[justgithubaccount]

Reproduced defect

A real in-cluster k8s-healthcheck returned HTTP 200 but classified a Completed Job as failing and inferred cluster-wide component absence from a namespace-only snapshot. A later run interpreted the same class of evidence differently, so prompt-only behavior was nondeterministic.

What changed

• pass the requested namespace deterministically to kubectl reads and record the actual evidence scope
• count pod status/reason values in code instead of asking an LLM to reinterpret them
• treat Completed/Succeeded as successful terminal states
• recognize common failure reasons including init/config, crash-loop, image-pull, OOM and eviction states
• derive the final bounded health summary only from recorded evidence; the cluster-summary LLM is not invoked
• strengthen prompts/config for any direct task usage

Verification

• uv run ruff check .
• uv run mypy src
• uv run pytest -q — 57 passed
• regression fixtures cover namespace propagation, Completed-only health, CrashLoopBackOff, CreateContainerConfigError and Init:CrashLoopBackOff

Review at prior head 98b70298703380fbf6c4b5c4479f887802a13ee1: approved for operator merge for that head only.

Additional scope-integrity fix (unreviewed current head)

• Reject context.namespace and context.app_name in direct CrewAI API requests with HTTP 422, preventing bypass of the UI's reserved-key guard.
• Keep explicit request scope authoritative and add regression tests for rejected overrides and accepted supplemental context.
• Current head: 194577e4f95de5a8ef005a9b68b1550730f243a8.
• Previous approval does not cover the current head. Fresh CI and independent exact-head review required. No merge or deploy authorized.