@skyhook-io/k8s-ui 1.8.10 → 1.8.12

package/src/utils/resource-icons.ts

@@ -129,7 +129,9 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
 
   // Argo
   workflow: Activity,
+  cronworkflow: Activity,
   workflowtemplate: Activity,
+  clusterworkflowtemplate: Activity,
   application: GitBranch, // ArgoCD Application
   applicationset: GitBranch, // ArgoCD ApplicationSet
 

package/src/utils/topology-neighborhood.test.ts

@@ -1,10 +1,13 @@
 import { describe, it, expect } from 'vitest'
-import { neighborhoodFor, tagWorkloadOwnership } from './topology-neighborhood'
+import { batchRunParentNodes, neighborhoodFor, tagWorkloadOwnership } from './topology-neighborhood'
 import type { Topology, NodeKind, EdgeType } from '../types/core'
 
 function node(id: string, kind: string, ns: string, name: string): Topology['nodes'][number] {
   return { id, kind: kind as NodeKind, name, status: 'healthy' as Topology['nodes'][number]['status'], data: { namespace: ns } }
 }
+function crdNode(id: string, kind: string, ns: string, name: string, apiVersion: string): Topology['nodes'][number] {
+  return { id, kind: kind as NodeKind, name, status: 'healthy' as Topology['nodes'][number]['status'], data: { namespace: ns, apiVersion } }
+}
 function edge(source: string, target: string, type: EdgeType): Topology['edges'][number] {
   return { id: `${source}->${target}`, source, target, type }
 }
@@ -32,6 +35,27 @@ describe('neighborhoodFor', () => {
     expect(new Set(out.nodes.map((n) => n.id))).toEqual(new Set(['dep', 'rs', 'pod', 'svc', 'cm']))
   })
 
+  it('includes the complete upstream serving path without crossing through a shared Service', () => {
+    const topo: Topology = {
+      nodes: [
+        node('route', 'HTTPRoute', 'app', 'web'),
+        node('ingress', 'Ingress', 'app', 'web'),
+        node('svc', 'Service', 'app', 'web'),
+        node('depA', 'Deployment', 'app', 'a'),
+        node('depB', 'Deployment', 'app', 'b'),
+      ],
+      edges: [
+        edge('route', 'svc', 'routes-to'),
+        edge('ingress', 'svc', 'routes-to'),
+        edge('svc', 'depA', 'exposes'),
+        edge('svc', 'depB', 'exposes'),
+      ],
+    }
+
+    const out = neighborhoodFor(topo, [{ kind: 'Deployment', namespace: 'app', name: 'a' }])
+    expect(new Set(out.nodes.map((n) => n.id))).toEqual(new Set(['route', 'ingress', 'svc', 'depA']))
+  })
+
   // The leaf rule: a ConfigMap shared by two unrelated Deployments must NOT
   // bridge the second Deployment into the first's neighborhood.
   it('does not bleed through a shared ConfigMap', () => {
@@ -53,6 +77,29 @@ describe('neighborhoodFor', () => {
     expect(ids.has('depB')).toBe(false) // …but it doesn't drag in the other app
   })
 
