@opensoha/contracts 0.1.12 → 0.1.14

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98"
-	PermissionCatalogSHA256 = "f563a9be8901002e790f271d589c9f4b8b05dcd8e9b4bba767b835b1cc606b76"
+	PermissionCatalogContentSHA256 = "0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609"
+	PermissionCatalogSHA256 = "5f1d8b49fb4155473f61ff255002ec7a13e3f63d718d5f9fc592daa93da610df"
 )
 
 //go:embed permission-catalog.json

package/auth/catalog_test.go

@@ -86,3 +86,43 @@ func TestPermissionCatalogIncludesIndependentResourceCreationEntry(t *testing.T)
 		t.Fatal("platform.resource-creation.use is missing")
 	}
 }
+
+func TestPermissionCatalogIncludesIndependentWorkbenchEntries(t *testing.T) {
+	var catalog struct {
+		Permissions []struct {
+			Key        string `json:"key"`
+			Domain     string `json:"domain"`
+			Action     string `json:"action"`
+			Status     string `json:"status"`
+			Assignable bool   `json:"assignable"`
+		} `json:"permissions"`
+	}
+	if err := json.Unmarshal(PermissionCatalogJSON(), &catalog); err != nil {
+		t.Fatalf("decode permission catalog: %v", err)
+	}
+
+	want := map[string]bool{
+		"workbench.ai.view":         false,
+		"workbench.compute.view":    false,
+		"workbench.delivery.view":   false,
+		"workbench.home.view":       false,
+		"workbench.monitoring.view": false,
+		"workbench.platform.view":   false,
+		"workbench.security.view":   false,
+		"workbench.settings.view":   false,
+	}
+	for _, permission := range catalog.Permissions {
+		if _, ok := want[permission.Key]; !ok {
+			continue
+		}
+		if permission.Domain != "workbench" || permission.Action != "view" || permission.Status != "active" || !permission.Assignable {
+			t.Fatalf("workbench entry must be independently assignable: %#v", permission)
+		}
+		want[permission.Key] = true
+	}
+	for key, found := range want {
+		if !found {
+			t.Fatalf("%s is missing", key)
+		}
+	}
+}

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98",
+  "contentHash": "sha256:0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -10929,12 +10929,132 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "workbench.ai.view",
+      "domain": "workbench",
+      "resource": "ai",
+      "action": "view",
+      "displayName": "访问 AI 工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.compute.view",
+      "domain": "workbench",
+      "resource": "compute",
+      "action": "view",
+      "displayName": "访问计算资源工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.delivery.view",
+      "domain": "workbench",
+      "resource": "delivery",
+      "action": "view",
+      "displayName": "访问应用交付工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.home.view",
+      "domain": "workbench",
+      "resource": "home",
+      "action": "view",
+      "displayName": "访问应用门户",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.monitoring.view",
+      "domain": "workbench",
+      "resource": "monitoring",
+      "action": "view",
+      "displayName": "访问可观测与值班工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.platform.view",
+      "domain": "workbench",
+      "resource": "platform",
+      "action": "view",
+      "displayName": "访问 k8s工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.security.view",
+      "domain": "workbench",
+      "resource": "security",
+      "action": "view",
+      "displayName": "访问身份与安全工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.settings.view",
+      "domain": "workbench",
+      "resource": "settings",
+      "action": "view",
+      "displayName": "访问设置中心",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "workspace.application.view",
       "domain": "workspace",
       "resource": "application",
       "action": "view",
-      "displayName": "查看应用工作台",
+      "displayName": "查看工作空间应用",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",
@@ -10950,7 +11070,7 @@
       "domain": "workspace",
       "resource": "resource",
       "action": "view",
-      "displayName": "查看 k8s工作台",
+      "displayName": "查看工作空间资源",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.12",
+  "version": "0.1.14",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.12",
+  "version": "0.1.14",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/openapi/KubernetesWorkloadSnapshotEnvelope/invalid/missing-content.json

@@ -0,0 +1,8 @@
+{
+  "data": {
+    "sourceUid": "a17fd246-9f85-4a1f-8bb0-c6c1f844b17e",
+    "selectedContainer": "worker",
+    "containers": [],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotEnvelope/valid/job.json

@@ -0,0 +1,14 @@
+{
+  "data": {
+    "content": "apiVersion: batch/v1\nkind: Job\nmetadata:\n  name: report\n",
+    "sourceUid": "a17fd246-9f85-4a1f-8bb0-c6c1f844b17e",
+    "selectedContainer": "worker",
+    "containers": [
+      {
+        "name": "worker",
+        "image": "registry.example.com/report:2026.08"
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/invalid/cronjob-missing-schedule.json

@@ -0,0 +1,8 @@
+{
+  "namespace": "default",
+  "sourceKind": "Deployment",
+  "sourceName": "reports",
+  "targetKind": "CronJob",
+  "targetName": "reports-schedule",
+  "restartPolicy": "Never"
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/invalid/unknown-inheritance.json

