npm - @opensoha/contracts - Versions diffs - 0.1.21 → 0.1.23 - Mend

@opensoha/contracts 0.1.21 → 0.1.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/compat/consumer-revisions.json +2 -2
package/compat/json-schema-ecosystem-0.1.0.json +1 -1
package/compat/openapi-loose-boundaries-0.1.0.json +1 -1
package/gen/go/sohaapi/client.go +1 -1
package/gen/go/sohaapi/types.go +523 -35
package/gen/go/sohaapi/types_test.go +30 -0
package/gen/ts/sohaapi/index.ts +1040 -1
package/openapi/soha-api.json +1998 -655
package/openapi/soha-api.yaml +690 -1
package/openapi/spec_generated.go +3 -3
package/package.json +1 -1

package/openapi/soha-api.json CHANGED Viewed

@@ -61730,7 +61730,7 @@
   "info": {
     "description": "Public OpenSoha core API contract. This first contract focuses on stable cross-repository boundaries: auth, health, runner-facing control-plane callbacks, AI Gateway, and MCP capability discovery.\n",
     "title": "Soha API",
-    "version": "0.1.21"
+    "version": "0.1.23"
   },
   "openapi": "3.1.0",
   "paths": {
@@ -72612,6 +72612,108 @@
         }
       }
     },
+    "/clusters/{clusterID}/agent-upgrade": {
+      "get": {
+        "description": "Read the running Agent version and standard Agent Deployment rollout through the existing cluster connection.",
+        "operationId": "getClusterAgentUpgradeStatus",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ClusterAgentUpgradeStatusEnvelope"
+                }
+              }
+            },
+            "description": "Agent version, recommended version bundled with this server, and rollout status. The recommendation is not a live latest-release lookup."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "platform.clusters.view"
+          ],
+          "mode": "all"
+        }
+      },
+      "post": {
+        "description": "Update only the standard Agent container to an explicit official release version using the Agent connection. Kubernetes owns the rollout; HTTP 202 means the image update was accepted, not that rollout completed. Non-direct resource owners must use their owning delivery tool.",
+        "operationId": "upgradeClusterAgent",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ClusterAgentUpgradeInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ClusterAgentUpgradeResultEnvelope"
+                }
+              }
+            },
+            "description": "Image update accepted. Read upgrade status until the target version reconnects and rollout is healthy."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "platform.clusters.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/configuration/configmaps": {
       "get": {
         "operationId": "listKubernetesConfigMaps",
@@ -72656,6 +72758,69 @@
         }
       }
     },
+    "/clusters/{clusterID}/configuration/configmaps/{name}/data": {
+      "put": {
+        "operationId": "updateKubernetesConfigMapData",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesConfigMapDataInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesConfigMapDetailEnvelope"
+                }
+              }
+            },
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.configuration.config-maps.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/configuration/configmaps/{name}/detail": {
       "get": {
         "operationId": "getKubernetesConfigMapDetail",
@@ -73369,6 +73534,124 @@
         }
       }
     },
+    "/clusters/{clusterID}/configuration/secrets/{name}/data": {
+      "put": {
+        "operationId": "updateKubernetesSecretData",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesSecretDataInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesSecretDetailEnvelope"
+                }
+              }
+            },
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.configuration.secret-data.view",
+            "platform.configuration.secrets.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/configuration/secrets/{name}/detail": {
+      "get": {
+        "operationId": "getKubernetesSecretDetail",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesSecretDetailEnvelope"
+                }
+              }
+            },
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.configuration.secret-data.view",
+            "platform.configuration.secrets.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/configuration/secrets/{name}/references": {
       "get": {
         "operationId": "listKubernetesSecretReferences",
@@ -73638,6 +73921,107 @@
         }
       }
     },
+    "/clusters/{clusterID}/extensions/crds/{crdName}": {
+      "delete": {
+        "description": "Delete one cluster-scoped CRD definition and all of its custom resource instances. This does not uninstall its operator or Helm release. UID and resourceVersion preconditions protect against replacement; finalizers may delay removal.",
+        "operationId": "deleteKubernetesCustomResourceDefinition",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesCRDName"
+          },
+          {
+            "description": "UID observed in the CRD catalog. A same-name replacement is rejected.",
+            "in": "query",
+            "name": "expectedUid",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Deletion requested. Refresh the catalog to confirm disappearance; finalizers may still be pending."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.extensions.crds.delete"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/extensions/crds/{crdName}/access": {
+      "get": {
+        "operationId": "getKubernetesCustomResourceAccess",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesCRDName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesCustomResourceAccessEnvelope"
+                }
+              }
+            },
+            "description": "Soha and runtime permissions for this custom resource collection."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "platform.extensions.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/extensions/crds/{crdName}/resources": {
       "get": {
         "operationId": "listKubernetesCustomResources",
@@ -74206,9 +74590,9 @@
         }
       }
     },
-    "/clusters/{clusterID}/infrastructure/nodes/{nodeName}/detail": {
-      "get": {
-        "operationId": "getKubernetesNodeDetail",
+    "/clusters/{clusterID}/infrastructure/nodes/{nodeName}": {
+      "delete": {
+        "operationId": "deleteKubernetesNode",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
@@ -74218,15 +74602,11 @@
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/KubernetesNodeDetailEnvelope"
-                }
-              }
-            },
-            "description": "Kubernetes node status, resources, conditions, and bounded Pod context."
+          "204": {
+            "description": "Operation completed."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74234,6 +74614,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74241,38 +74624,29 @@
         "tags": [
           "Platform"
         ],
-        "x-soha-capability": {
-          "name": "k8s.nodes.detail",
-          "permissionKeys": [
-            "ai.gateway.invoke",
-            "platform.nodes.view",
-            "workspace.resource.view"
-          ],
-          "requiresApproval": false,
-          "riskLevel": "read"
-        },
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.nodes.view"
+            "platform.nodes.delete"
           ],
           "mode": "all"
         }
-      }
-    },
-    "/clusters/{clusterID}/logs/query": {
-      "post": {
-        "operationId": "queryClusterLogs",
+      },
+      "put": {
+        "operationId": "updateKubernetesNode",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNodeName"
           }
         ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/LogQuery"
+                "$ref": "#/components/schemas/KubernetesNodeUpdateInput"
               }
             }
           },
@@ -74283,11 +74657,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LogPageEnvelope"
+                  "$ref": "#/components/schemas/KubernetesNodeDetailEnvelope"
                 }
               }
             },
-            "description": "Authorized, bounded, and timestamp-ordered logs from the selected cluster sources."
+            "description": "Kubernetes operation result."
           },
           "400": {
             "$ref": "#/components/responses/Error"
@@ -74298,7 +74672,7 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
-          "422": {
+          "409": {
             "$ref": "#/components/responses/Error"
           },
           "503": {
@@ -74308,45 +74682,36 @@
         "tags": [
           "Platform"
         ],
+        "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.pods.logs"
+            "platform.nodes.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/logs/stream-ticket": {
-      "post": {
-        "operationId": "issueClusterLogStreamTicket",
+    "/clusters/{clusterID}/infrastructure/nodes/{nodeName}/detail": {
+      "get": {
+        "operationId": "getKubernetesNodeDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNodeName"
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LogQuery"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/StreamTicketEnvelope"
+                  "$ref": "#/components/schemas/KubernetesNodeDetailEnvelope"
                 }
               }
             },
-            "description": "Short-lived ticket for an authorized cluster runtime-log stream."
