@skyhook-io/k8s-ui 1.16.2 → 1.17.0

package/src/types/core.ts

@@ -167,6 +167,9 @@ export interface FeatureCapabilities {
   podEnvironment?: boolean
   policyResource?: boolean
   workloadHistory?: boolean
+  serviceEndpointSlices?: boolean
+  trafficRecords?: boolean
+  gitopsWriteEvidence?: boolean
 }
 
 // DeploymentMode is the closed set of topologies Radar can run in.
@@ -653,6 +656,8 @@ export interface Relationships {
   consumers?: ResourceRef[]
   scalers?: ResourceRef[]
   storageRefs?: ResourceRef[]
+  dependencies?: ResourceRef[]
+  dependents?: ResourceRef[]
   scaleTarget?: ResourceRef
   pdbs?: ResourceRef[]              // PodDisruptionBudgets protecting this workload
   networkPolicies?: ResourceRef[]   // NetworkPolicy / CiliumNetworkPolicy / ClusterNetworkPolicy variants selecting this workload
@@ -817,6 +822,7 @@ export interface HelmRevision {
   appVersion: string
   description: string
   updated: string // ISO date string
+  deleted?: string
 }
 
 export type HelmOperationKind = 'release_failed' | 'upgrade_failed' | 'upgrade_rolled_back' | 'rollback' | 'pending'
@@ -1284,10 +1290,12 @@ export interface MetricsDataPoint {
 export interface TrafficEndpoint {
   name: string
   namespace: string
-  kind: string // Pod, Service, External, Host, Unknown
+  kind: string // Pod, Workload, Service, External, Host, Unknown
   ip?: string
   labels?: Record<string, string>
   workload?: string
+  /** Deployment, StatefulSet, CronJob, … when resolved from the pod's owners. */
+  workloadKind?: string
   port?: number
 }
 
@@ -1453,6 +1461,12 @@ export interface TrafficFlowsResponse {
    *  nodeFlowLimit, so older traffic in the window did not fit. */
   coveredSince?: string
   nodeFlowLimit?: number
+  /** Set when the source kept only its newest flowLimit flows in total; the
+   *  window is then complete only from coveredSince. */
+  flowLimit?: number
+  /** How many records the aggregation covers. `flows` holds only the newest of
+   *  them; a Radar that predates the cap omits this and sends every record. */
+  flowsTotal?: number
   warning?: string  // Non-fatal warning (e.g., query errors)
   /** 'transient' (or absent) means the condition may clear on its own and a
    *  retry is worthwhile. 'partial' means the flows are correct but some of
@@ -1463,6 +1477,23 @@ export interface TrafficFlowsResponse {
   warningKind?: 'transient' | 'partial' | 'incomplete'
 }
 
+// Response from GET /api/traffic/flows/records — the newest records behind
+// one graph selection.
+export interface TrafficRecordsResponse {
+  source: string
+  timestamp: string
+  /** Newest first, at most the server's records limit. */
+  flows: TrafficFlow[]
+  /** How many records matched; more than flows.length when capped. */
+  matched: number
+  l7ResponsesCallerOriented?: boolean
+  coveredSince?: string
+  nodeFlowLimit?: number
+  flowLimit?: number
+  warning?: string
+  warningKind?: 'transient' | 'partial' | 'incomplete'
+}
+
 // Wizard state for traffic setup
 export type TrafficWizardState = 'detecting' | 'not_found' | 'wizard' | 'checking' | 'ready'
 

package/src/utils/format.test.ts

@@ -1,5 +1,5 @@
-import { describe, expect, it } from 'vitest'
-import { formatCPUString, formatMemoryString, parseMemoryToBytes, parseQuantityToNumber } from './format'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatCompactAge, formatCPUString, formatMemoryString, formatRelativeAgeTime, parseMemoryToBytes, parseQuantityToNumber } from './format'
 