@@ -0,0 +1,9 @@
+{
+  "namespace": "ops",
+  "sourceKind": "Deployment",
+  "sourceName": "api",
+  "targetKind": "Job",
+  "targetName": "report",
+  "inherit": ["everything"],
+  "restartPolicy": "Never"
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/invalid/workload-cronjob-missing-schedule.json

@@ -0,0 +1,8 @@
+{
+  "namespace": "default",
+  "sourceKind": "StatefulSet",
+  "sourceName": "indexer",
+  "targetKind": "WorkloadCronJob",
+  "targetName": "indexer-schedule",
+  "restartPolicy": "OnFailure"
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/valid/cronjob.json

@@ -0,0 +1,9 @@
+{
+  "namespace": "default",
+  "sourceKind": "Deployment",
+  "sourceName": "reports",
+  "targetKind": "CronJob",
+  "targetName": "reports-schedule",
+  "restartPolicy": "Never",
+  "schedule": "0 * * * *"
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/valid/job-zero-values.json

@@ -0,0 +1,11 @@
+{
+  "namespace": "default",
+  "sourceKind": "DaemonSet",
+  "sourceName": "collector",
+  "targetKind": "Job",
+  "targetName": "collector-once",
+  "restartPolicy": "Never",
+  "parallelism": 0,
+  "completions": 0,
+  "activeDeadlineSeconds": 0
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/valid/selective-job.json

@@ -0,0 +1,9 @@
+{
+  "namespace": "ops",
+  "sourceKind": "Deployment",
+  "sourceName": "api",
+  "targetKind": "Job",
+  "targetName": "report",
+  "inherit": ["environment", "storage", "resources", "securityContext", "scheduling"],
+  "restartPolicy": "Never"
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/valid/workload-cronjob.json

@@ -0,0 +1,9 @@
+{
+  "namespace": "default",
+  "sourceKind": "StatefulSet",
+  "sourceName": "indexer",
+  "targetKind": "WorkloadCronJob",
+  "targetName": "indexer-schedule",
+  "restartPolicy": "OnFailure",
+  "schedule": "*/15 * * * *"
+}

package/gen/go/sohaapi/client.go

@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-const defaultUserAgent = "opensoha-contracts/0.1.12"
+const defaultUserAgent = "opensoha-contracts/0.1.14"
 
 type Client struct {
 	BaseURL    string

package/gen/go/sohaapi/types.go

@@ -2713,6 +2713,102 @@ func (e KubernetesWorkloadImportInputWorkloadKind) Valid() bool {
 	}
 }
 
+// Defines values for KubernetesWorkloadSnapshotInheritance.
+const (
+	KubernetesWorkloadSnapshotInheritanceEnvironment      KubernetesWorkloadSnapshotInheritance = "environment"
+	KubernetesWorkloadSnapshotInheritanceInitContainers   KubernetesWorkloadSnapshotInheritance = "initContainers"
+	KubernetesWorkloadSnapshotInheritanceResources        KubernetesWorkloadSnapshotInheritance = "resources"
+	KubernetesWorkloadSnapshotInheritanceScheduling       KubernetesWorkloadSnapshotInheritance = "scheduling"
+	KubernetesWorkloadSnapshotInheritanceSecurityContext  KubernetesWorkloadSnapshotInheritance = "securityContext"
+	KubernetesWorkloadSnapshotInheritanceServiceRuntime   KubernetesWorkloadSnapshotInheritance = "serviceRuntime"
+	KubernetesWorkloadSnapshotInheritanceStorage          KubernetesWorkloadSnapshotInheritance = "storage"
+	KubernetesWorkloadSnapshotInheritanceTemplateMetadata KubernetesWorkloadSnapshotInheritance = "templateMetadata"
+)
+
+// Valid indicates whether the value is a known member of the KubernetesWorkloadSnapshotInheritance enum.
+func (e KubernetesWorkloadSnapshotInheritance) Valid() bool {
+	switch e {
+	case KubernetesWorkloadSnapshotInheritanceEnvironment:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceInitContainers:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceResources:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceScheduling:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceSecurityContext:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceServiceRuntime:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceStorage:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceTemplateMetadata:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for KubernetesWorkloadSnapshotRestartPolicy.
+const (
+	KubernetesWorkloadSnapshotRestartPolicyNever     KubernetesWorkloadSnapshotRestartPolicy = "Never"
+	KubernetesWorkloadSnapshotRestartPolicyOnFailure KubernetesWorkloadSnapshotRestartPolicy = "OnFailure"
+)
+
+// Valid indicates whether the value is a known member of the KubernetesWorkloadSnapshotRestartPolicy enum.
+func (e KubernetesWorkloadSnapshotRestartPolicy) Valid() bool {
+	switch e {
+	case KubernetesWorkloadSnapshotRestartPolicyNever:
+		return true
+	case KubernetesWorkloadSnapshotRestartPolicyOnFailure:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for KubernetesWorkloadSnapshotSourceKind.
+const (
+	KubernetesWorkloadSnapshotSourceKindDaemonSet   KubernetesWorkloadSnapshotSourceKind = "DaemonSet"
+	KubernetesWorkloadSnapshotSourceKindDeployment  KubernetesWorkloadSnapshotSourceKind = "Deployment"
+	KubernetesWorkloadSnapshotSourceKindStatefulSet KubernetesWorkloadSnapshotSourceKind = "StatefulSet"
+)
+
+// Valid indicates whether the value is a known member of the KubernetesWorkloadSnapshotSourceKind enum.
+func (e KubernetesWorkloadSnapshotSourceKind) Valid() bool {
+	switch e {
+	case KubernetesWorkloadSnapshotSourceKindDaemonSet:
+		return true
+	case KubernetesWorkloadSnapshotSourceKindDeployment:
+		return true
+	case KubernetesWorkloadSnapshotSourceKindStatefulSet:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for KubernetesWorkloadSnapshotTargetKind.
+const (
+	KubernetesWorkloadSnapshotTargetKindCronJob         KubernetesWorkloadSnapshotTargetKind = "CronJob"
+	KubernetesWorkloadSnapshotTargetKindJob             KubernetesWorkloadSnapshotTargetKind = "Job"
+	KubernetesWorkloadSnapshotTargetKindWorkloadCronJob KubernetesWorkloadSnapshotTargetKind = "WorkloadCronJob"
+)
+
+// Valid indicates whether the value is a known member of the KubernetesWorkloadSnapshotTargetKind enum.
+func (e KubernetesWorkloadSnapshotTargetKind) Valid() bool {
+	switch e {
+	case KubernetesWorkloadSnapshotTargetKindCronJob:
+		return true
+	case KubernetesWorkloadSnapshotTargetKindJob:
+		return true
+	case KubernetesWorkloadSnapshotTargetKindWorkloadCronJob:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for LLMCallLogCacheStatus.
 const (
 	LLMCallLogCacheStatusBypass       LLMCallLogCacheStatus = "bypass"
@@ -13983,6 +14079,76 @@ type KubernetesWorkloadRelation struct {
 	Relation  string `json:"relation,omitempty"`
 }
 
