Offline replay evaluation

CHG-3201 — Scale up the product-catalog Deployment

Ready to evaluateREADY

Choose Run replay to evaluate this bundled manifest proposal.

Deterministic findings

Image, security, selector, and protected-resource evidence

Policy evidence appears only after replay evaluation.

Evaluated proposal

Replay result only

No evaluated proposal is available yet.

Namespace inventory

1 captured offline resources

Deterministic evaluation always covers the complete snapshot; search and paging bound only the rendered inventory.

Search all Kubernetes resources

Showing 1–1 of 1 resources.

Page 1 of 1

Deployment storefront/product-catalog
res-2a8ee56717fc4c73
Labels: app=product-catalog

Service selector relationships

Current snapshot relationships

Every Service relationship remains searchable. Workload matches are indexed and materialized only for visible rows, where each complete match set has its own search and deterministic pages.

Search all Kubernetes Service relationships

Showing 0–0 of 0 relationships.

Page 1 of 1

Kubernetes Service selector relationships
Service	Selector	Matching workloads

Current / proposed manifest diff

Bundled manifest proposal

Image, workload security context, protected-resource labels, and Service selector effects are review evidence. Proposed manifests are data only and are never applied.

The complete 1-operation proposal remains available through search and paging; only the rendered operation cards are bounded.

Search all Kubernetes proposal operations

Showing 1–1 of 1 operations.

Page 1 of 1

replace · /resources/res-2a8ee56717fc4c73

Deployment storefront/product-catalog

Scale up ahead of forecast promotion traffic, tightening the rollout disruption budget so it does not widen at the higher replica count.

Evidence: ev-res-2a8ee56717fc4c73

Inspect current / proposed manifest for /resources/res-2a8ee56717fc4c73

spec.replicas: 3 → 6 · spec.maxUnavailable: "25%" → "10%"

  {
    "resourceId": "res-2a8ee56717fc4c73",
    "evidenceId": "ev-res-2a8ee56717fc4c73",
    "metadata": {
      "annotations": {},
      "labels": {
        "app": "product-catalog"
      }
    },
    "identity": {
      "namespace": "storefront",
      "name": "product-catalog",
      "apiVersion": "apps/v1",
      "kind": "Deployment"
    },
    "spec": {
      "podLabels": {
        "app": "product-catalog"
      },
      "hostNetwork": false,
      "hostPID": false,
      "hostIPC": false,
      "hasHostPath": false,
removed: -     "replicas": 3,
added: +     "replicas": 6,
      "strategy": "RollingUpdate",
removed: -     "maxUnavailable": "25%"
added: +     "maxUnavailable": "10%"
    }
  }

Policy coverage

Registered, loaded, and evaluated evidence

Registry metadata identifies the domain without loading its adapter. Loaded coverage comes from the deterministic runtime. A policy is marked evaluated only when the current review returned its finding.

Registered metadata

Domain: Kubernetes · kubernetes
Contract: 2.0.0
Shape: simulated-state
Declared capabilities: graph yes · structured diff yes · untrusted context yes

Loaded deterministic coverage

Policy version: core-v0.2.0+kubernetes-v0.1.0
Baseline pack: ChangeSafe core defaults · core-default
Blast radius: warn at 2 · block above 2
Verification: precondition required · postcheck required

Ordered deterministic policy coverage for Kubernetes
Order	Policy	Current review
1	PATCH_SCHEMA	loaded · not yet evaluated
2	K8S_PRIVILEGE_ESCALATION	loaded · not yet evaluated
3	K8S_WORKLOAD_AVAILABILITY	loaded · not yet evaluated
4	K8S_SERVICE_SELECTOR	loaded · not yet evaluated
5	K8S_PROTECTED_RESOURCE	loaded · not yet evaluated
6	K8S_MUTABLE_IMAGE	loaded · not yet evaluated
7	BLAST_RADIUS	loaded · not yet evaluated
8	ROLLBACK_COMPLETE	loaded · not yet evaluated
9	VERIFICATION_REQUIRED	loaded · not yet evaluated
10	UNTRUSTED_INSTRUCTION	loaded · not yet evaluated

Explicit policy skips: none.

Source provenance

Source ID: scenario-q-safe-scale-up
Source: authored-fixture
Analysis mode: replay
Provenance: authored-synthetic
Artifact input: bundled authored fixture
External read: unavailable
Model generation: not run
Infrastructure write: unavailable

Simulation and limitations

Sandbox simulation capability: available.

Kubernetes has an offline sandbox capability, but this public replay never requests simulation because it has no decision authority.

• Evaluates validated offline snapshots only; it never contacts a Kubernetes API or applies a manifest.