@opensoha/contracts 0.1.27 → 0.1.29

package/openapi/spec_generated.go

@@ -5,9 +5,9 @@ package openapi
 import _ "embed"
 
 const (
-	Version    = "0.1.27"
-	YAMLSHA256 = "7ec8930963123f5b79dff6dfaddf7200dd0fce51ada6212d47f415d4e7539727"
-	JSONSHA256 = "6c1d5c0d4871c5ff6ea82241a02ff8ee4147792c6026a474a9d10a3ef3ca051b"
+	Version    = "0.1.29"
+	YAMLSHA256 = "95ddf7a050831e3a9bae045952877b32f52d879a70e482c9c446a84f8cde4596"
+	JSONSHA256 = "4db09842ef24e3485e59e1d617f5027365eb7474de068425a50bf8a13222ad49"
 )
 
 //go:embed soha-api.yaml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensoha/contracts",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "private": false,
   "description": "Shared OpenSoha API, agent, MCP, skill, event, and auth contracts.",
   "license": "Apache-2.0",

package/resource/agent_profiles.go

@@ -8,22 +8,14 @@ func KubernetesAgentProfileActions(profile string) ([]string, error) {
 	switch profile {
 	case "read-only":
 		return []string{"platform.custom_resources.list"}, nil
-	case "workbench":
+	case "workbench", "legacy":
 		return append([]string(nil), kubernetesWorkbenchActions[:]...), nil
-	case "legacy":
-		actions := make([]string, 0, len(kubernetesWorkbenchActions))
-		for _, action := range kubernetesWorkbenchActions {
-			if action != "platform.helm_releases.install" && action != "platform.helm_releases.values_update" && action != "platform.helm_releases.delete" && action != "platform.helm_releases.rollback" {
-				actions = append(actions, action)
-			}
-		}
-		return actions, nil
 	default:
 		return nil, fmt.Errorf("unknown Kubernetes Agent action profile")
 	}
 }
 
-// KubernetesAgentActions lists implemented platform actions, including separately opted-in CRD deletion.
+// KubernetesAgentActions lists implemented platform actions, including separately opted-in mutations.
 func KubernetesAgentActions() []string {
 	actions := make([]string, 0, len(kubernetesWorkbenchActions))
 	for _, action := range kubernetesWorkbenchActions {
@@ -31,7 +23,13 @@ func KubernetesAgentActions() []string {
 			actions = append(actions, action)
 		}
 	}
-	return append(actions, "platform.crds.delete")
+	return append(actions,
+		"platform.helm_releases.install",
+		"platform.helm_releases.values_update",
+		"platform.helm_releases.delete",
+		"platform.helm_releases.rollback",
+		"platform.crds.delete",
+	)
 }
 
 var kubernetesWorkbenchActions = [...]string{
@@ -54,9 +52,5 @@ var kubernetesWorkbenchActions = [...]string{
 	"platform.port_forwards.create",
 	"platform.port_forwards.tunnel",
 	"platform.port_forwards.delete",
-	"platform.helm_releases.install",
-	"platform.helm_releases.values_update",
-	"platform.helm_releases.delete",
-	"platform.helm_releases.rollback",
 	"runtime.execution_tasks.cancel",
 }

package/resource/agent_profiles_test.go

@@ -10,7 +10,7 @@ func TestKubernetesAgentProfilesKeepPermissionsExplicit(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, action := range []string{"platform.nodes.drain", "platform.resources.apply", "platform.resources.create", "platform.resources.delete", "platform.helm_releases.rollback", "platform.port_forwards.tunnel"} {
+	for _, action := range []string{"platform.nodes.drain", "platform.resources.apply", "platform.resources.create", "platform.resources.delete", "platform.port_forwards.tunnel"} {
 		if !slices.Contains(workbench, action) {
 			t.Fatalf("missing workbench action %s", action)
 		}
@@ -19,8 +19,14 @@ func TestKubernetesAgentProfilesKeepPermissionsExplicit(t *testing.T) {
 		t.Fatal("workbench must not opt into unrestricted or CRD deletion actions")
 	}
 	legacy, _ := KubernetesAgentProfileActions("legacy")
-	if slices.Contains(legacy, "platform.helm_releases.install") {
-		t.Fatal("legacy installation permissions expanded")
+	if !slices.Equal(workbench, legacy) {
+		t.Fatal("legacy action set changed")
+	}
+	implemented := KubernetesAgentActions()
+	for _, action := range []string{"platform.helm_releases.install", "platform.helm_releases.values_update", "platform.helm_releases.delete", "platform.helm_releases.rollback"} {
+		if slices.Contains(workbench, action) || !slices.Contains(implemented, action) {
+			t.Fatalf("Helm mutation %s must require explicit opt-in", action)
+		}
 	}
 	readOnly, _ := KubernetesAgentProfileActions("read-only")
 	if !slices.Equal(readOnly, []string{"platform.custom_resources.list"}) {

