diff --git a/.github/actions/load-versions/action.yml b/.github/actions/load-versions/action.yml
index 3744181c1..4baa92b95 100644
--- a/.github/actions/load-versions/action.yml
+++ b/.github/actions/load-versions/action.yml
@@ -8,7 +8,7 @@ inputs:
   keys:
     description: "Space-separated pin names to export (default: every CI toolchain pin)"
     required: false
-    default: HELM_VERSION KUBECONFORM_VERSION KYVERNO_CLI_VERSION JAVA_VERSION NODE_VERSION ACTIONLINT_VERSION GOLANGCI_LINT_VERSION YAMLLINT_VERSION HADOLINT_VERSION GOVULNCHECK_VERSION KIND_VERSION KUBECTL_VERSION HELM_UNITTEST_VERSION
+    default: HELM_VERSION KUBECONFORM_VERSION KYVERNO_CLI_VERSION JAVA_VERSION NODE_VERSION ACTIONLINT_VERSION GOLANGCI_LINT_VERSION YAMLLINT_VERSION HADOLINT_VERSION GOVULNCHECK_VERSION CARGO_DENY_VERSION KIND_VERSION KUBECTL_VERSION HELM_UNITTEST_VERSION
 runs:
   using: composite
   steps:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 80ddd2a61..639ad75ef 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,7 +21,6 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
-
   # Maven dependencies (Quarkus BOM, kafka-clients/netty CVE pins, etc.).
   - package-ecosystem: maven
     directory: /kates
@@ -46,3 +45,9 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+
+  - package-ecosystem: cargo
+    directory: /operator
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/ci-operator.yml b/.github/workflows/ci-operator.yml
new file mode 100644
index 000000000..980c7c1d2
--- /dev/null
+++ b/.github/workflows/ci-operator.yml
@@ -0,0 +1,161 @@
+name: CI · Operator
+
+# The Rust workspace in operator/. Two gates on purpose: a schema edit runs the
+# Rust job, whose crdgen check fails a PR that did not regenerate the CRD, and
+# only a change that reaches a cluster starts Kind.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      rust: ${{ steps.filter.outputs.rust }}
+      e2e: ${{ steps.filter.outputs.e2e }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: filter
+        with:
+          filters: |
+            rust:
+              - 'operator/**'
+              - 'charts/kates-operator/**'
+              - 'schemas/test-request.v1.schema.json'
+              - 'rust-toolchain.toml'
+              - 'versions.env'
+              - '.github/workflows/ci-operator.yml'
+            e2e:
+              - 'operator/**'
+              - 'charts/kates-operator/**'
+              - 'charts/kates/**'
+              - 'charts/kafka-cluster/**'
+              - 'config/cluster.yaml'
+              - 'versions.env'
+              - '.github/workflows/ci-operator.yml'
+
+  rust:
+    name: Rust (fmt, clippy, test, deny, crdgen)
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: operator
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/load-versions
+      - uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
+        with:
+          cache-workspaces: operator
+      - uses: taiki-e/install-action@c509219cf42fba86913069efd0ade2458c59337b # v2.90.1
+        with:
+          tool: cargo-deny@${{ env.CARGO_DENY_VERSION }}
+      - run: cargo fmt --all --check
+      - run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
+      - run: cargo test --locked --workspace --all-features
+      - run: cargo deny --all-features check
+
+      # rustls picks a provider from crate features only when exactly one is
+      # on, and both on panics at the first Client::try_default(). The positive
+      # grep stops this passing on a cargo tree output it no longer understands.
+      - name: One crypto provider
+        run: |
+          tree=$(cargo tree --locked --all-features -e features -i rustls)
+          grep -q 'rustls feature "aws_lc_rs"' <<<"${tree}"
+          if grep -q 'rustls feature "ring"' <<<"${tree}"; then
+            echo "::error::rustls has the ring feature on"
+            exit 1
+          fi
+
+      - name: Generated CRDs are fresh
+        run: |
+          cargo run --locked --bin crdgen -- --out crds
+          if [ -n "$(git status --porcelain crds)" ]; then
+            git status --porcelain crds
+            git diff crds
+            echo "::error::operator/crds is stale: run cargo run --bin crdgen -- --out crds"
+            exit 1
+          fi
+
+      - name: Install kubeconform
+        uses: ./.github/actions/install-tools
+        with:
+          kubeconform: "true"
+
+      # No schema catalog publishes CustomResourceDefinition, so kubeconform
+      # cannot read the CRD itself and -ignore-missing-schemas would pass on
+      # nothing; the apiserver judges the CRD in the job below. What it can do
+      # is what a GitOps repository does with the CRD's own schema: refuse a
+      # mistyped key before anything reaches a cluster.
+      - name: The generated schema refuses a mistyped key (kubeconform)
+        working-directory: .
+        run: |
+          set -euo pipefail
+          schemas="${RUNNER_TEMP}/schemas"
+          mkdir -p "${schemas}"
+          yq -o=json '.spec.versions[0].schema.openAPIV3Schema' operator/crds/katestests.kates.io.yaml \
+            | jq '.properties.spec |= walk(if type == "object" and (.properties | type) == "object"
+                                           then . + {additionalProperties: false} else . end)' \
+            > "${schemas}/katestest_v1alpha1.json"
+          validate() {
+            printf 'apiVersion: kates.io/v1alpha1\nkind: KatesTest\nmetadata: {name: ci}\nspec: %s\n' "$1" \
+              | kubeconform -strict -summary -schema-location "${schemas}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json" -
+          }
+          validate '{type: LOAD, spec: {numRecords: 1, acks: all}, sla: {maxP99LatencyMs: 100}}'
+          if validate '{type: LOAD, spec: {records: 1}}'; then
+            echo "::error::kubeconform accepted a mistyped key"
+            exit 1
+          fi
+
+  e2e:
+    name: CRDs on Kind
+    needs: changes
+    if: needs.changes.outputs.e2e == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/load-versions
+
+      # node_image is deliberately not passed, as in integration.yml:
+      # config/cluster.yaml names the image.
