@skyhook-io/k8s-ui 1.16.2 → 1.17.0

package/src/components/resources/resource-utils.ts

@@ -1,7 +1,8 @@
 // Utility functions for resource display in tables
 
+import { getNodeLifecycle } from '../../utils/node-lifecycle'
 import { effectivePolicyTypeNames } from '../../utils/network-policy'
-import { formatCPUString, formatMemoryString, formatBytes } from '../../utils/format'
+import { formatCPUString, formatMemoryString, formatBytes, formatCompactAge } from '../../utils/format'
 import { pluralize } from '../../utils/pluralize'
 import type { WorkloadPodInfo } from '../../types/core'
 import { getArgoRolloutStepNumber, getObservedGeneration, getWorkloadRolloutActivity, isArgoRolloutResource, isRolloutActivityVisible, rolloutActivityBadge, type WorkloadRolloutActivity } from '../../utils/workload-rollout'
@@ -1329,25 +1330,8 @@ export function getHPAMetrics(hpa: any): { cpu?: number; memory?: number; custom
 // ============================================================================
 
 export function getNodeStatus(node: any): StatusBadge {
-  const conditions = node.status?.conditions || []
-  const readyCondition = conditions.find((c: any) => c.type === 'Ready')
-
-  const isReady = readyCondition?.status === 'True'
-  const isUnschedulable = node.spec?.unschedulable === true
-
-  if (isReady && isUnschedulable) {
-    // Cordon is intentional but consequential — it's lost scheduling capacity, and
-    // a forgotten cordon strands nodes — so it stays on the warning axis (matching
-    // the backend Cordoned issue), unlike no-op intentional states (suspended/idle).
-    return { text: 'Ready,SchedulingDisabled', color: healthColors.degraded, level: 'degraded' }
-  }
-  if (isReady) {
-    return { text: 'Ready', color: healthColors.healthy, level: 'healthy' }
-  }
-  if (readyCondition?.status === 'False') {
-    return { text: 'NotReady', color: healthColors.unhealthy, level: 'unhealthy' }
-  }
-  return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  const lifecycle = getNodeLifecycle(node)
+  return { text: lifecycle.label, color: healthColors[lifecycle.level], level: lifecycle.level }
 }
 
 export function getNodeRoles(node: any): string {
@@ -1375,27 +1359,32 @@ export interface NodeCondition {
   message?: string
 }
 
-// Problem conditions that indicate node issues
-const NODE_PROBLEM_CONDITIONS = ['DiskPressure', 'MemoryPressure', 'PIDPressure', 'NetworkUnavailable']
-
-export function getNodeConditions(node: any): { problems: string[]; healthy: boolean } {
+export function getNodeConditions(node: any): { problems: string[]; healthy: boolean; readinessLabel: string } {
   const conditions = node.status?.conditions || []
   const problems: string[] = []
+  const lifecycle = getNodeLifecycle(node)
 
   for (const cond of conditions) {
     // Ready=False is a problem
-    if (cond.type === 'Ready' && cond.status !== 'True') {
+    if (cond.type === 'Ready' && lifecycle.readinessFailed) {
       problems.push('NotReady')
     }
     // Other conditions are problems when True
-    if (NODE_PROBLEM_CONDITIONS.includes(cond.type) && cond.status === 'True') {
+    if (lifecycle.problems.includes(cond.type) && cond.status === 'True') {
       // Format: "DiskPressure" -> "Disk Pressure"
       const formatted = cond.type.replace(/([A-Z])/g, ' $1').trim()
       problems.push(formatted)
     }
   }
 
-  return { problems, healthy: problems.length === 0 }
+  if (lifecycle.delayed) problems.push('Removal delayed')
+  const ready = conditions.find((cond: any) => cond.type === 'Ready')
+  const readinessLabel = lifecycle.removing && !lifecycle.readinessFailed && ready?.status === 'False'
+    ? 'Not ready (expected during removal)'
+    : lifecycle.removing && !lifecycle.readinessFailed && ready?.status === 'Unknown'
+      ? 'Readiness unknown during removal'
+      : 'Readiness unknown'
+  return { problems, healthy: problems.length === 0 && ready?.status === 'True', readinessLabel }
 }
 