package/resource/custom_graph_page.go

@@ -0,0 +1,18 @@
+package resource
+
+import "encoding/json"
+
+// CustomResourceGraphObjectPath is relative to the authenticated Agent platform API.
+const CustomResourceGraphObjectPath = "/extensions/custom-resources/graph-object"
+
+type CustomResourceGraphObjectRequest struct {
+	Definition CRDResourceDefinition `json:"definition"`
+	Namespace  string                `json:"namespace"`
+	Name       string                `json:"name"`
+}
+
+// CustomResourceGraphPage contains only observed GVK and relationship metadata.
+type CustomResourceGraphPage struct {
+	Items     []json.RawMessage `json:"items"`
+	Truncated bool              `json:"truncated"`
+}

package/resource/models.go

@@ -54,10 +54,17 @@ type ResourceGraphNode struct {
 }
 
 type ResourceGraphEdge struct {
-	ID       string `json:"id"`
-	SourceID string `json:"sourceId"`
-	TargetID string `json:"targetId"`
-	Relation string `json:"relation"`
+	ID              string       `json:"id"`
+	SourceID        string       `json:"sourceId"`
+	TargetID        string       `json:"targetId"`
+	Relation        string       `json:"relation"`
+	ResolutionState string       `json:"resolutionState,omitempty"`
+	Protocol        string       `json:"protocol,omitempty"`
+	Port            string       `json:"port,omitempty"`
+	SectionName     string       `json:"sectionName,omitempty"`
+	FieldPath       string       `json:"fieldPath,omitempty"`
+	Note            string       `json:"note,omitempty"`
+	SourceRef       *ResourceRef `json:"sourceRef,omitempty"`
 }
 
 type ResourceEvidence struct {
@@ -104,23 +111,34 @@ type NamespaceUpsertInput struct {
 }
 
 type PodView struct {
-	UID                    string               `json:"uid,omitempty"`
-	Name                   string               `json:"name"`
-	Namespace              string               `json:"namespace"`
-	Phase                  string               `json:"phase"`
-	NodeName               string               `json:"nodeName,omitempty"`
-	PodIP                  string               `json:"podIp,omitempty"`
-	CreatedAt              string               `json:"createdAt,omitempty"`
-	CPU                    string               `json:"cpu,omitempty"`
-	Memory                 string               `json:"memory,omitempty"`
-	Requests               ResourceQuantityView `json:"requests,omitempty"`
-	Limits                 ResourceQuantityView `json:"limits,omitempty"`
-	Labels                 map[string]string    `json:"labels,omitempty"`
-	PersistentVolumeClaims []string             `json:"persistentVolumeClaims,omitempty"`
-	ReadyContainers        string               `json:"readyContainers"`
-	Restarts               int32                `json:"restarts"`
-	AgeSeconds             int64                `json:"ageSeconds"`
-	AllowedActions         []string             `json:"allowedActions,omitempty"`
+	UID                    string                   `json:"uid,omitempty"`
+	Name                   string                   `json:"name"`
+	Namespace              string                   `json:"namespace"`
+	Phase                  string                   `json:"phase"`
+	NodeName               string                   `json:"nodeName,omitempty"`
+	PodIP                  string                   `json:"podIp,omitempty"`
+	CreatedAt              string                   `json:"createdAt,omitempty"`
+	CPU                    string                   `json:"cpu,omitempty"`
+	Memory                 string                   `json:"memory,omitempty"`
+	Requests               ResourceQuantityView     `json:"requests,omitempty"`
+	Limits                 ResourceQuantityView     `json:"limits,omitempty"`
+	Labels                 map[string]string        `json:"labels,omitempty"`
+	PersistentVolumeClaims []string                 `json:"persistentVolumeClaims,omitempty"`
+	ReadyContainers        string                   `json:"readyContainers"`
+	QOSClass               string                   `json:"qosClass,omitempty"`
+	ContainerStatuses      []PodContainerStatusView `json:"containerStatuses,omitempty"`
+	Restarts               int32                    `json:"restarts"`
+	AgeSeconds             int64                    `json:"ageSeconds"`
+	AllowedActions         []string                 `json:"allowedActions,omitempty"`
+}
+
+type PodContainerStatusView struct {
+	Name     string `json:"name"`
+	Kind     string `json:"kind"`
+	Ready    bool   `json:"ready"`
+	State    string `json:"state"`
+	Reason   string `json:"reason,omitempty"`
+	ExitCode *int32 `json:"exitCode,omitempty"`
 }
 
 type WorkloadOverviewNamespaceView struct {
@@ -340,10 +358,11 @@ type ResourceYAMLView struct {
 }
 
 type ResourceUpdatePlanRequest struct {
-	Namespace string `json:"namespace,omitempty"`
-	Kind      string `json:"kind"`
-	Name      string `json:"name"`
-	Content   string `json:"content"`
+	Namespace               string `json:"namespace,omitempty"`
+	Kind                    string `json:"kind"`
+	Name                    string `json:"name"`
+	Content                 string `json:"content"`
+	RequireObservedIdentity bool   `json:"requireObservedIdentity,omitempty"`
 }
 