+  it('includes resources that produce a workload Secret without crossing through it', () => {
+    const topo: Topology = {
+      nodes: [
+        node('depA', 'Deployment', 'app', 'a'),
+        node('depB', 'Deployment', 'app', 'b'),
+        node('secret', 'Secret', 'app', 'generated'),
+        node('sealed', 'SealedSecret', 'app', 'encrypted'),
+        node('cert', 'Certificate', 'app', 'tls'),
+      ],
+      edges: [
+        edge('sealed', 'secret', 'manages'),
+        edge('cert', 'secret', 'manages'),
+        edge('secret', 'depA', 'configures'),
+        edge('secret', 'depB', 'configures'),
+      ],
+    }
+
+    const out = neighborhoodFor(topo, [{ kind: 'Deployment', namespace: 'app', name: 'a' }])
+    expect(new Set(out.nodes.map((n) => n.id))).toEqual(new Set(['depA', 'secret', 'sealed', 'cert']))
+    expect(out.edges).toEqual(expect.arrayContaining([expect.objectContaining({ source: 'sealed', target: 'secret' })]))
+    expect(out.edges).toEqual(expect.arrayContaining([expect.objectContaining({ source: 'cert', target: 'secret' })]))
+  })
+
   // A GitOps manager reached upward is a leaf: "managed by" is shown, but its
   // sibling workloads are not pulled in.
   it('does not expand through a GitOps manager to its siblings', () => {
@@ -119,6 +166,139 @@ describe('neighborhoodFor', () => {
     expect(out.nodes).toHaveLength(0)
     expect(out.warnings?.some((w) => w.includes('No topology nodes matched'))).toBe(true)
   })
+
+  it('uses seed group to disambiguate same-kind nodes', () => {
+    const topo: Topology = {
+      nodes: [
+        crdNode('argo', 'Workflow', 'app', 'run', 'argoproj.io/v1alpha1'),
+        crdNode('other', 'Workflow', 'app', 'run', 'example.com/v1'),
+      ],
+      edges: [],
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'Workflow', group: 'argoproj.io', namespace: 'app', name: 'run' }])
+    expect(out.nodes.map((n) => n.id)).toEqual(['argo'])
+  })
+
+  it('expands from an Argo WorkflowTemplate to its runs and run pods', () => {
+    const topo: Topology = {
+      nodes: [
+        crdNode('wt', 'WorkflowTemplate', 'app', 'migration', 'argoproj.io/v1alpha1'),
+        crdNode('wf', 'Workflow', 'app', 'migration-abc', 'argoproj.io/v1alpha1'),
+        node('pod', 'Pod', 'app', 'migration-abc-main'),
+      ],
+      edges: [
+        edge('wt', 'wf', 'configures'),
+        edge('wf', 'pod', 'manages'),
+      ],
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'WorkflowTemplate', group: 'argoproj.io', namespace: 'app', name: 'migration' }])
+    expect(new Set(out.nodes.map((n) => n.id))).toEqual(new Set(['wt', 'wf', 'pod']))
+  })
+
+  it('keeps active plus representative failed and successful retained runs', () => {
+    const runs = Array.from({ length: 18 }, (_, i) => ({
+      ...crdNode(`wf${i}`, 'Workflow', 'app', `migration-${i}`, 'argoproj.io/v1alpha1'),
+      status: i === 4 ? 'unhealthy' as const : i === 17 ? 'neutral' as const : 'healthy' as const,
+      data: { namespace: 'app', apiVersion: 'argoproj.io/v1alpha1', phase: i === 4 ? 'Failed' : i === 17 ? 'Running' : 'Succeeded', startedAt: `2026-01-${String(i + 1).padStart(2, '0')}T00:00:00Z` },
+    }))
+    const topo: Topology = {
+      nodes: [crdNode('wt', 'WorkflowTemplate', 'app', 'migration', 'argoproj.io/v1alpha1'), ...runs],
+      edges: runs.map((run) => edge('wt', run.id, 'configures')),
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'WorkflowTemplate', group: 'argoproj.io', namespace: 'app', name: 'migration' }])
+    const ids = new Set(out.nodes.map((n) => n.id))
+    expect(ids.has('wt')).toBe(true)
+    expect(ids.has('wf0')).toBe(false)
+    expect(ids.has('wf4')).toBe(true)
+    expect(ids.has('wf16')).toBe(true)
+    expect(ids.has('wf17')).toBe(true)
+    expect(out.warnings?.some((w) => w.includes('active and representative completed runs from 18 retained Workflow runs'))).toBe(true)
+  })
+
+  it('keeps the newest active runs plus the oldest potentially stuck run', () => {
+    const active = Array.from({ length: 12 }, (_, i) => ({
+      ...crdNode(`active${i}`, 'Workflow', 'app', `migration-active-${i}`, 'argoproj.io/v1alpha1'),
+      data: { namespace: 'app', apiVersion: 'argoproj.io/v1alpha1', phase: 'Running', startedAt: `2026-01-${String(i + 1).padStart(2, '0')}T00:00:00Z` },
+    }))
+    const failed = { ...crdNode('failed', 'Workflow', 'app', 'migration-failed', 'argoproj.io/v1alpha1'), status: 'unhealthy' as const, data: { namespace: 'app', phase: 'Failed', startedAt: '2026-02-01T00:00:00Z' } }
+    const succeeded = { ...crdNode('succeeded', 'Workflow', 'app', 'migration-succeeded', 'argoproj.io/v1alpha1'), status: 'healthy' as const, data: { namespace: 'app', phase: 'Succeeded', startedAt: '2026-02-02T00:00:00Z' } }
+    const runs = [...active, failed, succeeded]
+    const topo: Topology = {
+      nodes: [crdNode('wt', 'WorkflowTemplate', 'app', 'migration', 'argoproj.io/v1alpha1'), ...runs],
+      edges: runs.map((run) => edge('wt', run.id, 'configures')),
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'WorkflowTemplate', group: 'argoproj.io', namespace: 'app', name: 'migration' }])
+    const ids = new Set(out.nodes.map((node) => node.id))
+    expect(ids.has('active0')).toBe(true)
+    for (let i = 1; i < 5; i++) expect(ids.has(`active${i}`)).toBe(false)
+    for (let i = 5; i < 12; i++) expect(ids.has(`active${i}`)).toBe(true)
+    expect(ids.has('failed')).toBe(true)
+    expect(ids.has('succeeded')).toBe(true)
+    expect(out.warnings?.some((warning) => warning.includes('7 newest and oldest of 12 active runs'))).toBe(true)
+  })
+
+  it('uses the name tiebreak for runs without timestamps', () => {
+    const runs = Array.from({ length: 10 }, (_, i) => ({
+      ...crdNode(`wf${i}`, 'Workflow', 'app', `migration-${i}`, 'argoproj.io/v1alpha1'),
+      status: 'healthy' as const,
+      data: { namespace: 'app', phase: 'Succeeded' },
+    }))
+    const topo: Topology = {
+      nodes: [crdNode('wt', 'WorkflowTemplate', 'app', 'migration', 'argoproj.io/v1alpha1'), ...runs],
+      edges: runs.map((run) => edge('wt', run.id, 'configures')),
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'WorkflowTemplate', group: 'argoproj.io', namespace: 'app', name: 'migration' }])
+    expect(out.nodes.some((node) => node.id === 'wf9')).toBe(true)
+  })
+})
+
+describe('batchRunParentNodes', () => {
+  it('finds scheduled and template parents for generated runs only', () => {
+    const cronJob = node('cron', 'CronJob', 'app', 'backup')
+    const job = node('job', 'Job', 'app', 'backup-123')
+    const template = crdNode('template', 'WorkflowTemplate', 'app', 'migration', 'argoproj.io/v1alpha1')
+    const workflow = crdNode('workflow', 'Workflow', 'app', 'migration-abc', 'argoproj.io/v1alpha1')
+    const deployment = node('deployment', 'Deployment', 'app', 'api')
+    const pod = node('pod', 'Pod', 'app', 'api-123')
+    const topology: Topology = {
+      nodes: [cronJob, job, template, workflow, deployment, pod],
+      edges: [
+        edge('cron', 'job', 'manages'),
+        edge('template', 'workflow', 'configures'),
+        edge('deployment', 'pod', 'manages'),
+      ],
+    }
+
+    expect(batchRunParentNodes(topology, job)).toEqual([cronJob])
+    expect(batchRunParentNodes(topology, workflow)).toEqual([template])
+    expect(batchRunParentNodes(topology, pod)).toEqual([])
+  })
+
+  it('prefers a scheduler over template provenance when a Workflow has both', () => {
+    const cronWorkflow = crdNode('cron', 'CronWorkflow', 'app', 'scheduled-migration', 'argoproj.io/v1alpha1')
+    const template = crdNode('template', 'WorkflowTemplate', 'app', 'migration', 'argoproj.io/v1alpha1')
+    const workflow = crdNode('workflow', 'Workflow', 'app', 'scheduled-migration-123', 'argoproj.io/v1alpha1')
+    const topology: Topology = {
+      nodes: [cronWorkflow, template, workflow],
+      edges: [
+        edge('template', 'workflow', 'configures'),
+        edge('cron', 'workflow', 'manages'),
+      ],
+    }
+
+    expect(batchRunParentNodes(topology, workflow)).toEqual([cronWorkflow, template])
+  })
+
+  it('finds template provenance for a CronWorkflow', () => {
+    const template = crdNode('template', 'WorkflowTemplate', 'app', 'scheduled-migration', 'argoproj.io/v1alpha1')
+    const cronWorkflow = crdNode('cron', 'CronWorkflow', 'app', 'scheduled-migration', 'argoproj.io/v1alpha1')
+    const topology: Topology = {
+      nodes: [template, cronWorkflow],
+      edges: [edge('template', 'cron', 'configures')],
+    }
+
+    expect(batchRunParentNodes(topology, cronWorkflow)).toEqual([template])
+  })
 })
 