+      - name: Create Kind cluster
+        uses: helm/kind-action@1544676c07bb3570fcb70166beaa07c4528fd4aa # v1.15.1
+        with:
+          version: ${{ env.KIND_VERSION }}
+          kubectl_version: ${{ env.KUBECTL_VERSION }}
+          cluster_name: ci-test
+          config: config/cluster.yaml
+          wait: 120s
+
+      # The apiserver is the only CEL compiler, cost and oldSelf-correlatability
+      # checker there is.
+      - name: The apiserver accepts the CRDs
+        run: kubectl apply --dry-run=server -f operator/crds
+
+  gate:
+    name: Gate · Operator
+    if: always()
+    needs: [changes, rust, e2e]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/ci-gate
+        with:
+          needs: ${{ toJSON(needs) }}
diff --git a/.gitignore b/.gitignore
index 6fd708e49..8a6cbd4f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -173,6 +173,7 @@ vendor/bundle
 ## Rust
 target/
 Cargo.lock
+!operator/Cargo.lock
 **/*.rs.bk
 
 # Kubernetes & Docker
diff --git a/docs/book/appendix-c-cicd.md b/docs/book/appendix-c-cicd.md
index efd89570e..274ef6310 100644
--- a/docs/book/appendix-c-cicd.md
+++ b/docs/book/appendix-c-cicd.md
@@ -1,6 +1,6 @@
 # CI/CD Pipeline
 
-This appendix documents the GitHub Actions workflows that build, test and release the Kates platform, from pull-request validation to the published images and CLI binaries. The repository carries further workflows for the Apicurio Registry chart (`ci-apicurio.yml`), the Connect and tester image build checks (`ci-connect.yml`, `ci-tester.yml`), the release pin PR's image scan (`ci-release.yml`, below), native-image builds (`native.yml`), the linters (`lint.yml`), dependency review and the weekly rescan of released images (`security.yml`), CodeQL (`codeql.yml`), chart publishing (`publish-charts.yml`), registry descriptions (`sync-registry-descriptions.yml`), and documentation builds (`docs.yml`, `book.yml`). They follow the same patterns and are not covered here.
+This appendix documents the GitHub Actions workflows that build, test and release the Kates platform, from pull-request validation to the published images and CLI binaries. The repository carries further workflows for the Apicurio Registry chart (`ci-apicurio.yml`), the Connect and tester image build checks (`ci-connect.yml`, `ci-tester.yml`), the Rust operator workspace (`ci-operator.yml`), the release pin PR's image scan (`ci-release.yml`, below), native-image builds (`native.yml`), the linters (`lint.yml`), dependency review and the weekly rescan of released images (`security.yml`), CodeQL (`codeql.yml`), chart publishing (`publish-charts.yml`), registry descriptions (`sync-registry-descriptions.yml`), and documentation builds (`docs.yml`, `book.yml`). They follow the same patterns and are not covered here.
 
 Two rules hold across these workflows. First, **any job that renders a chart runs `helm dependency build` first**: `strimzi-operator` pulls the operator subchart from `quay.io`, and `kafka-cluster`, `connect-cluster` and `mirror-maker2` all resolve the `kafka-common` library through a `file://` dependency. `helm lint` only warns about a missing dependency and still exits 0, so a job that skips the build can be green while the chart cannot be deployed. Second, the expensive jobs, the ones that stand up a Kind cluster and scrape a real broker, are gated behind a schedule, a manual dispatch, or a pull-request label, and never run on an ordinary push.