 describe('formatCPUString', () => {
   it('renders exact zero as zero, not a fabricated near-zero', () => {
@@ -115,3 +115,41 @@ describe('parseQuantityToNumber', () => {
     expect(parseQuantityToNumber(Number.POSITIVE_INFINITY)).toBe(0)
   })
 })
+
+describe('relative ages', () => {
+  const now = Date.parse('2026-10-11T12:00:00Z')
+  const ago = (ms: number) => new Date(now - ms).toISOString()
+  const MIN = 60_000
+  const DAY = 24 * 60 * MIN
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(now)
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('counts days past a month instead of rounding to months or years', () => {
+    expect(formatCompactAge(ago(212 * DAY))).toBe('212d')
+    expect(formatCompactAge(ago(364 * DAY))).toBe('364d')
+    expect(formatRelativeAgeTime(ago(364 * DAY))).toBe('364d ago')
+  })
+
+  it('says just now for the current moment and for small clock skew', () => {
+    expect(formatRelativeAgeTime(ago(0))).toBe('just now')
+    expect(formatRelativeAgeTime(ago(-30_000))).toBe('just now')
+    expect(formatRelativeAgeTime(ago(5 * MIN))).toBe('5m ago')
+  })
+
+  it('shows a real future time as a date, not a negative age', () => {
+    const future = ago(-2 * 60 * MIN)
+    expect(formatRelativeAgeTime(future)).toBe(new Date(future).toLocaleString())
+  })
+
+  it('keeps missing and unparseable input visible', () => {
+    expect(formatRelativeAgeTime(undefined)).toBe('-')
+    expect(formatRelativeAgeTime('', '')).toBe('')
+    expect(formatRelativeAgeTime('not a time')).toBe('not a time')
+  })
+})

package/src/utils/format.ts

@@ -308,12 +308,16 @@ export function formatUpdatedAgo(elapsedMs: number): string {
   return `${bucket} ago`
 }
 
+// Timestamps written moments ago (a lease renewal, a sync) can land slightly in
+// the browser's future when its clock trails the cluster's.
+const CLOCK_SKEW_TOLERANCE_MS = 60_000
+
 export function formatRelativeAgeTime(value?: string, fallback = '-'): string {
   if (!value) return fallback
   const time = Date.parse(value)
   if (!Number.isFinite(time)) return value
   const diff = Date.now() - time
-  if (diff < 0) return new Date(time).toLocaleString()
+  if (diff < 0) return diff > -CLOCK_SKEW_TOLERANCE_MS ? 'just now' : new Date(time).toLocaleString()
   const compact = formatCompactAge(value)
   if (!compact) return fallback
   return compact === '0s' ? 'just now' : `${compact} ago`

package/src/utils/gateway-references.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { gatewayBackendResourceRef, gatewayParentResourceRef } from './gateway-references'
+
+describe('Gateway API references', () => {
+  it('applies the distinct backend and parent defaults', () => {
+    expect(gatewayBackendResourceRef({ name: 'api' }, 'app')).toEqual({ kind: 'Service', group: '', namespace: 'app', name: 'api' })
+    expect(gatewayParentResourceRef({ name: 'edge' }, 'app')).toEqual({ kind: 'Gateway', group: 'gateway.networking.k8s.io', namespace: 'app', name: 'edge' })
+  })
+
+  it('preserves custom kinds, exact groups and explicit namespaces', () => {
+    expect(gatewayBackendResourceRef({ name: 'api', kind: 'Widget', group: 'custom.example.io', namespace: 'backends' }, 'app'))
+      .toEqual({ kind: 'Widget', group: 'custom.example.io', namespace: 'backends', name: 'api' })
+    expect(gatewayBackendResourceRef({ name: 'api', kind: 'Service', group: 'serving.knative.dev' }, 'app').group).toBe('serving.knative.dev')
+    expect(gatewayParentResourceRef({ name: 'mesh', kind: 'Service', group: '', namespace: 'front' }, 'app'))
+      .toEqual({ kind: 'Service', group: '', namespace: 'front', name: 'mesh' })
+  })
+})

package/src/utils/gateway-references.ts

@@ -0,0 +1,29 @@
+import type { ResourceRef } from '../types'
+
+/** Gateway references name namespaced objects. Unlike ObjectReference, their
+ * namespace defaults to the referring Route and their group/kind have defaults.
+ */
+interface GatewayObjectReference {
+  name: string
+  group?: string
+  kind?: string
+  namespace?: string
+}
+
+export function gatewayBackendResourceRef(ref: GatewayObjectReference, routeNamespace: string): ResourceRef {
+  return {
+    kind: ref.kind ?? 'Service',
+    group: ref.group ?? '',
+    namespace: ref.namespace ?? routeNamespace,
+    name: ref.name,
+  }
+}
+
+export function gatewayParentResourceRef(ref: GatewayObjectReference, routeNamespace: string): ResourceRef {
+  return {
+    kind: ref.kind ?? 'Gateway',
+    group: ref.group ?? 'gateway.networking.k8s.io',
+    namespace: ref.namespace ?? routeNamespace,
+    name: ref.name,
+  }
+}