+// KubernetesWorkloadSnapshot defines model for KubernetesWorkloadSnapshot.
+type KubernetesWorkloadSnapshot struct {
+	Containers []KubernetesWorkloadSnapshotContainer `json:"containers"`
+
+	// Content Generated native batch/v1 Job or CronJob YAML, or workloads.soha.io/v1alpha1 WorkloadCronJob YAML whose selected container image follows the source workload, ready for the existing resource-creation preflight.
+	Content           string   `json:"content"`
+	SelectedContainer string   `json:"selectedContainer"`
+	SourceUID         string   `json:"sourceUid"`
+	Warnings          []string `json:"warnings"`
+}
+
+// KubernetesWorkloadSnapshotContainer defines model for KubernetesWorkloadSnapshotContainer.
+type KubernetesWorkloadSnapshotContainer struct {
+	Image string `json:"image"`
+	Name  string `json:"name"`
+}
+
+// KubernetesWorkloadSnapshotEnvelope defines model for KubernetesWorkloadSnapshotEnvelope.
+type KubernetesWorkloadSnapshotEnvelope struct {
+	Data KubernetesWorkloadSnapshot `json:"data"`
+}
+
+// KubernetesWorkloadSnapshotInheritance defines model for KubernetesWorkloadSnapshotInheritance.
+type KubernetesWorkloadSnapshotInheritance string
+
+// KubernetesWorkloadSnapshotRequest defines model for KubernetesWorkloadSnapshotRequest.
+type KubernetesWorkloadSnapshotRequest struct {
+	// ActiveDeadlineSeconds Zero leaves the Kubernetes default unchanged.
+	ActiveDeadlineSeconds int               `json:"activeDeadlineSeconds,omitempty"`
+	Annotations           map[string]string `json:"annotations,omitempty"`
+	Args                  []string          `json:"args,omitempty"`
+	BackoffLimit          int               `json:"backoffLimit,omitempty"`
+	Command               []string          `json:"command,omitempty"`
+
+	// Completions Zero leaves the Kubernetes default unchanged.
+	Completions int    `json:"completions,omitempty"`
+	Description string `json:"description,omitempty"`
+
+	// Inherit Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory.
+	Inherit []KubernetesWorkloadSnapshotInheritance `json:"inherit,omitempty"`
+	Labels  map[string]string                       `json:"labels,omitempty"`
+
+	// Namespace Namespace shared by the source workload and generated target because referenced Secrets, ConfigMaps, ServiceAccounts, and PVCs are namespace-scoped.
+	Namespace string `json:"namespace"`
+
+	// Parallelism Zero leaves the Kubernetes default unchanged.
+	Parallelism   int                                     `json:"parallelism,omitempty"`
+	RestartPolicy KubernetesWorkloadSnapshotRestartPolicy `json:"restartPolicy"`
+
+	// Schedule Required when targetKind is CronJob or WorkloadCronJob.
+	Schedule string `json:"schedule,omitempty"`
+
+	// SourceContainer Regular container to retain. When omitted, the first regular container is selected.
+	SourceContainer string                               `json:"sourceContainer,omitempty"`
+	SourceKind      KubernetesWorkloadSnapshotSourceKind `json:"sourceKind"`
+	SourceName      string                               `json:"sourceName"`
+	Suspend         bool                                 `json:"suspend,omitempty"`
+	TargetKind      KubernetesWorkloadSnapshotTargetKind `json:"targetKind"`
+	TargetName      string                               `json:"targetName"`
+}
+
+// KubernetesWorkloadSnapshotRestartPolicy defines model for KubernetesWorkloadSnapshotRestartPolicy.
+type KubernetesWorkloadSnapshotRestartPolicy string
+
+// KubernetesWorkloadSnapshotSourceKind defines model for KubernetesWorkloadSnapshotSourceKind.
+type KubernetesWorkloadSnapshotSourceKind string
+
+// KubernetesWorkloadSnapshotTargetKind defines model for KubernetesWorkloadSnapshotTargetKind.
+type KubernetesWorkloadSnapshotTargetKind string
+
 // LLMCallLog defines model for LLMCallLog.
 type LLMCallLog struct {
 	ActorID           string                `json:"actorId,omitempty"`
@@ -21453,6 +21619,9 @@ type PreflightKubernetesResourceCreateJSONRequestBody = KubernetesResourceCreate
 // DecideKubernetesResourceCreateScopeJSONRequestBody defines body for DecideKubernetesResourceCreateScope for application/json ContentType.
 type DecideKubernetesResourceCreateScopeJSONRequestBody = KubernetesResourceCreateScopeDecisionRequest
 