 
diff --git a/operator/Cargo.lock b/operator/Cargo.lock
new file mode 100644
index 000000000..e767c582c
--- /dev/null
+++ b/operator/Cargo.lock
@@ -0,0 +1,2655 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "annotate-snippets"
+version = "0.12.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a5b0a5ab8561c603f16c3b78c24a386b1f70e7fc1b1b1e8c15738828e4a176"
+dependencies = [
+ "anstyle",
+ "memchr",
+ "unicode-width",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "antlr4rust"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "093d520274bfff7278d776f7ea12981a0a0a6f96db90964658e0f38fc6e9a6a6"
+dependencies = [
+ "better_any",
+ "bit-set",
+ "byteorder",
+ "lazy_static",
+ "murmur3",
+ "once_cell",
+ "parking_lot",
+ "typed-arena",
+ "uuid",
+]
+
+[[package]]
+name = "ar_archive_writer"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6"
+dependencies = [
+ "object",
+]
+
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
+[[package]]
+name = "async-broadcast"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "048006790404103c488e6c5616b3e7e702a71292aadda08e8f7698a9e0d2eb53"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.47.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bfbe32ac36b3c428696ce315464181bc4029d689fd58e3f2a4e58c252242f52"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
+[[package]]
+name = "backon"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
+dependencies = [
+ "fastrand",
+ "gloo-timers",
+ "tokio",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "better_any"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4372b9543397a4b86050cc5e7ee36953edf4bac9518e8a774c2da694977fb6e4"
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "375989decec1a0fa424442bed520fa12ede43a48475ce8c7417d2c69b32b5f6b"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cel"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47a40f338a8c3505921000b609279775792c07cc21f97a3011578c0c5e1738ae"
+dependencies = [
+ "antlr4rust",
+ "chrono",
+ "lazy_static",
+ "nom",
+ "pastey",
+ "regex",
+ "serde",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4356eba6976435498d05a311ee9fc486da3bc81c200d3f0d7dd9703b41913f92"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
+[[package]]
+name = "darling"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "defmt"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a0795ac740cb54d7b3775c9c17345f6aaecf884c01733b39d6017738e0e3e1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "840bb056bd99c495c9188198a258ab787c79f306d864db3e6e8451442d6d8366"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71958f69fb2de856c5dd51ac9377e986ca1aa5919f931bf5395a807277f889a0"
+dependencies = [
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "educe"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebdb1f8f8d2815bbe7b369a7da10343c82026a4503b68bd1279ba557611e96d"
+dependencies = [
+ "enum-ordinalize",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "either"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89253175e704ab869b04f9db224d38630e0211a53841a79181deae0889e169f5"
+dependencies = [
+ "cfg-if",
+ "core_detect",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
+]
+
+[[package]]
+name = "encoding_rs_io"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fba3fe847045ecff794b9c138293a80db914678c453ad63fbf0c6a9eb6e00b22"
+dependencies = [
+ "encoding_rs",
+]
+
+[[package]]
+name = "enum-ordinalize"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89dd01549b09589510cf0647475075d12071456586d70f5c75c98ae2a5537677"
+dependencies = [
+ "enum-ordinalize-derive",
+]
+
+[[package]]
+name = "enum-ordinalize-derive"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a65863d15a4ce2888bd2f0f543cc963d3879c3a022c8ee43f6141d479a3ac815"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "gloo-timers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "granit-parser"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f05586d4d4df3d47123207826c40b252728b438a1a07bad3c01ee6bea401df"
+dependencies = [
+ "arraydeque",
+ "smallvec",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hostname"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617aaa3557aef3810a6369d0a99fac8a080891b68bd9f9812a1eeda0c0730cbd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "windows-link",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "log",
+ "rustls",
+ "rustls-native-certs",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "httparse",
+ "hyper",
+ "libc",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+
+[[package]]
+name = "icu_properties"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+
+[[package]]
+name = "icu_provider"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jiff"
+version = "0.2.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ac703058abac89e5c39b0b879dce2b6b14a4ba36600c7e7e3d0c60a6883ef3c"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aee43309eb53bafb8c36d35d6e444769c8f8e6206a9fbf7546f5db9d7d4a0e93"
+dependencies = [
+ "defmt",
+ "log",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dc32470c67eb7d0e9ccb74303fa925313dc04cecb1aa048beaa6f391e36a93d"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.21",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8dc09d2154098bbf4ef54eab6b117a3c24cbbffe94046b16ee6d6d4510584d3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "json-patch"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7421438de105a0827e44fadd05377727847d717c80ce29a229f85fd04c427b72"
+dependencies = [
+ "jsonptr",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "jsonpath-rust"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c4668c489390e66d586fe2238ee8568473f7ac1607b411342f787c5e1bedd7"
+dependencies = [
+ "pest",
+ "pest_derive",
+ "regex",
+ "serde_json",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "jsonptr"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5a3cc660ba5d72bce0b3bb295bf20847ccbb40fd423f3f05b61273672e561fe"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "k8s-openapi"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab0d13801242174b1f3966907c3f32039f2d6b36c7ce82c61225d66ed5d1eb70"
+dependencies = [
+ "base64 0.22.1",
+ "jiff",
+ "schemars",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "kates-crds"
+version = "0.1.0"
+dependencies = [
+ "k8s-openapi",
+ "kube",
+ "schemars",
+ "serde",
+ "serde-saphyr",
+ "serde_json",
+]
+
+[[package]]
+name = "kube"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c73b082f549411623a4f8949bd24dcaedacb1511379c461c76d579fde301d021"
+dependencies = [
+ "k8s-openapi",
+ "kube-client",
+ "kube-core",
+ "kube-derive",
+ "kube-runtime",
+]
+
+[[package]]
+name = "kube-cel"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c45323142a22d96c26cc345e646f8313b443171f76550b0d825f84316863fc20"
+dependencies = [
+ "base64 0.22.1",
+ "cel",
+ "chrono",
+ "ipnet",
+ "regex",
+ "semver",
+ "serde",
+ "serde_json",
+ "url",
+]
+
+[[package]]
+name = "kube-client"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae56b223bca490db1f1b115bfc606d411177511d7748d8cc019a7e3b2935430b"
+dependencies = [
+ "base64 0.23.1",
+ "bytes",
+ "either",
+ "futures",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-timeout",
+ "hyper-util",
+ "jiff",
+ "jsonpath-rust",
+ "k8s-openapi",
+ "kube-core",
+ "pem",