 type ManagedFieldOwner struct {
@@ -434,6 +453,7 @@ type SubjectAccessReviewResult struct {
 type DeploymentView struct {
 	Name            string            `json:"name"`
 	Namespace       string            `json:"namespace"`
+	UID             string            `json:"uid,omitempty"`
 	Labels          map[string]string `json:"labels,omitempty"`
 	DesiredReplicas int32             `json:"desiredReplicas"`
 	ReadyReplicas   int32             `json:"readyReplicas"`
@@ -446,6 +466,7 @@ type DeploymentView struct {
 type DeploymentDetailView struct {
 	Name               string                  `json:"name"`
 	Namespace          string                  `json:"namespace"`
+	UID                string                  `json:"uid,omitempty"`
 	DesiredReplicas    int32                   `json:"desiredReplicas"`
 	ReadyReplicas      int32                   `json:"readyReplicas"`
 	UpdatedReplicas    int32                   `json:"updatedReplicas"`
@@ -464,13 +485,15 @@ type DeploymentDetailView struct {
 }
 
 type RolloutHistoryView struct {
-	Name          string   `json:"name"`
-	Namespace     string   `json:"namespace"`
-	Revision      string   `json:"revision"`
-	Images        []string `json:"images,omitempty"`
-	Replicas      int32    `json:"replicas"`
-	ReadyReplicas int32    `json:"readyReplicas"`
-	CreatedAt     string   `json:"createdAt,omitempty"`
+	Name                   string   `json:"name"`
+	Namespace              string   `json:"namespace"`
+	Revision               string   `json:"revision"`
+	Images                 []string `json:"images,omitempty"`
+	Replicas               int32    `json:"replicas"`
+	ReadyReplicas          int32    `json:"readyReplicas"`
+	CreatedAt              string   `json:"createdAt,omitempty"`
+	PodRevisionHash        string   `json:"podRevisionHash,omitempty"`
+	MatchesCurrentTemplate *bool    `json:"matchesCurrentTemplate,omitempty"`
 }
 
 type DeploymentRolloutStatusView struct {
@@ -556,34 +579,45 @@ type DaemonSetDetailView struct {
 }
 
 type JobView struct {
-	Name           string   `json:"name"`
-	Namespace      string   `json:"namespace"`
-	Completions    int32    `json:"completions"`
-	Succeeded      int32    `json:"succeeded"`
-	Failed         int32    `json:"failed"`
-	Active         int32    `json:"active"`
-	CompletionMode string   `json:"completionMode,omitempty"`
-	AgeSeconds     int64    `json:"ageSeconds"`
-	AllowedActions []string `json:"allowedActions,omitempty"`
+	Name             string                  `json:"name"`
+	Namespace        string                  `json:"namespace"`
+	Completions      int32                   `json:"completions"`
+	Succeeded        int32                   `json:"succeeded"`
+	Failed           int32                   `json:"failed"`
+	Active           int32                   `json:"active"`
+	CompletionMode   string                  `json:"completionMode,omitempty"`
+	AgeSeconds       int64                   `json:"ageSeconds"`
+	AllowedActions   []string                `json:"allowedActions,omitempty"`
+	CompletionTarget *int32                  `json:"completionTarget,omitempty"`
+	Suspend          *bool                   `json:"suspend,omitempty"`
+	Conditions       []WorkloadConditionView `json:"conditions,omitempty"`
+	StartTime        string                  `json:"startTime,omitempty"`
+	CompletionTime   string                  `json:"completionTime,omitempty"`
 }
 
 type JobDetailView struct {
-	Name             string                 `json:"name"`
-	Namespace        string                 `json:"namespace"`
-	Completions      int32                  `json:"completions"`
-	Parallelism      int32                  `json:"parallelism"`
-	Succeeded        int32                  `json:"succeeded"`
-	Failed           int32                  `json:"failed"`
-	Active           int32                  `json:"active"`
-	CompletionMode   string                 `json:"completionMode,omitempty"`
-	CreatedAt        string                 `json:"createdAt,omitempty"`
-	StartTime        string                 `json:"startTime,omitempty"`
-	CompletionTime   string                 `json:"completionTime,omitempty"`
-	Labels           map[string]string      `json:"labels,omitempty"`
-	Annotations      map[string]string      `json:"annotations,omitempty"`
-	Pods             []PodView              `json:"pods,omitempty"`
-	RelatedResources []WorkloadRelationView `json:"relatedResources,omitempty"`
-	AllowedActions   []string               `json:"allowedActions,omitempty"`
+	Name                    string                  `json:"name"`
+	Namespace               string                  `json:"namespace"`
+	Completions             int32                   `json:"completions"`
+	Parallelism             int32                   `json:"parallelism"`
+	Succeeded               int32                   `json:"succeeded"`
+	Failed                  int32                   `json:"failed"`
+	Active                  int32                   `json:"active"`
+	CompletionMode          string                  `json:"completionMode,omitempty"`
+	CreatedAt               string                  `json:"createdAt,omitempty"`
+	StartTime               string                  `json:"startTime,omitempty"`
+	CompletionTime          string                  `json:"completionTime,omitempty"`
+	Labels                  map[string]string       `json:"labels,omitempty"`
+	Annotations             map[string]string       `json:"annotations,omitempty"`
+	Pods                    []PodView               `json:"pods,omitempty"`
+	RelatedResources        []WorkloadRelationView  `json:"relatedResources,omitempty"`
+	AllowedActions          []string                `json:"allowedActions,omitempty"`
+	CompletionTarget        *int32                  `json:"completionTarget,omitempty"`
+	Suspend                 *bool                   `json:"suspend,omitempty"`
+	Conditions              []WorkloadConditionView `json:"conditions,omitempty"`
+	BackoffLimit            *int32                  `json:"backoffLimit,omitempty"`
+	ActiveDeadlineSeconds   *int64                  `json:"activeDeadlineSeconds,omitempty"`
+	TTLSecondsAfterFinished *int32                  `json:"ttlSecondsAfterFinished,omitempty"`
 }
 