+// GenerateKubernetesWorkloadSnapshotJSONRequestBody defines body for GenerateKubernetesWorkloadSnapshot for application/json ContentType.
+type GenerateKubernetesWorkloadSnapshotJSONRequestBody = KubernetesWorkloadSnapshotRequest
+
 // RecordCompanionInteractionJSONRequestBody defines body for RecordCompanionInteraction for application/json ContentType.
 type RecordCompanionInteractionJSONRequestBody = CompanionInteractionRequest
 

package/gen/go/sohaapi/types_test.go

@@ -0,0 +1,18 @@
+package sohaapi
+
+import "testing"
+
+func TestKubernetesWorkloadSnapshotRequestGeneratedShape(t *testing.T) {
+	request := KubernetesWorkloadSnapshotRequest{
+		Namespace:     "default",
+		SourceKind:    KubernetesWorkloadSnapshotSourceKindDeployment,
+		SourceName:    "reports",
+		TargetKind:    KubernetesWorkloadSnapshotTargetKindCronJob,
+		TargetName:    "reports-schedule",
+		Inherit:       []KubernetesWorkloadSnapshotInheritance{KubernetesWorkloadSnapshotInheritanceEnvironment},
+		RestartPolicy: KubernetesWorkloadSnapshotRestartPolicyNever,
+	}
+	if request.Namespace != "default" || len(request.Inherit) != 1 {
+		t.Fatalf("request = %#v", request)
+	}
+}