package/src/utils/gitops-write-guard.test.ts

@@ -0,0 +1,401 @@
+import { describe, expect, it } from 'vitest'
+
+import type { GitOpsOwnerRef } from './gitops-owner'
+import {
+  canConfirmGitOpsWrite,
+  evaluateGitOpsWriteGuard,
+  gitOpsWriteEvidencePaths,
+  gitOpsWriteGuardKey,
+  type GitOpsPathEvidence,
+  type GitOpsWrite,
+  type GitOpsWriteEvidence,
+  type GitOpsWriteGuardInput,
+  type GitOpsWritePolicyEvidence,
+} from './gitops-write-guard'
+
+const target = { kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'db', name: 'pg' }
+const argo: GitOpsOwnerRef = { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'pg' }
+const kustomization: GitOpsOwnerRef = { tool: 'fluxcd', kind: 'kustomizations', namespace: 'flux-system', name: 'apps' }
+const helmRelease: GitOpsOwnerRef = { tool: 'fluxcd', kind: 'helmreleases', namespace: 'flux-system', name: 'pg' }
+
+const HIBERNATE = 'metadata.annotations["cnpg.io/hibernation"]'
+const hibernate: GitOpsWrite = { scope: 'metadata', paths: [HIBERNATE], description: 'Hibernation' }
+
+const selfHeal: GitOpsWritePolicyEvidence = { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null }
+const autoNoHeal: GitOpsWritePolicyEvidence = { tool: 'argocd', auto: true, selfHeal: false, prune: false, suspended: null }
+const manual: GitOpsWritePolicyEvidence = { tool: 'argocd', auto: false, selfHeal: false, prune: false, suspended: null }
+
+function pathEvidence(overrides: Partial<GitOpsPathEvidence> = {}): GitOpsPathEvidence {
+  return { path: HIBERNATE, lastApplied: 'absent', ownedBy: [], ownedByGitOps: false, ...overrides }
+}
+
+function evidence(policy: GitOpsWritePolicyEvidence | null, paths: GitOpsPathEvidence[] = [], extra: Partial<GitOpsWriteEvidence> = {}): GitOpsWriteEvidence {
+  return { uid: 'u', resourceVersion: '1', owner: null, policy, paths, ...extra }
+}
+
+function guard(input: Partial<GitOpsWriteGuardInput> & Pick<GitOpsWriteGuardInput, 'writes'>) {
+  return evaluateGitOpsWriteGuard({ target, owner: argo, ...input })
+}
+
+describe('evaluateGitOpsWriteGuard', () => {
+  it('reports nothing without an owner', () => {
+    const g = evaluateGitOpsWriteGuard({ target, owner: null, writes: [hibernate] })
+    expect(g.level).toBe('none')
+    expect(g.requiresAck).toBe(false)
+    expect(g.summary).toBe('')
+  })
+
+  it('never warns for status writes', () => {
+    const g = guard({ writes: [{ scope: 'status' }], evidence: evidence(selfHeal) })
+    expect(g.level).toBe('none')
+    expect(g.perWrite[0].reason).toContain('ordinary GitOps sync does not manage these fields')
+  })
+
+  it('treats a new child object as info', () => {
+    const g = guard({ writes: [{ scope: 'create-child' }], evidence: evidence(selfHeal) })
+    expect(g.level).toBe('info')
+    expect(g.requiresAck).toBe(false)
+  })
+
+  describe('declared fields', () => {
+    const inLastApplied = [pathEvidence({ lastApplied: 'present' })]
+    const ownedByArgo = [
+      pathEvidence({
+        lastApplied: 'no-annotation',
+        ownedByGitOps: true,
+        ownedBy: [{ manager: 'argocd-controller', operation: 'Apply', tool: 'argocd' }],
+      }),
+    ]
+
+    it.each([
+      ['last-applied', inLastApplied],
+      ['managedFields', ownedByArgo],
+    ])('%s + self-heal ⇒ will-revert', (_label, paths) => {
+      const g = guard({ writes: [hibernate], evidence: evidence(selfHeal, paths) })
+      expect(g.level).toBe('will-revert')
+      expect(g.requiresAck).toBe(true)
+      expect(g.summary).toContain('Argo CD Application argocd/pg will revert this change.')
+      expect(g.summary).toContain('overwritten at the next sync')
+    })
+
+    it('names the owning field manager', () => {
+      const g = guard({ writes: [hibernate], evidence: evidence(selfHeal, ownedByArgo) })
+      expect(g.perWrite[0].reason).toContain('argocd-controller owns this field')
+    })
+
