@opensoha/contracts 0.1.24 → 0.1.26

package/openapi/soha-api.yaml

@@ -1,11 +1,13 @@
 openapi: 3.1.0
 info:
   title: Soha API
-  version: 0.1.24
+  version: 0.1.26
   description: >
     Public OpenSoha core API contract. This first contract focuses on stable
     cross-repository boundaries: auth, health, runner-facing control-plane
     callbacks, AI Gateway, and MCP capability discovery.
+    Pod session WebSocket targets and their UID-aware ticket requirements are
+    described separately in x-soha-websocket-paths to preserve HTTP client generation.
 servers:
   - url: /api/v1
     description: Soha API v1
@@ -40,6 +42,78 @@ tags:
   - name: Portal
   - name: Directory
   - name: Network Access
+x-soha-websocket-paths:
+  /clusters/{clusterID}/workloads/pods/{podName}/logs/stream:
+    get:
+      tags: [Platform]
+      operationId: streamKubernetesPodLogs
+      x-soha-permissions:
+        mode: all
+        keys: [platform.pods.logs]
+      x-soha-implementation-status: implemented
+      description: >-
+        Existing WebSocket logs endpoint. Saved sessions must provide expectedUid.
+        Each upstream open checks the current Pod UID and current action authorization.
+        A stream ticket issued with expectedUid binds namespace, container and shell too.
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesPodName"
+        - $ref: "#/components/parameters/KubernetesNamespaceDefaultQuery"
+        - name: expectedUid
+          in: query
+          schema: { type: string, minLength: 1 }
+        - name: container
+          in: query
+          schema: { type: string, minLength: 1 }
+        - name: stream_ticket
+          in: query
+          schema: { type: string, minLength: 1 }
+        - name: tailLines
+          in: query
+          schema: { type: integer, minimum: 0, default: 200 }
+        - name: sinceSeconds
+          in: query
+          schema: { type: integer, minimum: 0, default: 0 }
+      responses:
+        "101":
+          description: WebSocket opened; terminalMessage envelopes carry stream output and safe exit status. Authentication, UID, permission or provider failures terminate the stream without attaching to a replacement Pod.
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/workloads/pods/{podName}/terminal:
+    get:
+      tags: [Platform]
+      operationId: streamKubernetesPodTerminal
+      x-soha-permissions:
+        mode: all
+        keys: [platform.pods.exec]
+      x-soha-implementation-status: implemented
+      description: >-
+        Existing WebSocket exec endpoint. Saved sessions must provide expectedUid.
+        Each upstream open checks the current Pod UID and current action authorization.
+        A stream ticket issued with expectedUid binds namespace, container and shell too.
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesPodName"
+        - $ref: "#/components/parameters/KubernetesNamespaceDefaultQuery"
+        - name: expectedUid
+          in: query
+          schema: { type: string, minLength: 1 }
+        - name: container
+          in: query
+          schema: { type: string, minLength: 1 }
+        - name: stream_ticket
+          in: query
+          schema: { type: string, minLength: 1 }
+        - name: shell
+          in: query
+          schema: { type: string, default: /bin/sh }
+      responses:
+        "101":
+          description: WebSocket opened; terminalMessage envelopes carry stream output and safe exit status. Authentication, UID, permission or provider failures terminate the stream without attaching to a replacement Pod.
+        "401": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
 paths:
   /network-access/vpn/profiles:
     get:
@@ -2640,11 +2714,81 @@ paths:
                 $ref: "#/components/schemas/ApplicationEnvironmentEnvelope"
         "400":
           $ref: "#/components/responses/Error"
+  /application-environments/{applicationEnvironmentID}/targets/{targetID}/source:
+    get:
+      tags: [Delivery]
+      operationId: getApplicationEnvironmentTargetSource
+      description: Read a linked source through existing Kubernetes authorization. Rejects replaced UIDs. Custom resource YAML additionally requires sensitive-data read permission. Responses must not be persisted in browser caches.
+      parameters:
+        - name: applicationEnvironmentID
+          in: path
+          required: true
+          schema: { type: string, minLength: 1 }
+        - name: targetID
+          in: path
+          required: true
+          schema: { type: string, minLength: 1 }
+      responses:
+        "200":
+          description: Current cluster YAML for the linked resource, never a fabricated source file.
+          headers:
+            Cache-Control:
+              required: true
+              schema: { type: string, const: no-store }
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "403":
+          $ref: "#/components/responses/Error"
+        "404":
+          $ref: "#/components/responses/Error"
+        "409":
+          $ref: "#/components/responses/Error"
+  /application-environments/{applicationEnvironmentID}/targets/{targetID}/relations:
+    get:
+      tags: [Delivery]
+      operationId: getApplicationEnvironmentTargetRelations
+      description: Read UID-verified metadata relationships for an imported root. Every source retains Kubernetes and Soha authorization. Rules are observational metadata, never permission grants. Partial coverage is explicit; no provider configuration values are returned.
+      parameters:
+        - name: applicationEnvironmentID
+          in: path
+          required: true
+          schema: { type: string, minLength: 1 }
+        - name: targetID
+          in: path
+          required: true
+          schema: { type: string, minLength: 1 }
+      responses:
+        "200":
+          description: Bounded observed relations, including coverage gaps.
+          headers:
+            Cache-Control:
+              required: true
+              schema: { type: string, const: no-store }
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ResourceRelationsEnvelope" }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
   /application-environments/target-candidates:
     get:
       tags: [Delivery]
       operationId: listApplicationEnvironmentTargetCandidates
       parameters:
+        - name: workloadKind
+          in: query
+          required: false
+          schema:
+            type: string
+            enum: [Deployment, StatefulSet, DaemonSet, Job, CronJob, CustomResource]
+        - name: crdName
+          in: query
+          required: false
+          description: Explicit CRD selection for CustomResource discovery. Only this served resource and namespace are queried.
+          schema: { type: string, minLength: 1 }
         - name: clusterId
           in: query
           required: true
@@ -4196,6 +4340,23 @@ paths:
                 $ref: "#/components/schemas/DeliveryEnvironmentListEnvelope"
         "403":
           $ref: "#/components/responses/Error"
+  /delivery/template-updates/targets:
+    get:
+      {"tags": ["Delivery"], "operationId": "listTemplateUpdateTargets", "summary": "Preview affected application bindings with honest paginated totals", "description": "Uses current application and environment permissions. Published immutable template versions only; adoption changes configuration and never deploys resources. Fixed and detached bindings are excluded from automatic propagation. Concurrent changes return 409.", "responses": {"200": {"description": "Success", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdateTargetPageEnvelope"}}}}, "400": {"$ref": "#/components/responses/Error"}, "403": {"$ref": "#/components/responses/Error"}, "404": {"$ref": "#/components/responses/Error"}, "409": {"$ref": "#/components/responses/Error"}}, "parameters": [{"in": "query", "name": "kind", "required": true, "schema": {"$ref": "#/components/schemas/TemplateUpdateKind"}}, {"in": "query", "name": "templateId", "required": true, "schema": {"type": "string", "maxLength": 256}}, {"in": "query", "name": "applicationId", "required": false, "schema": {"type": "string", "maxLength": 256}}, {"in": "query", "name": "page", "required": false, "schema": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}}, {"in": "query", "name": "pageSize", "required": false, "schema": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 100}}, {"name": "serviceId", "in": "query", "required": false, "schema": {"type": "string", "maxLength": 256}}, {"name": "applicationEnvironmentId", "in": "query", "required": false, "schema": {"type": "string", "maxLength": 256}}]}
+  /delivery/template-updates/previews:
+    post:
+      {"tags": ["Delivery"], "operationId": "createTemplateUpdatePreview", "summary": "Freeze final template adoption and cumulative plus adjacent-version differences", "description": "Uses current application and environment permissions. Published immutable template versions only; adoption changes configuration and never deploys resources. Fixed and detached bindings are excluded from automatic propagation. Concurrent changes return 409.", "responses": {"200": {"description": "Success", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdatePreviewEnvelope"}}}}, "400": {"$ref": "#/components/responses/Error"}, "403": {"$ref": "#/components/responses/Error"}, "404": {"$ref": "#/components/responses/Error"}, "409": {"$ref": "#/components/responses/Error"}}, "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdatePreviewInput"}}}}}
+  /delivery/template-updates/previews/{previewID}:
+    get:
+      {"tags": ["Delivery"], "operationId": "getTemplateUpdatePreview", "summary": "Read a frozen adoption preview with current scope revalidation", "description": "Uses current application and environment permissions. Published immutable template versions only; adoption changes configuration and never deploys resources. Fixed and detached bindings are excluded from automatic propagation. Concurrent changes return 409.", "responses": {"200": {"description": "Success", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdatePreviewEnvelope"}}}}, "400": {"$ref": "#/components/responses/Error"}, "403": {"$ref": "#/components/responses/Error"}, "404": {"$ref": "#/components/responses/Error"}, "409": {"$ref": "#/components/responses/Error"}}, "parameters": [{"in": "path", "name": "previewID", "required": true, "schema": {"type": "string", "maxLength": 256}}]}
+  /delivery/template-updates/previews/{previewID}/batches:
+    post:
+      {"tags": ["Delivery"], "operationId": "createTemplateUpdateBatch", "summary": "Adopt selected candidates in waves through existing DeliveryBatch and Plan approvals", "description": "Uses current application and environment permissions. Published immutable template versions only; adoption changes configuration and never deploys resources. Fixed and detached bindings are excluded from automatic propagation. Concurrent changes return 409.", "responses": {"200": {"description": "Success", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/DeliveryBatchEnvelope"}}}}, "400": {"$ref": "#/components/responses/Error"}, "403": {"$ref": "#/components/responses/Error"}, "404": {"$ref": "#/components/responses/Error"}, "409": {"$ref": "#/components/responses/Error"}}, "parameters": [{"in": "path", "name": "previewID", "required": true, "schema": {"type": "string", "maxLength": 256}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdateBatchInput"}}}}}
+  /delivery/template-updates/policies:
+    get:
+      {"tags": ["Delivery"], "operationId": "listTemplateUpdatePolicies", "summary": "List explicit adoption policies visible to the current principal", "description": "Uses current application and environment permissions. Published immutable template versions only; adoption changes configuration and never deploys resources. Fixed and detached bindings are excluded from automatic propagation. Concurrent changes return 409.", "responses": {"200": {"description": "Success", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdatePolicyListEnvelope"}}}}, "400": {"$ref": "#/components/responses/Error"}, "403": {"$ref": "#/components/responses/Error"}, "404": {"$ref": "#/components/responses/Error"}, "409": {"$ref": "#/components/responses/Error"}}, "parameters": [{"in": "query", "name": "kind", "required": true, "schema": {"$ref": "#/components/schemas/TemplateUpdateKind"}}, {"in": "query", "name": "templateId", "required": true, "schema": {"type": "string", "maxLength": 256}}, {"in": "query", "name": "applicationId", "required": false, "schema": {"type": "string", "maxLength": 256}}]}
+    put:
+      {"tags": ["Delivery"], "operationId": "saveTemplateUpdatePolicy", "summary": "Save fixed manual automatic or approval policy using a binding-scoped CAS", "description": "Uses current application and environment permissions. Published immutable template versions only; adoption changes configuration and never deploys resources. Fixed and detached bindings are excluded from automatic propagation. Concurrent changes return 409.", "responses": {"200": {"description": "Success", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdatePolicyEnvelope"}}}}, "400": {"$ref": "#/components/responses/Error"}, "403": {"$ref": "#/components/responses/Error"}, "404": {"$ref": "#/components/responses/Error"}, "409": {"$ref": "#/components/responses/Error"}}, "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/TemplateUpdatePolicyInput"}}}}}
   /delivery/manifest-packages:
     get:
       tags: [Delivery]
@@ -8661,6 +8822,10 @@ paths:
         - $ref: "#/components/parameters/ClusterID"
         - $ref: "#/components/parameters/KubernetesPodName"
         - $ref: "#/components/parameters/KubernetesNamespaceDefaultQuery"
+        - name: expectedUid
+          in: query
+          description: Reject the request if the live Pod UID differs. Omit only for legacy clients, never when restoring a saved session.