package/gen/ts/sohaapi/index.ts

@@ -4562,6 +4562,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/clusters/{clusterID}/resource-creation/workload-snapshot": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post: operations["generateKubernetesWorkloadSnapshot"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/clusters/{clusterID}/resource-creation/preflight": {
         parameters: {
             query?: never;
@@ -15954,6 +15970,61 @@ export interface components {
             status?: components["schemas"]["LogStreamStatus"];
         } & (unknown & unknown);
         /** @enum {string} */
+        KubernetesWorkloadSnapshotSourceKind: "Deployment" | "StatefulSet" | "DaemonSet";
+        /** @enum {string} */
+        KubernetesWorkloadSnapshotTargetKind: "Job" | "CronJob" | "WorkloadCronJob";
+        /** @enum {string} */
+        KubernetesWorkloadSnapshotRestartPolicy: "Never" | "OnFailure";
+        /** @enum {string} */
+        KubernetesWorkloadSnapshotInheritance: "environment" | "storage" | "resources" | "securityContext" | "scheduling" | "initContainers" | "templateMetadata" | "serviceRuntime";
+        KubernetesWorkloadSnapshotRequest: {
+            /** @description Namespace shared by the source workload and generated target because referenced Secrets, ConfigMaps, ServiceAccounts, and PVCs are namespace-scoped. */
+            namespace: string;
+            sourceKind: components["schemas"]["KubernetesWorkloadSnapshotSourceKind"];
+            sourceName: string;
+            /** @description Regular container to retain. When omitted, the first regular container is selected. */
+            sourceContainer?: string;
+            targetKind: components["schemas"]["KubernetesWorkloadSnapshotTargetKind"];
+            targetName: string;
+            description?: string;
+            labels?: {
+                [key: string]: string;
+            };
+            annotations?: {
+                [key: string]: string;
+            };
+            command?: string[];
+            args?: string[];
+            /** @description Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory. */
+            inherit?: components["schemas"]["KubernetesWorkloadSnapshotInheritance"][];
+            restartPolicy: components["schemas"]["KubernetesWorkloadSnapshotRestartPolicy"];
+            /** @description Zero leaves the Kubernetes default unchanged. */
+            parallelism?: number;
+            /** @description Zero leaves the Kubernetes default unchanged. */
+            completions?: number;
+            backoffLimit?: number;
+            /** @description Zero leaves the Kubernetes default unchanged. */
+            activeDeadlineSeconds?: number;
+            /** @description Required when targetKind is CronJob or WorkloadCronJob. */
+            schedule?: string;
+            suspend?: boolean;
+        };
+        KubernetesWorkloadSnapshotContainer: {
+            name: string;
+            image: string;
+        };
+        KubernetesWorkloadSnapshot: {
+            /** @description Generated native batch/v1 Job or CronJob YAML, or workloads.soha.io/v1alpha1 WorkloadCronJob YAML whose selected container image follows the source workload, ready for the existing resource-creation preflight. */
+            content: string;
+            sourceUid: string;
+            selectedContainer: string;
+            containers: components["schemas"]["KubernetesWorkloadSnapshotContainer"][];
+            warnings: string[];
+        };
+        KubernetesWorkloadSnapshotEnvelope: {
+            data: components["schemas"]["KubernetesWorkloadSnapshot"];
+        };
+        /** @enum {string} */
         KubernetesResourceCreateSource: "list" | "global_yaml" | "form";
         /** @enum {string} */
         KubernetesResourceScopeMode: "namespace" | "cluster";
@@ -19309,6 +19380,14 @@ export type LogPage = components['schemas']['LogPage'];
 export type LogPageEnvelope = components['schemas']['LogPageEnvelope'];
 export type LogStreamStatus = components['schemas']['LogStreamStatus'];
 export type LogStreamEvent = components['schemas']['LogStreamEvent'];
+export type KubernetesWorkloadSnapshotSourceKind = components['schemas']['KubernetesWorkloadSnapshotSourceKind'];
+export type KubernetesWorkloadSnapshotTargetKind = components['schemas']['KubernetesWorkloadSnapshotTargetKind'];
+export type KubernetesWorkloadSnapshotRestartPolicy = components['schemas']['KubernetesWorkloadSnapshotRestartPolicy'];
+export type KubernetesWorkloadSnapshotInheritance = components['schemas']['KubernetesWorkloadSnapshotInheritance'];
+export type KubernetesWorkloadSnapshotRequest = components['schemas']['KubernetesWorkloadSnapshotRequest'];
+export type KubernetesWorkloadSnapshotContainer = components['schemas']['KubernetesWorkloadSnapshotContainer'];
+export type KubernetesWorkloadSnapshot = components['schemas']['KubernetesWorkloadSnapshot'];
+export type KubernetesWorkloadSnapshotEnvelope = components['schemas']['KubernetesWorkloadSnapshotEnvelope'];
 export type KubernetesResourceCreateSource = components['schemas']['KubernetesResourceCreateSource'];
 export type KubernetesResourceScopeMode = components['schemas']['KubernetesResourceScopeMode'];
 export type KubernetesResourceAction = components['schemas']['KubernetesResourceAction'];
@@ -28239,6 +28318,35 @@ export interface operations {
             404: components["responses"]["Error"];
         };
     };
+    generateKubernetesWorkloadSnapshot: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                clusterID: components["parameters"]["ClusterID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["KubernetesWorkloadSnapshotRequest"];
+            };
+        };
+        responses: {
+            /** @description A native Job or CronJob manifest, or a workloads.soha.io/v1alpha1 WorkloadCronJob manifest, generated from a same-namespace workload Pod template. This operation does not create resources. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["KubernetesWorkloadSnapshotEnvelope"];
+                };
+            };
+            400: components["responses"]["Error"];
+            403: components["responses"]["Error"];
+            404: components["responses"]["Error"];
+        };
+    };
     preflightKubernetesResourceCreate: {
         parameters: {
             query?: never;