+    it('auto-sync without self-heal ⇒ may-revert', () => {
+      const g = guard({ writes: [hibernate], evidence: evidence(autoNoHeal, inLastApplied) })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain('the next sync will overwrite it')
+    })
+
+    it('manual sync ⇒ may-revert', () => {
+      const g = guard({ writes: [hibernate], evidence: evidence(manual, inLastApplied) })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain('Auto-sync is off; the next sync will overwrite it.')
+    })
+
+    it('unreadable owner ⇒ may-revert naming why', () => {
+      const g = guard({
+        writes: [hibernate],
+        evidence: evidence(null, inLastApplied, { policyError: "you can't read the owner, so its sync policy is unknown" }),
+      })
+      expect(g.level).toBe('may-revert')
+      expect(g.syncPolicy).toBeNull()
+      expect(g.perWrite[0].reason).toContain("you can't read the owner")
+    })
+
+    it('Argo Replace=true treats every field as declared', () => {
+      const g = guard({ writes: [hibernate], evidence: evidence({ ...selfHeal, replace: true }, [pathEvidence()]) })
+      expect(g.level).toBe('will-revert')
+      expect(g.perWrite[0].reason).toContain('Replace=true')
+    })
+  })
+
+  describe('undeclared or unknown fields are never safe', () => {
+    it('absent from last-applied and managedFields ⇒ may-revert, lower-confidence copy', () => {
+      const g = guard({ writes: [hibernate], evidence: evidence(selfHeal, [pathEvidence()]) })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain("doesn't rule it out")
+      expect(g.perWrite[0].reason).toContain('may be overwritten on sync if the GitOps source declares this field')
+      expect(g.summary).not.toMatch(/won't be reverted|not declared in Git/i)
+    })
+
+    it('no evidence at all ⇒ may-revert, and says why', () => {
+      const g = guard({ writes: [hibernate], evidenceError: 'GitOps revert warnings need a newer Radar' })
+      expect(g.level).toBe('may-revert')
+      expect(g.requiresAck).toBe(true)
+      expect(g.perWrite[0].reason).toContain("can't see which fields the GitOps source declares (GitOps revert warnings need a newer Radar)")
+    })
+
+    it('unknown fields (no paths) ⇒ may-revert', () => {
+      const g = guard({ writes: [{ scope: 'spec' }], evidence: evidence(selfHeal) })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain("doesn't know which fields")
+    })
+  })
+
+  describe('ignore rules', () => {
+    it('effective ignore (RespectIgnoreDifferences) ⇒ info', () => {
+      const g = guard({
+        writes: [hibernate],
+        evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present', ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' })]),
+      })
+      expect(g.level).toBe('info')
+      expect(g.requiresAck).toBe(false)
+    })
+
+    it('comparison-only ignore on a declared field ⇒ may-revert', () => {
+      const g = guard({
+        writes: [hibernate],
+        evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present', ignored: 'comparison-only', ignoredBy: 'spec.ignoreDifferences' })]),
+      })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain('without RespectIgnoreDifferences')
+    })
+
+    it('unevaluated jq ignore rule on a declared field ⇒ may-revert, not will-revert', () => {
+      const g = guard({
+        writes: [hibernate],
+        evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present', ignored: 'unevaluated', ignoredBy: 'spec.ignoreDifferences jqPathExpressions' })]),
+      })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain('jq')
+    })
+
+    // The annotation on the live object doesn't prove the source declares it.
+    it('Flux ssa: IfNotPresent on the live object ⇒ may-revert', () => {
+      const g = guard({
+        owner: kustomization,
+        writes: [hibernate],