+          schema: { type: string, minLength: 1 }
         - name: container
           in: query
           schema: { type: string, minLength: 1 }
@@ -8682,6 +8847,11 @@ paths:
                 $ref: "#/components/schemas/KubernetesPodLogsEnvelope"
         "403": { $ref: "#/components/responses/Error" }
         "404": { $ref: "#/components/responses/Error" }
+        "409":
+          description: The current Pod UID differs from expectedUid; open the current Pod instead of adopting it by name.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ErrorEnvelope" }
         "503": { $ref: "#/components/responses/Error" }
   /clusters/{clusterID}/workloads/pods/{podName}/yaml:
     get:
@@ -10086,6 +10256,36 @@ paths:
         "403": { $ref: "#/components/responses/Error" }
         "404": { $ref: "#/components/responses/Error" }
         "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/resource-monitoring:
+    get:
+      tags: [Platform]
+      operationId: getKubernetesResourceMonitoring
+      description: Fixed bounded monitoring templates. The selected view requires its exact permission plus cluster-wide nodes.view. Raw PromQL is never accepted. Current snapshots and historical series have separate observation times.
+      x-soha-permissions:
+        mode: all
+        keys: [platform.nodes.view]
+        byQuery:
+          view:
+            overview: platform.resource-monitoring.overview.view
+            cpu: platform.resource-monitoring.cpu.view
+            memory: platform.resource-monitoring.memory.view
+            conntrack: platform.resource-monitoring.conntrack.view
+            pods: platform.resource-monitoring.pods.view
+      x-soha-implementation-status: implemented
+      parameters:
+        - { $ref: "#/components/parameters/ClusterID" }
+        - { name: view, in: query, required: true, schema: { $ref: "#/components/schemas/ResourceMonitoringViewName" } }
+        - { name: node, in: query, schema: { type: string, maxLength: 253 } }
+        - { name: from, in: query, schema: { type: string, format: date-time } }
+        - { name: to, in: query, schema: { type: string, format: date-time } }
+        - { name: rangeMinutes, in: query, schema: { type: integer, minimum: 1, maximum: 1440, default: 60 } }
+        - { name: stepSeconds, in: query, schema: { type: integer, minimum: 15, maximum: 3600, default: 60 } }
+      responses:
+        "200": { description: Per-panel quality and bounded node series., content: { application/json: { schema: { $ref: "#/components/schemas/ResourceMonitoringEnvelope" } } } }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
   /clusters/{clusterID}/network/topology:
     get:
       tags: [Platform]
@@ -10097,7 +10297,7 @@ paths:
       x-soha-implementation-status: implemented
       parameters: [{ $ref: "#/components/parameters/ClusterID" }, { $ref: "#/components/parameters/KubernetesNamespaceQuery" }]
       responses:
-        "200": { description: Resolved ingress and Gateway API topology for the selected scope., content: { application/json: { schema: { $ref: "#/components/schemas/KubernetesNetworkTopologyEnvelope" } } } }
+        "200": { description: "Bounded permission-filtered Kubernetes, Gateway API, Traefik and APISIX topology, with per-source coverage and explicit unresolved relationships.", content: { application/json: { schema: { $ref: "#/components/schemas/KubernetesNetworkTopologyEnvelope" } } } }
         "403": { $ref: "#/components/responses/Error" }
         "404": { $ref: "#/components/responses/Error" }
         "503": { $ref: "#/components/responses/Error" }
@@ -19764,6 +19964,12 @@ paths:
       tags:
         - Platform
       operationId: drainKubernetesNode
+      description: >-
+        Cordon the node and evict eligible pods. A 409 with node_drain_pdb_blocked,
+        node_drain_eviction_blocked, node_drain_timeout, node_drain_canceled,
+        node_drain_pod_selection or node_drain_failed means this drain did not complete.
+        Inspect current node schedulability and remaining pods before retrying or
+        explicitly restoring scheduling. Transport failure leaves the outcome unknown.
       x-soha-permissions:
         mode: all
         keys:
@@ -20027,6 +20233,458 @@ paths:
           $ref: "#/components/responses/Error"
         "503":
           $ref: "#/components/responses/Error"
+  /clusters/{clusterID}/network/httproutes/{name}:
+    delete:
+      tags: [Platform]
+      operationId: deleteKubernetesHTTPRoute
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.http-routes.delete]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "204": { description: Resource deleted. }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/network/httproutes/{name}/yaml:
+    get:
+      tags: [Platform]
+      operationId: getKubernetesHTTPRouteYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.http-routes.view]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+    put:
+      tags: [Platform]
+      operationId: applyKubernetesHTTPRouteYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.http-routes.update]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesResourceYamlInput"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/network/grpcroutes/{name}:
+    delete:
+      tags: [Platform]
+      operationId: deleteKubernetesGRPCRoute
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.grpc-routes.delete]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "204": { description: Resource deleted. }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/network/grpcroutes/{name}/yaml:
+    get:
+      tags: [Platform]
+      operationId: getKubernetesGRPCRouteYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.grpc-routes.view]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+    put:
+      tags: [Platform]
+      operationId: applyKubernetesGRPCRouteYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.grpc-routes.update]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesResourceYamlInput"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/network/backendtlspolicies/{name}:
+    delete:
+      tags: [Platform]
+      operationId: deleteKubernetesBackendTLSPolicy
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.backend-tls-policies.delete]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "204": { description: Resource deleted. }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/network/backendtlspolicies/{name}/yaml:
+    get:
+      tags: [Platform]
+      operationId: getKubernetesBackendTLSPolicyYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.backend-tls-policies.view]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+    put:
+      tags: [Platform]
+      operationId: applyKubernetesBackendTLSPolicyYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.backend-tls-policies.update]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesResourceYamlInput"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/network/referencegrants/{name}:
+    delete:
+      tags: [Platform]
+      operationId: deleteKubernetesReferenceGrant
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.reference-grants.delete]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "204": { description: Resource deleted. }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/network/referencegrants/{name}/yaml:
+    get:
+      tags: [Platform]
+      operationId: getKubernetesReferenceGrantYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.reference-grants.view]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+    put:
+      tags: [Platform]
+      operationId: applyKubernetesReferenceGrantYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.network.reference-grants.update]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesResourceYamlInput"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/configuration/hpas/{name}:
+    delete:
+      tags: [Platform]
+      operationId: deleteKubernetesHorizontalPodAutoscaler
+      x-soha-permissions:
+        mode: all
+        keys: [platform.configuration.horizontal-pod-autoscalers.delete]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "204": { description: Resource deleted. }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/configuration/hpas/{name}/yaml:
+    get:
+      tags: [Platform]
+      operationId: getKubernetesHorizontalPodAutoscalerYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.configuration.horizontal-pod-autoscalers.view]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+    put:
+      tags: [Platform]
+      operationId: applyKubernetesHorizontalPodAutoscalerYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.configuration.horizontal-pod-autoscalers.update]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesResourceYamlInput"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/configuration/poddisruptionbudgets/{name}:
+    delete:
+      tags: [Platform]
+      operationId: deleteKubernetesPodDisruptionBudget
+      x-soha-permissions:
+        mode: all
+        keys: [platform.configuration.pod-disruption-budgets.delete]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "204": { description: Resource deleted. }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/configuration/poddisruptionbudgets/{name}/yaml:
+    get:
+      tags: [Platform]
+      operationId: getKubernetesPodDisruptionBudgetYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.configuration.pod-disruption-budgets.view]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+    put:
+      tags: [Platform]
+      operationId: applyKubernetesPodDisruptionBudgetYaml
+      x-soha-permissions:
+        mode: all
+        keys: [platform.configuration.pod-disruption-budgets.update]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/KubernetesResourceYamlInput"
+      responses:
+        "200":
+          description: Authorized Kubernetes resource YAML.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KubernetesResourceYamlEnvelope"
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+  /clusters/{clusterID}/workloads/replicationcontrollers/{name}:
+    delete:
+      tags: [Platform]
+      operationId: deleteKubernetesReplicationController
+      x-soha-permissions:
+        mode: all
+        keys: [platform.workloads.replication-controllers.delete]
+      x-soha-implementation-status: implemented
+      parameters:
+        - $ref: "#/components/parameters/ClusterID"
+        - $ref: "#/components/parameters/KubernetesResourceName"
+        - $ref: "#/components/parameters/KubernetesNamespaceQuery"
+      responses:
+        "204": { description: Resource deleted. }
+        "400": { $ref: "#/components/responses/Error" }
+        "403": { $ref: "#/components/responses/Error" }
+        "404": { $ref: "#/components/responses/Error" }
+        "409": { $ref: "#/components/responses/Error" }
+        "503": { $ref: "#/components/responses/Error" }
+
 components:
   securitySchemes:
     bearerAuth:
@@ -20942,6 +21600,7 @@ components:
       schema:
         type: string
         enum: [default, bypass, read-only, refresh]
+        x-enum-varnames: [CreateAIGatewayOpenAICompatibleProviderResponseParamsXSohaCacheModeDefault, CreateAIGatewayOpenAICompatibleProviderResponseParamsXSohaCacheModeBypass, CreateAIGatewayOpenAICompatibleProviderResponseParamsXSohaCacheModeReadOnly, CreateAIGatewayOpenAICompatibleProviderResponseParamsXSohaCacheModeRefresh]
       description: Optional relay cache behavior hint.