 export function getNodeTaints(node: any): { count: number; text: string } {
@@ -1414,11 +1403,7 @@ export function getNodeVersion(node: any): string {
 // ============================================================================
 
 export function formatAge(timestamp: string): string {
-  if (!timestamp) return '-'
-  const created = new Date(timestamp)
-  const now = new Date()
-  const diffMs = now.getTime() - created.getTime()
-  return formatDuration(diffMs)
+  return formatCompactAge(timestamp) || '-'
 }
 
 export function formatDuration(ms: number, detailed: boolean = false): string {
@@ -2691,7 +2676,6 @@ export {
   getScaledObjectTriggers,
   getScaledObjectTriggerCount,
   getScaledObjectHpaName,
-  getScaledObjectLastActiveTime,
   getScaledObjectPollingInterval,
   getScaledObjectCooldownPeriod,
   getScaledJobStatus,

package/src/components/resources/status-overclaim.test.ts

@@ -141,7 +141,7 @@ describe('getCNPGObjectStoreStatus', () => {
     // Every timestamp on a RecoveryWindow is optional, so the server can be
     // listed while holding nothing restorable.
     expect(getCNPGObjectStoreStatus({ status: { serverRecoveryWindow: { pg: {} } } }))
-      .toMatchObject({ text: 'No recovery point', level: 'unknown' })
+      .toMatchObject({ text: 'Recovery point not reported', level: 'unknown' })
   })
 
   it('reports recoverable once a real point exists', () => {

package/src/components/shared/DrainPlanDialog.tsx

@@ -18,6 +18,7 @@ export interface DrainPlanPod {
   emptyDir: boolean
   pdb?: string
   pdbChecked: boolean
+  terminating?: boolean
 }
 
 export interface DrainPlan {

package/src/components/shared/GitOpsWriteWarning.test.tsx

@@ -0,0 +1,86 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it } from 'vitest'
+
+import { evaluateGitOpsWriteGuard, type GitOpsWriteGuardInput } from '../../utils/gitops-write-guard'
+import { GitOpsWriteWarning } from './GitOpsWriteWarning'
+
+const base: GitOpsWriteGuardInput = {
+  target: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' },
+  owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+  writes: [{ scope: 'spec', paths: ['spec.replicas'] }],
+  evidence: {
+    uid: 'u',
+    resourceVersion: '1',
+    owner: null,
+    policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null },
+    paths: [{ path: 'spec.replicas', lastApplied: 'present', ownedBy: [], ownedByGitOps: false }],
+  },
+}
+
+function render(input: GitOpsWriteGuardInput, onOpenOwner?: () => void) {
+  return renderToStaticMarkup(
+    <GitOpsWriteWarning
+      guard={evaluateGitOpsWriteGuard(input)}
+      acknowledged={false}
+      onAcknowledgedChange={() => {}}
+      onOpenOwner={onOpenOwner}
+    />,
+  )
+}
+
+describe('GitOpsWriteWarning', () => {
+  it('renders the revert warning, owner link and required acknowledgment', () => {
+    const html = render(base, () => {})
+    expect(html).toContain('Argo CD Application argocd/api will revert this change.')
+    expect(html).toContain('overwritten at the next sync')
+    expect(html).toContain('change it in the GitOps source')
+    expect(html).toContain('View Argo CD Application')
+    expect(html).toContain('type="checkbox"')
+    expect(html).toContain('I understand Argo CD will revert this.')
+  })
+
+  it('asks the acknowledgment in the verdict’s own terms', () => {
+    const html = render({
+      ...base,
+      evidence: { ...base.evidence!, policy: { tool: 'argocd', auto: false, selfHeal: false, prune: false, suspended: null } },
+    })
+    expect(html).toContain('Argo CD Application argocd/api may revert this change.')
+    expect(html).toContain('I understand Argo CD may revert this.')
+  })
+
+  it('shows a checking state while ownership resolves', () => {
+    const html = render({ ...base, ownerPending: true })
+    expect(html).toContain('Checking GitOps ownership…')
+    expect(html).not.toContain('type="checkbox"')
+  })
+
+  it('renders a quiet note without acknowledgment at info level', () => {
+    const html = render({ ...base, writes: [{ scope: 'create-child' }] })
+    expect(html).toContain('Managed by Argo CD Application argocd/api.')
+    expect(html).not.toContain('type="checkbox"')
+  })
+
+  it('leaves vertical spacing to the parent', () => {
+    for (const input of [base, { ...base, ownerPending: true }, { ...base, writes: [{ scope: 'create-child' as const }] }]) {
+      const root = render(input).match(/^<div class="([^"]*)"/)?.[1] ?? ''
+      expect(root).not.toMatch(/(^|\s)m[bt]-/)
+    }
+  })
+
+  it('renders nothing when unmanaged', () => {
+    expect(render({ ...base, owner: null })).toBe('')
+  })
+
+  it('lists per-write reasons when they differ', () => {
+    const html = render({
+      ...base,
+      writes: [
+        { scope: 'spec', paths: ['spec.replicas'], description: 'Replicas' },
+        { scope: 'delete', description: 'Delete' },
+      ],
+      evidence: { ...base.evidence!, policy: { tool: 'argocd', auto: false, selfHeal: false, prune: false, suspended: null } },
+    })
+    expect(html).toContain('Replicas:')
+    expect(html).toContain('Delete:')
+  })
+})