package/openapi/soha-api.json

@@ -24057,6 +24057,264 @@
         ],
         "type": "object"
       },
+      "KubernetesWorkloadSnapshot": {
+        "additionalProperties": false,
+        "properties": {
+          "containers": {
+            "items": {
+              "$ref": "#/components/schemas/KubernetesWorkloadSnapshotContainer"
+            },
+            "minItems": 1,
+            "type": "array"
+          },
+          "content": {
+            "description": "Generated native batch/v1 Job or CronJob YAML, or workloads.soha.io/v1alpha1 WorkloadCronJob YAML whose selected container image follows the source workload, ready for the existing resource-creation preflight.",
+            "maxLength": 1048576,
+            "minLength": 1,
+            "type": "string"
+          },
+          "selectedContainer": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "sourceUid": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "warnings": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "content",
+          "sourceUid",
+          "selectedContainer",
+          "containers",
+          "warnings"
+        ],
+        "type": "object"
+      },
+      "KubernetesWorkloadSnapshotContainer": {
+        "additionalProperties": false,
+        "properties": {
+          "image": {
+            "type": "string"
+          },
+          "name": {
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "image"
+        ],
+        "type": "object"
+      },
+      "KubernetesWorkloadSnapshotEnvelope": {
+        "additionalProperties": false,
+        "properties": {
+          "data": {
+            "$ref": "#/components/schemas/KubernetesWorkloadSnapshot"
+          }
+        },
+        "required": [
+          "data"
+        ],
+        "type": "object"
+      },
+      "KubernetesWorkloadSnapshotInheritance": {
+        "enum": [
+          "environment",
+          "storage",
+          "resources",
+          "securityContext",
+          "scheduling",
+          "initContainers",
+          "templateMetadata",
+          "serviceRuntime"
+        ],
+        "type": "string",
+        "x-enum-varnames": [
+          "KubernetesWorkloadSnapshotInheritanceEnvironment",
+          "KubernetesWorkloadSnapshotInheritanceStorage",
+          "KubernetesWorkloadSnapshotInheritanceResources",
+          "KubernetesWorkloadSnapshotInheritanceSecurityContext",
+          "KubernetesWorkloadSnapshotInheritanceScheduling",
+          "KubernetesWorkloadSnapshotInheritanceInitContainers",
+          "KubernetesWorkloadSnapshotInheritanceTemplateMetadata",
+          "KubernetesWorkloadSnapshotInheritanceServiceRuntime"
+        ]
+      },
+      "KubernetesWorkloadSnapshotRequest": {
+        "additionalProperties": false,
+        "if": {
+          "properties": {
+            "targetKind": {
+              "enum": [
+                "CronJob",
+                "WorkloadCronJob"
+              ]
+            }
+          },
+          "required": [
+            "targetKind"
+          ]
+        },
+        "properties": {
+          "activeDeadlineSeconds": {
+            "description": "Zero leaves the Kubernetes default unchanged.",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "annotations": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "maxProperties": 64,
+            "type": "object"
+          },
+          "args": {
+            "items": {
+              "maxLength": 4096,
+              "type": "string"
+            },
+            "maxItems": 128,
+            "type": "array"
+          },
+          "backoffLimit": {
+            "minimum": 0,
+            "type": "integer"
+          },
+          "command": {
+            "items": {
+              "maxLength": 4096,
+              "type": "string"
+            },
+            "maxItems": 128,
+            "type": "array"
+          },
+          "completions": {
+            "description": "Zero leaves the Kubernetes default unchanged.",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "description": {
+            "maxLength": 512,
+            "type": "string"
+          },
+          "inherit": {
+            "description": "Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory.",
+            "items": {
+              "$ref": "#/components/schemas/KubernetesWorkloadSnapshotInheritance"
+            },
+            "maxItems": 8,
+            "type": "array",
+            "uniqueItems": true
+          },