   headers:
     SohaRouteIDHeader:
@@ -27105,7 +27764,10 @@ components:
       type: object
       properties:
         publicModel: { type: string, maxLength: 200 }
-        reasoningEffort: { type: string, enum: [auto, low, medium, high] }
+        reasoningEffort:
+          type: string
+          enum: [auto, low, medium, high]
+          x-enum-varnames: [WorkbenchModelPreferencesReasoningEffortAuto, WorkbenchModelPreferencesReasoningEffortLow, WorkbenchModelPreferencesReasoningEffortMedium, WorkbenchModelPreferencesReasoningEffortHigh]
       additionalProperties: false
     WorkbenchModelOption:
       type: object
@@ -29614,6 +30276,7 @@ components:
       properties:
         path:
           type: string
+          description: Same-origin stream pathname. UID-aware Pod sessions include expectedUid, namespace, container and shell query fields to bind the one-use ticket to that exact target; other query fields are not part of the binding.
       additionalProperties: false
     StreamTicket:
       type: object
@@ -30611,6 +31274,14 @@ components:
           type: string
           format: date-time
       additionalProperties: false
+    ResourceRelationSource: {"type": "object", "required": ["apiVersion", "resource", "kind", "namespace"], "properties": {"apiVersion": {"type": "string", "minLength": 1}, "resource": {"type": "string", "minLength": 1}, "kind": {"type": "string", "minLength": 1}, "namespace": {"type": "string", "minLength": 1}}, "additionalProperties": false}
+    ResourceRelationRule: {"type": "object", "required": ["id", "type", "target"], "properties": {"id": {"type": "string", "minLength": 1}, "type": {"type": "string", "enum": ["reference", "manual", "selector"]}, "target": {"$ref": "#/components/schemas/ResourceRelationSource"}, "name": {"type": "string"}, "uid": {"type": "string"}, "selector": {"type": "object", "additionalProperties": {"type": "string"}, "maxProperties": 16}}, "additionalProperties": false}
+    ResourceRelationConfig: {"type": "object", "required": ["version", "rootUid", "sources", "rules"], "properties": {"version": {"type": "string", "const": "v1"}, "rootUid": {"type": "string", "minLength": 1}, "sources": {"type": "array", "items": {"$ref": "#/components/schemas/ResourceRelationSource"}, "maxItems": 8}, "rules": {"type": "array", "items": {"$ref": "#/components/schemas/ResourceRelationRule"}, "maxItems": 8}}, "additionalProperties": false}
+    ResourceRelationNode: {"type": "object", "required": ["resource", "role", "depth"], "properties": {"resource": {"$ref": "#/components/schemas/KubernetesResourceRef"}, "role": {"type": "string", "enum": ["root", "owned", "manual", "reference", "candidate"]}, "depth": {"type": "integer", "minimum": 0, "maximum": 8}}, "additionalProperties": false}
+    ResourceRelationEdge: {"type": "object", "required": ["fromUid", "toUid", "type"], "properties": {"fromUid": {"type": "string", "minLength": 1}, "toUid": {"type": "string", "minLength": 1}, "type": {"type": "string", "enum": ["owns", "manual", "references", "selector_candidate"]}, "ruleId": {"type": "string"}}, "additionalProperties": false}
+    ResourceRelationCoverage: {"type": "object", "required": ["queryId", "state", "truncated"], "properties": {"queryId": {"type": "string", "minLength": 1}, "state": {"type": "string", "enum": ["available", "partial", "denied", "error", "not_installed", "unsupported"]}, "reasonCode": {"type": "string"}, "truncated": {"type": "boolean"}}, "additionalProperties": false}
+    ResourceRelationsView: {"type": "object", "required": ["root", "config", "nodes", "edges", "coverage", "partial", "observedAt"], "properties": {"root": {"$ref": "#/components/schemas/KubernetesResourceRef"}, "config": {"$ref": "#/components/schemas/ResourceRelationConfig"}, "nodes": {"type": "array", "items": {"$ref": "#/components/schemas/ResourceRelationNode"}, "maxItems": 500}, "edges": {"type": "array", "items": {"$ref": "#/components/schemas/ResourceRelationEdge"}}, "coverage": {"type": "array", "items": {"$ref": "#/components/schemas/ResourceRelationCoverage"}}, "partial": {"type": "boolean"}, "observedAt": {"type": "string"}}, "additionalProperties": false}
+    ResourceRelationsEnvelope: {"type": "object", "required": ["data"], "properties": {"data": {"$ref": "#/components/schemas/ResourceRelationsView"}}, "additionalProperties": false}
     ReleaseTarget:
       type: object
       required: [id, applicationEnvironmentId, clusterId, namespace, workloadKind, workloadName, enabled]
@@ -30996,6 +31667,8 @@ components:
       type: object
       required: [deliveryPlanId, targetId, applicationId, applicationEnvironmentId, serviceId, serviceVersion, clusterId, namespace, releaseName, operation, chart, chartVersion, chartDigest, configurationDigest, valuesDigest, renderedDigest, expectedRevision, resources, preflightTaskId]
       properties:
+        templateInputs: {"$ref": "#/components/schemas/TemplateVersionReference"}
+        migration: {"$ref": "#/components/schemas/TemplateMigrationAssessment"}
         deliveryPlanId: { type: string, minLength: 1 }
         targetId: { type: string, minLength: 1 }
         applicationId: { type: string, minLength: 1 }
@@ -31043,6 +31716,11 @@ components:
         action: { type: string, enum: [preflight, apply, observe] }
         snapshot: { $ref: "#/components/schemas/HelmDeliverySnapshot" }
         prepared: { $ref: "#/components/schemas/HelmPreparedRelease" }
+        initializationResources:
+          type: array
+          maxItems: 300
+          description: Server-derived original successful initialization apply receipt. Required for initialization observation or already-applied recovery; current same-name objects cannot establish original ownership.
+          items: { $ref: "#/components/schemas/ManifestResourceInventory" }
       additionalProperties: false
     HelmExecutionTaskResult:
       type: object
@@ -31118,6 +31796,7 @@ components:
       type: object
       required: [key, name, source, parameterSchema, defaults, health, enabled]
       properties:
+        migrationPolicy: { $ref: "#/components/schemas/TemplateMigrationPolicy" }
         copiedFrom: { $ref: '#/components/schemas/TemplateCopyOrigin' }
         key: { type: string, minLength: 1, maxLength: 128, pattern: '^[a-z0-9][a-z0-9._-]*$' }
         name: { type: string, minLength: 1, maxLength: 200 }
@@ -31143,6 +31822,7 @@ components:
       type: object
       required: [id, key, name, source, parameterSchema, defaults, health, enabled, revision, publishedVersion, publicationState, createdAt, updatedAt]
       properties:
+        migrationPolicy: { $ref: "#/components/schemas/TemplateMigrationPolicy" }
         id: { type: string, minLength: 1 }
         key: { type: string, minLength: 1 }
         name: { type: string, minLength: 1 }
@@ -31236,6 +31916,7 @@ components:
       type: object
       required: [id, key, name, enabled, createdAt, updatedAt]
       properties:
+        migrationPolicy: {"$ref": "#/components/schemas/TemplateMigrationPolicy"}
         revision:
           type: integer
           minimum: 1
@@ -31277,6 +31958,7 @@ components:
       type: object
       required: [key, name, enabled]
       properties:
+        migrationPolicy: {"$ref": "#/components/schemas/TemplateMigrationPolicy"}
         copiedFrom: { $ref: '#/components/schemas/TemplateCopyOrigin' }
         expectedRevision:
           type: integer
@@ -31433,10 +32115,44 @@ components:
           type: string
           minLength: 1
       additionalProperties: false
+    KubernetesImportOwnerReference:
+      type: object
+      required: [apiVersion, kind, name, uid]
+      properties:
+        apiVersion: { type: string, minLength: 1 }
+        kind: { type: string, minLength: 1 }
+        name: { type: string, minLength: 1 }
+        uid: { type: string, minLength: 1 }
+        controller: { type: boolean }
+        blockOwnerDeletion: { type: boolean }
+      additionalProperties: false
+    KubernetesImportSource:
+      type: object
+      description: Safe source identity captured from an authorized live read. No YAML, spec values, annotations or status are persisted here. For native workloads specDigest covers configuration and ownership metadata excluding status/resourceVersion. For CRs it fences the public UID, generation and owner references without hashing secret content; metadata-only edits are outside that fence. CRs without a positive generation are rejected. UID identifies recreation.