package/src/components/shared/GitOpsWriteWarning.tsx

@@ -0,0 +1,135 @@
+import { ExternalLink, GitBranch, Info, Loader2 } from 'lucide-react'
+import { clsx } from 'clsx'
+
+import { AlertBanner } from '../ui/drawer-components'
+import {
+  canConfirmGitOpsWrite,
+  gitOpsWriteHeadline,
+  guardToolLabel,
+  type GitOpsWriteAssessment,
+  type GitOpsWriteGuard,
+} from '../../utils/gitops-write-guard'
+
+export { canConfirmGitOpsWrite }
+
+export interface GitOpsWriteWarningProps {
+  guard: GitOpsWriteGuard
+  acknowledged: boolean
+  onAcknowledgedChange: (acknowledged: boolean) => void
+  /** Opens the GitOps owner (or Helm release) the guard names. */
+  onOpenOwner?: () => void
+  disabled?: boolean
+  className?: string
+}
+
+const OWNER_LINK_LABEL = {
+  applications: 'View Argo CD Application',
+  kustomizations: 'View Flux Kustomization',
+  helmreleases: 'View Flux HelmRelease',
+} as const
+
+function reasonLines(perWrite: GitOpsWriteAssessment[], levels: GitOpsWriteGuard['level'][]): string[] {
+  const relevant = perWrite.filter((entry) => levels.includes(entry.level) && entry.reason)
+  const distinct = new Set(relevant.map((entry) => entry.reason))
+  if (distinct.size <= 1) return [...distinct]
+  return relevant.map((entry) =>
+    entry.write.description ? `${entry.write.description}: ${entry.reason}` : entry.reason,
+  )
+}
+
+export function GitOpsWriteWarning({
+  guard,
+  acknowledged,
+  onAcknowledgedChange,
+  onOpenOwner,
+  disabled = false,
+  // Not undefined: AlertBanner would add its own mb-4, and a margin utility
+  // overrides the parent's space-y gap.
+  className = '',
+}: GitOpsWriteWarningProps) {
+  if (guard.pending) {
+    return (
+      <div
+        className={clsx(
+          'flex items-center gap-2 rounded-lg border border-theme-border bg-theme-base px-3 py-2 text-xs text-theme-text-secondary',
+          className,
+        )}
+      >
+        <Loader2 className="h-3.5 w-3.5 animate-spin" />
+        Checking GitOps ownership…
+      </div>
+    )
+  }
+  if (guard.level === 'none') return null
+
+  const headline = gitOpsWriteHeadline(guard)
+  const ownerLink = onOpenOwner ? (
+    <button
+      type="button"
+      onClick={onOpenOwner}
+      className="inline-flex items-center gap-1 text-xs font-medium text-skyhook-600 hover:underline dark:text-skyhook-400"
+    >
+      {guard.owner ? OWNER_LINK_LABEL[guard.owner.kind] : 'View Helm release'}
+      <ExternalLink className="h-3 w-3" />
+    </button>
+  ) : null
+
+  if (guard.level === 'info') {
+    const lines = reasonLines(guard.perWrite, ['info'])
+    return (
+      <div
+        className={clsx(
+          'flex items-start gap-2 rounded-lg border border-theme-border bg-theme-base px-3 py-2 text-xs text-theme-text-secondary',
+          className,
+        )}
+      >
+        <Info className="mt-0.5 h-3.5 w-3.5 shrink-0 text-theme-text-tertiary" />
+        <div className="min-w-0 space-y-1">
+          <p>
+            <span className="font-medium text-theme-text-primary">{headline}</span> {lines.join(' ')}
+          </p>
+          {ownerLink}
+        </div>
+      </div>
+    )
+  }
+
+  const tool = guardToolLabel(guard)
+  const lines = reasonLines(guard.perWrite, ['will-revert', 'may-revert'])
+  const durableFix = guard.owner
+    ? 'For a lasting change, change it in the GitOps source.'
+    : guard.helmRelease
+      ? 'For a lasting change, change the release’s chart values.'
+      : null
+  return (
+    <AlertBanner
+      variant="warning"
+      icon={GitBranch}
+      title={headline}
+      className={className}
+      message={
+        lines.length === 1 ? (
+          <>
+            {lines[0]}
+            {durableFix ? ` ${durableFix}` : ''}
+          </>
+        ) : durableFix ?? undefined
+      }
+      items={lines.length > 1 ? lines : undefined}
+    >
+      {ownerLink && <div className="mt-2">{ownerLink}</div>}
+      <label className="mt-2 flex cursor-pointer items-start gap-2 text-xs text-theme-text-primary">
+        <input
+          type="checkbox"
+          checked={acknowledged}
+          onChange={(event) => onAcknowledgedChange(event.target.checked)}
+          disabled={disabled}
+          className="mt-0.5 h-3.5 w-3.5 accent-skyhook-500"
+        />
+        <span>
+          I understand {tool} {guard.level === 'will-revert' ? 'will' : 'may'} revert this.
+        </span>
+      </label>
+    </AlertBanner>
+  )
+}