+          "labels": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "maxProperties": 64,
+            "type": "object"
+          },
+          "namespace": {
+            "description": "Namespace shared by the source workload and generated target because referenced Secrets, ConfigMaps, ServiceAccounts, and PVCs are namespace-scoped.",
+            "minLength": 1,
+            "type": "string"
+          },
+          "parallelism": {
+            "description": "Zero leaves the Kubernetes default unchanged.",
+            "minimum": 0,
+            "type": "integer"
+          },
+          "restartPolicy": {
+            "$ref": "#/components/schemas/KubernetesWorkloadSnapshotRestartPolicy"
+          },
+          "schedule": {
+            "description": "Required when targetKind is CronJob or WorkloadCronJob.",
+            "minLength": 1,
+            "type": "string"
+          },
+          "sourceContainer": {
+            "description": "Regular container to retain. When omitted, the first regular container is selected.",
+            "minLength": 1,
+            "type": "string"
+          },
+          "sourceKind": {
+            "$ref": "#/components/schemas/KubernetesWorkloadSnapshotSourceKind"
+          },
+          "sourceName": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "suspend": {
+            "type": "boolean"
+          },
+          "targetKind": {
+            "$ref": "#/components/schemas/KubernetesWorkloadSnapshotTargetKind"
+          },
+          "targetName": {
+            "minLength": 1,
+            "type": "string"
+          }
+        },
+        "required": [
+          "namespace",
+          "sourceKind",
+          "sourceName",
+          "targetKind",
+          "targetName",
+          "restartPolicy"
+        ],
+        "then": {
+          "required": [
+            "schedule"
+          ]
+        },
+        "type": "object"
+      },
+      "KubernetesWorkloadSnapshotRestartPolicy": {
+        "enum": [
+          "Never",
+          "OnFailure"
+        ],
+        "type": "string",
+        "x-enum-varnames": [
+          "KubernetesWorkloadSnapshotRestartPolicyNever",
+          "KubernetesWorkloadSnapshotRestartPolicyOnFailure"
+        ]
+      },
+      "KubernetesWorkloadSnapshotSourceKind": {
+        "enum": [
+          "Deployment",
+          "StatefulSet",
+          "DaemonSet"
+        ],
+        "type": "string",
+        "x-enum-varnames": [
+          "KubernetesWorkloadSnapshotSourceKindDeployment",
+          "KubernetesWorkloadSnapshotSourceKindStatefulSet",
+          "KubernetesWorkloadSnapshotSourceKindDaemonSet"
+        ]
+      },
+      "KubernetesWorkloadSnapshotTargetKind": {
+        "enum": [
+          "Job",
+          "CronJob",
+          "WorkloadCronJob"
+        ],
+        "type": "string",
+        "x-enum-varnames": [
+          "KubernetesWorkloadSnapshotTargetKindJob",
+          "KubernetesWorkloadSnapshotTargetKindCronJob",
+          "KubernetesWorkloadSnapshotTargetKindWorkloadCronJob"
+        ]
+      },
       "LLMCallLog": {
         "additionalProperties": false,
         "properties": {
@@ -41167,7 +41425,7 @@
   "info": {
     "description": "Public OpenSoha core API contract. This first contract focuses on stable cross-repository boundaries: auth, health, runner-facing control-plane callbacks, AI Gateway, and MCP capability discovery.\n",
     "title": "Soha API",
-    "version": "0.1.12"
+    "version": "0.1.14"
   },
   "openapi": "3.1.0",
   "paths": {
@@ -52715,6 +52973,55 @@
         ]
       }
     },
+    "/clusters/{clusterID}/resource-creation/workload-snapshot": {
+      "post": {
+        "operationId": "generateKubernetesWorkloadSnapshot",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesWorkloadSnapshotRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesWorkloadSnapshotEnvelope"
+                }
+              }
+            },
+            "description": "A native Job or CronJob manifest, or a workloads.soha.io/v1alpha1 WorkloadCronJob manifest, generated from a same-namespace workload Pod template. This operation does not create resources."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-capability": {
+          "name": "k8s.workloads.snapshot.generate",
+          "requiresApproval": false,
+          "riskLevel": "analyze"
+        }
+      }
+    },
     "/clusters/{clusterID}/storage/persistentvolumeclaims": {
       "get": {
         "operationId": "listKubernetesPersistentVolumeClaims",