+      required: [resource, specDigest, observedAt]
+      properties:
+        resource:
+          allOf:
+            - $ref: "#/components/schemas/KubernetesResourceRef"
+            - type: object
+              required: [uid]
+              properties:
+                uid: { type: string, minLength: 1 }
+        specDigest: { type: string, pattern: '^[a-f0-9]{64}$' }
+        generation: { type: integer, format: int64, minimum: 0 }
+        crdName: { type: string, minLength: 1 }
+        plural: { type: string, minLength: 1 }
+        observedAt: { type: string, format: date-time }
+        owners:
+          type: array
+          maxItems: 32
+          items: { $ref: "#/components/schemas/KubernetesImportOwnerReference" }
+      additionalProperties: false
     KubernetesImportCandidate:
       type: object
       required: [clusterId, namespace, workloadKind, workloadName, desiredReplicas, readyReplicas, relatedResources]
       properties:
+        source: { $ref: "#/components/schemas/KubernetesImportSource" }
         clusterId:
           type: string
           minLength: 1
@@ -31445,7 +32161,7 @@ components:
           minLength: 1
         workloadKind:
           type: string
-          enum: [Deployment, StatefulSet, DaemonSet]
+          enum: [Deployment, StatefulSet, DaemonSet, Job, CronJob, CustomResource]
         workloadName:
           type: string
           minLength: 1
@@ -31484,14 +32200,21 @@ components:
       type: object
       required: [workloadKind, workloadName]
       properties:
+        expectedUid: { type: string, minLength: 1 }
+        expectedSpecDigest: { type: string, pattern: '^[a-f0-9]{64}$' }
+        crdName:
+          type: string
+          minLength: 1
+          description: Required for CustomResource. Resolve the served GVR and scope from this CRD; never infer API group or plural from Kind.
         workloadKind:
           type: string
-          enum: [Deployment, StatefulSet, DaemonSet]
+          enum: [Deployment, StatefulSet, DaemonSet, Job, CronJob, CustomResource]
         workloadName:
           type: string
           minLength: 1
       additionalProperties: false
     KubernetesServiceImportRequest:
+      description: Initial association is observe_only. A managed request is rejected until a separate UID-aware ownership handoff and release preflight are available; it must never silently enable publishing.
       type: object
       required: [clusterId, namespace, applicationKey, applicationName, environmentKey, environmentName, ownershipMode, workloads]
       properties:
@@ -31549,7 +32272,7 @@ components:
           type: string
         workloadKind:
           type: string
-          enum: [Deployment, StatefulSet, DaemonSet]
+          enum: [Deployment, StatefulSet, DaemonSet, Job, CronJob, CustomResource]
         workloadName:
           type: string
         created:
@@ -31559,11 +32282,12 @@ components:
       type: object
       required: [id, workloadKind, workloadName, created]
       properties:
+        source: { $ref: "#/components/schemas/KubernetesImportSource" }
         id:
           type: string
         workloadKind:
           type: string
-          enum: [Deployment, StatefulSet, DaemonSet]
+          enum: [Deployment, StatefulSet, DaemonSet, Job, CronJob, CustomResource]
         workloadName:
           type: string
         created:
@@ -31702,6 +32426,7 @@ components:
       type: object
       required: [id, key, name, enabled, createdAt, updatedAt]
       properties:
+        migrationPolicy: {"$ref": "#/components/schemas/TemplateMigrationPolicy"}
         revision:
           type: integer
           minimum: 1
@@ -31753,6 +32478,7 @@ components:
       type: object
       required: [key, name, enabled]
       properties:
+        migrationPolicy: {"$ref": "#/components/schemas/TemplateMigrationPolicy"}
         copiedFrom: { $ref: '#/components/schemas/TemplateCopyOrigin' }
         expectedRevision:
           type: integer
@@ -31855,9 +32581,10 @@ components:
       type: object
       required: [id, applicationId, serviceId, action]
       properties:
+        templateCandidateId: { type: string, minLength: 1, maxLength: 256 }
         id: { type: string, pattern: '^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$' }
         applicationId: { type: string, minLength: 1 }
-        serviceId: { type: string, minLength: 1 }
+        serviceId: { type: string }
         applicationEnvironmentId: { type: string, minLength: 1 }
         releaseTargetId: { type: string }
         helmRevision: { type: integer, minimum: 1, description: Existing owned Helm revision to restore through a new config_update batch. }
@@ -31878,10 +32605,25 @@ components:
           items: { type: string }
       allOf:
         - if:
-            properties:
-              action: { enum: [build_deploy, deploy, config_update] }
+            required: [templateCandidateId]
           then:
-            required: [applicationEnvironmentId]
+            properties:
+              action: { const: config_update }
+              releaseBundleId: { type: string, maxLength: 0 }
+            not:
+              anyOf:
+                - required: [helmRevision]
+                - required: [buildArgs]
+                - required: [repositoryRefs]
+          else:
+            properties:
+              serviceId: { type: string, minLength: 1 }
+            allOf:
+              - if:
+                  properties:
+                    action: { enum: [build_deploy, deploy, config_update] }
+                then:
+                  required: [applicationEnvironmentId]
         - if:
             properties:
               action: { const: deploy }
@@ -31929,6 +32671,7 @@ components:
       type: object
       additionalProperties: false
       properties:
+        migrationPolicy: { $ref: "#/components/schemas/TemplateMigrationPolicy" }
         builderKind: { type: string, minLength: 1, maxLength: 128, default: custom }
         dockerfileTemplate: { type: string, maxLength: 1048576 }
         buildCommands:
@@ -31961,6 +32704,7 @@ components:
       additionalProperties: false
       required: [source, parameterSchema, defaults, health]
       properties:
+        migrationPolicy: {"$ref": "#/components/schemas/TemplateMigrationPolicy"}
         source: { $ref: '#/components/schemas/DeploymentTemplateSource' }
         parameterSchema: { $ref: '#/components/schemas/TemplateParameterSchema' }
         defaults: { $ref: '#/components/schemas/TemplateParameterValues' }
@@ -32117,6 +32861,7 @@ components:
       additionalProperties: false
       required: [definition]
       properties:
+        migrationPolicy: { $ref: "#/components/schemas/TemplateMigrationPolicy" }
         category: { type: string, minLength: 1, maxLength: 128, not: { pattern: '^application:' }, default: release }
         definition:
           oneOf:
@@ -32837,6 +33582,7 @@ components:
       type: object
       required: [target, applicationName, serviceName, serviceVersion, configurationDigest]
       properties:
+        templateUpdate: { $ref: "#/components/schemas/TemplateUpdateReceipt" }
         target: { $ref: "#/components/schemas/DeliveryTargetInput" }
         applicationName: { type: string }
         serviceName: { type: string }
@@ -33198,6 +33944,13 @@ components:
       type: object
       required: [applicationEnvironmentId, clusterId, namespace, workloadKind, workloadName, desiredReplicas, readyReplicas, updatedReplicas, availableReplicas]
       properties:
+        targetId:
+          type: string
+        source:
+          $ref: "#/components/schemas/KubernetesImportSource"
+        sourceStatus:
+          type: string
+          enum: [linked, changed, replaced, missing, unavailable, forbidden]
         applicationEnvironmentId:
           type: string
         clusterId:
@@ -33747,11 +34500,28 @@ components:
       type: string
       enum: [preflight, apply, observe, repair, adopt, rollback, sync, rollout_control]
       x-enum-varnames: [ManifestTaskActionPreflight, ManifestTaskActionApply, ManifestTaskActionObserve, ManifestTaskActionRepair, ManifestTaskActionAdopt, ManifestTaskActionRollback, ManifestTaskActionSync, ManifestTaskActionRolloutControl]
+    ManifestRootResource:
+      type: object
+      description: Server-frozen imported namespaced CR identity and user-reviewed generation. Publication requires the original imported target with metadata ownershipMode=managed, rootCRGeneration matching the reviewed generation, and configRef selecting its Manifest binding. Only spec may be updated; missing roots are never created. Current user or token permissions, external ownership and UID are rechecked. Requires manifest.root-cr.v1 Agent capability and manifest_root_cr_v1 provider. Configuration copies, revisions, plans and deployments retain the sensitive configuration read permission; ordinary task summaries omit root documents.