 type CronJobView struct {
@@ -916,6 +950,7 @@ type NetworkTopologyView struct {
 }
 
 type NodeView struct {
+	Labels         map[string]string       `json:"labels,omitempty"`
 	Name           string                  `json:"name"`
 	Status         string                  `json:"status"`
 	Unschedulable  bool                    `json:"unschedulable"`
@@ -1379,6 +1414,16 @@ type SecretView struct {
 	AllowedActions []string `json:"allowedActions,omitempty"`
 }
 
+// SecretCertificateView contains public facts only; it cannot carry Secret data or PEM.
+type SecretCertificateView struct {
+	Name       string `json:"name"`
+	Namespace  string `json:"namespace"`
+	Status     string `json:"status"`
+	NotBefore  string `json:"notBefore,omitempty"`
+	NotAfter   string `json:"notAfter,omitempty"`
+	SelfSigned *bool  `json:"selfSigned,omitempty"`
+}
+
 type SecretDetailView struct {
 	Name        string            `json:"name"`
 	Namespace   string            `json:"namespace"`

package/resource/network_topology.go

@@ -1,6 +1,7 @@
 package resource
 
 const (
+	NetworkTopologyNamedRootFeature = "network.topology.named-root.v1"
 	NetworkTopologySnapshotFeature  = "network.topology.snapshot.v1"
 	NetworkTopologyGatewayL4Feature = "network.topology.gateway-l4.v1"
 	NetworkTopologyMaxQueries       = 64
@@ -36,6 +37,8 @@ type NetworkTopologyGraphEdge struct {
 	ResolutionState string       `json:"resolutionState"`
 	Protocol        string       `json:"protocol,omitempty"`
 	Port            string       `json:"port,omitempty"`
+	SectionName     string       `json:"sectionName,omitempty"`
+	FieldPath       string       `json:"fieldPath,omitempty"`
 	Weight          *int64       `json:"weight,omitempty"`
 	TotalWeight     *int64       `json:"totalWeight,omitempty"`
 	MirrorPercent   *float64     `json:"mirrorPercent,omitempty"`
@@ -74,6 +77,7 @@ type NetworkTopologyCondition struct {
 }
 
 type NetworkTopologyCoverage struct {
+	Name           string   `json:"name,omitempty"`
 	Provider       string   `json:"provider"`
 	SourceID       string   `json:"sourceId"`
 	State          string   `json:"state"`
@@ -87,6 +91,7 @@ type NetworkTopologyCoverage struct {
 
 // Snapshot queries name a fixed source, never a caller-supplied GVR or field path.
 type NetworkTopologySourceQuery struct {
+	Name      string `json:"name,omitempty"`
 	SourceID  string `json:"sourceId"`
 	Namespace string `json:"namespace,omitempty"`
 }
@@ -120,6 +125,10 @@ type NetworkTopologySourceDefinition struct {
 }
 