+ "percent-encoding",
+ "rustls",
+ "rustls-platform-verifier",
+ "secrecy",
+ "serde",
+ "serde-saphyr",
+ "serde_json",
+ "thiserror 2.0.21",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tracing",
+]
+
+[[package]]
+name = "kube-core"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6de84b47fc1aa35ba0ef9059ef54b47c8b47f0979afd15487e525282f2d73fb9"
+dependencies = [
+ "derive_more",
+ "form_urlencoded",
+ "http",
+ "jiff",
+ "json-patch",
+ "k8s-openapi",
+ "kube-cel",
+ "schemars",
+ "serde",
+ "serde-value",
+ "serde_json",
+ "thiserror 2.0.21",
+]
+
+[[package]]
+name = "kube-derive"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de1fb46ac34371491ac0277c13e0e1bb9288000e64c86ca3d91343754818e64e"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "kube-runtime"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dea60005024b6ec1819c426209aa29b9eaca64f6b3988ab73c55f43fa484392"
+dependencies = [
+ "ahash",
+ "async-broadcast",
+ "async-stream",
+ "backon",
+ "educe",
+ "futures",
+ "hashbrown",
+ "hostname",
+ "json-patch",
+ "k8s-openapi",
+ "kube-client",
+ "parking_lot",
+ "pin-project",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
+
+[[package]]
+name = "libc"
+version = "0.2.191"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mime"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5848f5a9e8117cf94f2f90faac24a87ff81600ff8628c1e3deaab572e76bfa1"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
+[[package]]
+name = "murmur3"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a198f9589efc03f544388dfc4a19fe8af4323662b62f598b8dcfdac62c14771c"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "object"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e036b411754132fd6b74e94b74e9a13c5cf606fa93d1885c35860d3060820b1"
+
+[[package]]
+name = "ordered-float"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "pastey"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
+
+[[package]]
+name = "pem"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120"
+dependencies = [
+ "base64 0.23.1",
+ "serde_core",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pest"
+version = "2.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8db75153506001cb36ed924f08cadc862eb3f8c4d0d534139f29074769d7660"
+dependencies = [
+ "memchr",
+ "pest_stack_guard",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20aa17e11fb35664b67d5214a0afac57a360d231b6ec53d6eba0700b27d933b4"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626ec5afccf44ccbfeb2b232316510bb55b4bf34d891afcb0fb07d2b17d7fe9d"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3f45b6caa65c1b08186832745159c2529994146340a7bf44168095469720f5d"
+dependencies = [
+ "pest",
+]
+
+[[package]]
+name = "pest_stack_guard"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ac6154fd4418b8f0b82532c59c26f303f9ca59a64c883e8ce3971fd82733439"
+dependencies = [
+ "psm",
+ "stacker",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "psm"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dcd034599e63b970727f70d79e02d62390a4a84f7c6b827c27c46d5ac3fa622"
+dependencies = [
+ "ar_archive_writer",
+ "cc",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cb23c424d8ee841bb4d813677ca237e2a610067d594fec130f87d6093495ab5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab508826f74a77ca9d5aba6ff19b522583ee3eaf28a19384ff3d0e5835fadf6e"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1c3a92094fa7d61aa124645844facb6b554dfc797136d0f5fd1f890e2bffc69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "secrecy"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e891af845473308773346dc847b2c23ee78fe442e0472ac50e22a18a93d3ae5a"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-saphyr"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a253edfdea34032da21af84e16fcc94f4c7a6ba237f9f3bc2dbf43cea8535c44"
+dependencies = [
+ "annotate-snippets",
+ "base64 0.23.1",
+ "encoding_rs_io",
+ "granit-parser",
+ "nohash-hasher",
+ "num-traits",
+ "serde_core",
+ "smallvec",
+ "zmij",
+]
+
+[[package]]
+name = "serde-value"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
+dependencies = [
+ "ordered-float",
+ "serde",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0d5d4b1981b8bbbb7aed204cae5726d683d5d6ac7e74ec54122ea28f315e7c8"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stacker"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "psm",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl 2.0.21",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.54.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
+dependencies = [
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e464cf451ba96ebfc6f9b6542f17ee8b8956e33f1e40d9690624e59d7a7f8a4b"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "slab",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
+dependencies = [
+ "base64 0.22.1",
+ "bitflags 2.13.2",
+ "bytes",
+ "http",
+ "http-body",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typed-arena"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca718471876992059f251e33aafc334346ada08042b7661dd1fe313a9bced557"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
+dependencies = [
+ "utf_types",
+]
+
+[[package]]
+name = "utf_types"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
+
+[[package]]
+name = "uuid"
+version = "1.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a0e2d11620c50695fe12bbbfde96b3477fe606e7284c22d505c12ce51214514"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0181c14ddd6c7b8b0b0132a5f1ea2f32be0d893cd3ea97b6e3b28886b8a3d1c"
+dependencies = [
+ "cfg-if",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e931a02a39abdbf66966fc35902b5ed58344750a70885bed4ebb3d8eaf28ed9"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ca4b54280e455bd831e33a6b8e734baf432fe63fbc35c42ac14ce67a043a53a"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b1f9c3798725016c6ee5f2f57869ec0831e8bbc0ab0310a86e787e97f41389e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5fe1f8f1b06191a00962174c61aa5005e0bb391a6d80d07e24d115c01a92ed8"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "863ad3ac83293fb4d740aedbfdc9240dd8d1a50c1099acd76ce80ce7c7230c7f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/operator/Cargo.toml b/operator/Cargo.toml
new file mode 100644
index 000000000..5f7b8e6bc
--- /dev/null
+++ b/operator/Cargo.toml
@@ -0,0 +1,20 @@
+[workspace]
+resolver = "3"
+members = ["crates/*"]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2024"
+license = "Apache-2.0"
+publish = false
+
+[workspace.dependencies]
+k8s-openapi = { version = "0.29", features = ["schemars", "v1_34"] }
+kube = { version = "5.0", default-features = false, features = ["client", "runtime", "derive", "cel", "rustls-tls", "aws-lc-rs"] }
+schemars = "1"
+serde = { version = "1", features = ["derive"] }
+serde-saphyr = "2"
+serde_json = "1"
+
+[workspace.lints.clippy]
+pedantic = { level = "warn", priority = -1 }
diff --git a/operator/crates/kates-crds/Cargo.toml b/operator/crates/kates-crds/Cargo.toml
new file mode 100644
index 000000000..ba7664ead
--- /dev/null
+++ b/operator/crates/kates-crds/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "kates-crds"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[[bin]]
+name = "crdgen"
+# Not src/bin/: the repository's .gitignore ignores every directory named bin.