 describe('tagWorkloadOwnership', () => {
@@ -132,6 +312,7 @@ describe('tagWorkloadOwnership', () => {
         node('depA', 'Deployment', 'app', 'a'),
         node('podA', 'Pod', 'app', 'a-1'),
         node('svcA', 'Service', 'app', 'a'),
+        node('routeA', 'HTTPRoute', 'app', 'a'),
         node('depB', 'Deployment', 'app', 'b'),
         node('podB', 'Pod', 'app', 'b-1'),
         node('shared', 'ConfigMap', 'app', 'shared'),
@@ -139,6 +320,7 @@ describe('tagWorkloadOwnership', () => {
       edges: [
         edge('depA', 'podA', 'manages'),
         edge('svcA', 'depA', 'exposes'),
+        edge('routeA', 'svcA', 'routes-to'),
         edge('depB', 'podB', 'manages'),
         edge('shared', 'depA', 'configures'),
         edge('shared', 'depB', 'configures'),
@@ -155,6 +337,7 @@ describe('tagWorkloadOwnership', () => {
     expect(dataOf(topology, 'depA').ownerWorkloadId).toBe('Deployment/app/a')
     expect(dataOf(topology, 'podA').ownerColorIndex).toBe(a)
     expect(dataOf(topology, 'svcA').ownerColorIndex).toBe(a)
+    expect(dataOf(topology, 'routeA').ownerColorIndex).toBe(a)
     expect(dataOf(topology, 'podB').ownerColorIndex).toBe(b)
     // the ConfigMap touches both workloads → neutral color…
     expect(dataOf(topology, 'shared').ownerWorkloadId).toBeNull()
@@ -165,6 +348,7 @@ describe('tagWorkloadOwnership', () => {
     )
     // an exclusive satellite's focus set is just its own workload.
     expect(dataOf(topology, 'svcA').focusWorkloadIds).toEqual(['Deployment/app/a'])
+    expect(dataOf(topology, 'routeA').focusWorkloadIds).toEqual(['Deployment/app/a'])
   })
 
