} ready \u2014 confidence ${d.confidence.toFixed(2)}`;
+    }
   }
 }
 async function runDivergences(client, input) {