K8S

Workflow	Type	Description
k8s.app.deploy	Dag	Deploy a containerised app: Namespace + ConfigMap + Secret + Deployment + Service, with optional PVC / HPA / PDB / Ingress
k8s.app.set-image	Dag	Patch a Deployment's container image and wait for rollout to be Available. Helm-safe — only touches the image field.
k8s.app.teardown	Dag	Tear down a containerised app: Ingress/HPA/PDB + Service + Deployment + ConfigMap + Secret; PVCs only when delete_pvcs=true
k8s.app.update	Dag	Apply a new desired state to an existing app: ConfigMap + Secret + Deployment + Service, with optional PVC / HPA / PDB / Ingress
k8s.cluster.snapshot	Atomic	Cluster-wide workload snapshot (one list per kind, slim projection)
k8s.manifest.diff_set	Atomic	Drift report for a desired manifest set (no mutation)
k8s.manifest.sync	Atomic	Reconcile a cluster to a desired manifest set (apply + prune + self-heal + wait)