   // A GitOps manager is context, not membership — it never claims a color even
@@ -182,4 +366,21 @@ describe('tagWorkloadOwnership', () => {
     expect(dataOf(topology, 'ks').ownerWorkloadId).toBeNull()
     expect(dataOf(topology, 'pod').ownerWorkloadId).toBe('Deployment/app/web')
   })
+
+  it('attributes Secret producers through the Secret they produce', () => {
+    const topo: Topology = {
+      nodes: [
+        node('dep', 'Deployment', 'app', 'web'),
+        node('secret', 'Secret', 'app', 'generated'),
+        node('sealed', 'SealedSecret', 'app', 'encrypted'),
+        node('cert', 'Certificate', 'app', 'tls'),
+      ],
+      edges: [edge('sealed', 'secret', 'manages'), edge('cert', 'secret', 'manages'), edge('secret', 'dep', 'configures')],
+    }
+
+    const { topology } = tagWorkloadOwnership(topo, [{ kind: 'Deployment', namespace: 'app', name: 'web' }])
+    expect(dataOf(topology, 'secret').ownerWorkloadId).toBe('Deployment/app/web')
+    expect(dataOf(topology, 'sealed').ownerWorkloadId).toBe('Deployment/app/web')
+    expect(dataOf(topology, 'cert').ownerWorkloadId).toBe('Deployment/app/web')
+  })
 })