+path = "src/crdgen.rs"
+
+[dependencies]
+k8s-openapi.workspace = true
+kube.workspace = true
+schemars.workspace = true
+serde.workspace = true
+serde-saphyr.workspace = true
+serde_json.workspace = true
+
+[lints]
+workspace = true
diff --git a/operator/crates/kates-crds/src/crdgen.rs b/operator/crates/kates-crds/src/crdgen.rs
new file mode 100644
index 000000000..945ecf767
--- /dev/null
+++ b/operator/crates/kates-crds/src/crdgen.rs
@@ -0,0 +1,19 @@
+use std::path::PathBuf;
+use std::{env, fs};
+
+fn main() {
+    let mut args = env::args().skip(1);
+    let (Some("--out"), Some(dir), None) = (args.next().as_deref(), args.next(), args.next())
+    else {
+        eprintln!("usage: crdgen --out <dir>");
+        std::process::exit(2);
+    };
+    let dir = PathBuf::from(dir);
+
+    fs::create_dir_all(&dir).expect("create the output directory");
+    for crd in kates_crds::crds() {
+        let name = crd.metadata.name.as_deref().expect("a CRD has a name");
+        let yaml = serde_saphyr::to_string(&crd).expect("a CRD serialises");
+        fs::write(dir.join(format!("{name}.yaml")), yaml).expect("write the CRD");
+    }
+}
diff --git a/operator/crates/kates-crds/src/katestest.rs b/operator/crates/kates-crds/src/katestest.rs
new file mode 100644
index 000000000..6315ee948
--- /dev/null
+++ b/operator/crates/kates-crds/src/katestest.rs
@@ -0,0 +1,156 @@
+use k8s_openapi::apimachinery::pkg::apis::meta::v1::{Condition, Time};
+use kube::{CustomResource, KubeSchema};
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use crate::wire;
+
+/// One Kates run, as `kubectl apply` takes it.
+#[derive(CustomResource, KubeSchema, Serialize, Deserialize, Clone, Debug)]
+#[kube(
+    group = "kates.io",
+    version = "v1alpha1",
+    kind = "KatesTest",
+    namespaced,
+    status = "KatesTestStatus",
+    doc = "One Kates run. crd-version: 1",
+    cel,
+    validation = Rule::new("has(self.spec.spec) != has(self.spec.scenario)")
+        .message("exactly one of spec.spec and spec.scenario is required"),
+    validation = Rule::new("!has(self.spec.sla) || has(self.spec.spec)")
+        .message("spec.sla goes with spec.spec: a scenario carries its own sla"),
+    validation = Rule::new("!has(oldSelf.status) || !has(oldSelf.status.runId) || oldSelf.spec == self.spec")
+        .message("spec is immutable once the run has started: create a new KatesTest"),
+    printcolumn = r#"{"name":"Phase","type":"string","jsonPath":".status.phase"}"#,
+    printcolumn = r#"{"name":"Run","type":"string","jsonPath":".status.runId"}"#,
+    printcolumn = r#"{"name":"Age","type":"date","jsonPath":".metadata.creationTimestamp"}"#
+)]
+#[serde(rename_all = "camelCase")]
+pub struct KatesTestSpec {
+    #[serde(rename = "type")]
+    pub test_type: TestType,
+    /// Execution backend: native (the API's default) or trogdor.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub backend: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[schemars(schema_with = "wire::test_spec")]
+    pub spec: Option<Value>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[schemars(schema_with = "wire::scenario")]
+    pub scenario: Option<Value>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[schemars(schema_with = "wire::sla")]
+    pub sla: Option<Value>,
+    /// Seconds after the end of the run to delete this resource. Never set it on a resource Flux
+    /// or Argo CD holds: the tool re-creates it, and the run repeats every TTL.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    // The API never sees this field, so the CRD is the only check on it.
+    #[schemars(range(min = 0))]
+    pub ttl_seconds_after_finished: Option<i32>,
+}
+
+/// `TestType`, as `POST /api/tests` takes it.
+#[derive(Serialize, Deserialize, JsonSchema, Clone, Copy, Debug, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum TestType {
+    Load,
+    Stress,
+    Spike,
+    Endurance,
+    Volume,
+    Capacity,
+    RoundTrip,
+    Integrity,
+    TuneReplication,
+    TuneAcks,
+    TuneBatching,
+    TuneCompression,
+    TunePartitions,
+    IntegrationCdc,
+}
+
+#[derive(Serialize, Deserialize, JsonSchema, Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Phase {
+    Pending,
+    Running,
+    Succeeded,
+    Failed,
+}
+
+// Every field stays omitted until set: `kubectl wait`'s value-less jsonpath form matches any
+// present value, null included, and the operator's server-side apply must not claim empty fields.
+#[derive(KubeSchema, Serialize, Deserialize, Clone, Debug, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct KatesTestStatus {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub observed_generation: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub run_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub phase: Option<Phase>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at: Option<Time>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at: Option<Time>,
+    /// The `kates.io/reconcile-at` value last acted on.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_handled_reconcile_at: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub summary: Option<RunSummary>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    #[x_kube(merge_strategy = ListMerge::Map(vec!["type".into()]))]
+    pub conditions: Vec<Condition>,
+}
+
+/// `ReportSummary`'s fields verbatim, from `GET /api/tests/{id}/report`.