package/src/components/shared/ResourceActionsBar.tsx

@@ -1,3 +1,4 @@
+import { getNodeLifecycle } from '../../utils/node-lifecycle'
 import { useEffect, useState, useRef, useId } from 'react'
 import {
   RefreshCw,
@@ -28,11 +29,12 @@ import type { SelectedResource, WorkloadRevision } from '../../types'
 import type { RadarUpgradeRequirement } from '../../types/fetch-error'
 import { displayKindName } from '../ui/drawer-components'
 import { getDefaultContainerName } from '../resources/resource-utils'
-import { SetImageDialog, type ManagedImageSource } from './SetImageDialog'
+import { SetImageDialog, type SetImageOwnership } from './SetImageDialog'
 import { DrainPlanDialog, DEFAULT_DRAIN_DIALOG_OPTIONS, type DrainDialogOptions, type DrainPlan } from './DrainPlanDialog'
 import type { WorkloadImageInventory, WorkloadImageUpdate } from '../../types/core'
 import { isArgoRolloutResource } from '../../utils/workload-rollout'
 import { isCoreBatchJob } from '../../utils/api-resources'
+import { formatRelativeAgeTime } from '../../utils/format'
 
 // ============================================================================
 // ACTIONS BAR - Interactive buttons that change based on resource kind
@@ -86,7 +88,7 @@ interface ResourceActionsBarProps {
   onLoadImages?: (params: { kind: string; namespace: string; name: string }) => Promise<WorkloadImageInventory>
   onSetImages?: (params: { kind: string; namespace: string; name: string; updates: WorkloadImageUpdate[] }) => Promise<unknown>
   isSettingImages?: boolean
-  managedImageSources?: ManagedImageSource[]
+  imageOwnership?: SetImageOwnership
 
   // Rollback
   revisions?: WorkloadRevision[]
@@ -161,7 +163,7 @@ export function ResourceActionsBar({
   renderPortForward,
   onDelete, isDeleting, cascadeDependents, cascadeLoading, cascadeRootResolved,
   onRestart, isRestarting,
-  onLoadImages, onSetImages, isSettingImages, managedImageSources,
+  onLoadImages, onSetImages, isSettingImages, imageOwnership,
   revisions: revisionsList, revisionsLoading, revisionsError, onRollback, isRollingBack,
   onRolloutPromoteFull,
   onTriggerCronJob, isTriggeringCronJob,
@@ -358,7 +360,7 @@ export function ResourceActionsBar({
             </button>
           )}
 