package/src/utils/topology-neighborhood.ts

@@ -12,10 +12,10 @@ import type { Topology, TopologyNode, TopologyEdge, EdgeType, NodeKind } from '.
 //   identity (`manages`)            — the ownerRef / controller chain
 //                                     (Deployment→ReplicaSet→Pod). Walk it: a
 //                                     workload's pods ARE the workload.
-//   routing  (`exposes`,`routes-to`)— a Service/Ingress/Route in front of the
-//                                     workload. INCLUDE it, but as a LEAF: a
-//                                     shared Ingress fronts many unrelated apps,
-//                                     so we don't expand THROUGH it.
+//   routing  (`exposes`,`routes-to`)— walk UPSTREAM from workload to Service to
+//                                     Ingress/Route, then stop. Never walk back
+//                                     DOWN through a shared Service into another
+//                                     workload.
 //   context  (`configures`,`uses`,  — a ConfigMap/Secret/HPA/PDB attached to the
 //             `protects`)             workload. INCLUDE as a LEAF: a shared
 //                                     ConfigMap mounted by two apps must not glue
@@ -30,12 +30,14 @@ import type { Topology, TopologyNode, TopologyEdge, EdgeType, NodeKind } from '.
 
 export interface NeighborhoodSeed {
   kind: string
+  group?: string
   namespace: string
   name: string
 }
 
 const IDENTITY_EDGES = new Set<EdgeType>(['manages'])
 const ROUTING_EDGES = new Set<EdgeType>(['exposes', 'routes-to'])
+const BATCH_RUN_FANOUT_LIMIT = 8
 // context: 'configures' | 'uses' | 'protects' — everything else is leaf-attached.
 
 // GitOps managers: included as context ("managed by"), never expanded through.
@@ -45,12 +47,101 @@ const GITOPS_MANAGER_KINDS = new Set<NodeKind>([
   'HelmRelease',
   'GitRepository',
 ] as NodeKind[])
+const SECRET_PRODUCER_KINDS = new Set<NodeKind>(['SealedSecret', 'Certificate'])
 
 function nodeNamespace(node: TopologyNode): string {
   const ns = node.data?.namespace
   return typeof ns === 'string' ? ns : ''
 }
 