+        evidence: evidence({ tool: 'fluxcd', auto: true, selfHeal: true, prune: true, suspended: false, objectReconcile: 'if-not-present' }, [pathEvidence({ lastApplied: 'present' })]),
+      })
+      expect(g.level).toBe('may-revert')
+      expect(g.requiresAck).toBe(true)
+      expect(g.perWrite[0].reason).toContain("can't confirm the GitOps source declares it")
+    })
+
+    it('an owner matched by name only never waives the acknowledgment', () => {
+      const ignored = evidence({ ...selfHeal, respectIgnoreDifferences: true }, [pathEvidence({ lastApplied: 'present', ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' })])
+      expect(guard({ writes: [hibernate], evidence: ignored }).level).toBe('info')
+      const byName = guard({ writes: [hibernate], evidence: ignored, ownerMatchedByName: true })
+      expect(byName.level).toBe('may-revert')
+      expect(byName.requiresAck).toBe(true)
+      expect(byName.perWrite[0].reason).toContain('by name only')
+    })
+  })
+
+  describe('Flux', () => {
+    const owned = [pathEvidence({ ownedByGitOps: true, ownedBy: [{ manager: 'kustomize-controller', operation: 'Apply', tool: 'fluxcd' }] })]
+
+    it('active Kustomization ⇒ will-revert with its interval', () => {
+      const g = guard({
+        owner: kustomization,
+        writes: [hibernate],
+        evidence: evidence({ tool: 'fluxcd', auto: true, selfHeal: true, prune: true, suspended: false, interval: '10m' }, owned),
+      })
+      expect(g.level).toBe('will-revert')
+      expect(g.perWrite[0].reason).toContain('next reconcile (every 10m)')
+      expect(g.syncPolicy).toEqual({ tool: 'fluxcd', auto: true, selfHeal: true, prune: true, suspended: false, interval: '10m' })
+    })
+
+    it('suspended Kustomization ⇒ may-revert (resuming overwrites)', () => {
+      const g = guard({
+        owner: kustomization,
+        writes: [hibernate],
+        evidence: evidence({ tool: 'fluxcd', auto: false, selfHeal: false, prune: true, suspended: true, interval: '10m' }, owned),
+      })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain('is suspended; resuming it will overwrite')
+    })
+
+    it.each([
+      ['disabled', false, 'may-revert'],
+      ['warn', false, 'may-revert'],
+      ['enabled', true, 'will-revert'],
+    ] as const)('HelmRelease drift detection %s ⇒ %s', (mode, heal, level) => {
+      const g = guard({
+        owner: helmRelease,
+        writes: [hibernate],
+        evidence: evidence({ tool: 'fluxcd', auto: true, selfHeal: heal, prune: null, suspended: false, driftDetection: mode }, [
+          pathEvidence({ ownedByGitOps: true, ownedBy: [{ manager: 'helm-controller', operation: 'Update', tool: 'fluxcd' }] }),
+        ]),
+      })
+      expect(g.level).toBe(level)
+    })
+  })
+
+  describe('HelmRelease drift exemptions', () => {
+    const helmOwned = pathEvidence({ ownedByGitOps: true, ownedBy: [{ manager: 'helm-controller', operation: 'Update', tool: 'fluxcd' }] })
+    const heal: GitOpsWritePolicyEvidence = { tool: 'fluxcd', auto: true, selfHeal: true, prune: null, suspended: false, driftDetection: 'enabled' }
+
+    it('an ignored field still reverts on the next upgrade', () => {
+      const g = guard({
+        owner: helmRelease,
+        writes: [hibernate],
+        evidence: evidence(heal, [{ ...helmOwned, ignored: 'effective', ignoredBy: 'spec.driftDetection.ignore' }]),
+      })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain('next Helm upgrade overwrites it')
+    })
+
+    it('an object opted out of drift detection still reverts on the next upgrade', () => {
+      const g = guard({ owner: helmRelease, writes: [hibernate], evidence: evidence({ ...heal, objectReconcile: 'ignore' }, [helmOwned]) })
+      expect(g.level).toBe('may-revert')
+    })
+
+    it('deleting an opted-out object is recreated by the next upgrade', () => {
+      const g = guard({ owner: helmRelease, writes: [{ scope: 'delete' }], evidence: evidence({ ...heal, objectReconcile: 'ignore' }) })