-          {canNodeWrite && (
+          {canNodeWrite && !getNodeLifecycle(data).removing && (
             <>
               {data?.spec?.unschedulable ? (
                 onUncordonNode && (
@@ -660,7 +662,7 @@ export function ResourceActionsBar({
         </div>
       )}
 
-      {onDelete && (
+      {onDelete && !((kind === 'node' || kind === 'nodes') && data?.metadata?.deletionTimestamp) && (
         <Tooltip content="Delete resource">
           <button
             onClick={() => setShowDeleteConfirm(true)}
@@ -690,7 +692,7 @@ export function ResourceActionsBar({
           workloadLabel={`${displayKindName(resource.kind, data?.kind)} ${resource.namespace}/${resource.name}`}
           workloadName={resource.name}
           workloadResource={resource.kind}
-          managedSources={managedImageSources}
+          ownership={imageOwnership}
           pending={isSettingImages}
           onClose={() => setShowSetImage(false)}
           onLoad={() => onLoadImages({ kind: resource.kind, namespace: resource.namespace, name: resource.name })}
@@ -1127,19 +1129,6 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
     setPromoteError(outcome.error ?? { message: 'The promotion did not go through.', controllerLagging: false })
   }
 
-  function formatTimeAgo(dateStr: string): string {
-    const date = new Date(dateStr)
-    const now = new Date()
-    const seconds = Math.floor((now.getTime() - date.getTime()) / 1000)
-    if (seconds < 60) return `${seconds}s ago`
-    const minutes = Math.floor(seconds / 60)
-    if (minutes < 60) return `${minutes}m ago`
-    const hours = Math.floor(minutes / 60)
-    if (hours < 24) return `${hours}h ago`
-    const days = Math.floor(hours / 24)
-    return `${days}d ago`
-  }
-
   function getImageTag(image: string): string {
     if (!image) return '-'
     const parts = image.split(':')
@@ -1231,7 +1220,7 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
                       <RevisionImage image={rev.image} displayImage={getImageTag(rev.image)} />
                     </td>
                     <td className="py-2 pr-3 text-theme-text-secondary whitespace-nowrap">
-                      {formatTimeAgo(rev.createdAt)}
+                      {formatRelativeAgeTime(rev.createdAt)}
                     </td>
                     <td className="py-2 text-right">
                       <div className="flex items-center gap-1 justify-end">

package/src/components/shared/ResourceRendererDispatch.tsx

@@ -978,7 +978,7 @@ export function ResourceRendererDispatch({
         {kind === 'authorizationpolicies' && <IstioAuthorizationPolicyRenderer data={data} />}
         {kind === 'mutatingwebhookconfigurations' && <WebhookConfigRenderer data={data} isMutating />}
         {kind === 'validatingwebhookconfigurations' && <WebhookConfigRenderer data={data} />}
-        {kind === 'ingressclasses' && <IngressClassRenderer data={data} />}
+        {kind === 'ingressclasses' && <IngressClassRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'priorityclasses' && <PriorityClassRenderer data={data} />}
         {kind === 'runtimeclasses' && <RuntimeClassRenderer data={data} />}
         {kind === 'leases' && <LeaseRenderer data={data} />}

package/src/components/shared/SetImageDialog.test.ts

@@ -1,11 +1,14 @@
 import { describe, expect, it } from 'vitest'
 
 import type { WorkloadContainerImage } from '../../types/core'
+import { canConfirmGitOpsWrite, evaluateGitOpsWriteGuard, gitOpsWriteGuardKey } from '../../utils/gitops-write-guard'
 import {
+  SET_IMAGE_WRITES,
   canSubmitImageUpdates,
   changedImageUpdates,
   describeImageUpdateBehavior,
   reconcileRefreshedImageDrafts,
+  setImageWrites,
 } from './SetImageDialog'
 
 const containers: WorkloadContainerImage[] = [
@@ -104,26 +107,92 @@ describe('reconcileRefreshedImageDrafts', () => {
 })
 