-          },
-          "400": {
-            "$ref": "#/components/responses/Error"
+            "description": "Kubernetes node status, resources, conditions, and bounded Pod context."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74354,9 +74719,6 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
-          "422": {
-            "$ref": "#/components/responses/Error"
-          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74364,32 +74726,52 @@
         "tags": [
           "Platform"
         ],
+        "x-soha-capability": {
+          "name": "k8s.nodes.detail",
+          "permissionKeys": [
+            "ai.gateway.invoke",
+            "platform.nodes.view",
+            "workspace.resource.view"
+          ],
+          "requiresApproval": false,
+          "riskLevel": "read"
+        },
+        "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.pods.logs"
+            "platform.nodes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/namespaces": {
-      "get": {
-        "operationId": "listKubernetesNamespaces",
+    "/clusters/{clusterID}/infrastructure/nodes/{nodeName}/drain": {
+      "post": {
+        "operationId": "drainKubernetesNode",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNodeName"
           }
         ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/KubernetesNamespaceListEnvelope"
-                }
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesNodeDrainInput"
               }
-            },
-            "description": "Kubernetes namespaces visible in the selected cluster scope."
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "Operation completed."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74397,6 +74779,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74407,33 +74792,39 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.namespaces.view"
+            "platform.nodes.drain"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/backendtlspolicies": {
-      "get": {
-        "operationId": "listKubernetesBackendTLSPolicies",
+    "/clusters/{clusterID}/infrastructure/nodes/{nodeName}/schedulability": {
+      "put": {
+        "operationId": "setKubernetesNodeSchedulability",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
           {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+            "$ref": "#/components/parameters/KubernetesNodeName"
           }
         ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/KubernetesBackendTLSPolicyListEnvelope"
-                }
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesNodeSchedulabilityInput"
               }
-            },
-            "description": "BackendTLSPolicies visible in the selected scope."
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "Operation completed."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74441,6 +74832,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74451,38 +74845,36 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.backend-tls-policies.view"
+            "platform.nodes.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/backendtlspolicies/{name}/detail": {
+    "/clusters/{clusterID}/infrastructure/nodes/{nodeName}/yaml": {
       "get": {
-        "operationId": "getKubernetesBackendTLSPolicyDetail",
+        "operationId": "getKubernetesNodeYaml",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
           {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+            "$ref": "#/components/parameters/KubernetesNodeName"
           }
         ],
         "responses": {
           "200": {
-            "and status conditions.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesBackendTLSPolicyDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesResourceYamlEnvelope"
                 }
               }
             },
-            "description": "BackendTLSPolicy targets",
-            "trust sources": null
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74490,6 +74882,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74500,33 +74895,44 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.backend-tls-policies.view"
+            "platform.nodes.view"
           ],
           "mode": "all"
         }
-      }
-    },
-    "/clusters/{clusterID}/network/endpointslices": {
-      "get": {
-        "operationId": "listKubernetesEndpointSlices",
+      },
+      "put": {
+        "operationId": "applyKubernetesNodeYaml",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
           {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+            "$ref": "#/components/parameters/KubernetesNodeName"
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesResourceYamlInput"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesEndpointSliceListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesResourceYamlEnvelope"
                 }
               }
             },
-            "description": "EndpointSlices visible in the selected scope."
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74534,6 +74940,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74544,38 +74953,43 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.endpoint-slices.view"
+            "platform.nodes.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/endpointslices/{name}/detail": {
-      "get": {
-        "operationId": "getKubernetesEndpointSliceDetail",
+    "/clusters/{clusterID}/logs/query": {
+      "post": {
+        "operationId": "queryClusterLogs",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LogQuery"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
-            "and topology hints.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesEndpointSliceDetailEnvelope"
+                  "$ref": "#/components/schemas/LogPageEnvelope"
                 }
               }
             },
-            "description": "EndpointSlice ports",
-            "endpoint health": null
+            "description": "Authorized, bounded, and timestamp-ordered logs from the selected cluster sources."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74583,6 +74997,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "422": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74590,33 +75007,45 @@
         "tags": [
           "Platform"
         ],
-        "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.endpoint-slices.view"
+            "platform.pods.logs"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/gatewayclasses": {
-      "get": {
-        "operationId": "listKubernetesGatewayClasses",
+    "/clusters/{clusterID}/logs/stream-ticket": {
+      "post": {
+        "operationId": "issueClusterLogStreamTicket",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LogQuery"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesGatewayClassListEnvelope"
+                  "$ref": "#/components/schemas/StreamTicketEnvelope"
                 }
               }
             },
-            "description": "Cluster-scoped GatewayClasses."
+            "description": "Short-lived ticket for an authorized cluster runtime-log stream."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74624,6 +75053,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "422": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74631,38 +75063,32 @@
         "tags": [
           "Platform"
         ],
-        "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.gateway-classes.view"
+            "platform.pods.logs"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/gatewayclasses/{name}/detail": {
+    "/clusters/{clusterID}/namespaces": {
       "get": {
-        "operationId": "getKubernetesGatewayClassDetail",
+        "operationId": "listKubernetesNamespaces",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
           }
         ],
         "responses": {
           "200": {
-            "and authorized Gateways.": null,
-            "conditions": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesGatewayClassDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesNamespaceListEnvelope"
                 }
               }
             },
-            "description": "GatewayClass status"
+            "description": "Kubernetes namespaces visible in the selected cluster scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74680,33 +75106,41 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.gateway-classes.view"
+            "platform.namespaces.view"
           ],
           "mode": "all"
         }
-      }
-    },
-    "/clusters/{clusterID}/network/gateways": {
-      "get": {
-        "operationId": "listKubernetesGateways",
+      },
+      "post": {
+        "operationId": "createKubernetesNamespace",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesNamespaceCreateInput"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesGatewayListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesNamespaceEnvelope"
                 }
               }
             },
-            "description": "Gateway API Gateways visible in the selected scope."
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74714,6 +75148,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74724,38 +75161,35 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.gateways.view"
+            "platform.namespaces.create"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/gateways/{name}/detail": {
-      "get": {
-        "operationId": "getKubernetesGatewayDetail",
+    "/clusters/{clusterID}/namespaces/{namespaceName}": {
+      "delete": {
+        "operationId": "deleteKubernetesNamespace",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
           {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+            "in": "path",
+            "name": "namespaceName",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
-          "200": {
-            "and attached routes.": null,
-            "conditions": null,
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/KubernetesGatewayDetailEnvelope"
-                }
-              }
-            },
-            "description": "Gateway listeners"
+          "204": {
+            "description": "Operation completed."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74763,6 +75197,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74773,33 +75210,50 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.gateways.view"
+            "platform.namespaces.delete"
           ],
           "mode": "all"
         }
-      }
-    },
-    "/clusters/{clusterID}/network/grpcroutes": {
-      "get": {
-        "operationId": "listKubernetesGRPCRoutes",
+      },
+      "put": {
+        "operationId": "updateKubernetesNamespace",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
           {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+            "in": "path",
+            "name": "namespaceName",
+            "required": true,
+            "schema": {
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesNamespaceInput"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesGRPCRouteListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesNamespaceEnvelope"
                 }
               }
             },
-            "description": "GRPCRoutes visible in the selected scope."
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74807,6 +75261,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -74817,38 +75274,33 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.grpc-routes.view"
+            "platform.namespaces.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/grpcroutes/{name}/detail": {
+    "/clusters/{clusterID}/network/backendtlspolicies": {
       "get": {
-        "operationId": "getKubernetesGRPCRouteDetail",
+        "operationId": "listKubernetesBackendTLSPolicies",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
-            "and authorized backends.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesGRPCRouteDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesBackendTLSPolicyListEnvelope"
                 }
               }
             },
-            "description": "GRPCRoute parents",
-            "matching rules": null
+            "description": "BackendTLSPolicies visible in the selected scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74866,33 +75318,38 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.grpc-routes.view"
+            "platform.network.backend-tls-policies.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/httproutes": {
+    "/clusters/{clusterID}/network/backendtlspolicies/{name}/detail": {
       "get": {
-        "operationId": "listKubernetesHTTPRoutes",
+        "operationId": "getKubernetesBackendTLSPolicyDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
+            "and status conditions.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesHTTPRouteListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesBackendTLSPolicyDetailEnvelope"
                 }
               }
             },
-            "description": "HTTPRoutes visible in the selected scope."