+function nodeGroup(node: TopologyNode): string {
+  const apiVersion = node.data?.apiVersion
+  return typeof apiVersion === 'string' && apiVersion.includes('/') ? apiVersion.split('/')[0] : ''
+}
+
+function isWorkflowTemplateKind(kind: NodeKind | string): boolean {
+  return kind === 'WorkflowTemplate' || kind === 'ClusterWorkflowTemplate'
+}
+
+function isTemplateConfiguredRun(kind: NodeKind | string): boolean {
+  return kind === 'Workflow' || kind === 'CronWorkflow'
+}
+
+function isTemplateToRunEdge(edge: TopologyEdge, nodeById: Map<string, TopologyNode>): boolean {
+  return edge.type === 'configures'
+    && isWorkflowTemplateKind(nodeById.get(edge.source)?.kind ?? '')
+    && isTemplateConfiguredRun(nodeById.get(edge.target)?.kind ?? '')
+}
+
+function isBatchRunFanoutEdge(edge: TopologyEdge, nodeById: Map<string, TopologyNode>): boolean {
+  const source = nodeById.get(edge.source)
+  const target = nodeById.get(edge.target)
+  if (!source || !target) return false
+  if (edge.type === 'manages') {
+    return (source.kind === 'CronJob' || source.kind === 'ScaledJob') && target.kind === 'Job'
+      || source.kind === 'CronWorkflow' && target.kind === 'Workflow'
+  }
+  return isTemplateToRunEdge(edge, nodeById)
+}
+
+export function batchRunParentNodes(topology: Topology, run: TopologyNode): TopologyNode[] {
+  const nodeById = new Map(topology.nodes.map((node) => [node.id, node]))
+  const parentEdges = topology.edges.filter((edge) => edge.target === run.id && isBatchRunFanoutEdge(edge, nodeById))
+  parentEdges.sort((left, right) => Number(right.type === 'manages') - Number(left.type === 'manages'))
+  return parentEdges.flatMap((edge) => {
+    const parent = nodeById.get(edge.source)
+    return parent ? [parent] : []
+  })
+}
+
+function nodeRunTime(node: TopologyNode): number {
+  const data = node.data ?? {}
+  for (const key of ['startedAt', 'finishedAt', 'startTime', 'completionTime', 'creationTimestamp']) {
+    const value = data[key]
+    if (typeof value !== 'string' || value === '') continue
+    const parsed = Date.parse(value)
+    if (Number.isFinite(parsed)) return parsed
+  }
+  return Number.NEGATIVE_INFINITY
+}
+
+function compareRunsNewestFirst(a: TopologyNode, b: TopologyNode): number {
+  const aTime = nodeRunTime(a)
+  const bTime = nodeRunTime(b)
+  if (bTime !== aTime) return bTime - aTime
+  return b.name.localeCompare(a.name)
+}
+
+function runDisposition(node: TopologyNode): 'active' | 'failed' | 'succeeded' | 'other' {
+  const data = node.data ?? {}
+  const phase = typeof data.phase === 'string' ? data.phase : ''
+  if (phase === 'Running' || phase === 'Pending' || Number(data.active ?? 0) > 0) return 'active'
+  if (phase === 'Failed' || phase === 'Error' || node.status === 'unhealthy') return 'failed'
+  if (phase === 'Succeeded' || node.status === 'healthy' || Number(data.succeeded ?? 0) > 0) return 'succeeded'
+  if (node.kind === 'Job' && !data.completionTime) return 'active'
+  return 'other'
+}
+
+function representativeRuns(targets: TopologyNode[]): TopologyNode[] {
+  const sorted = [...targets].sort(compareRunsNewestFirst)
+  const active = sorted.filter((node) => runDisposition(node) === 'active')
+  const selected: TopologyNode[] = active.length > BATCH_RUN_FANOUT_LIMIT
+    ? [...active.slice(0, BATCH_RUN_FANOUT_LIMIT - 1), active[active.length - 1]]
+    : active
+  const addLatest = (disposition: 'failed' | 'succeeded') => {
+    const node = sorted.find((candidate) => runDisposition(candidate) === disposition)
+    if (node && !selected.some((candidate) => candidate.id === node.id)) selected.push(node)
+  }
+  addLatest('failed')
+  addLatest('succeeded')
+  if (selected.length === 0 && sorted[0]) selected.push(sorted[0])
+  return selected
+}
+
+function batchFanoutLimit(edge: TopologyEdge, nodeById: Map<string, TopologyNode>): number | null {
+  return isBatchRunFanoutEdge(edge, nodeById) ? BATCH_RUN_FANOUT_LIMIT : null
+}
+
 /** The identity string for a workload/seed — `kind/namespace/name`. This format
  *  is a cross-module contract: rail rows, the `?workload=` URL param, hover
  *  focus, and the ownership stamp all compare these strings. Always construct
@@ -61,7 +152,10 @@ export function workloadKey(ref: NeighborhoodSeed): string {
 }
 
 function matchSeedNode(node: TopologyNode, seeds: NeighborhoodSeed[]): boolean {
-  return seeds.some((s) => s.kind === node.kind && s.name === node.name && s.namespace === nodeNamespace(node))
+  return seeds.some((s) => {
+    if (s.kind !== node.kind || s.name !== node.name || s.namespace !== nodeNamespace(node)) return false
+    return !s.group || s.group === nodeGroup(node)
+  })
 }
 
 /** Filter a topology to the neighborhood of `seeds`. Returns the subgraph; an
@@ -92,18 +186,43 @@ export function neighborhoodFor(topology: Topology, seeds: NeighborhoodSeed[]):
     }
   }
 
+  const limitedFanouts = new Map<string, { allowed: Set<string>; total: number; kind: string; activeTotal: number; activeShown: number }>()
+  for (const [sourceId, edges] of adjacency) {
+    const runEdges = edges.filter((edge) => edge.source === sourceId && batchFanoutLimit(edge, nodeById) !== null)
+    if (runEdges.length <= BATCH_RUN_FANOUT_LIMIT) continue
+    const targets = runEdges
+      .map((edge) => nodeById.get(edge.target))
+      .filter((node): node is TopologyNode => !!node)
+      .sort(compareRunsNewestFirst)
+    const representatives = representativeRuns(targets)
+    limitedFanouts.set(sourceId, {
+      allowed: new Set(representatives.map((node) => node.id)),
+      total: targets.length,
+      kind: targets[0]?.kind === 'Job' ? 'Job' : 'Workflow',
+      activeTotal: targets.filter((node) => runDisposition(node) === 'active').length,
+      activeShown: representatives.filter((node) => runDisposition(node) === 'active').length,
+    })
+  }
+
   const keep = new Set(seedIds)
   // Nodes included for context but never expanded THROUGH.
   const leaf = new Set<string>()
   const queue: string[] = Array.from(seedIds)
+  const cappedSources = new Set<string>()
 