 describe('canSubmitImageUpdates', () => {
+  const target = { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' }
+  const managedGuard = evaluateGitOpsWriteGuard({
+    target,
+    owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+    writes: SET_IMAGE_WRITES,
+  })
+  const unmanagedGuard = evaluateGitOpsWriteGuard({ target, owner: null, writes: SET_IMAGE_WRITES })
+  const pendingGuard = evaluateGitOpsWriteGuard({ target, owner: null, ownerPending: true, writes: SET_IMAGE_WRITES })
   const ready = {
     updateCount: 1,
     hasEmptyImage: false,
-    managed: false,
-    ownershipResolved: true,
-    acknowledged: false,
+    ownershipConfirmable: canConfirmGitOpsWrite(unmanagedGuard, false),
     busy: false,
   }
 
   it('requires break-glass acknowledgement for managed resources', () => {
-    expect(canSubmitImageUpdates({ ...ready, managed: true })).toBe(false)
+    expect(managedGuard.requiresAck).toBe(true)
+    expect(
+      canSubmitImageUpdates({ ...ready, ownershipConfirmable: canConfirmGitOpsWrite(managedGuard, false) }),
+    ).toBe(false)
     expect(
-      canSubmitImageUpdates({ ...ready, managed: true, acknowledged: true }),
+      canSubmitImageUpdates({ ...ready, ownershipConfirmable: canConfirmGitOpsWrite(managedGuard, true) }),
     ).toBe(true)
   })
 
+  it('gates until ownership resolves', () => {
+    expect(canConfirmGitOpsWrite(undefined, true)).toBe(false)
+    expect(canConfirmGitOpsWrite(pendingGuard, true)).toBe(false)
+    expect(canSubmitImageUpdates(ready)).toBe(true)
+  })
+
   it('blocks empty images and concurrent submissions', () => {
     expect(canSubmitImageUpdates({ ...ready, hasEmptyImage: true })).toBe(false)
     expect(canSubmitImageUpdates({ ...ready, busy: true })).toBe(false)
     expect(canSubmitImageUpdates({ ...ready, loadFailed: true })).toBe(false)
-    expect(canSubmitImageUpdates({ ...ready, ownershipResolved: false })).toBe(false)
+    expect(canSubmitImageUpdates({ ...ready, ownershipConfirmable: false })).toBe(false)
+  })
+})
+
+describe('setImageWrites', () => {
+  it('names each container, so the verdict is for exactly the images being changed', () => {
+    expect(setImageWrites(containers).map((w) => w.paths)).toEqual([
+      ['spec.template.spec.containers[name=app].image'],
+      ['spec.template.spec.containers[name=sidecar].image'],
+      ['spec.template.spec.initContainers[name=migrate].image'],
+    ])
+  })
+
+  it("asks again when the evidence doesn't cover a changed container", () => {
+    // Evidence read before the dialog listed the init container covers only
+    // the app image, which the owner ignores.
+    const guard = evaluateGitOpsWriteGuard({
+      target: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' },
+      owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+      writes: setImageWrites([{ type: 'initContainer', name: 'migrate' }]),
+      evidence: {
+        uid: 'u',
+        resourceVersion: '1',
+        owner: null,
+        policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null, respectIgnoreDifferences: true },
+        paths: [{ path: 'spec.template.spec.containers[name=app].image', lastApplied: 'present', ownedBy: [], ownedByGitOps: false, ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }],
+      },
+    })
+    expect(guard.level).toBe('may-revert')
+    expect(canConfirmGitOpsWrite(guard, false)).toBe(false)
+  })
+})
+
+describe('acknowledgment scope', () => {
+  it("an acknowledgment for one container's image doesn't cover another's with the same verdict", () => {
+    const guardFor = (name: string) =>
+      evaluateGitOpsWriteGuard({
+        target: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' },
+        owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+        writes: setImageWrites([{ type: 'container', name }]),
+        evidence: {
+          uid: 'u',
+          resourceVersion: '1',
+          owner: null,
+          policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null },
+          paths: ['app', 'sidecar'].map((n) => ({ path: `spec.template.spec.containers[name=${n}].image`, lastApplied: 'present' as const, ownedBy: [], ownedByGitOps: false })),
+        },
+      })
+    const sidecar = guardFor('sidecar')
+    const app = guardFor('app')
+    expect(app.level).toBe(sidecar.level)
+    expect(gitOpsWriteGuardKey(app)).not.toBe(gitOpsWriteGuardKey(sidecar))
   })
 })