+            "description": "BackendTLSPolicy targets",
+            "trust sources": null
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74910,38 +75367,33 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.http-routes.view"
+            "platform.network.backend-tls-policies.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/httproutes/{name}/detail": {
+    "/clusters/{clusterID}/network/endpointslices": {
       "get": {
-        "operationId": "getKubernetesHTTPRouteDetail",
+        "operationId": "listKubernetesEndpointSlices",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
-            "and authorized backends.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesHTTPRouteDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesEndpointSliceListEnvelope"
                 }
               }
             },
-            "description": "HTTPRoute parents",
-            "matching rules": null
+            "description": "EndpointSlices visible in the selected scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -74959,30 +75411,38 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.http-routes.view"
+            "platform.network.endpoint-slices.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/ingressclasses": {
+    "/clusters/{clusterID}/network/endpointslices/{name}/detail": {
       "get": {
-        "operationId": "listKubernetesIngressClasses",
+        "operationId": "getKubernetesEndpointSliceDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
+            "and topology hints.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesIngressClassListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesEndpointSliceDetailEnvelope"
                 }
               }
             },
-            "description": "Cluster-scoped IngressClasses."
+            "description": "EndpointSlice ports",
+            "endpoint health": null
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75000,21 +75460,18 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.ingress-classes.view"
+            "platform.network.endpoint-slices.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/ingressclasses/{name}/detail": {
+    "/clusters/{clusterID}/network/gatewayclasses": {
       "get": {
-        "operationId": "getKubernetesIngressClassDetail",
+        "operationId": "listKubernetesGatewayClasses",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
           }
         ],
         "responses": {
@@ -75022,11 +75479,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesIngressClassDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesGatewayClassListEnvelope"
                 }
               }
             },
-            "description": "IngressClass metadata and authorized related Ingresses."
+            "description": "Cluster-scoped GatewayClasses."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75044,33 +75501,35 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.ingress-classes.view"
+            "platform.network.gateway-classes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/ingresses": {
+    "/clusters/{clusterID}/network/gatewayclasses/{name}/detail": {
       "get": {
-        "operationId": "listKubernetesIngresses",
+        "operationId": "getKubernetesGatewayClassDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
           {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+            "$ref": "#/components/parameters/KubernetesResourceName"
           }
         ],
         "responses": {
           "200": {
+            "and authorized Gateways.": null,
+            "conditions": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesIngressListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesGatewayClassDetailEnvelope"
                 }
               }
             },
-            "description": "Kubernetes Ingress resources visible in the selected scope."
+            "description": "GatewayClass status"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75088,22 +75547,19 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.ingresses.view"
+            "platform.network.gateway-classes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/ingresses/{name}/detail": {
+    "/clusters/{clusterID}/network/gateways": {
       "get": {
-        "operationId": "getKubernetesIngressDetail",
+        "operationId": "listKubernetesGateways",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
@@ -75113,11 +75569,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesIngressDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesGatewayListEnvelope"
                 }
               }
             },
-            "description": "Ingress routes and authorized backend relations."
+            "description": "Gateway API Gateways visible in the selected scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75135,33 +75591,38 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.ingresses.view"
+            "platform.network.gateways.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/networkpolicies": {
+    "/clusters/{clusterID}/network/gateways/{name}/detail": {
       "get": {
-        "operationId": "listKubernetesNetworkPolicies",
+        "operationId": "getKubernetesGatewayDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
+            "and attached routes.": null,
+            "conditions": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesNetworkPolicyListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesGatewayDetailEnvelope"
                 }
               }
             },
-            "description": "NetworkPolicies visible in the selected scope."
+            "description": "Gateway listeners"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75179,38 +75640,33 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.network-policies.view"
+            "platform.network.gateways.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/networkpolicies/{name}/detail": {
+    "/clusters/{clusterID}/network/grpcroutes": {
       "get": {
-        "operationId": "getKubernetesNetworkPolicyDetail",
+        "operationId": "listKubernetesGRPCRoutes",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
-            "and authorized matching Pods.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesNetworkPolicyDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesGRPCRouteListEnvelope"
                 }
               }
             },
-            "description": "NetworkPolicy selectors",
-            "rules": null
+            "description": "GRPCRoutes visible in the selected scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75228,33 +75684,38 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.network-policies.view"
+            "platform.network.grpc-routes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/referencegrants": {
+    "/clusters/{clusterID}/network/grpcroutes/{name}/detail": {
       "get": {
-        "operationId": "listKubernetesReferenceGrants",
+        "operationId": "getKubernetesGRPCRouteDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
+            "and authorized backends.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesReferenceGrantListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesGRPCRouteDetailEnvelope"
                 }
               }
             },
-            "description": "ReferenceGrants visible in the selected scope."
+            "description": "GRPCRoute parents",
+            "matching rules": null
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75272,22 +75733,19 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.reference-grants.view"
+            "platform.network.grpc-routes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/referencegrants/{name}/detail": {
+    "/clusters/{clusterID}/network/httproutes": {
       "get": {
-        "operationId": "getKubernetesReferenceGrantDetail",
+        "operationId": "listKubernetesHTTPRoutes",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
-          {
-            "$ref": "#/components/parameters/KubernetesResourceName"
-          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
@@ -75297,11 +75755,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesReferenceGrantDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesHTTPRouteListEnvelope"
                 }
               }
             },
-            "description": "ReferenceGrant source and target references."
+            "description": "HTTPRoutes visible in the selected scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75319,33 +75777,38 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.reference-grants.view"
+            "platform.network.http-routes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/services": {
+    "/clusters/{clusterID}/network/httproutes/{name}/detail": {
       "get": {
-        "operationId": "listKubernetesServices",
+        "operationId": "getKubernetesHTTPRouteDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
           {
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
+            "and authorized backends.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesServiceListEnvelope"
+                  "$ref": "#/components/schemas/KubernetesHTTPRouteDetailEnvelope"
                 }
               }
             },
-            "description": "Kubernetes Services visible in the selected scope."
+            "description": "HTTPRoute parents",
+            "matching rules": null
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75360,51 +75823,33 @@
         "tags": [
           "Platform"
         ],
-        "x-soha-capability": {
-          "name": "k8s.services.list",
-          "permissionKeys": [
-            "ai.gateway.invoke",
-            "platform.network.services.view",
-            "workspace.resource.view"
-          ],
-          "requiresApproval": false,
-          "riskLevel": "read"
-        },
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.services.view"
+            "platform.network.http-routes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/services/{serviceName}/detail": {
+    "/clusters/{clusterID}/network/ingressclasses": {
       "get": {
-        "operationId": "getKubernetesServiceDetail",
+        "operationId": "listKubernetesIngressClasses",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesServiceName"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
           "200": {
-            "and authorized backend Pods.": null,
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesServiceDetailEnvelope"
+                  "$ref": "#/components/schemas/KubernetesIngressClassListEnvelope"
                 }
               }
             },
-            "description": "Service metadata",
-            "endpoints": null
+            "description": "Cluster-scoped IngressClasses."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75422,30 +75867,21 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.services.view"
+            "platform.network.ingress-classes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/services/{serviceName}/metrics": {
+    "/clusters/{clusterID}/network/ingressclasses/{name}/detail": {
       "get": {
-        "operationId": "getKubernetesServiceMetrics",
+        "operationId": "getKubernetesIngressClassDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
           },
           {
-            "$ref": "#/components/parameters/KubernetesServiceName"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesMetricsRangeMinutesQuery"
-          },
-          {
-            "$ref": "#/components/parameters/KubernetesMetricsStepSecondsQuery"
+            "$ref": "#/components/parameters/KubernetesResourceName"
           }
         ],
         "responses": {
@@ -75453,11 +75889,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesResourceMetricsEnvelope"
+                  "$ref": "#/components/schemas/KubernetesIngressClassDetailEnvelope"
                 }
               }
             },
-            "description": "Bounded Prometheus-backed Service metrics or an explicit unconfigured response."