+#[derive(Serialize, Deserialize, JsonSchema, Clone, Debug, Default, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct RunSummary {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub total_records: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub avg_throughput_rec_per_sec: Option<f64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub peak_throughput_rec_per_sec: Option<f64>,
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        rename = "avgThroughputMBPerSec"
+    )]
+    pub avg_throughput_mb_per_sec: Option<f64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub avg_latency_ms: Option<f64>,
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        rename = "p50LatencyMs"
+    )]
+    pub p50_latency_ms: Option<f64>,
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        rename = "p95LatencyMs"
+    )]
+    pub p95_latency_ms: Option<f64>,
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        rename = "p99LatencyMs"
+    )]
+    pub p99_latency_ms: Option<f64>,
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        rename = "p999LatencyMs"
+    )]
+    pub p999_latency_ms: Option<f64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_latency_ms: Option<f64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub total_errors: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error_rate: Option<f64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub duration_ms: Option<i64>,
+}
diff --git a/operator/crates/kates-crds/src/lib.rs b/operator/crates/kates-crds/src/lib.rs
new file mode 100644
index 000000000..d538d0848
--- /dev/null
+++ b/operator/crates/kates-crds/src/lib.rs
@@ -0,0 +1,15 @@
+//! The custom resources of `kates.io/v1alpha1`.
+
+mod katestest;
+mod wire;
+
+use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
+use kube::CustomResourceExt;
+
+pub use katestest::{KatesTest, KatesTestSpec, KatesTestStatus, Phase, RunSummary, TestType};
+
+/// Every CRD this build carries, for `crdgen`.
+#[must_use]
+pub fn crds() -> Vec<CustomResourceDefinition> {
+    vec![KatesTest::crd()]
+}
diff --git a/operator/crates/kates-crds/src/wire.rs b/operator/crates/kates-crds/src/wire.rs
new file mode 100644
index 000000000..84b64b7bc
--- /dev/null
+++ b/operator/crates/kates-crds/src/wire.rs
@@ -0,0 +1,100 @@
+//! The D2 conversion: names and types from the shipped request schema, so a mistyped key is
+//! refused by the CRD, while values stay the API's job.
+
+use schemars::{Schema, SchemaGenerator};
+use serde_json::{Map, Value};
+
+const TEST_REQUEST: &str = include_str!("../../../../schemas/test-request.v1.schema.json");
+
+/// Keys the schema accepts for `kates` files and the API never binds: left in, they would pass
+/// the CRD and be dropped silently, which on `sla` means `Ready=True` on an empty SLA.
+const FILE_ONLY: &[(&str, &[&str])] = &[
+    (
+        "slaDefinition",
+        &[
+            "p95LatencyMs",
+            "p99LatencyMs",
+            "avgLatencyMs",
+            "maxErrorRatePercent",
+            "maxRecoveryTimeMs",
+            "maxThroughputDegradationPercent",
+            "maxIsrRecoveryTimeMs",
+            "maxConsumerLag",
+        ],
+    ),
+    ("scenarioPhase", &["type", "specOverrides"]),
+];
+
+pub fn test_spec(_: &mut SchemaGenerator) -> Schema {
+    definition("wireTestSpec")
+}
+
+pub fn scenario(_: &mut SchemaGenerator) -> Schema {
+    definition("multiPhaseScenario")
+}
+
+pub fn sla(_: &mut SchemaGenerator) -> Schema {
+    definition("slaDefinition")
+}
+
+fn definition(name: &str) -> Schema {
+    let root: Value = serde_json::from_str(TEST_REQUEST).expect("the shipped schema is JSON");
+    let converted = convert_definition(name, &root["$defs"]);
+    Schema::try_from(converted).expect("a converted definition is an object")
+}
+
+fn convert_definition(name: &str, defs: &Value) -> Value {
+    let file_only = FILE_ONLY
+        .iter()
+        .find_map(|(def, keys)| (*def == name).then_some(*keys))
+        .unwrap_or_default();
+    convert(&defs[name], defs, file_only)
+}
+
+fn convert(node: &Value, defs: &Value, file_only: &[&str]) -> Value {
+    if let Some(reference) = node["$ref"].as_str() {
+        let name = reference
+            .strip_prefix("#/$defs/")
+            .expect("only local refs in the schema");
+        let mut resolved = convert_definition(name, defs);
+        if !node["description"].is_null() {
+            resolved["description"] = node["description"].clone();
+        }
+        return resolved;
+    }
+
+    let mut out = Map::new();
+    if !node["description"].is_null() {
+        out.insert("description".into(), node["description"].clone());
+    }
+    // A oneOf is acks, the schema's only property taking two types.