package/openapi/soha-api.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Soha API
-  version: 0.1.12
+  version: 0.1.14
   description: >
     Public OpenSoha core API contract. This first contract focuses on stable
     cross-repository boundaries: auth, health, runner-facing control-plane
@@ -6304,6 +6304,35 @@ paths:
           $ref: "#/components/responses/Error"
         "404":
           $ref: "#/components/responses/Error"
+  /clusters/{clusterID}/resource-creation/workload-snapshot:
+    post:
+      tags: [Platform]
+      operationId: generateKubernetesWorkloadSnapshot
+      x-soha-capability:
+        name: k8s.workloads.snapshot.generate
+        riskLevel: analyze
+        requiresApproval: false
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesWorkloadSnapshotRequest"
+      responses:
+        "200":
+          description: A native Job or CronJob manifest, or a workloads.soha.io/v1alpha1 WorkloadCronJob manifest, generated from a same-namespace workload Pod template. This operation does not create resources.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesWorkloadSnapshotEnvelope"
+        "400":
+          $ref: "#/components/responses/Error"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
   /clusters/{clusterID}/resource-creation/preflight:
     post:
       tags: [Platform]
@@ -27727,6 +27756,155 @@ components:
             required: [type]
           then:
             required: [status]
+    KubernetesWorkloadSnapshotSourceKind:
+      type: string
+      enum: [Deployment, StatefulSet, DaemonSet]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotSourceKindDeployment
+        - KubernetesWorkloadSnapshotSourceKindStatefulSet
+        - KubernetesWorkloadSnapshotSourceKindDaemonSet
+    KubernetesWorkloadSnapshotTargetKind:
+      type: string
+      enum: [Job, CronJob, WorkloadCronJob]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotTargetKindJob
+        - KubernetesWorkloadSnapshotTargetKindCronJob
+        - KubernetesWorkloadSnapshotTargetKindWorkloadCronJob
+    KubernetesWorkloadSnapshotRestartPolicy:
+      type: string
+      enum: [Never, OnFailure]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotRestartPolicyNever
+        - KubernetesWorkloadSnapshotRestartPolicyOnFailure
+    KubernetesWorkloadSnapshotInheritance:
+      type: string
+      enum: [environment, storage, resources, securityContext, scheduling, initContainers, templateMetadata, serviceRuntime]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotInheritanceEnvironment
+        - KubernetesWorkloadSnapshotInheritanceStorage
+        - KubernetesWorkloadSnapshotInheritanceResources
+        - KubernetesWorkloadSnapshotInheritanceSecurityContext
+        - KubernetesWorkloadSnapshotInheritanceScheduling
+        - KubernetesWorkloadSnapshotInheritanceInitContainers
+        - KubernetesWorkloadSnapshotInheritanceTemplateMetadata
+        - KubernetesWorkloadSnapshotInheritanceServiceRuntime
+    KubernetesWorkloadSnapshotRequest:
+      type: object
+      required: [namespace, sourceKind, sourceName, targetKind, targetName, restartPolicy]
+      properties:
+        namespace:
+          type: string
+          minLength: 1
+          description: Namespace shared by the source workload and generated target because referenced Secrets, ConfigMaps, ServiceAccounts, and PVCs are namespace-scoped.
+        sourceKind:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshotSourceKind"
+        sourceName:
+          type: string
+          minLength: 1
+        sourceContainer:
+          type: string
+          minLength: 1
+          description: Regular container to retain. When omitted, the first regular container is selected.
+        targetKind:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshotTargetKind"
+        targetName:
+          type: string
+          minLength: 1
+        description:
+          type: string
+          maxLength: 512
+        labels:
+          type: object
+          maxProperties: 64
+          additionalProperties: { type: string }
+        annotations:
+          type: object
+          maxProperties: 64
+          additionalProperties: { type: string }
+        command:
+          type: array
+          maxItems: 128
+          items: { type: string, maxLength: 4096 }
+        args:
+          type: array
+          maxItems: 128
+          items: { type: string, maxLength: 4096 }
+        inherit:
+          type: array
+          maxItems: 8
+          uniqueItems: true
+          items:
+            $ref: "#/components/schemas/KubernetesWorkloadSnapshotInheritance"
+          description: Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory.
+        restartPolicy:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshotRestartPolicy"
+        parallelism:
+          type: integer
+          minimum: 0
+          description: Zero leaves the Kubernetes default unchanged.
+        completions:
+          type: integer
+          minimum: 0
+          description: Zero leaves the Kubernetes default unchanged.
+        backoffLimit:
+          type: integer
+          minimum: 0
+        activeDeadlineSeconds:
+          type: integer
+          minimum: 0
+          description: Zero leaves the Kubernetes default unchanged.
+        schedule:
+          type: string
+          minLength: 1
+          description: Required when targetKind is CronJob or WorkloadCronJob.
+        suspend:
+          type: boolean
+      additionalProperties: false
+      if:
+        properties:
+          targetKind:
+            enum: [CronJob, WorkloadCronJob]
+        required: [targetKind]
+      then:
+        required: [schedule]
+    KubernetesWorkloadSnapshotContainer:
+      type: object
+      required: [name, image]
+      properties:
+        name: { type: string, minLength: 1 }
+        image: { type: string }
+      additionalProperties: false
+    KubernetesWorkloadSnapshot:
+      type: object
+      required: [content, sourceUid, selectedContainer, containers, warnings]
+      properties:
+        content:
+          type: string
+          minLength: 1
+          maxLength: 1048576
+          description: Generated native batch/v1 Job or CronJob YAML, or workloads.soha.io/v1alpha1 WorkloadCronJob YAML whose selected container image follows the source workload, ready for the existing resource-creation preflight.
+        sourceUid:
+          type: string
+          minLength: 1
+        selectedContainer:
+          type: string
+          minLength: 1
+        containers:
+          type: array
+          minItems: 1
+          items:
+            $ref: "#/components/schemas/KubernetesWorkloadSnapshotContainer"
+        warnings:
+          type: array
+          items: { type: string }
+      additionalProperties: false
+    KubernetesWorkloadSnapshotEnvelope:
+      type: object
+      required: [data]
+      properties:
+        data:
+          $ref: "#/components/schemas/KubernetesWorkloadSnapshot"
+      additionalProperties: false
     KubernetesResourceCreateSource:
       type: string
       enum: [list, global_yaml, form]

package/openapi/spec_generated.go

@@ -5,9 +5,9 @@ package openapi
 import _ "embed"
 
 const (
-	Version    = "0.1.12"
-	YAMLSHA256 = "b9dbd5597000f9124790f0df8e9e7616e76f7d7e12df03b72490c3403da4eda5"
-	JSONSHA256 = "6f34774013b3e6c9dd0e2c9b3e9d929a68f8f8b659a5909dad64a77821ef24dd"
+	Version    = "0.1.14"
+	YAMLSHA256 = "231a8b25b830df7c602c1356494502235ca8c00f23a4aea56c87c0fd79438663"
+	JSONSHA256 = "35983758f2bf5d2b4c2e918ee32f34f384218d882edf42d86c310f2820e2a82f"
 )
 
 //go:embed soha-api.yaml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensoha/contracts",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "private": false,
   "description": "Shared OpenSoha API, agent, MCP, skill, event, and auth contracts.",
   "license": "Apache-2.0",