+            "description": "IngressClass metadata and authorized related Ingresses."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75475,15 +75911,15 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.services.view"
+            "platform.network.ingress-classes.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/network/topology": {
+    "/clusters/{clusterID}/network/ingresses": {
       "get": {
-        "operationId": "getKubernetesNetworkTopology",
+        "operationId": "listKubernetesIngresses",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
@@ -75497,11 +75933,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/KubernetesNetworkTopologyEnvelope"
+                  "$ref": "#/components/schemas/KubernetesIngressListEnvelope"
                 }
               }
             },
-            "description": "Resolved ingress and Gateway API topology for the selected scope."
+            "description": "Kubernetes Ingress resources visible in the selected scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -75519,18 +75955,24 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.network.topology.view"
+            "platform.network.ingresses.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/observability/logging": {
+    "/clusters/{clusterID}/network/ingresses/{name}/detail": {
       "get": {
-        "operationId": "getClusterLogCollection",
+        "operationId": "getKubernetesIngressDetail",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
         "responses": {
@@ -75538,83 +75980,508 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LogCollectionStateEnvelope"
+                  "$ref": "#/components/schemas/KubernetesIngressDetailEnvelope"
                 }
               }
             },
-            "description": "Current durable log-collection mode and health for the cluster."
+            "description": "Ingress routes and authorized backend relations."
           },
           "403": {
             "$ref": "#/components/responses/Error"
           },
           "404": {
             "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
           }
         },
         "tags": [
-          "Observability"
+          "Platform"
         ],
+        "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.clusters.view"
+            "platform.network.ingresses.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/observability/logging/disable": {
-      "post": {
-        "operationId": "disableClusterLogCollection",
+    "/clusters/{clusterID}/network/networkpolicies": {
+      "get": {
+        "operationId": "listKubernetesNetworkPolicies",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LogCollectionDisableInput"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LogCollectionStateEnvelope"
+                  "$ref": "#/components/schemas/KubernetesNetworkPolicyListEnvelope"
                 }
               }
             },
-            "description": "Collection state after stopping or uninstalling the managed collector. Durable history is retained."
-          },
-          "400": {
-            "$ref": "#/components/responses/Error"
+            "description": "NetworkPolicies visible in the selected scope."
           },
           "403": {
             "$ref": "#/components/responses/Error"
           },
           "404": {
             "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
           }
         },
         "tags": [
-          "Observability"
+          "Platform"
         ],
+        "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.observability.logging.disable"
+            "platform.network.network-policies.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/clusters/{clusterID}/observability/logging/enable": {
-      "post": {
-        "operationId": "enableClusterLogCollection",
+    "/clusters/{clusterID}/network/networkpolicies/{name}/detail": {
+      "get": {
+        "operationId": "getKubernetesNetworkPolicyDetail",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "and authorized matching Pods.": null,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesNetworkPolicyDetailEnvelope"
+                }
+              }
+            },
+            "description": "NetworkPolicy selectors",
+            "rules": null
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.network-policies.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/network/referencegrants": {
+      "get": {
+        "operationId": "listKubernetesReferenceGrants",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesReferenceGrantListEnvelope"
+                }
+              }
+            },
+            "description": "ReferenceGrants visible in the selected scope."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.reference-grants.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/network/referencegrants/{name}/detail": {
+      "get": {
+        "operationId": "getKubernetesReferenceGrantDetail",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesResourceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesReferenceGrantDetailEnvelope"
+                }
+              }
+            },
+            "description": "ReferenceGrant source and target references."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.reference-grants.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/network/services": {
+      "get": {
+        "operationId": "listKubernetesServices",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesServiceListEnvelope"
+                }
+              }
+            },
+            "description": "Kubernetes Services visible in the selected scope."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-capability": {
+          "name": "k8s.services.list",
+          "permissionKeys": [
+            "ai.gateway.invoke",
+            "platform.network.services.view",
+            "workspace.resource.view"
+          ],
+          "requiresApproval": false,
+          "riskLevel": "read"
+        },
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.services.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/network/services/{serviceName}/detail": {
+      "get": {
+        "operationId": "getKubernetesServiceDetail",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesServiceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "and authorized backend Pods.": null,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesServiceDetailEnvelope"
+                }
+              }
+            },
+            "description": "Service metadata",
+            "endpoints": null
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.services.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/network/services/{serviceName}/metrics": {
+      "get": {
+        "operationId": "getKubernetesServiceMetrics",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesServiceName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceDefaultQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsRangeMinutesQuery"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesMetricsStepSecondsQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesResourceMetricsEnvelope"
+                }
+              }
+            },
+            "description": "Bounded Prometheus-backed Service metrics or an explicit unconfigured response."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.services.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/network/topology": {
+      "get": {
+        "operationId": "getKubernetesNetworkTopology",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesNetworkTopologyEnvelope"
+                }
+              }
+            },
+            "description": "Resolved ingress and Gateway API topology for the selected scope."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.network.topology.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/observability/logging": {
+      "get": {
+        "operationId": "getClusterLogCollection",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LogCollectionStateEnvelope"
+                }
+              }
+            },
+            "description": "Current durable log-collection mode and health for the cluster."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Observability"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "platform.clusters.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/observability/logging/disable": {
+      "post": {
+        "operationId": "disableClusterLogCollection",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LogCollectionDisableInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LogCollectionStateEnvelope"
+                }
+              }
+            },
+            "description": "Collection state after stopping or uninstalling the managed collector. Durable history is retained."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Observability"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "platform.observability.logging.disable"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/observability/logging/enable": {
+      "post": {
+        "operationId": "enableClusterLogCollection",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
@@ -76551,9 +77418,56 @@
         }
       }
     },
-    "/clusters/{clusterID}/workloads/cronjobs/{cronJobName}/detail": {
-      "get": {
-        "operationId": "getKubernetesCronJobDetail",
+    "/clusters/{clusterID}/workloads/cronjobs/{cronJobName}/detail": {
+      "get": {
+        "operationId": "getKubernetesCronJobDetail",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesCronJobName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/KubernetesCronJobDetailEnvelope"
+                }
+              }
+            },
+            "description": "Kubernetes CronJob status, Jobs, and related resources."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.workloads.cron-jobs.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/clusters/{clusterID}/workloads/cronjobs/{cronJobName}/suspend": {
+      "post": {
+        "operationId": "setKubernetesCronJobSuspend",
         "parameters": [
           {
             "$ref": "#/components/parameters/ClusterID"
@@ -76565,6 +77479,16 @@
             "$ref": "#/components/parameters/KubernetesNamespaceQuery"
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KubernetesCronJobSuspendInput"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
@@ -76574,7 +77498,10 @@
                 }
               }
             },
-            "description": "Kubernetes CronJob status, Jobs, and related resources."
+            "description": "Kubernetes operation result."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -76582,6 +77509,9 @@
           "404": {
             "$ref": "#/components/responses/Error"
           },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
           "503": {
             "$ref": "#/components/responses/Error"
           }
@@ -76592,7 +77522,7 @@
         "x-soha-implementation-status": "implemented",
         "x-soha-permissions": {
           "keys": [
-            "platform.workloads.cron-jobs.view"
+            "platform.workloads.cron-jobs.suspend"
           ],
           "mode": "all"
         }
@@ -77383,6 +78313,52 @@
         }
       }
     },
+    "/clusters/{clusterID}/workloads/pods/{podName}": {
+      "delete": {
+        "operationId": "deleteKubernetesPod",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/ClusterID"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesPodName"
+          },
+          {
+            "$ref": "#/components/parameters/KubernetesNamespaceQuery"
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Operation completed."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          },
+          "503": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Platform"
+        ],
+        "x-soha-implementation-status": "implemented",
+        "x-soha-permissions": {
+          "keys": [
+            "platform.pods.delete"
+          ],
+          "mode": "all"
+        }
+      }
+    },
     "/clusters/{clusterID}/workloads/pods/{podName}/detail": {
       "get": {
         "operationId": "getKubernetesPodDetail",
@@ -88634,10 +89610,202 @@
             },
             "description": "Registered endpoint device. New devices remain pending until admitted by policy or an administrator."