+    if !node["oneOf"].is_null() {
+        out.insert("x-kubernetes-int-or-string".into(), true.into());
+        return out.into();
+    }
+
+    let kind = node["type"]
+        .as_str()
+        .unwrap_or_else(|| panic!("no type in {node}"));
+    out.insert("type".into(), kind.into());
+    match kind {
+        "object" => {
+            if let Some(properties) = node["properties"].as_object() {
+                let kept = properties
+                    .iter()
+                    .filter(|(key, _)| !file_only.contains(&key.as_str()))
+                    .map(|(key, value)| (key.clone(), convert(value, defs, &[])));
+                out.insert("properties".into(), Value::Object(kept.collect()));
+            }
+            if node["additionalProperties"].is_object() {
+                let values = convert(&node["additionalProperties"], defs, &[]);
+                out.insert("additionalProperties".into(), values);
+            }
+        }
+        "array" => {
+            out.insert("items".into(), convert(&node["items"], defs, &[]));
+        }
+        _ => {}
+    }
+    out.into()
+}
diff --git a/operator/crates/kates-crds/tests/katestest.rs b/operator/crates/kates-crds/tests/katestest.rs
new file mode 100644
index 000000000..0f7ae5974
--- /dev/null
+++ b/operator/crates/kates-crds/tests/katestest.rs
@@ -0,0 +1,340 @@
+use std::collections::BTreeSet;
+
+use kates_crds::{KatesTest, KatesTestSpec, KatesTestStatus, Phase, TestType};
+use kube::CustomResourceExt;
+use serde_json::{Value, json};
+
+const NONE: [&str; 0] = [];
+
+fn spec(body: Value) -> KatesTestSpec {
+    serde_json::from_value(body).expect("a KatesTest spec")
+}
+
+fn resource(body: Value) -> KatesTest {
+    KatesTest::new("nightly-load", spec(body))
+}
+
+fn flat() -> Value {
+    json!({"type": "LOAD", "spec": {"numRecords": 1}})
+}
+
+fn started(body: Value) -> KatesTest {
+    let mut test = resource(body);
+    test.status = Some(KatesTestStatus {
+        run_id: Some("8f2a1c0e".into()),
+        ..KatesTestStatus::default()
+    });
+    test
+}
+
+fn schema() -> Value {
+    let crd = serde_json::to_value(KatesTest::crd()).unwrap();
+    crd["spec"]["versions"][0]["schema"]["openAPIV3Schema"].clone()
+}
+
+fn spec_schema() -> Value {
+    schema()["properties"]["spec"].clone()
+}
+
+// The apiserver prunes these and kubectl's strict field validation refuses them.
+fn unknown_fields(schema: &Value, value: &Value, path: &str, found: &mut Vec<String>) {
+    match value {
+        Value::Object(fields) => {
+            for (key, child) in fields {
+                let here = format!("{path}.{key}");
+                let declared = schema["properties"]
+                    .get(key)
+                    .or_else(|| schema.get("additionalProperties"));
+                match declared {
+                    Some(declared) => unknown_fields(declared, child, &here, found),
+                    None => found.push(here),
+                }
+            }
+        }
+        Value::Array(items) => {
+            for (i, child) in items.iter().enumerate() {
+                unknown_fields(&schema["items"], child, &format!("{path}[{i}]"), found);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn refused(body: &Value) -> Vec<String> {
+    let mut found = Vec::new();
+    unknown_fields(&spec_schema(), body, "spec", &mut found);
+    found
+}
+
+fn walk<'a>(node: &'a Value, seen: &mut Vec<&'a Value>) {
+    seen.push(node);
+    match node {
+        Value::Object(fields) => fields.values().for_each(|child| walk(child, seen)),
+        Value::Array(items) => items.iter().for_each(|child| walk(child, seen)),
+        _ => {}
+    }
+}
+
+fn property_names(node: &Value) -> BTreeSet<String> {
+    node["properties"]
+        .as_object()
+        .expect("properties")
+        .keys()
+        .cloned()
+        .collect()
+}
+
+fn scenario_with_sla() -> Value {
+    json!({
+        "type": "LOAD",
+        "scenario": {"name": "ramp", "sla": {"maxP99LatencyMs": 10}},
+    })
+}
+
+#[test]
+fn exactly_one_of_spec_and_scenario() {
+    assert!(resource(flat()).validate_cel().is_ok());
+    assert!(resource(scenario_with_sla()).validate_cel().is_ok());
+
+    let both = json!({"type": "LOAD", "spec": {}, "scenario": {"name": "ramp"}});
+    assert!(resource(both).validate_cel().is_err());
+    assert!(resource(json!({"type": "LOAD"})).validate_cel().is_err());
+}
+
+#[test]
+fn sla_goes_with_spec_only() {
+    let with_spec = json!({"type": "LOAD", "spec": {}, "sla": {"maxP99LatencyMs": 10}});
+    assert!(resource(with_spec).validate_cel().is_ok());
+
+    let beside_scenario = json!({
+        "type": "LOAD",
+        "scenario": {"name": "ramp"},
+        "sla": {"maxP99LatencyMs": 10},
+    });
+    assert!(resource(beside_scenario).validate_cel().is_err());
+}
+
+#[test]
+fn spec_is_frozen_once_a_run_is_recorded() {
+    let old = started(flat());
+
+    let same = started(flat());
+    assert!(same.validate_cel_update(&old).is_ok());
+
+    let records = started(json!({"type": "LOAD", "spec": {"numRecords": 2}}));
+    assert!(records.validate_cel_update(&old).is_err());
+
+    let sla =
+        started(json!({"type": "LOAD", "spec": {"numRecords": 1}, "sla": {"maxErrorRate": 0.1}}));