+      expect(g.level).toBe('may-revert')
+      expect(g.perWrite[0].reason).toContain('next Helm upgrade recreates it')
+    })
+  })
+
+  describe('delete', () => {
+    it('self-heal ⇒ will-revert (recreated)', () => {
+      const g = guard({ writes: [{ scope: 'delete' }], evidence: evidence(selfHeal) })
+      expect(g.level).toBe('will-revert')
+      expect(g.perWrite[0].reason).toContain('recreate')
+    })
+
+    it('manual sync ⇒ may-revert', () => {
+      expect(guard({ writes: [{ scope: 'delete' }], evidence: evidence(manual) }).level).toBe('may-revert')
+    })
+
+    it('an operator-owned object is recreated by the operator, not GitOps', () => {
+      const g = guard({
+        target: { kind: 'Pod', group: '', namespace: 'db', name: 'pg-1' },
+        writes: [{ scope: 'delete' }],
+        evidence: evidence(selfHeal, [], { controllerOwner: { apiVersion: 'postgresql.cnpg.io/v1', kind: 'Cluster', name: 'pg' } }),
+      })
+      expect(g.level).toBe('info')
+      expect(g.perWrite[0].reason).toBe('Cluster pg will recreate this Pod.')
+    })
+  })
+
+  it('native Helm ownership needs acknowledgement', () => {
+    const g = evaluateGitOpsWriteGuard({ target, owner: null, helmRelease: { namespace: 'db', name: 'pg' }, writes: [hibernate] })
+    expect(g.level).toBe('may-revert')
+    expect(g.summary).toContain('Helm release db/pg may revert this change.')
+  })
+
+  it('unverifiable ownership needs acknowledgement', () => {
+    const why = "Radar couldn't read this resource, so it can't tell whether a GitOps tool or Helm manages it."
+    const g = evaluateGitOpsWriteGuard({ target, owner: null, ownershipError: why, writes: [hibernate] })
+    expect(g.requiresAck).toBe(true)
+    expect(g.summary).toBe(`A GitOps tool may revert this change. ${why}`)
+  })
+
+  it('reports the worst write and keeps per-write reasons', () => {
+    const g = guard({
+      writes: [{ scope: 'status' }, { scope: 'create-child' }, hibernate],
+      evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present' })]),
+    })
+    expect(g.perWrite.map((w) => w.level)).toEqual(['none', 'info', 'will-revert'])
+    expect(g.level).toBe('will-revert')
+  })
+})
+
+describe('canConfirmGitOpsWrite', () => {
+  it('blocks while pending and until acknowledged', () => {
+    const managed = guard({ writes: [hibernate], evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present' })]) })
+    expect(canConfirmGitOpsWrite(managed, false)).toBe(false)
+    expect(canConfirmGitOpsWrite(managed, true)).toBe(true)
+    expect(canConfirmGitOpsWrite({ ...managed, pending: true }, true)).toBe(false)
+    expect(canConfirmGitOpsWrite(undefined, true)).toBe(false)
+    expect(canConfirmGitOpsWrite(evaluateGitOpsWriteGuard({ target, owner: null, writes: [hibernate] }), false)).toBe(true)
+  })
+})
+
+describe('gitOpsWriteEvidencePaths', () => {
+  it('collects field paths of metadata/spec writes only', () => {
+    expect(
+      gitOpsWriteEvidencePaths([
+        hibernate,
+        { scope: 'spec', paths: ['spec.suspend', HIBERNATE] },
+        { scope: 'status', paths: ['status.phase'] },
+      ]),
+    ).toEqual([HIBERNATE, 'spec.suspend'])
+  })
+})
+
+describe('gitOpsWriteGuardKey', () => {
+  it('changes with the verdict and stays put for the same one', () => {
+    const mayRevert = guard({ writes: [hibernate], evidence: evidence(manual, [pathEvidence({ lastApplied: 'present' })]) })
+    const willRevert = guard({ writes: [hibernate], evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present' })]) })
+    expect(gitOpsWriteGuardKey(mayRevert)).not.toBe('')
+    expect(gitOpsWriteGuardKey(mayRevert)).toBe(gitOpsWriteGuardKey(guard({ writes: [hibernate], evidence: evidence(manual, [pathEvidence({ lastApplied: 'present' })]) })))
+    expect(gitOpsWriteGuardKey(mayRevert)).not.toBe(gitOpsWriteGuardKey(willRevert))