           },
-          "400": {
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "401": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ]
+      }
+    },
+    "/network-access/enrollments": {
+      "get": {
+        "operationId": "listNetworkRuntimeEnrollments",
+        "parameters": [
+          {
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 100,
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentListEnvelope"
+                }
+              }
+            },
+            "description": "Runtime enrollment challenges without token material or token digests."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ],
+        "x-soha-capability": {
+          "name": "network_access.enrollments.list",
+          "permissionKeys": [
+            "ai.gateway.invoke",
+            "network_access.enrollments.view"
+          ],
+          "requiresApproval": false,
+          "riskLevel": "read"
+        },
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.enrollments.view"
+          ],
+          "mode": "all"
+        }
+      },
+      "post": {
+        "operationId": "createNetworkRuntimeEnrollment",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NetworkRuntimeEnrollmentInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentSecretEnvelope"
+                }
+              }
+            },
+            "description": "Created runtime enrollment and its one-time token.",
+            "headers": {
+              "Cache-Control": {
+                "description": "Always `no-store` because the response includes a one-time enrollment token.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ],
+        "x-soha-capability": {
+          "name": "network_access.enrollments.create",
+          "permissionKeys": [
+            "ai.gateway.invoke",
+            "network_access.enrollments.create"
+          ],
+          "requiresApproval": true,
+          "riskLevel": "high"
+        },
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.enrollments.create"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/network-access/enrollments/{enrollmentID}": {
+      "get": {
+        "operationId": "getNetworkRuntimeEnrollment",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "enrollmentID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentEnvelope"
+                }
+              }
+            },
+            "description": "Runtime enrollment detail without token material or token digests."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.enrollments.view"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/network-access/enrollments/{enrollmentID}/revoke": {
+      "post": {
+        "operationId": "revokeNetworkRuntimeEnrollment",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "enrollmentID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentEnvelope"
+                }
+              }
+            },
+            "description": "Revoked pending runtime enrollment."
+          },
+          "403": {
             "$ref": "#/components/responses/Error"
           },
-          "401": {
+          "404": {
             "$ref": "#/components/responses/Error"
           },
           "409": {
@@ -88646,13 +89814,51 @@
         },
         "tags": [
           "Network Access"
-        ]
+        ],
+        "x-soha-capability": {
+          "name": "network_access.enrollments.revoke",
+          "permissionKeys": [
+            "ai.gateway.invoke",
+            "network_access.enrollments.revoke"
+          ],
+          "requiresApproval": true,
+          "riskLevel": "high"
+        },
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.enrollments.revoke"
+          ],
+          "mode": "all"
+        }
       }
     },
-    "/network-access/enrollments": {
+    "/network-access/gateways": {
       "get": {
-        "operationId": "listNetworkRuntimeEnrollments",
+        "operationId": "listNetworkGateways",
         "parameters": [
+          {
+            "in": "query",
+            "name": "search",
+            "schema": {
+              "maxLength": 200,
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "siteId",
+            "schema": {
+              "maxLength": 128,
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "status",
+            "schema": {
+              "$ref": "#/components/schemas/NetworkGatewayStatus"
+            }
+          },
           {
             "in": "query",
             "name": "limit",
@@ -88669,11 +89875,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentListEnvelope"
+                  "$ref": "#/components/schemas/NetworkGatewayListEnvelope"
                 }
               }
             },
-            "description": "Runtime enrollment challenges without token material or token digests."
+            "description": "Registered network gateways."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -88682,29 +89888,20 @@
         "tags": [
           "Network Access"
         ],
-        "x-soha-capability": {
-          "name": "network_access.enrollments.list",
-          "permissionKeys": [
-            "ai.gateway.invoke",
-            "network_access.enrollments.view"
-          ],
-          "requiresApproval": false,
-          "riskLevel": "read"
-        },
         "x-soha-permissions": {
           "keys": [
-            "network_access.enrollments.view"
+            "network_access.gateways.view"
           ],
           "mode": "all"
         }
       },
       "post": {
-        "operationId": "createNetworkRuntimeEnrollment",
+        "operationId": "createNetworkGateway",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkRuntimeEnrollmentInput"
+                "$ref": "#/components/schemas/NetworkGatewayInput"
               }
             }
           },
@@ -88715,54 +89912,49 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentSecretEnvelope"
+                  "$ref": "#/components/schemas/NetworkGatewayEnvelope"
                 }
               }
             },
-            "description": "Created runtime enrollment and its one-time token.",
-            "headers": {
-              "Cache-Control": {
-                "description": "Always `no-store` because the response includes a one-time enrollment token.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "Created WireGuard network gateway configuration."
           },
           "400": {
             "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
           }
         },
         "tags": [
           "Network Access"
         ],
         "x-soha-capability": {
-          "name": "network_access.enrollments.create",
+          "name": "network_access.gateways.create",
           "permissionKeys": [
             "ai.gateway.invoke",
-            "network_access.enrollments.create"
+            "network_access.gateways.create"
           ],
           "requiresApproval": true,
           "riskLevel": "high"
         },
         "x-soha-permissions": {
           "keys": [
-            "network_access.enrollments.create"
+            "network_access.gateways.create"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/enrollments/{enrollmentID}": {
+    "/network-access/gateways/{gatewayID}": {
       "get": {
-        "operationId": "getNetworkRuntimeEnrollment",
+        "operationId": "getNetworkGateway",
         "parameters": [
           {
             "in": "path",
-            "name": "enrollmentID",
+            "name": "gatewayID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -88776,11 +89968,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentEnvelope"
+                  "$ref": "#/components/schemas/NetworkGatewayEnvelope"
                 }
               }
             },
-            "description": "Runtime enrollment detail without token material or token digests."
+            "description": "Network gateway detail."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -88794,19 +89986,17 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.enrollments.view"
+            "network_access.gateways.view"
           ],
           "mode": "all"
         }
-      }
-    },
-    "/network-access/enrollments/{enrollmentID}/revoke": {
-      "post": {
-        "operationId": "revokeNetworkRuntimeEnrollment",
+      },
+      "put": {
+        "operationId": "updateNetworkGateway",
         "parameters": [
           {
             "in": "path",
-            "name": "enrollmentID",
+            "name": "gatewayID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -88815,16 +90005,29 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NetworkGatewayInput"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkRuntimeEnrollmentEnvelope"
+                  "$ref": "#/components/schemas/NetworkGatewayEnvelope"
                 }
               }
             },
-            "description": "Revoked pending runtime enrollment."