 var networkTopologySources = [...]NetworkTopologySourceDefinition{
+	{ID: "kubernetes.networkpolicies", Provider: "kubernetes", CRDResourceDefinition: CRDResourceDefinition{Kind: "NetworkPolicy", Group: "networking.k8s.io", Version: "v1", Resource: "networkpolicies", Namespaced: true}},
+	{ID: "kubernetes.namespaces", Provider: "kubernetes", CRDResourceDefinition: CRDResourceDefinition{Kind: "Namespace", Version: "v1", Resource: "namespaces"}},
+	{ID: "kubernetes.configmaps", Provider: "kubernetes", CRDResourceDefinition: CRDResourceDefinition{Kind: "ConfigMap", Version: "v1", Resource: "configmaps", Namespaced: true}},
+	{ID: "gateway.backendtlspolicies", Provider: "gateway", FallbackVersion: "v1alpha3", CRDResourceDefinition: CRDResourceDefinition{Kind: "BackendTLSPolicy", Group: "gateway.networking.k8s.io", Version: "v1", Resource: "backendtlspolicies", Namespaced: true}},
 	{ID: "kubernetes.services", Provider: "kubernetes", CRDResourceDefinition: CRDResourceDefinition{Kind: "Service", Version: "v1", Resource: "services", Namespaced: true}},
 	{ID: "kubernetes.pods", Provider: "kubernetes", CRDResourceDefinition: CRDResourceDefinition{Kind: "Pod", Version: "v1", Resource: "pods", Namespaced: true}},
 	{ID: "kubernetes.endpointslices", Provider: "kubernetes", CRDResourceDefinition: CRDResourceDefinition{Kind: "EndpointSlice", Group: "discovery.k8s.io", Version: "v1", Resource: "endpointslices", Namespaced: true}},
@@ -164,3 +173,16 @@ func LookupNetworkTopologySource(id string) (NetworkTopologySourceDefinition, bo
 	}
 	return NetworkTopologySourceDefinition{}, false
 }
+
+// NetworkTopologySourceVersions is the explicit served-version allowlist. Legacy
+// BackendTLSPolicy v1alpha2 uses targetRef rather than targetRefs.
+func NetworkTopologySourceVersions(d NetworkTopologySourceDefinition) []string {
+	versions := []string{d.Version}
+	if d.FallbackVersion != "" {
+		versions = append(versions, d.FallbackVersion)
+	}
+	if d.ID == "gateway.backendtlspolicies" {
+		versions = append(versions, "v1alpha2")
+	}
+	return versions
+}