+    expect(gitOpsWriteGuardKey(guard({ writes: [hibernate], ownerPending: true }))).toBe('')
+    expect(gitOpsWriteGuardKey(undefined)).toBe('')
+  })
+})
+
+describe('copy', () => {
+  it('never promises a change will not be reverted', () => {
+    const optedOut = evidence({ ...selfHeal, objectReconcile: 'ignore' }, [pathEvidence({ lastApplied: 'present' })])
+    const ignored = evidence({ ...selfHeal, respectIgnoreDifferences: true }, [pathEvidence({ lastApplied: 'present', ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' })])
+    for (const g of [
+      guard({ writes: [hibernate], evidence: optedOut }),
+      guard({ writes: [hibernate], evidence: ignored }),
+      guard({ writes: [{ scope: 'create-child', description: 'A Backup' }] }),
+      guard({ writes: [{ scope: 'delete' }], evidence: optedOut }),
+    ]) {
+      expect(g.level).toBe('info')
+      for (const w of g.perWrite) expect(w.reason).not.toMatch(/won.t/)
+    }
+  })
+
+  it("doesn't let an object's opt-out waive a change whose fields are unknown", () => {
+    const optedOut = evidence({ ...selfHeal, objectReconcile: 'ignore' })
+    const g = guard({ writes: [{ scope: 'spec' }], evidence: optedOut })
+    expect(g.level).toBe('may-revert')
+    expect(g.requiresAck).toBe(true)
+  })
+
+  it('describes a rule that covers only some of the entries as unconfirmed', () => {
+    const g = guard({
+      writes: [hibernate],
+      evidence: evidence({ ...selfHeal, respectIgnoreDifferences: true }, [
+        pathEvidence({ lastApplied: 'present', ignored: 'unevaluated', ignoredBy: 'spec.ignoreDifferences jsonPointers' }),
+      ]),
+    })
+    expect(g.level).toBe('may-revert')
+    expect(g.requiresAck).toBe(true)
+    expect(g.perWrite[0].reason).toBe(
+      "Radar can't confirm the Application's ignore rule (spec.ignoreDifferences jsonPointers) covers this field, so the next sync may overwrite it.",
+    )
+  })
+
+  it('a wildcard the source declares for only some entries may revert, not will', () => {
+    const partial = guard({ writes: [hibernate], evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present', partial: true })]) })
+    expect(partial.level).toBe('may-revert')
+    expect(partial.requiresAck).toBe(true)
+    expect(partial.perWrite[0].reason).toBe('The GitOps source sets this for some containers but not others; the ones it sets will be overwritten at the next sync.')
+    const whole = guard({ writes: [hibernate], evidence: evidence(selfHeal, [pathEvidence({ lastApplied: 'present' })]) })
+    expect(whole.level).toBe('will-revert')
+  })
+
+  it('a path that matches nothing in the live object adds no verdict', () => {
+    const g = guard({
+      writes: [{ scope: 'spec', paths: ['spec.template.spec.containers[*].image', 'spec.template.spec.initContainers[*].image'] }],
+      evidence: evidence({ ...selfHeal, respectIgnoreDifferences: true }, [
+        pathEvidence({ path: 'spec.template.spec.containers[*].image', lastApplied: 'present', ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }),
+        pathEvidence({ path: 'spec.template.spec.initContainers[*].image', empty: true }),
+      ]),
+    })
+    expect(g.level).toBe('info')
+    expect(g.requiresAck).toBe(false)
+  })
+
+  it('names the owner once, in the headline', () => {
+    for (const ev of [
+      evidence({ ...selfHeal, respectIgnoreDifferences: true }, [pathEvidence({ lastApplied: 'present', ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' })]),
+      evidence({ ...selfHeal, suspended: true }, [pathEvidence({ lastApplied: 'present' })]),
+      evidence(selfHeal, [pathEvidence({ lastApplied: 'present', ignored: 'comparison-only', ignoredBy: 'spec.ignoreDifferences' })]),
+    ]) {
+      const g = guard({ writes: [hibernate], evidence: ev })
+      expect(g.summary.split('argocd/pg').length - 1).toBe(1)
+    }
+  })
+})