+            "description": "Updated WireGuard network gateway configuration."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -88840,25 +90043,25 @@
           "Network Access"
         ],
         "x-soha-capability": {
-          "name": "network_access.enrollments.revoke",
+          "name": "network_access.gateways.update",
           "permissionKeys": [
             "ai.gateway.invoke",
-            "network_access.enrollments.revoke"
+            "network_access.gateways.update"
           ],
           "requiresApproval": true,
           "riskLevel": "high"
         },
         "x-soha-permissions": {
           "keys": [
-            "network_access.enrollments.revoke"
+            "network_access.gateways.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/gateways": {
+    "/network-access/mihomo-profiles": {
       "get": {
-        "operationId": "listNetworkGateways",
+        "operationId": "listNetworkMihomoProfiles",
         "parameters": [
           {
             "in": "query",
@@ -88870,17 +90073,24 @@
           },
           {
             "in": "query",
-            "name": "siteId",
+            "name": "deviceId",
             "schema": {
               "maxLength": 128,
               "type": "string"
             }
           },
+          {
+            "in": "query",
+            "name": "mode",
+            "schema": {
+              "$ref": "#/components/schemas/NetworkMihomoMode"
+            }
+          },
           {
             "in": "query",
             "name": "status",
             "schema": {
-              "$ref": "#/components/schemas/NetworkGatewayStatus"
+              "$ref": "#/components/schemas/NetworkMihomoProfileStatus"
             }
           },
           {
@@ -88899,11 +90109,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkGatewayListEnvelope"
+                  "$ref": "#/components/schemas/NetworkMihomoProfileListEnvelope"
                 }
               }
             },
-            "description": "Registered network gateways."
+            "description": "Mihomo profiles assigned to endpoint devices. Subscription credentials are never returned."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -88912,20 +90122,29 @@
         "tags": [
           "Network Access"
         ],
+        "x-soha-capability": {
+          "name": "network_access.mihomo_profiles.list",
+          "permissionKeys": [
+            "ai.gateway.invoke",
+            "network_access.mihomo_profiles.view"
+          ],
+          "requiresApproval": false,
+          "riskLevel": "read"
+        },
         "x-soha-permissions": {
           "keys": [
-            "network_access.gateways.view"
+            "network_access.mihomo_profiles.view"
           ],
           "mode": "all"
         }
       },
       "post": {
-        "operationId": "createNetworkGateway",
+        "operationId": "createNetworkMihomoProfile",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkGatewayInput"
+                "$ref": "#/components/schemas/NetworkMihomoProfileInput"
               }
             }
           },
@@ -88936,11 +90155,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkGatewayEnvelope"
+                  "$ref": "#/components/schemas/NetworkMihomoProfileEnvelope"
                 }
               }
             },
-            "description": "Created WireGuard network gateway configuration."
+            "description": "Created mihomo profile. The write-only subscription URL is not returned."
           },
           "400": {
             "$ref": "#/components/responses/Error"
@@ -88955,30 +90174,63 @@
         "tags": [
           "Network Access"
         ],
-        "x-soha-capability": {
-          "name": "network_access.gateways.create",
-          "permissionKeys": [
-            "ai.gateway.invoke",
-            "network_access.gateways.create"
-          ],
-          "requiresApproval": true,
-          "riskLevel": "high"
-        },
         "x-soha-permissions": {
           "keys": [
-            "network_access.gateways.create"
+            "network_access.mihomo_profiles.create"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/gateways/{gatewayID}": {
+    "/network-access/mihomo-profiles/{profileID}": {
+      "delete": {
+        "operationId": "deleteNetworkMihomoProfile",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "profileID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OperationStatus"
+                }
+              }
+            },
+            "description": "Deleted mihomo profile."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.mihomo_profiles.delete"
+          ],
+          "mode": "all"
+        }
+      },
       "get": {
-        "operationId": "getNetworkGateway",
+        "operationId": "getNetworkMihomoProfile",
         "parameters": [
           {
             "in": "path",
-            "name": "gatewayID",
+            "name": "profileID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -88992,11 +90244,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkGatewayEnvelope"
+                  "$ref": "#/components/schemas/NetworkMihomoProfileEnvelope"
                 }
               }
             },
-            "description": "Network gateway detail."
+            "description": "Mihomo profile metadata without subscription credentials."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89010,17 +90262,17 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.gateways.view"
+            "network_access.mihomo_profiles.view"
           ],
           "mode": "all"
         }
       },
       "put": {
-        "operationId": "updateNetworkGateway",
+        "operationId": "updateNetworkMihomoProfile",
         "parameters": [
           {
             "in": "path",
-            "name": "gatewayID",
+            "name": "profileID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -89033,7 +90285,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkGatewayInput"
+                "$ref": "#/components/schemas/NetworkMihomoProfileInput"
               }
             }
           },
@@ -89044,11 +90296,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkGatewayEnvelope"
+                  "$ref": "#/components/schemas/NetworkMihomoProfileEnvelope"
                 }
               }
             },
-            "description": "Updated WireGuard network gateway configuration."
+            "description": "Updated mihomo profile. Omitting subscriptionUrl preserves the current secret."
           },
           "400": {
             "$ref": "#/components/responses/Error"
@@ -89066,55 +90318,39 @@
         "tags": [
           "Network Access"
         ],
-        "x-soha-capability": {
-          "name": "network_access.gateways.update",
-          "permissionKeys": [
-            "ai.gateway.invoke",
-            "network_access.gateways.update"
-          ],
-          "requiresApproval": true,
-          "riskLevel": "high"
-        },
         "x-soha-permissions": {
           "keys": [
-            "network_access.gateways.update"
+            "network_access.mihomo_profiles.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/mihomo-profiles": {
+    "/network-access/nas-bindings": {
       "get": {
-        "operationId": "listNetworkMihomoProfiles",
+        "operationId": "listNetworkNASBindings",
         "parameters": [
           {
             "in": "query",
-            "name": "search",
+            "name": "siteId",
             "schema": {
-              "maxLength": 200,
+              "maxLength": 128,
               "type": "string"
             }
           },
           {
             "in": "query",
-            "name": "deviceId",
+            "name": "runtimeId",
             "schema": {
               "maxLength": 128,
               "type": "string"
             }
           },
-          {
-            "in": "query",
-            "name": "mode",
-            "schema": {
-              "$ref": "#/components/schemas/NetworkMihomoMode"
-            }
-          },
           {
             "in": "query",
             "name": "status",
             "schema": {
-              "$ref": "#/components/schemas/NetworkMihomoProfileStatus"
+              "$ref": "#/components/schemas/NetworkNASBindingStatus"
             }
           },
           {
@@ -89133,11 +90369,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkMihomoProfileListEnvelope"
+                  "$ref": "#/components/schemas/NetworkNASBindingListEnvelope"
                 }
               }
             },
-            "description": "Mihomo profiles assigned to endpoint devices. Subscription credentials are never returned."
+            "description": "NAS identities bound to registered network runtimes and sites."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89146,29 +90382,20 @@
         "tags": [
           "Network Access"
         ],
-        "x-soha-capability": {
-          "name": "network_access.mihomo_profiles.list",
-          "permissionKeys": [
-            "ai.gateway.invoke",
-            "network_access.mihomo_profiles.view"
-          ],
-          "requiresApproval": false,
-          "riskLevel": "read"
-        },
         "x-soha-permissions": {
           "keys": [
-            "network_access.mihomo_profiles.view"
+            "network_access.sites.view"
           ],
           "mode": "all"
         }
       },
       "post": {
-        "operationId": "createNetworkMihomoProfile",
+        "operationId": "createNetworkNASBinding",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkMihomoProfileInput"
+                "$ref": "#/components/schemas/NetworkNASBindingInput"
               }
             }
           },
@@ -89179,11 +90406,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkMihomoProfileEnvelope"
+                  "$ref": "#/components/schemas/NetworkNASBindingEnvelope"
                 }
               }
             },
-            "description": "Created mihomo profile. The write-only subscription URL is not returned."
+            "description": "Created NAS binding."
           },
           "400": {
             "$ref": "#/components/responses/Error"
@@ -89200,19 +90427,19 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.mihomo_profiles.create"
+            "network_access.sites.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/mihomo-profiles/{profileID}": {
+    "/network-access/nas-bindings/{bindingID}": {
       "delete": {
-        "operationId": "deleteNetworkMihomoProfile",
+        "operationId": "deleteNetworkNASBinding",
         "parameters": [
           {
             "in": "path",
-            "name": "profileID",
+            "name": "bindingID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -89230,7 +90457,7 @@
                 }
               }
             },
-            "description": "Deleted mihomo profile."