+      required: [apiVersion, kind, namespace, name, uid, generation, crdName, targetId, deliveryPlanId]
+      properties:
+        targetId: { type: string, minLength: 1 }
+        deliveryPlanId: { type: string, minLength: 1 }
+        apiVersion: { type: string, minLength: 3 }
+        kind: { type: string, minLength: 1 }
+        namespace: { type: string, minLength: 1 }
+        name: { type: string, minLength: 1 }
+        uid: { type: string, minLength: 1 }
+        generation: { type: integer, format: int64, minimum: 1 }
+        crdName: { type: string, minLength: 1 }
+      additionalProperties: false
     ManifestExecutionTaskPayload:
       type: object
       description: Controller-aware tasks use providerKind manifest_agent_v3.<clusterId> and require manifest.execution.v3. Older runners must not claim these tasks or bypass GitOps and Rollout ownership.
       required: [action, packageId, generation, idempotencyKey]
       properties:
+        initializationPlanId: { type: string, minLength: 1, maxLength: 128, description: "Server-frozen initialization Plan identity. Requires manifest.initialize.v1 and its dedicated provider; preflight uses create dry-run, apply creates only, and observation verifies the created UIDs. Never a force or adoption flag." }
+        rootResource: { $ref: "#/components/schemas/ManifestRootResource" }
         rolloutControl: { $ref: "#/components/schemas/ProgressiveRolloutControlInput" }
         gitOpsDocuments:
           type: array
@@ -33814,6 +34584,7 @@ components:
       type: object
       required: [ready, capability, renderedDigest, resourceCount, diagnostics]
       properties:
+        initializationPlanId: { type: string, minLength: 1, maxLength: 128, description: "Server-frozen initialization Plan identity. Requires manifest.initialize.v1 and its dedicated provider; preflight uses create dry-run, apply creates only, and observation verifies the created UIDs. Never a force or adoption flag." }
         ready: { type: boolean }
         capability: { type: string, enum: [available, degraded, unsupported] }
         renderedDigest: { type: string }
@@ -33860,6 +34631,7 @@ components:
       type: object
       required: [action, generation, stale, diagnostics, inventory]
       properties:
+        initializationPlanId: { type: string, minLength: 1, maxLength: 128, description: "Server-frozen initialization Plan identity. Requires manifest.initialize.v1 and its dedicated provider; preflight uses create dry-run, apply creates only, and observation verifies the created UIDs. Never a force or adoption flag." }
         rollout: { $ref: "#/components/schemas/ProgressiveRolloutStatus" }
         action: { $ref: "#/components/schemas/ManifestTaskAction" }
         deploymentId: { type: string }
@@ -33972,6 +34744,7 @@ components:
       type: object
       required: [id, packageId, applicationEnvironmentId, environmentKey, clusterId, namespace, overlay, driftPolicy, deletionPolicy, enabled, version, createdAt, updatedAt]
       properties:
+        templateSelection: { $ref: "#/components/schemas/ManifestTemplateSelection" }
         templateParameters: { $ref: "#/components/schemas/TemplateParameterValues" }
         id: { type: string, minLength: 1 }
         packageId: { type: string, minLength: 1 }
@@ -34109,6 +34882,7 @@ components:
       type: object
       required: [observedGeneration, phase, conditions, inventory]
       properties:
+        appliedTemplate: {"$ref": "#/components/schemas/TemplateVersionReference"}
         observedGeneration: { type: integer, format: int64, minimum: 0 }
         appliedRevision: { type: integer, minimum: 1 }
         appliedDigest: { type: string }
@@ -34653,6 +35427,7 @@ components:
       type: object
       required: [id, source, status, applicationId, applicationEnvironmentId, action, requiresApproval, createdAt, updatedAt]
       properties:
+        templateCandidateId: { type: string, minLength: 1, maxLength: 256 }
         dockerSnapshots:
           type: array
           maxItems: 50
@@ -34751,6 +35526,8 @@ components:
       type: object
       required: [deliveryPlanId, targetId, packageId, bindingId, bindingVersion, applicationEnvironmentId, clusterId, namespace, revision, revisionDigest, packageUpdatedAt, rendererVersion, inputDigest, renderedDigest, documents, preflightTaskId, expectedGeneration]
       properties:
+        migration: {"$ref": "#/components/schemas/TemplateMigrationAssessment"}
+        rootResource: { $ref: "#/components/schemas/ManifestRootResource" }
         gitOpsDocuments:
           type: array
           minItems: 1
@@ -36979,6 +37756,10 @@ components:
       type: object
       required: [transport, syncStrategy, cacheStatus, cacheReady, connectionState]
       properties:
+        actionChecks:
+          type: array
+          maxItems: 64
+          items: { $ref: "#/components/schemas/KubernetesAgentActionCheck" }
         transport:
           type: string
         syncStrategy:
@@ -36999,6 +37780,22 @@ components:
         message:
           type: string
       additionalProperties: false
+    KubernetesAgentActionCheck:
+      type: object
+      required: [action, implementation, configured, kubernetesRBAC]
+      properties:
+        action: { type: string }
+        implementation: { type: string, enum: [supported, unsupported, unknown] }
+        configured: { type: string, enum: [allowed, denied, unknown] }
+        kubernetesRBAC: { type: string, enum: [allowed, denied, unknown, not_applicable] }
+        checkedAt: { type: string, format: date-time }
+        reasonCode: { type: string }
+        scope: { type: string, enum: [cluster], x-enum-varnames: [KubernetesAgentActionCheckScopeCluster] }
+      additionalProperties: false
+    KubernetesAgentActionProfile:
+      type: string
+      enum: [legacy, workbench, read-only]
+      description: Installation preset only. Legacy preserves existing permissions; selecting workbench or read-only requires regenerating and reviewing the installation manifest.
     KubernetesClusterConnectionDetail:
       type: object
       required: [mode, credentialType, sourceType, hasInlineKubeconfig, hasToken, usesInformerCache]
@@ -37021,6 +37818,7 @@ components:
           type: boolean
         usesInformerCache:
           type: boolean
+        actionProfile: { $ref: "#/components/schemas/KubernetesAgentActionProfile" }
         customResourceRules:
           type: array
           maxItems: 50
@@ -37062,6 +37860,7 @@ components:
         prometheusClusterLabel: { type: string }
         grafanaBaseUrl: { type: string }
         prometheusTransport: { $ref: "#/components/schemas/KubernetesPrometheusTransport" }
+        agentActionProfile: { $ref: "#/components/schemas/KubernetesAgentActionProfile" }
         agentCustomResourceRules:
           type: array
           maxItems: 50
@@ -37249,6 +38048,18 @@ components:
           type: string
         unschedulable:
           type: boolean
+        taints:
+          type: array
+          nullable: true
+          description: Current Node spec taints. Empty means none; null or absent means not reported.
+          items:
+            $ref: "#/components/schemas/KubernetesNodeTaint"
+        conditions:
+          type: array
+          nullable: true
+          description: Current Node conditions, independent of scheduling and drain operations.
+          items:
+            $ref: "#/components/schemas/KubernetesWorkloadCondition"
         roles:
           type: array
           items:
@@ -37496,6 +38307,10 @@ components:
       type: object
       required: [name, namespace, phase, readyContainers, restarts, ageSeconds]
       properties:
+        uid:
+          type: string
+          minLength: 1
+          description: Immutable Pod identity. Required by clients restoring a saved live session; absent on older providers.
         name:
           type: string
         namespace:
@@ -37655,6 +38470,10 @@ components:
       type: object
       required: [name, namespace, phase]
       properties:
+        uid:
+          type: string
+          minLength: 1
+          description: Immutable Pod identity. Required by clients restoring a saved live session; absent on older providers.
         name:
           type: string
         namespace:
@@ -39689,6 +40508,193 @@ components:
       properties:
         data: { $ref: "#/components/schemas/KubernetesNetworkPolicyDetail" }
       additionalProperties: false
+    KubernetesTopologyProvider:
+      type: string
+      enum: [kubernetes, gateway, traefik, apisix]
+      x-enum-varnames: [KubernetesTopologyProviderKubernetes, KubernetesTopologyProviderGateway, KubernetesTopologyProviderTraefik, KubernetesTopologyProviderApisix]
+    KubernetesTopologyResolution:
+      type: string
+      enum: [resolved, unresolved, not_found, not_visible, no_ready_endpoints, external, unsupported_fragment, unknown]
+      x-enum-varnames: [KubernetesTopologyResolutionResolved, KubernetesTopologyResolutionUnresolved, KubernetesTopologyResolutionNotFound, KubernetesTopologyResolutionNotVisible, KubernetesTopologyResolutionNoReadyEndpoints, KubernetesTopologyResolutionExternal, KubernetesTopologyResolutionUnsupportedFragment, KubernetesTopologyResolutionUnknown]
+    KubernetesTopologyProperty:
+      type: object
+      required: [name, value]
+      properties:
+        name: { type: string, maxLength: 64 }
+        value: { type: string, maxLength: 1024 }
+      additionalProperties: false
+    KubernetesTopologyMatch:
+      type: object
+      required: [type]
+      properties:
+        type: { type: string, maxLength: 32 }
+        name: { type: string, maxLength: 128 }
+        operator: { type: string, maxLength: 32 }
+        value: { type: string, maxLength: 1024 }
+      additionalProperties: false
+    KubernetesTopologyRule:
+      type: object
+      required: [index]
+      properties:
+        name: { type: string, maxLength: 253 }
+        index: { type: integer, minimum: 0 }
+        matchGroups:
+          description: Groups are ORed; matches inside each group are ANDed. Opaque expressions remain a bounded summary and are marked unsupported_fragment.