package/resource/network_topology_projection.go

@@ -124,28 +124,32 @@ func redactTopologyMatches(value any, key string) {
 }
 
 var topologyProjectionPaths = map[string][]string{
-	"kubernetes.services":       strings.Fields("spec.type spec.externalName spec.clusterIP spec.selector.* spec.ports.name spec.ports.port spec.ports.targetPort spec.ports.protocol spec.publishNotReadyAddresses"),
-	"kubernetes.pods":           strings.Fields("metadata.labels.* status.phase status.conditions.type status.conditions.status"),
-	"kubernetes.endpointslices": strings.Fields("metadata.labels.* addressType ports.name ports.port ports.protocol endpoints.addresses endpoints.conditions.ready endpoints.conditions.serving endpoints.conditions.terminating endpoints.targetRef.kind endpoints.targetRef.namespace endpoints.targetRef.name endpoints.targetRef.uid"),
-	"kubernetes.ingresses":      strings.Fields("spec.ingressClassName spec.defaultBackend.service.name spec.defaultBackend.service.port.name spec.defaultBackend.service.port.number spec.defaultBackend.resource.kind spec.rules.host spec.rules.http.paths.path spec.rules.http.paths.pathType spec.rules.http.paths.backend.service.name spec.rules.http.paths.backend.service.port.name spec.rules.http.paths.backend.service.port.number spec.rules.http.paths.backend.resource.kind spec.tls.hosts"),
-	"kubernetes.ingressclasses": strings.Fields("spec.controller"),
-	"gateway.gateways":          strings.Fields("spec.gatewayClassName spec.listeners.name spec.listeners.port spec.listeners.protocol spec.listeners.hostname spec.listeners.allowedRoutes.namespaces.from spec.listeners.allowedRoutes.namespaces.selector.matchLabels.* spec.listeners.allowedRoutes.kinds.kind spec.listeners.allowedRoutes.kinds.group spec.listeners.tls.mode"),
-	"gateway.gatewayclasses":    strings.Fields("spec.controllerName"),
-	"gateway.httproutes":        gatewayTopologyPaths(),
-	"gateway.grpcroutes":        gatewayTopologyPaths(),
-	"gateway.tcproutes":         gatewayL4TopologyPaths(),
-	"gateway.tlsroutes":         gatewayL4TopologyPaths(),
-	"gateway.udproutes":         gatewayL4TopologyPaths(),
-	"gateway.referencegrants":   strings.Fields("spec.from.group spec.from.kind spec.from.namespace spec.to.group spec.to.kind spec.to.name"),
-	"traefik.ingressroutes":     traefikTopologyPaths(),
-	"traefik.ingressroutetcps":  traefikTopologyPaths(),
-	"traefik.ingressrouteudps":  traefikTopologyPaths(),
-	"traefik.traefikservices":   strings.Fields("spec.weighted.services.name spec.weighted.services.namespace spec.weighted.services.kind spec.weighted.services.port spec.weighted.services.weight spec.mirroring.name spec.mirroring.namespace spec.mirroring.kind spec.mirroring.port spec.mirroring.mirrors.name spec.mirroring.mirrors.namespace spec.mirroring.mirrors.kind spec.mirroring.mirrors.port spec.mirroring.mirrors.percent"),
-	"traefik.middlewares":       strings.Fields("spec.chain.middlewares.name spec.chain.middlewares.namespace"),
-	"traefik.middlewaretcps":    strings.Fields("spec.chain.middlewares.name spec.chain.middlewares.namespace"),
-	"apisix.apisixroutes":       apisixTopologyPaths(),
-	"apisix.apisixupstreams":    strings.Fields("spec.scheme spec.loadbalancer.type spec.externalNodes.type spec.externalNodes.name spec.externalNodes.port spec.externalNodes.weight spec.subsets.name spec.subsets.labels.*"),
-	"apisix.apisixtls":          strings.Fields("spec.hosts spec.secret.name spec.secret.namespace"),
+	"kubernetes.namespaces":      strings.Fields("metadata.labels.*"),
+	"kubernetes.configmaps":      {},
+	"kubernetes.networkpolicies": networkPolicyTopologyPaths(),
+	"gateway.backendtlspolicies": strings.Fields("spec.targetRefs.group spec.targetRefs.kind spec.targetRefs.name spec.targetRefs.sectionName spec.targetRef.group spec.targetRef.kind spec.targetRef.name spec.targetRef.sectionName spec.validation.caCertificateRefs.group spec.validation.caCertificateRefs.kind spec.validation.caCertificateRefs.name"),
+	"kubernetes.services":        strings.Fields("spec.type spec.externalName spec.clusterIP spec.selector.* spec.ports.name spec.ports.port spec.ports.targetPort spec.ports.protocol spec.publishNotReadyAddresses"),
+	"kubernetes.pods":            strings.Fields("metadata.labels.* status.phase status.conditions.type status.conditions.status"),
+	"kubernetes.endpointslices":  strings.Fields("metadata.labels.* addressType ports.name ports.port ports.protocol endpoints.addresses endpoints.conditions.ready endpoints.conditions.serving endpoints.conditions.terminating endpoints.targetRef.apiVersion endpoints.targetRef.kind endpoints.targetRef.namespace endpoints.targetRef.name endpoints.targetRef.uid"),
+	"kubernetes.ingresses":       strings.Fields("spec.ingressClassName spec.defaultBackend.service.name spec.defaultBackend.service.port.name spec.defaultBackend.service.port.number spec.defaultBackend.resource.kind spec.rules.host spec.rules.http.paths.path spec.rules.http.paths.pathType spec.rules.http.paths.backend.service.name spec.rules.http.paths.backend.service.port.name spec.rules.http.paths.backend.service.port.number spec.rules.http.paths.backend.resource.kind spec.tls.hosts spec.tls.secretName"),
+	"kubernetes.ingressclasses":  strings.Fields("spec.controller spec.parameters.apiGroup spec.parameters.kind spec.parameters.name spec.parameters.namespace spec.parameters.scope"),
+	"gateway.gateways":           strings.Fields("spec.gatewayClassName spec.listeners.name spec.listeners.port spec.listeners.protocol spec.listeners.hostname spec.listeners.allowedRoutes.namespaces.from spec.listeners.allowedRoutes.namespaces.selector.matchLabels.* spec.listeners.allowedRoutes.kinds.kind spec.listeners.allowedRoutes.kinds.group spec.listeners.tls.mode spec.listeners.tls.certificateRefs.group spec.listeners.tls.certificateRefs.kind spec.listeners.tls.certificateRefs.name spec.listeners.tls.certificateRefs.namespace spec.listeners.allowedRoutes.namespaces.selector.matchExpressions.key spec.listeners.allowedRoutes.namespaces.selector.matchExpressions.operator spec.listeners.allowedRoutes.namespaces.selector.matchExpressions.values"),
+	"gateway.gatewayclasses":     strings.Fields("spec.controllerName spec.parametersRef.group spec.parametersRef.kind spec.parametersRef.name spec.parametersRef.namespace"),
+	"gateway.httproutes":         gatewayTopologyPaths(),
+	"gateway.grpcroutes":         gatewayTopologyPaths(),
+	"gateway.tcproutes":          gatewayL4TopologyPaths(),
+	"gateway.tlsroutes":          gatewayL4TopologyPaths(),
+	"gateway.udproutes":          gatewayL4TopologyPaths(),
+	"gateway.referencegrants":    strings.Fields("spec.from.group spec.from.kind spec.from.namespace spec.to.group spec.to.kind spec.to.name"),
+	"traefik.ingressroutes":      traefikTopologyPaths(),
+	"traefik.ingressroutetcps":   traefikTopologyPaths(),
+	"traefik.ingressrouteudps":   traefikTopologyPaths(),
+	"traefik.traefikservices":    strings.Fields("spec.weighted.services.name spec.weighted.services.namespace spec.weighted.services.kind spec.weighted.services.port spec.weighted.services.weight spec.mirroring.name spec.mirroring.namespace spec.mirroring.kind spec.mirroring.port spec.mirroring.mirrors.name spec.mirroring.mirrors.namespace spec.mirroring.mirrors.kind spec.mirroring.mirrors.port spec.mirroring.mirrors.percent"),
+	"traefik.middlewares":        strings.Fields("spec.chain.middlewares.name spec.chain.middlewares.namespace"),
+	"traefik.middlewaretcps":     strings.Fields("spec.chain.middlewares.name spec.chain.middlewares.namespace"),
+	"apisix.apisixroutes":        apisixTopologyPaths(),
+	"apisix.apisixupstreams":     strings.Fields("spec.scheme spec.loadbalancer.type spec.externalNodes.type spec.externalNodes.name spec.externalNodes.port spec.externalNodes.weight spec.subsets.name spec.subsets.labels.*"),
+	"apisix.apisixtls":           strings.Fields("spec.hosts spec.secret.name spec.secret.namespace"),
 }
 