   while (queue.length) {
     const id = queue.shift()!
     if (leaf.has(id)) continue // a leaf is a dead end — don't traverse out of it
+    const currentNode = nodeById.get(id)
     for (const e of adjacency.get(id) ?? []) {
       const nextId = e.source === id ? e.target : e.source
       const nextNode = nodeById.get(nextId)
       if (!nextNode) continue
+      const fanout = e.source === id ? limitedFanouts.get(id) : undefined
+      if (fanout && !fanout.allowed.has(nextId)) {
+        cappedSources.add(id)
+        continue
+      }
 
       let asLeaf: boolean
       if (IDENTITY_EDGES.has(e.type)) {
@@ -114,7 +233,17 @@ export function neighborhoodFor(topology: Topology, seeds: NeighborhoodSeed[]):
         // every sibling Job its CronJob owns).
         asLeaf = nextId === e.source
       } else if (ROUTING_EDGES.has(e.type)) {
-        asLeaf = true // a Service/Ingress in front of the workload — leaf
+        if (e.type === 'exposes' && id === e.source) {
+          // We reached a Service from one of its workloads. Only continue
+          // upstream to its routes; following the Service's other targets would
+          // pull sibling or unrelated workloads into this neighborhood.
+          continue
+        }
+        // A Service reached from a workload may expand once more to the
+        // Ingress/Route in front of it. The entrypoint itself remains a leaf.
+        asLeaf = e.type === 'routes-to' || nextNode.kind !== 'Service'
+      } else if (currentNode && isTemplateToRunEdge(e, nodeById) && e.source === currentNode.id) {
+        asLeaf = false
       } else {
         asLeaf = true // configures / uses / protects — leaf
       }
@@ -123,6 +252,16 @@ export function neighborhoodFor(topology: Topology, seeds: NeighborhoodSeed[]):
         if (asLeaf) leaf.add(nextId)
         queue.push(nextId)
       }
+
+      if (asLeaf && nextNode.kind === 'Secret') {
+        for (const producerEdge of adjacency.get(nextId) ?? []) {
+          if (producerEdge.type !== 'manages' || producerEdge.target !== nextId) continue
+          const producer = nodeById.get(producerEdge.source)
+          if (!producer || !SECRET_PRODUCER_KINDS.has(producer.kind)) continue
+          keep.add(producer.id)
+          leaf.add(producer.id)
+        }
+      }
     }
   }
 
@@ -130,6 +269,15 @@ export function neighborhoodFor(topology: Topology, seeds: NeighborhoodSeed[]):
     ...topology,
     nodes: topology.nodes.filter((n) => keep.has(n.id)),
     edges: topology.edges.filter((e) => keep.has(e.source) && keep.has(e.target)),
+    warnings: [
+      ...(topology.warnings ?? []),
+      ...Array.from(cappedSources).map((sourceId) => {
+        const source = nodeById.get(sourceId)
+        const fanout = limitedFanouts.get(sourceId)
+        const activeNote = fanout && fanout.activeTotal > fanout.activeShown ? ` showing the ${fanout.activeShown - 1} newest and oldest of ${fanout.activeTotal} active runs plus representative completed runs` : ' showing active and representative completed runs'
+        return `Topology view:${activeNote} from ${fanout?.total ?? BATCH_RUN_FANOUT_LIMIT} retained ${fanout?.kind ?? 'batch'} runs for ${source?.kind ?? 'workload'}/${source?.name ?? sourceId}. Use Run history for the full retained set.`
+      }),
+    ],
   }
 }
 
@@ -190,19 +338,26 @@ export function tagWorkloadOwnership(topology: Topology, seeds: NeighborhoodSeed
 