+            "description": "Deleted NAS binding."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89244,17 +90471,17 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.mihomo_profiles.delete"
+            "network_access.sites.update"
           ],
           "mode": "all"
         }
       },
       "get": {
-        "operationId": "getNetworkMihomoProfile",
+        "operationId": "getNetworkNASBinding",
         "parameters": [
           {
             "in": "path",
-            "name": "profileID",
+            "name": "bindingID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -89268,11 +90495,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkMihomoProfileEnvelope"
+                  "$ref": "#/components/schemas/NetworkNASBindingEnvelope"
                 }
               }
             },
-            "description": "Mihomo profile metadata without subscription credentials."
+            "description": "NAS binding detail."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89286,17 +90513,17 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.mihomo_profiles.view"
+            "network_access.sites.view"
           ],
           "mode": "all"
         }
       },
       "put": {
-        "operationId": "updateNetworkMihomoProfile",
+        "operationId": "updateNetworkNASBinding",
         "parameters": [
           {
             "in": "path",
-            "name": "profileID",
+            "name": "bindingID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -89309,7 +90536,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkMihomoProfileInput"
+                "$ref": "#/components/schemas/NetworkNASBindingInput"
               }
             }
           },
@@ -89320,11 +90547,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkMihomoProfileEnvelope"
+                  "$ref": "#/components/schemas/NetworkNASBindingEnvelope"
                 }
               }
             },
-            "description": "Updated mihomo profile. Omitting subscriptionUrl preserves the current secret."
+            "description": "Updated NAS binding."
           },
           "400": {
             "$ref": "#/components/responses/Error"
@@ -89344,37 +90571,36 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.mihomo_profiles.update"
+            "network_access.sites.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/nas-bindings": {
+    "/network-access/policies": {
       "get": {
-        "operationId": "listNetworkNASBindings",
+        "operationId": "listNetworkAccessPolicies",
         "parameters": [
           {
             "in": "query",
-            "name": "siteId",
+            "name": "search",
             "schema": {
-              "maxLength": 128,
+              "maxLength": 200,
               "type": "string"
             }
           },
           {
             "in": "query",
-            "name": "runtimeId",
+            "name": "enabled",
             "schema": {
-              "maxLength": 128,
-              "type": "string"
+              "type": "boolean"
             }
           },
           {
             "in": "query",
-            "name": "status",
+            "name": "effect",
             "schema": {
-              "$ref": "#/components/schemas/NetworkNASBindingStatus"
+              "$ref": "#/components/schemas/NetworkPolicyEffect"
             }
           },
           {
@@ -89393,11 +90619,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkNASBindingListEnvelope"
+                  "$ref": "#/components/schemas/NetworkAccessPolicyListEnvelope"
                 }
               }
             },
-            "description": "NAS identities bound to registered network runtimes and sites."
+            "description": "Draft network access policies."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89408,18 +90634,18 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.sites.view"
+            "network_access.policy.view"
           ],
           "mode": "all"
         }
       },
       "post": {
-        "operationId": "createNetworkNASBinding",
+        "operationId": "createNetworkAccessPolicy",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkNASBindingInput"
+                "$ref": "#/components/schemas/NetworkAccessPolicyInput"
               }
             }
           },
@@ -89430,20 +90656,17 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkNASBindingEnvelope"
+                  "$ref": "#/components/schemas/NetworkAccessPolicyEnvelope"
                 }
               }
             },
-            "description": "Created NAS binding."
+            "description": "Created draft network access policy."
           },
           "400": {
             "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
-          },
-          "409": {
-            "$ref": "#/components/responses/Error"
           }
         },
         "tags": [
@@ -89451,19 +90674,19 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.sites.update"
+            "network_access.policy.create"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/nas-bindings/{bindingID}": {
+    "/network-access/policies/{policyID}": {
       "delete": {
-        "operationId": "deleteNetworkNASBinding",
+        "operationId": "deleteNetworkAccessPolicy",
         "parameters": [
           {
             "in": "path",
-            "name": "bindingID",
+            "name": "policyID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -89481,7 +90704,7 @@
                 }
               }
             },
-            "description": "Deleted NAS binding."
+            "description": "Deleted draft network access policy."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89495,35 +90718,170 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.sites.update"
+            "network_access.policy.delete"
           ],
           "mode": "all"
         }
       },
       "get": {
-        "operationId": "getNetworkNASBinding",
+        "operationId": "getNetworkAccessPolicy",
         "parameters": [
           {
             "in": "path",
-            "name": "bindingID",
+            "name": "policyID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkAccessPolicyEnvelope"
+                }
+              }
+            },
+            "description": "Network access policy detail."
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.policy.view"
+          ],
+          "mode": "all"
+        }
+      },
+      "put": {
+        "operationId": "updateNetworkAccessPolicy",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "policyID",
             "required": true,
             "schema": {
               "maxLength": 128,
               "minLength": 1,
               "type": "string"
             }
-          }
-        ],
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NetworkAccessPolicyInput"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkAccessPolicyEnvelope"
+                }
+              }
+            },
+            "description": "Updated draft network access policy."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "404": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.policy.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/network-access/policies/compile": {
+      "post": {
+        "operationId": "compileNetworkAccessPolicySnapshot",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkPolicySnapshotEnvelope"
+                }
+              }
+            },
+            "description": "Current immutable compiled policy snapshot."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
+          },
+          "403": {
+            "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
+          }
+        },
+        "tags": [
+          "Network Access"
+        ],
+        "x-soha-permissions": {
+          "keys": [
+            "network_access.policy.update"
+          ],
+          "mode": "all"
+        }
+      }
+    },
+    "/network-access/policy/preview": {
+      "post": {
+        "operationId": "previewNetworkAccessPolicy",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NetworkPolicyPreviewRequest"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkNASBindingEnvelope"
+                  "$ref": "#/components/schemas/NetworkPolicyPreviewEnvelope"
                 }
               }
             },
-            "description": "NAS binding detail."
+            "description": "Side-effect-free network access decision and selected path."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89535,59 +90893,42 @@
         "tags": [
           "Network Access"
         ],
+        "x-soha-capability": {
+          "name": "network_access.policy.preview",
+          "permissionKeys": [
+            "ai.gateway.invoke",
+            "network_access.policy.view"
+          ],
+          "requiresApproval": false,
+          "riskLevel": "analyze"
+        },
         "x-soha-permissions": {
           "keys": [
-            "network_access.sites.view"
+            "network_access.policy.view"
           ],
           "mode": "all"
         }
-      },
-      "put": {
-        "operationId": "updateNetworkNASBinding",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "bindingID",
-            "required": true,
-            "schema": {
-              "maxLength": 128,
-              "minLength": 1,
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/NetworkNASBindingInput"
-              }
-            }
-          },
-          "required": true
-        },
+      }
+    },
+    "/network-access/policy/snapshot": {
+      "get": {
+        "operationId": "getNetworkAccessPolicySnapshot",
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkNASBindingEnvelope"
+                  "$ref": "#/components/schemas/NetworkPolicySnapshotEnvelope"
                 }
               }
             },
-            "description": "Updated NAS binding."
-          },
-          "400": {
-            "$ref": "#/components/responses/Error"
+            "description": "Active immutable compiled policy snapshot."