 func gatewayTopologyPaths() []string {
@@ -206,3 +210,13 @@ func topologyMiddlewareTypes(input map[string]any) []string {
 	sort.Strings(result)
 	return result
 }
+
+func networkPolicyTopologyPaths() []string {
+	paths := strings.Fields("spec.podSelector.matchLabels.* spec.podSelector.matchExpressions.key spec.podSelector.matchExpressions.operator spec.podSelector.matchExpressions.values spec.policyTypes")
+	for _, direction := range []string{"ingress.from", "egress.to"} {
+		for _, field := range strings.Fields("podSelector.matchLabels.* podSelector.matchExpressions.key podSelector.matchExpressions.operator podSelector.matchExpressions.values namespaceSelector.matchLabels.* namespaceSelector.matchExpressions.key namespaceSelector.matchExpressions.operator namespaceSelector.matchExpressions.values ipBlock.cidr ipBlock.except") {
+			paths = append(paths, "spec."+direction+"."+field)
+		}
+	}
+	return paths
+}

package/resource/network_topology_projection_test.go

@@ -11,6 +11,10 @@ func TestTopologyProjectionExcludesCredentialsAndPreservesAlternatives(t *testin
 		source, input string
 		keep          []string
 	}{
+		{"kubernetes.configmaps", `{"metadata":{"name":"ca","uid":"ca-uid","annotations":{"key":"secret-value"}},"data":{"ca.crt":"secret-value"},"binaryData":{"key":"secret-value"}}`, []string{"ca-uid"}},
+		{"kubernetes.namespaces", `{"metadata":{"name":"team","labels":{"access":"permitted"},"annotations":{"token":"secret-value"}}}`, []string{"permitted"}},
+		{"kubernetes.networkpolicies", `{"spec":{"podSelector":{"matchLabels":{"app":"web"}},"ingress":[{"from":[{"namespaceSelector":{"matchLabels":{"role":"client"}},"podSelector":{"matchExpressions":[{"key":"tier","operator":"In","values":["frontend"]}]}},{"ipBlock":{"cidr":"10.0.0.0/8","except":["10.1.0.0/16"]}}]}]},"data":"secret-value"}`, []string{"frontend", "10.1.0.0/16"}},
+		{"gateway.backendtlspolicies", `{"spec":{"targetRefs":[{"group":"","kind":"Service","name":"web","sectionName":"https"}],"targetRef":{"kind":"Service","name":"legacy"},"validation":{"caCertificateRefs":[{"kind":"ConfigMap","name":"ca"}],"privateKey":"secret-value"}}}`, []string{"https", "legacy", "ca"}},
 		{"kubernetes.pods", `{"metadata":{"name":"p","namespace":"n","annotations":{"token":"secret-value"},"labels":{"app":"web"}},"spec":{"containers":[{"env":[{"value":"secret-value"}]}]},"status":{"phase":"Running"}}`, []string{"Running", "web"}},
 		{"gateway.httproutes", `{"metadata":{"name":"r"},"spec":{"rules":[{"matches":[{"method":"GET","headers":[{"name":"Authorization","value":"secret-value"}],"queryParams":[{"name":"token","value":"secret-value"}]}],"backendRefs":[{"name":"web","weight":0,"port":80}]}]}}`, []string{"GET", "[redacted]", "\"weight\":0"}},
 		{"gateway.tcproutes", `{"spec":{"parentRefs":[{"name":"gw","sectionName":"tcp","port":9000}],"rules":[{"backendRefs":[{"name":"web","port":9000,"weight":0}],"filters":[{"secret":"secret-value"}]}]}}`, []string{"tcp", "9000", "\"weight\":0"}},

package/resource/network_topology_test.go

@@ -49,3 +49,23 @@ func TestTopologySourcesKeepSupportedVersionsAndDedicatedKindsExplicit(t *testin
 		t.Fatal("source allowlist is mutable by callers")
 	}
 }
+
+func TestNetworkTopologyNamedQueriesRejectUnsafeIdentity(t *testing.T) {
+	for _, query := range []NetworkTopologySourceQuery{
+		{SourceID: "kubernetes.services", Namespace: "team", Name: "../secret"},
+		{SourceID: "traefik.ingressroutes", Namespace: "team", Name: "route"},
+		{SourceID: "gateway.tcproutes", Namespace: "team", Name: "route"},
+		{SourceID: "kubernetes.services", Name: "service"},
+		{SourceID: "kubernetes.services", Namespace: "team", Name: "service/name"},
+		{SourceID: "kubernetes.services", Namespace: "team", Name: "service?watch=true"},
+		{SourceID: "kubernetes.ingressclasses", Namespace: "team", Name: "class"},
+	} {
+		if err := ValidateNetworkTopologySnapshotRequest(NetworkTopologySnapshotRequest{Queries: []NetworkTopologySourceQuery{query}}); err == nil {
+			t.Fatalf("unsafe named query accepted: %+v", query)
+		}
+	}
+	valid := NetworkTopologySnapshotRequest{Queries: []NetworkTopologySourceQuery{{SourceID: "kubernetes.services", Namespace: "team", Name: "service"}, {SourceID: "kubernetes.services", Namespace: "team"}}}
+	if err := ValidateNetworkTopologySnapshotRequest(valid); err != nil {
+		t.Fatalf("named and list queries must coexist: %v", err)
+	}
+}