   // The seed nodes present in the subgraph, by their workload key.
   const seedKeyById = new Map<string, string>()
+  const subNodeById = new Map(sub.nodes.map((node) => [node.id, node]))
   for (const n of sub.nodes) {
     if (matchSeedNode(n, seeds)) {
       seedKeyById.set(n.id, workloadKey({ kind: n.kind, namespace: nodeNamespace(n), name: n.name }))
     }
   }
 
-  // manages-DOWN children (source manages target) + undirected neighbors.
-  const downChildren = new Map<string, string[]>()
+  // manages-DOWN children, template-to-run provenance, and undirected neighbors.
+  const nodeById = new Map<string, TopologyNode>()
+  for (const n of sub.nodes) nodeById.set(n.id, n)
+  const managedChildren = new Map<string, string[]>()
+  const templateRunChildren = new Map<string, string[]>()
   const neighbors = new Map<string, Set<string>>()
   for (const e of sub.edges) {
     if (e.type === 'manages') {
-      if (!downChildren.has(e.source)) downChildren.set(e.source, [])
-      downChildren.get(e.source)!.push(e.target)
+      if (!managedChildren.has(e.source)) managedChildren.set(e.source, [])
+      managedChildren.get(e.source)!.push(e.target)
+    } else if (isTemplateToRunEdge(e, nodeById)) {
+      if (!templateRunChildren.has(e.source)) templateRunChildren.set(e.source, [])
+      templateRunChildren.get(e.source)!.push(e.target)
     }
     for (const [a, b] of [[e.source, e.target], [e.target, e.source]] as const) {
       if (!neighbors.has(a)) neighbors.set(a, new Set())
@@ -210,8 +365,10 @@ export function tagWorkloadOwnership(topology: Topology, seeds: NeighborhoodSeed
     }
   }
 
-  // Core = each seed plus everything reachable DOWN the manages chain from it
-  // (its ReplicaSets, Pods). Exclusive by construction — a pod has one controller.
+  // Scheduler/controller ownership is authoritative. Claim every seed and its
+  // manages descendants first, then let template seeds claim only unowned runs
+  // and their descendants. A shared template remains provenance when a
+  // CronWorkflow in the same app already owns the Workflow.
   const coreOwner = new Map<string, string>()
   for (const [seedId, key] of seedKeyById) {
     const queue = [seedId]
@@ -219,7 +376,18 @@ export function tagWorkloadOwnership(topology: Topology, seeds: NeighborhoodSeed
       const id = queue.shift()!
       if (coreOwner.has(id)) continue
       coreOwner.set(id, key)
-      for (const c of downChildren.get(id) ?? []) if (!coreOwner.has(c)) queue.push(c)
+      for (const c of managedChildren.get(id) ?? []) if (!coreOwner.has(c)) queue.push(c)
+    }
+  }
+  for (const [seedId, key] of seedKeyById) {
+    const seed = nodeById.get(seedId)
+    if (!seed || !isWorkflowTemplateKind(seed.kind)) continue
+    const queue = [...(templateRunChildren.get(seedId) ?? [])]
+    while (queue.length) {
+      const id = queue.shift()!
+      if (coreOwner.has(id)) continue
+      coreOwner.set(id, key)
+      for (const c of managedChildren.get(id) ?? []) if (!coreOwner.has(c)) queue.push(c)
     }
   }
 
@@ -240,6 +408,19 @@ export function tagWorkloadOwnership(topology: Topology, seeds: NeighborhoodSeed
       for (const nb of neighbors.get(n.id) ?? []) {
         const o = coreOwner.get(nb)
         if (o) related.add(o)
+        const neighborNode = subNodeById.get(nb)
+        if (neighborNode?.kind === 'Service') {
+          for (const serviceNeighbor of neighbors.get(nb) ?? []) {
+            const serviceOwner = coreOwner.get(serviceNeighbor)
+            if (serviceOwner) related.add(serviceOwner)
+          }
+        }
+        if (SECRET_PRODUCER_KINDS.has(n.kind) && neighborNode?.kind === 'Secret') {
+          for (const secretNeighbor of neighbors.get(nb) ?? []) {
+            const secretOwner = coreOwner.get(secretNeighbor)
+            if (secretOwner) related.add(secretOwner)
+          }
+        }
       }
       focusWorkloadIds = [...related]
       owner = related.size === 1 && !GITOPS_MANAGER_KINDS.has(n.kind) ? [...related][0] : null