+          type: array
+          maxItems: 64
+          items:
+            type: array
+            maxItems: 64
+            items: { $ref: "#/components/schemas/KubernetesTopologyMatch" }
+        matchSummary: { type: string, maxLength: 2048 }
+        priority: { type: integer, format: int64 }
+        tlsMode: { type: string, maxLength: 64 }
+      additionalProperties: false
+    KubernetesTopologyCondition:
+      type: object
+      required: [type, status]
+      properties:
+        type: { type: string, maxLength: 128 }
+        status: { type: string, maxLength: 32 }
+        reason: { type: string, maxLength: 128 }
+        observedGeneration: { type: integer, format: int64 }
+        lastTransitionTime: { type: string, format: date-time }
+      additionalProperties: false
+    KubernetesTopologyGraphNode:
+      type: object
+      required: [id, type, label, provider, resolutionState]
+      properties:
+        id: { type: string, minLength: 1, maxLength: 2048 }
+        type:
+          type: string
+          enum: [entry, rule, processor, backend-group, service, endpoint-group, pod, external]
+          x-enum-varnames: [KubernetesTopologyGraphNodeTypeEntry, KubernetesTopologyGraphNodeTypeRule, KubernetesTopologyGraphNodeTypeProcessor, KubernetesTopologyGraphNodeTypeBackendGroup, KubernetesTopologyGraphNodeTypeService, KubernetesTopologyGraphNodeTypeEndpointGroup, KubernetesTopologyGraphNodeTypePod, KubernetesTopologyGraphNodeTypeExternal]
+        label: { type: string, maxLength: 1024 }
+        provider: { $ref: "#/components/schemas/KubernetesTopologyProvider" }
+        protocol: { type: string, maxLength: 16 }
+        resolutionState: { $ref: "#/components/schemas/KubernetesTopologyResolution" }
+        resource: { $ref: "#/components/schemas/KubernetesResourceRef" }
+        rule: { $ref: "#/components/schemas/KubernetesTopologyRule" }
+        generation: { type: integer, format: int64 }
+        properties:
+          type: array
+          maxItems: 64
+          items: { $ref: "#/components/schemas/KubernetesTopologyProperty" }
+        conditions:
+          type: array
+          maxItems: 64
+          items: { $ref: "#/components/schemas/KubernetesTopologyCondition" }
+      additionalProperties: false
+    KubernetesTopologyGraphEdge:
+      type: object
+      required: [id, source, target, relation, resolutionState]
+      properties:
+        id: { type: string, minLength: 1, maxLength: 2048 }
+        source: { type: string, minLength: 1, maxLength: 2048 }
+        target: { type: string, minLength: 1, maxLength: 2048 }
+        relation:
+          type: string
+          enum: [matches, processes, forwards, weights, mirrors, resolves, selects]
+          x-enum-varnames: [KubernetesTopologyGraphEdgeRelationMatches, KubernetesTopologyGraphEdgeRelationProcesses, KubernetesTopologyGraphEdgeRelationForwards, KubernetesTopologyGraphEdgeRelationWeights, KubernetesTopologyGraphEdgeRelationMirrors, KubernetesTopologyGraphEdgeRelationResolves, KubernetesTopologyGraphEdgeRelationSelects]
+        resolutionState: { $ref: "#/components/schemas/KubernetesTopologyResolution" }
+        protocol: { type: string, maxLength: 16 }
+        port: { type: string, maxLength: 64 }
+        weight: { type: integer, format: int64, minimum: 0 }
+        totalWeight: { type: integer, format: int64, minimum: 0 }
+        mirrorPercent: { type: number, minimum: 0, maximum: 100 }
+        ruleRef: { type: string, maxLength: 2048 }
+        sourceRef: { $ref: "#/components/schemas/KubernetesResourceRef" }
+        note: { type: string, maxLength: 2048 }
+      additionalProperties: false
+    KubernetesTopologyCoverage:
+      type: object
+      required: [provider, sourceId, state]
+      properties:
+        provider: { $ref: "#/components/schemas/KubernetesTopologyProvider" }
+        sourceId: { type: string, maxLength: 128 }
+        state:
+          type: string
+          enum: [available, not_installed, unsupported, denied, error, partial]
+          x-enum-varnames: [KubernetesTopologyCoverageStateAvailable, KubernetesTopologyCoverageStateNotInstalled, KubernetesTopologyCoverageStateUnsupported, KubernetesTopologyCoverageStateDenied, KubernetesTopologyCoverageStateError, KubernetesTopologyCoverageStatePartial]
+        namespace: { type: string, maxLength: 63 }
+        supportedKinds:
+          type: array
+          maxItems: 32
+          items: { type: string, maxLength: 128 }
+        reasonCode: { type: string, maxLength: 128 }
+        checkedAt: { type: string, format: date-time }
+        observedAt: { type: string, format: date-time }
+        truncated: { type: boolean }
+      additionalProperties: false
+    KubernetesTopologySourceQuery:
+      type: object
+      required: [sourceId]
+      properties:
+        sourceId:
+          type: string
+          enum: [kubernetes.services, kubernetes.pods, kubernetes.endpointslices, kubernetes.ingresses, kubernetes.ingressclasses, gateway.gateways, gateway.gatewayclasses, gateway.httproutes, gateway.grpcroutes, gateway.tcproutes, gateway.tlsroutes, gateway.udproutes, gateway.referencegrants, traefik.ingressroutes, traefik.ingressroutetcps, traefik.ingressrouteudps, traefik.traefikservices, traefik.middlewares, traefik.middlewaretcps, apisix.apisixroutes, apisix.apisixupstreams, apisix.apisixtls]
+          x-enum-varnames: [KubernetesTopologySourceKubernetesServices, KubernetesTopologySourceKubernetesPods, KubernetesTopologySourceKubernetesEndpointslices, KubernetesTopologySourceKubernetesIngresses, KubernetesTopologySourceKubernetesIngressclasses, KubernetesTopologySourceGatewayGateways, KubernetesTopologySourceGatewayGatewayclasses, KubernetesTopologySourceGatewayHttproutes, KubernetesTopologySourceGatewayGrpcroutes, KubernetesTopologySourceGatewayTcproutes, KubernetesTopologySourceGatewayTlsroutes, KubernetesTopologySourceGatewayUdproutes, KubernetesTopologySourceGatewayReferencegrants, KubernetesTopologySourceTraefikIngressroutes, KubernetesTopologySourceTraefikIngressroutetcps, KubernetesTopologySourceTraefikIngressrouteudps, KubernetesTopologySourceTraefikTraefikservices, KubernetesTopologySourceTraefikMiddlewares, KubernetesTopologySourceTraefikMiddlewaretcps, KubernetesTopologySourceApisixApisixroutes, KubernetesTopologySourceApisixApisixupstreams, KubernetesTopologySourceApisixApisixtls]
+        namespace: { type: string, maxLength: 63, pattern: '^$|^[a-z0-9]([a-z0-9-]*[a-z0-9])?$' }
+      allOf:
+        - if:
+            properties:
+              sourceId: { enum: [kubernetes.ingressclasses, gateway.gatewayclasses] }
+            required: [sourceId]
+          then:
+            properties:
+              namespace: { type: string, maxLength: 0 }
+      additionalProperties: false
+    KubernetesTopologySnapshotRequest:
+      type: object
+      required: [queries]
+      properties:
+        queries:
+          type: array
+          minItems: 1
+          maxItems: 64
+          uniqueItems: true
+          items: { $ref: "#/components/schemas/KubernetesTopologySourceQuery" }
+      additionalProperties: false
+    KubernetesTopologySourceObject:
+      type: object
+      required: [resource, content]
+      properties:
+        resource: { $ref: "#/components/schemas/KubernetesResourceRef" }
+        generation: { type: integer, format: int64 }
+        content:
+          type: string
+          maxLength: 65536
+          description: Fixed source-schema projection encoded as JSON. Unknown fields, raw annotations, Secret values, plugin configuration and credential material are removed before transport. This is not an original Kubernetes manifest.