package/resource/network_topology_validation.go

@@ -6,6 +6,8 @@ import (
 	"regexp"
 )
 
+var topologyNamePattern = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
+
 var topologyNamespacePattern = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]*[a-z0-9])?$`)
 
 func ValidateNetworkTopologySnapshotRequest(request NetworkTopologySnapshotRequest) error {
@@ -19,6 +21,9 @@ func ValidateNetworkTopologySnapshotRequest(request NetworkTopologySnapshotReque
 			return fmt.Errorf("unknown or duplicate topology source query")
 		}
 		seen[query] = true
+		if query.Name != "" && (definition.RequiresCustomResourceAccess() || len(query.Name) > 253 || !topologyNamePattern.MatchString(query.Name) || definition.Namespaced && query.Namespace == "") {
+			return fmt.Errorf("invalid named topology query")
+		}
 		if query.Namespace != "" && (!definition.Namespaced || len(query.Namespace) > 63 || !topologyNamespacePattern.MatchString(query.Namespace)) {
 			return fmt.Errorf("invalid topology source namespace")
 		}

package/resource/observed_workload.go

@@ -0,0 +1,18 @@
+package resource
+
+import "regexp"
+
+var workloadUIDPattern = regexp.MustCompile(`^[A-Za-z0-9._-]{1,128}$`)
+
+// ValidWorkloadUID validates an observed Kubernetes UID at the API boundary.
+func ValidWorkloadUID(uid string) bool {
+	return workloadUIDPattern.MatchString(uid)
+}
+
+// ObservedWorkloadDeleteRequest is the Agent request for UID-guarded workload deletion.
+type ObservedWorkloadDeleteRequest struct {
+	Namespace   string `json:"namespace"`
+	Kind        string `json:"kind"`
+	Name        string `json:"name"`
+	ExpectedUID string `json:"expectedUid"`
+}

package/resource/pod_status_test.go

@@ -0,0 +1,22 @@
+package resource
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestPodContainerStatusKeepsSuccessfulExitAndOldPayloads(t *testing.T) {
+	exitCode := int32(0)
+	encoded, err := json.Marshal(PodView{ContainerStatuses: []PodContainerStatusView{{Name: "migrate", Kind: "init", State: "terminated", ExitCode: &exitCode}}})
+	if err != nil || !strings.Contains(string(encoded), `"exitCode":0`) {
+		t.Fatalf("successful termination was lost: %s, %v", encoded, err)
+	}
+	var old PodView
+	if err := json.Unmarshal([]byte(`{"name":"api","namespace":"apps","phase":"Running","readyContainers":"1/1","restarts":0,"ageSeconds":1}`), &old); err != nil {
+		t.Fatal(err)
+	}
+	if old.QOSClass != "" || len(old.ContainerStatuses) != 0 {
+		t.Fatal("old payload must not invent QoS or container states")
+	}
+}

package/resource/rbac_graph.go

@@ -0,0 +1,4 @@
+package resource
+
+// RBACResourceGraphFeature identifies Agent support for the RBAC graph roots.
+const RBACResourceGraphFeature = "resource.graph.rbac.v1"

package/resource/rollout_optional_test.go

@@ -0,0 +1,33 @@
+package resource
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestRolloutTemplateMatchDistinguishesUnknownFromMismatch(t *testing.T) {
+	var legacy RolloutHistoryView
+	if err := json.Unmarshal([]byte(`{"name":"revision-a","namespace":"team","revision":"1","replicas":0,"readyReplicas":0}`), &legacy); err != nil {
+		t.Fatal(err)
+	}
+	if legacy.MatchesCurrentTemplate != nil || legacy.PodRevisionHash != "" {
+		t.Fatal("legacy history must not invent template match or Pod hash")
+	}
+	mismatch := false
+	legacy.MatchesCurrentTemplate = &mismatch
+	legacy.PodRevisionHash = "observed-hash"
+	data, err := json.Marshal(legacy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var wire map[string]any
+	if err := json.Unmarshal(data, &wire); err != nil {
+		t.Fatal(err)
+	}
+	if value, ok := wire["matchesCurrentTemplate"]; !ok || value != false {
+		t.Fatal("confirmed mismatch must survive JSON encoding")
+	}
+	if wire["podRevisionHash"] != "observed-hash" {
+		t.Fatal("observed hash must survive JSON encoding")
+	}
+}