           },
           "403": {
             "$ref": "#/components/responses/Error"
           },
           "404": {
             "$ref": "#/components/responses/Error"
-          },
-          "409": {
-            "$ref": "#/components/responses/Error"
           }
         },
         "tags": [
@@ -89595,15 +90936,15 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.sites.update"
+            "network_access.policy.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/policies": {
+    "/network-access/proxy-instances": {
       "get": {
-        "operationId": "listNetworkAccessPolicies",
+        "operationId": "listNetworkProxyInstances",
         "parameters": [
           {
             "in": "query",
@@ -89615,16 +90956,9 @@
           },
           {
             "in": "query",
-            "name": "enabled",
-            "schema": {
-              "type": "boolean"
-            }
-          },
-          {
-            "in": "query",
-            "name": "effect",
+            "name": "engine",
             "schema": {
-              "$ref": "#/components/schemas/NetworkPolicyEffect"
+              "$ref": "#/components/schemas/NetworkProxyEngine"
             }
           },
           {
@@ -89643,11 +90977,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkAccessPolicyListEnvelope"
+                  "$ref": "#/components/schemas/NetworkProxyInstanceListEnvelope"
                 }
               }
             },
-            "description": "Draft network access policies."
+            "description": "Registered server proxy instances and observed state."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89658,18 +90992,18 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.policy.view"
+            "network_access.proxy_instances.view"
           ],
           "mode": "all"
         }
       },
       "post": {
-        "operationId": "createNetworkAccessPolicy",
+        "operationId": "createNetworkProxyInstance",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkAccessPolicyInput"
+                "$ref": "#/components/schemas/NetworkProxyInstanceInput"
               }
             }
           },
@@ -89680,60 +91014,19 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkAccessPolicyEnvelope"
+                  "$ref": "#/components/schemas/NetworkProxyInstanceEnvelope"
                 }
               }
             },
-            "description": "Created draft network access policy."
+            "description": "Created proxy instance. A separate one-time proxy runtime enrollment is required before it can report state."
           },
           "400": {
             "$ref": "#/components/responses/Error"
           },
-          "403": {
-            "$ref": "#/components/responses/Error"
-          }
-        },
-        "tags": [
-          "Network Access"
-        ],
-        "x-soha-permissions": {
-          "keys": [
-            "network_access.policy.create"
-          ],
-          "mode": "all"
-        }
-      }
-    },
-    "/network-access/policies/{policyID}": {
-      "delete": {
-        "operationId": "deleteNetworkAccessPolicy",
-        "parameters": [
-          {
-            "in": "path",
-            "name": "policyID",
-            "required": true,
-            "schema": {
-              "maxLength": 128,
-              "minLength": 1,
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/OperationStatus"
-                }
-              }
-            },
-            "description": "Deleted draft network access policy."
-          },
           "403": {
             "$ref": "#/components/responses/Error"
           },
-          "404": {
+          "409": {
             "$ref": "#/components/responses/Error"
           }
         },
@@ -89742,17 +91035,19 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.policy.delete"
+            "network_access.proxy_instances.create"
           ],
           "mode": "all"
         }
-      },
+      }
+    },
+    "/network-access/proxy-instances/{instanceID}": {
       "get": {
-        "operationId": "getNetworkAccessPolicy",
+        "operationId": "getNetworkProxyInstance",
         "parameters": [
           {
             "in": "path",
-            "name": "policyID",
+            "name": "instanceID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -89766,11 +91061,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkAccessPolicyEnvelope"
+                  "$ref": "#/components/schemas/NetworkProxyInstanceEnvelope"
                 }
               }
             },
-            "description": "Network access policy detail."
+            "description": "Proxy instance metadata. Configuration contents and controller credentials are excluded."
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89784,17 +91079,19 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.policy.view"
+            "network_access.proxy_instances.view"
           ],
           "mode": "all"
         }
-      },
+      }
+    },
+    "/network-access/proxy-instances/{instanceID}/configuration": {
       "put": {
-        "operationId": "updateNetworkAccessPolicy",
+        "operationId": "updateNetworkProxyConfiguration",
         "parameters": [
           {
             "in": "path",
-            "name": "policyID",
+            "name": "instanceID",
             "required": true,
             "schema": {
               "maxLength": 128,
@@ -89807,7 +91104,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/NetworkAccessPolicyInput"
+                "$ref": "#/components/schemas/NetworkProxyConfigurationInput"
               }
             }
           },
@@ -89818,11 +91115,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkAccessPolicyEnvelope"
+                  "$ref": "#/components/schemas/NetworkProxyInstanceEnvelope"
                 }
               }
             },
-            "description": "Updated draft network access policy."
+            "description": "Desired revision saved; runtime application is asynchronous. Configuration contents are not returned."
           },
           "400": {
             "$ref": "#/components/responses/Error"
@@ -89832,6 +91129,9 @@
           },
           "404": {
             "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
           }
         },
         "tags": [
@@ -89839,33 +91139,42 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.policy.update"
+            "network_access.proxy_instances.update"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/policies/compile": {
-      "post": {
-        "operationId": "compileNetworkAccessPolicySnapshot",
+    "/network-access/proxy-instances/{instanceID}/connections": {
+      "get": {
+        "operationId": "getNetworkProxyConnections",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "instanceID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkPolicySnapshotEnvelope"
+                  "$ref": "#/components/schemas/NetworkProxyConnectionsEnvelope"
                 }
               }
             },
-            "description": "Current immutable compiled policy snapshot."
-          },
-          "400": {
-            "$ref": "#/components/responses/Error"
+            "description": "Latest short-lived connection snapshot, or an explicit unsupported/unavailable state."
           },
           "403": {
             "$ref": "#/components/responses/Error"
           },
-          "409": {
+          "404": {
             "$ref": "#/components/responses/Error"
           }
         },
@@ -89874,79 +91183,113 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.policy.update"
+            "network_access.proxy_connections.view"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/policy/preview": {
+    "/network-access/proxy-instances/{instanceID}/connections/{connectionID}/close": {
       "post": {
-        "operationId": "previewNetworkAccessPolicy",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/NetworkPolicyPreviewRequest"
-              }
+        "operationId": "closeNetworkProxyConnection",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "instanceID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "in": "path",
+            "name": "connectionID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "200": {
+          "202": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkPolicyPreviewEnvelope"
+                  "$ref": "#/components/schemas/NetworkProxyCloseCommandEnvelope"
                 }
               }
             },
-            "description": "Side-effect-free network access decision and selected path."
-          },
-          "400": {
-            "$ref": "#/components/responses/Error"
+            "description": "Expiring close command queued for the enrolled runtime. The action is audited."
           },
           "403": {
             "$ref": "#/components/responses/Error"
           },
           "404": {
             "$ref": "#/components/responses/Error"
+          },
+          "409": {
+            "$ref": "#/components/responses/Error"
           }
         },
         "tags": [
           "Network Access"
         ],
-        "x-soha-capability": {
-          "name": "network_access.policy.preview",
-          "permissionKeys": [
-            "ai.gateway.invoke",
-            "network_access.policy.view"
-          ],
-          "requiresApproval": false,
-          "riskLevel": "analyze"
-        },
         "x-soha-permissions": {
           "keys": [
-            "network_access.policy.view"
+            "network_access.proxy_connections.close"
           ],
           "mode": "all"
         }
       }
     },
-    "/network-access/policy/snapshot": {
+    "/network-access/proxy-instances/{instanceID}/traffic": {
       "get": {
-        "operationId": "getNetworkAccessPolicySnapshot",
+        "operationId": "getNetworkProxyTraffic",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "instanceID",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "from",
+            "schema": {
+              "format": "date-time",
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "to",
+            "schema": {
+              "format": "date-time",
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NetworkPolicySnapshotEnvelope"
+                  "$ref": "#/components/schemas/NetworkProxyTrafficEnvelope"
                 }
               }
             },
-            "description": "Active immutable compiled policy snapshot."
+            "description": "Bounded samples; speed is derived from adjacent cumulative counters within one runtime uptime epoch."
+          },
+          "400": {
+            "$ref": "#/components/responses/Error"
           },
           "403": {
             "$ref": "#/components/responses/Error"
@@ -89960,7 +91303,7 @@
         ],
         "x-soha-permissions": {
           "keys": [
-            "network_access.policy.view"
+            "network_access.proxy_instances.view"
           ],
           "mode": "all"
         }