+      additionalProperties: false
+    KubernetesTopologySourceResult:
+      type: object
+      required: [coverage, objects]
+      properties:
+        coverage: { $ref: "#/components/schemas/KubernetesTopologyCoverage" }
+        objects:
+          type: array
+          maxItems: 200
+          items: { $ref: "#/components/schemas/KubernetesTopologySourceObject" }
+      additionalProperties: false
+    KubernetesTopologySnapshot:
+      type: object
+      required: [version, sources]
+      properties:
+        version: { type: string, pattern: '^v1$' }
+        sources:
+          type: array
+          maxItems: 64
+          items: { $ref: "#/components/schemas/KubernetesTopologySourceResult" }
+      additionalProperties: false
+    ResourceMonitoringQuality: {"type":"string","enum":["valid","partial","stale","not_configured","not_collected","unsupported","denied","error","empty"],"x-enum-varnames":["ResourceMonitoringQualityValid","ResourceMonitoringQualityPartial","ResourceMonitoringQualityStale","ResourceMonitoringQualityNotConfigured","ResourceMonitoringQualityNotCollected","ResourceMonitoringQualityUnsupported","ResourceMonitoringQualityDenied","ResourceMonitoringQualityError","ResourceMonitoringQualityEmpty"]}
+    ResourceMonitoringViewName: {"type":"string","enum":["overview","cpu","memory","conntrack","pods"],"x-enum-varnames":["ResourceMonitoringViewOverview","ResourceMonitoringViewCPU","ResourceMonitoringViewMemory","ResourceMonitoringViewConntrack","ResourceMonitoringViewPods"]}
+    ResourceMonitoringQuantity: {"type":"object","additionalProperties":false,"required":["cpuCores","memoryBytes","podSlots"],"properties":{"cpuCores":{"type":"number","format":"double","nullable":true},"memoryBytes":{"type":"number","format":"double","nullable":true},"podSlots":{"type":"number","format":"double","nullable":true}}}
+    ResourceMonitoringNode: {"type":"object","additionalProperties":false,"required":["nodeRef","ready","cordoned","memoryPressure","diskPressure","pidPressure","capacity","allocatable","requests","limits","cpuLimitsComplete","memoryLimitsComplete","boundPods","pendingPods","remainingPodSlots","overflowPodSlots","quality"],"properties":{"nodeRef":{"$ref":"#/components/schemas/KubernetesResourceRef"},"internalIP":{"type":"string"},"os":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"ready":{"type":"string"},"cordoned":{"type":"boolean"},"memoryPressure":{"type":"string"},"diskPressure":{"type":"string"},"pidPressure":{"type":"string"},"capacity":{"$ref":"#/components/schemas/ResourceMonitoringQuantity"},"allocatable":{"$ref":"#/components/schemas/ResourceMonitoringQuantity"},"requests":{"$ref":"#/components/schemas/ResourceMonitoringQuantity"},"limits":{"$ref":"#/components/schemas/ResourceMonitoringQuantity"},"cpuLimitsComplete":{"type":"boolean"},"memoryLimitsComplete":{"type":"boolean"},"boundPods":{"type":"number","format":"double","nullable":true},"pendingPods":{"type":"number","format":"double","nullable":true},"remainingPodSlots":{"type":"number","format":"double","nullable":true},"overflowPodSlots":{"type":"number","format":"double","nullable":true},"quality":{"$ref":"#/components/schemas/ResourceMonitoringQuality"},"observedAt":{"type":"string","format":"date-time"}}}
+    ResourceMonitoringPoint: {"type":"object","additionalProperties":false,"required":["timestamp","value"],"properties":{"timestamp":{"type":"string","format":"date-time"},"value":{"type":"number","format":"double","nullable":true}}}
+    ResourceMonitoringSeries: {"type":"object","additionalProperties":false,"required":["nodeRef","metricKey","unit","quality","source","latest","points"],"properties":{"nodeRef":{"$ref":"#/components/schemas/KubernetesResourceRef"},"metricKey":{"type":"string","maxLength":64},"unit":{"type":"string","enum":["cores","bytes","count","events/s","events","percent"],"x-enum-varnames":["ResourceMonitoringUnitCores","ResourceMonitoringUnitBytes","ResourceMonitoringUnitCount","ResourceMonitoringUnitEventsPerSecond","ResourceMonitoringUnitEvents","ResourceMonitoringUnitPercent"]},"quality":{"$ref":"#/components/schemas/ResourceMonitoringQuality"},"reasonCode":{"type":"string","maxLength":64},"source":{"type":"string"},"sampledAt":{"type":"string","format":"date-time"},"latest":{"type":"number","format":"double","nullable":true},"points":{"type":"array","maxItems":1440,"items":{"$ref":"#/components/schemas/ResourceMonitoringPoint"}}}}
+    ResourceMonitoringPanel: {"type":"object","additionalProperties":false,"required":["key","label","unit","quality","series"],"properties":{"key":{"type":"string","maxLength":64},"label":{"type":"string"},"unit":{"type":"string"},"quality":{"$ref":"#/components/schemas/ResourceMonitoringQuality"},"reasonCode":{"type":"string","maxLength":64},"estimated":{"type":"boolean"},"windowSeconds":{"type":"integer","minimum":300,"maximum":3600},"series":{"type":"array","maxItems":500,"items":{"$ref":"#/components/schemas/ResourceMonitoringSeries"}}}}
+    ResourceMonitoringView: {"type":"object","additionalProperties":false,"required":["clusterId","view","from","to","stepSeconds","generatedAt","snapshotQuality","unscheduledPendingPods","nodes","panels"],"properties":{"clusterId":{"type":"string"},"view":{"$ref":"#/components/schemas/ResourceMonitoringViewName"},"node":{"type":"string"},"from":{"type":"string","format":"date-time"},"to":{"type":"string","format":"date-time"},"stepSeconds":{"type":"integer","minimum":15,"maximum":3600},"generatedAt":{"type":"string","format":"date-time"},"snapshotObservedAt":{"type":"string","format":"date-time"},"snapshotQuality":{"$ref":"#/components/schemas/ResourceMonitoringQuality"},"unscheduledPendingPods":{"type":"number","format":"double","nullable":true},"nodes":{"type":"array","maxItems":500,"items":{"$ref":"#/components/schemas/ResourceMonitoringNode"}},"panels":{"type":"array","maxItems":32,"items":{"$ref":"#/components/schemas/ResourceMonitoringPanel"}},"truncated":{"type":"boolean"},"nodeOptions":{"type":"array","maxItems":500,"items":{"$ref":"#/components/schemas/KubernetesResourceRef"}}}}
+    ResourceMonitoringEnvelope: {"type":"object","additionalProperties":false,"required":["data"],"properties":{"data":{"$ref":"#/components/schemas/ResourceMonitoringView"}}}
     KubernetesNetworkTopologySummary:
       type: object
       required: [entryCount, routeCount, serviceCount, missingServiceCount, backendPodCount, pendingRouteCount]
@@ -39737,6 +40743,21 @@ components:
         source: { type: string }
         generatedAt: { type: string }
         summary: { $ref: "#/components/schemas/KubernetesNetworkTopologySummary" }
+        graphVersion: { type: string, pattern: '^v1$' }
+        nodes:
+          type: array
+          maxItems: 500
+          items: { $ref: "#/components/schemas/KubernetesTopologyGraphNode" }
+        edges:
+          type: array
+          maxItems: 1000
+          items: { $ref: "#/components/schemas/KubernetesTopologyGraphEdge" }
+        coverage:
+          type: array
+          maxItems: 128
+          items: { $ref: "#/components/schemas/KubernetesTopologyCoverage" }
+        observedAt: { type: string, format: date-time }
+        truncated: { type: boolean }
         traces:
           type: array
           items: { $ref: "#/components/schemas/KubernetesNetworkTopologyTrace" }
@@ -43187,6 +44208,7 @@ components:
         namespace: { type: string, minLength: 1 }
         scopeMode: { $ref: "#/components/schemas/KubernetesResourceScopeMode" }
         uid: { type: string }
+        resourceVersion: { type: string }
       additionalProperties: false
     KubernetesResourceStreamEventType:
       type: string
@@ -49791,3 +50813,50 @@ components:
       properties:
         data: { $ref: "#/components/schemas/NetworkPolicyPreviewResult" }
       additionalProperties: false
+
+    TemplateUpdateKind:
+      {"type": "string", "enum": ["deployment", "build", "workflow", "blueprint"]}
+    TemplateUpdateMode:
+      {"type": "string", "enum": ["fixed", "manual", "automatic", "approval"]}
+    ManifestTemplateSelection:
+      {"type": "object", "properties": {"templateId": {"type": "string", "maxLength": 256}, "version": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "parameters": {"$ref": "#/components/schemas/TemplateParameterValues"}, "baseFilesDigest": {"type": "string", "maxLength": 80}, "adoptionId": {"type": "string", "maxLength": 256}}, "required": ["templateId", "version", "parameters", "baseFilesDigest", "adoptionId"], "additionalProperties": false}
+    TemplateUpdateTarget:
+      {"type": "object", "properties": {"id": {"type": "string", "maxLength": 256}, "kind": {"$ref": "#/components/schemas/TemplateUpdateKind"}, "templateId": {"type": "string", "maxLength": 256}, "applicationId": {"type": "string", "maxLength": 256}, "applicationName": {"type": "string", "maxLength": 256}, "serviceId": {"type": "string", "maxLength": 256}, "serviceName": {"type": "string", "maxLength": 256}, "applicationEnvironmentId": {"type": "string", "maxLength": 256}, "environmentName": {"type": "string", "maxLength": 256}, "releaseTargetId": {"type": "string", "maxLength": 256}, "fromVersion": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "mode": {"$ref": "#/components/schemas/TemplateUpdateMode"}, "requiresApproval": {"type": "boolean"}, "eligible": {"type": "boolean"}, "reason": {"type": "string", "maxLength": 1024}, "independentOverrides": {"type": "array", "items": {"type": "string", "maxLength": 256}, "maxItems": 100}, "bindingRevision": {"type": "string", "maxLength": 256}, "scope": {"type": "string", "enum": ["environment", "application", "creation_only"]}}, "required": ["id", "kind", "templateId", "applicationId", "applicationName", "serviceId", "serviceName", "applicationEnvironmentId", "environmentName", "releaseTargetId", "fromVersion", "mode", "requiresApproval", "eligible", "reason", "independentOverrides", "bindingRevision", "scope"], "additionalProperties": false}
+    TemplateUpdateTargetPage:
+      {"type": "object", "properties": {"items": {"type": "array", "items": {"$ref": "#/components/schemas/TemplateUpdateTarget"}, "maxItems": 100}, "total": {"type": "integer", "format": "int64", "minimum": 0, "maximum": 2147483647}, "page": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "pageSize": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 100}}, "required": ["items", "total", "page", "pageSize"], "additionalProperties": false}
+    TemplateUpdateSelection:
+      {"type": "object", "properties": {"targetId": {"type": "string", "maxLength": 256, "minLength": 1}, "parameters": {"$ref": "#/components/schemas/TemplateParameterValues"}, "useNewDefaults": {"type": "array", "items": {"type": "string", "maxLength": 256}, "maxItems": 100, "uniqueItems": true}, "wave": {"type": "integer", "format": "int64", "minimum": 0, "maximum": 199}}, "required": ["targetId"], "additionalProperties": false}
+    TemplateUpdatePreviewInput:
+      {"type": "object", "properties": {"kind": {"$ref": "#/components/schemas/TemplateUpdateKind"}, "templateId": {"type": "string", "maxLength": 256, "minLength": 1}, "toVersion": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "targets": {"type": "array", "items": {"$ref": "#/components/schemas/TemplateUpdateSelection"}, "maxItems": 100, "minItems": 1}, "applicationId": {"type": "string", "minLength": 1, "maxLength": 256}}, "required": ["kind", "templateId", "toVersion", "targets"], "additionalProperties": false}
+    TemplateUpdateChange:
+      {"type": "object", "properties": {"section": {"type": "string", "enum": ["source", "schema", "defaults", "parameters", "resources"]}, "path": {"type": "string", "maxLength": 1024}, "before": {"type": "string", "maxLength": 32768}, "after": {"type": "string", "maxLength": 32768}}, "required": ["section", "path", "before", "after"], "additionalProperties": false}
+    TemplateUpdateDiff:
+      {"type": "object", "properties": {"fromVersion": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "toVersion": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "changes": {"type": "array", "items": {"$ref": "#/components/schemas/TemplateUpdateChange"}, "maxItems": 500}, "renderStatus": {"type": "string", "enum": ["available", "unavailable", "invalid"]}, "diagnostics": {"type": "array", "items": {"type": "string", "maxLength": 2048}, "maxItems": 32}, "historyGap": {"type": "boolean"}, "migration": {"$ref": "#/components/schemas/TemplateMigrationAssessment"}}, "required": ["fromVersion", "toVersion", "changes", "renderStatus", "diagnostics", "historyGap"], "additionalProperties": false}
+    TemplateUpdateCandidate:
+      {"type": "object", "properties": {"id": {"type": "string", "maxLength": 256}, "target": {"$ref": "#/components/schemas/TemplateUpdateTarget"}, "toVersion": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "digest": {"type": "string", "maxLength": 80}, "parameters": {"$ref": "#/components/schemas/TemplateParameterValues"}, "cumulative": {"$ref": "#/components/schemas/TemplateUpdateDiff"}, "versions": {"type": "array", "items": {"$ref": "#/components/schemas/TemplateUpdateDiff"}, "maxItems": 200}, "eligible": {"type": "boolean"}, "reason": {"type": "string", "maxLength": 1024}, "requiresApproval": {"type": "boolean"}, "wave": {"type": "integer", "format": "int64", "minimum": 0, "maximum": 199}}, "required": ["id", "target", "toVersion", "digest", "parameters", "cumulative", "versions", "eligible", "reason", "requiresApproval", "wave"], "additionalProperties": false}
+    TemplateUpdatePreview:
+      {"type": "object", "properties": {"id": {"type": "string", "maxLength": 256}, "kind": {"$ref": "#/components/schemas/TemplateUpdateKind"}, "templateId": {"type": "string", "maxLength": 256}, "toVersion": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "digest": {"type": "string", "maxLength": 80}, "candidates": {"type": "array", "items": {"$ref": "#/components/schemas/TemplateUpdateCandidate"}, "maxItems": 100}, "createdAt": {"type": "string", "format": "date-time"}, "expiresAt": {"type": "string", "format": "date-time"}, "configurationOnly": {"type": "boolean", "const": true}}, "required": ["id", "kind", "templateId", "toVersion", "digest", "candidates", "createdAt", "expiresAt", "configurationOnly"], "additionalProperties": false}
+    TemplateUpdateBatchInput:
+      {"type": "object", "properties": {"previewDigest": {"type": "string", "maxLength": 80, "minLength": 1}, "candidateIds": {"type": "array", "items": {"type": "string", "maxLength": 256, "minLength": 1}, "maxItems": 100, "minItems": 1, "uniqueItems": true}, "waveSize": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 100}, "stopOnFailure": {"type": "boolean"}, "acknowledgeHistoryGaps": {"type": "boolean"}, "idempotencyKey": {"type": "string", "maxLength": 128, "minLength": 8}}, "required": ["previewDigest", "candidateIds", "waveSize", "stopOnFailure", "acknowledgeHistoryGaps", "idempotencyKey"], "additionalProperties": false}
+    TemplateUpdatePolicyInput:
+      {"type": "object", "properties": {"kind": {"$ref": "#/components/schemas/TemplateUpdateKind"}, "templateId": {"type": "string", "maxLength": 256, "minLength": 1}, "targetId": {"type": "string", "maxLength": 256, "minLength": 1}, "mode": {"$ref": "#/components/schemas/TemplateUpdateMode"}, "paused": {"type": "boolean"}, "expectedVersion": {"type": "integer", "format": "int64", "minimum": 0, "maximum": 2147483647}}, "required": ["kind", "templateId", "targetId", "mode", "paused", "expectedVersion"], "additionalProperties": false}
+    TemplateUpdatePolicy:
+      {"type": "object", "properties": {"id": {"type": "string", "maxLength": 256}, "kind": {"$ref": "#/components/schemas/TemplateUpdateKind"}, "templateId": {"type": "string", "maxLength": 256}, "targetId": {"type": "string", "maxLength": 256}, "mode": {"$ref": "#/components/schemas/TemplateUpdateMode"}, "paused": {"type": "boolean"}, "version": {"type": "integer", "format": "int64", "minimum": 1, "maximum": 2147483647}, "lastBatchId": {"type": "string", "maxLength": 256}, "lastError": {"type": "string", "maxLength": 1024}, "updatedAt": {"type": "string", "format": "date-time"}}, "required": ["id", "kind", "templateId", "targetId", "mode", "paused", "version", "lastBatchId", "lastError", "updatedAt"], "additionalProperties": false}
+    TemplateUpdateTargetPageEnvelope:
+      {"type": "object", "properties": {"data": {"$ref": "#/components/schemas/TemplateUpdateTargetPage"}}, "required": ["data"], "additionalProperties": false}
+    TemplateUpdatePreviewEnvelope:
+      {"type": "object", "properties": {"data": {"$ref": "#/components/schemas/TemplateUpdatePreview"}}, "required": ["data"], "additionalProperties": false}
+    TemplateUpdatePolicyEnvelope:
+      {"type": "object", "properties": {"data": {"$ref": "#/components/schemas/TemplateUpdatePolicy"}}, "required": ["data"], "additionalProperties": false}
+    TemplateUpdatePolicyListEnvelope:
+      {"type": "object", "properties": {"data": {"type": "array", "items": {"$ref": "#/components/schemas/TemplateUpdatePolicy"}, "maxItems": 2000}}, "required": ["data"], "additionalProperties": false}
+    TemplateUpdateReceipt:
+      {"type": "object", "required": ["kind", "templateId", "bindingId", "previewId", "candidateId", "fromVersion", "toVersion", "requiresApproval"], "properties": {"kind": {"$ref": "#/components/schemas/TemplateUpdateKind"}, "templateId": {"type": "string", "minLength": 1, "maxLength": 256}, "bindingId": {"type": "string", "minLength": 1, "maxLength": 256}, "previewId": {"type": "string", "minLength": 1, "maxLength": 256}, "candidateId": {"type": "string", "minLength": 1, "maxLength": 256}, "fromVersion": {"type": "integer", "format": "int64", "minimum": 1}, "toVersion": {"type": "integer", "format": "int64", "minimum": 1}, "requiresApproval": {"type": "boolean"}}, "additionalProperties": false}
+    TemplateMigrationPolicy:
+      {"type": "object", "additionalProperties": false, "properties": {"sequential": {"type": "boolean", "description": "Must cross this boundary as adjacent published versions; approval cannot waive it."}, "irreversible": {"type": "boolean", "description": "Forward changes require approval; ordinary rollback across this boundary is forbidden."}, "guide": {"type": "string", "maxLength": 2000, "description": "Human migration/recovery instructions. Never executed as a script."}}, "required": ["sequential", "irreversible"], "if": {"anyOf": [{"required": ["sequential"], "properties": {"sequential": {"const": true}}}, {"required": ["irreversible"], "properties": {"irreversible": {"const": true}}}]}, "then": {"required": ["guide"], "properties": {"guide": {"minLength": 1, "pattern": "\\S"}}}}
+    TemplateVersionReference:
+      {"type": "object", "additionalProperties": false, "properties": {"templateId": {"type": "string", "maxLength": 128, "minLength": 1}, "templateVersion": {"type": "integer", "format": "int64", "minimum": 1}, "templateDigest": {"type": "string", "maxLength": 80, "minLength": 1}}, "required": ["templateId", "templateVersion", "templateDigest"]}
+    TemplateMigrationStep:
+      {"type": "object", "additionalProperties": false, "properties": {"version": {"type": "integer", "format": "int64", "minimum": 1}, "contentDigest": {"type": "string", "maxLength": 80}, "policy": {"$ref": "#/components/schemas/TemplateMigrationPolicy"}}, "required": ["version", "contentDigest", "policy"]}
+    TemplateMigrationAssessment:
+      {"type": "object", "additionalProperties": false, "properties": {"initialization": {"type": "boolean", "description": "Server-classified first-deployment candidate; requires create-only preflight and explicit Plan approval. It is not a successful runtime baseline or proof that external data is empty."}, "fromVersion": {"type": "integer", "format": "int64", "minimum": 0}, "toVersion": {"type": "integer", "format": "int64", "minimum": 1}, "blocked": {"type": "boolean"}, "requiresApproval": {"type": "boolean"}, "reason": {"type": "string", "maxLength": 1024}, "steps": {"type": "array", "maxItems": 200, "items": {"$ref": "#/components/schemas/TemplateMigrationStep"}}}, "required": ["fromVersion", "toVersion", "blocked", "requiresApproval", "reason", "steps"]}