+    assert!(sla.validate_cel_update(&old).is_err());
+
+    let ttl =
+        started(json!({"type": "LOAD", "spec": {"numRecords": 1}, "ttlSecondsAfterFinished": 60}));
+    assert!(ttl.validate_cel_update(&old).is_err());
+}
+
+#[test]
+fn spec_can_change_before_a_run_is_recorded() {
+    let no_status = resource(flat());
+    let changed = resource(json!({"type": "LOAD", "spec": {"numRecords": 2}}));
+    assert!(changed.validate_cel_update(&no_status).is_ok());
+
+    let mut empty_status = resource(flat());
+    empty_status.status = Some(KatesTestStatus::default());
+    assert!(changed.validate_cel_update(&empty_status).is_ok());
+}
+
+#[test]
+fn a_mistyped_test_spec_key_is_refused() {
+    assert_eq!(
+        refused(&json!({"spec": {"records": 1}})),
+        ["spec.spec.records"]
+    );
+    assert_eq!(refused(&json!({"spec": {"numRecords": 1}})), NONE);
+}
+
+#[test]
+fn every_scenario_spec_is_the_wire_test_spec() {
+    let spec = spec_schema();
+    let scenario = &spec["properties"]["scenario"]["properties"];
+    let phase = &scenario["phases"]["items"]["properties"];
+    let wire = &spec["properties"]["spec"]["properties"];
+    assert_eq!(&scenario["baseSpec"]["properties"], wire);
+    assert_eq!(&phase["spec"]["properties"], wire);
+}
+
+#[test]
+fn no_property_carries_a_default() {
+    let root = schema();
+    let mut nodes = Vec::new();
+    walk(&root, &mut nodes);
+    for node in nodes {
+        assert!(node.get("default").is_none(), "default survived: {node}");
+    }
+}
+
+#[test]
+fn the_wire_schema_keeps_names_and_types_only() {
+    let spec = spec_schema();
+    let mut nodes = Vec::new();
+    for field in ["spec", "scenario", "sla"] {
+        walk(&spec["properties"][field], &mut nodes);
+    }
+    for node in nodes {
+        let Value::Object(fields) = node else {
+            continue;
+        };
+        if fields.get("type").is_none_or(Value::is_object) {
+            continue;
+        }
+        for key in [
+            "minimum", "maximum", "pattern", "enum", "anyOf", "oneOf", "required",
+        ] {
+            assert!(!fields.contains_key(key), "{key} survived: {node}");
+        }
+        assert_ne!(fields.get("additionalProperties"), Some(&json!(false)));
+        assert!(!fields.contains_key("x-kubernetes-preserve-unknown-fields"));
+    }
+}
+
+#[test]
+fn a_negative_ttl_is_refused() {
+    let ttl = &spec_schema()["properties"]["ttlSecondsAfterFinished"];
+    assert_eq!(ttl["minimum"], json!(0.0));
+}
+
+#[test]
+fn acks_takes_an_integer_or_a_string() {
+    let acks = &spec_schema()["properties"]["spec"]["properties"]["acks"];
+    assert_eq!(acks["x-kubernetes-int-or-string"], json!(true));
+    assert!(acks.get("type").is_none());
+}
+
+#[test]
+fn sla_has_exactly_the_keys_the_api_binds() {
+    let spec = spec_schema();
+    let expected: BTreeSet<String> = [
+        "maxP99LatencyMs",
+        "maxP999LatencyMs",
+        "maxAvgLatencyMs",
+        "minThroughputRecPerSec",
+        "maxErrorRate",
+        "minRecordsProcessed",
+        "maxDataLossPercent",
+        "maxRtoMs",
+        "maxRpoMs",
+    ]
+    .map(String::from)
+    .into();
+    assert_eq!(property_names(&spec["properties"]["sla"]), expected);
+    assert_eq!(
+        spec["properties"]["scenario"]["properties"]["sla"]["properties"],
+        spec["properties"]["sla"]["properties"]
+    );
+
+    assert_eq!(
+        refused(&json!({"sla": {"p99LatencyMs": 1}})),
+        ["spec.sla.p99LatencyMs"]
+    );
+    assert_eq!(refused(&json!({"sla": {"maxP99LatencyMs": 1}})), NONE);
+}
+
+#[test]
+fn phases_take_only_what_the_api_binds() {
+    let phase = |fields: Value| json!({"scenario": {"phases": [fields]}});
+
+    assert_eq!(
+        refused(&phase(json!({"specOverrides": {}}))),
+        ["spec.scenario.phases[0].specOverrides"]
+    );
+    assert_eq!(
+        refused(&phase(json!({"type": "RAMP"}))),
+        ["spec.scenario.phases[0].type"]
+    );
+    assert_eq!(refused(&phase(json!({"phaseType": "RAMP"}))), NONE);
+}
+
+#[test]
+fn scenario_labels_stay_a_string_map() {
+    let spec = spec_schema();
+    let labels = &spec["properties"]["scenario"]["properties"]["labels"];
+    assert_eq!(labels["additionalProperties"]["type"], json!("string"));
+    assert_eq!(
+        refused(&json!({"scenario": {"labels": {"team": "payments"}}})),
+        NONE
+    );
+}
+
+#[test]
+fn test_type_is_the_wire_enum() {
+    let wire: Value = serde_json::from_str(include_str!(
+        "../../../../schemas/test-request.v1.schema.json"
+    ))
+    .unwrap();
+    let crd = spec_schema()["properties"]["type"]["enum"].clone();
+    assert_eq!(crd, wire["$defs"]["testType"]["enum"]);
+    assert_eq!(
+        serde_json::to_value(TestType::IntegrationCdc).unwrap(),
+        json!("INTEGRATION_CDC")
+    );
+}
+
+#[test]
+fn schema_ends_in_the_crd_version_marker() {
+    let description = schema()["description"].as_str().unwrap().to_owned();
+    let marker = description.rsplit("crd-version: ").next().unwrap();
+    assert!(
+        marker.parse::<u32>().is_ok(),
+        "no marker in {description:?}"
+    );
+}
+
+#[test]
+fn printer_columns_are_the_dashboard() {
+    let crd = serde_json::to_value(KatesTest::crd()).unwrap();
+    let columns = crd["spec"]["versions"][0]["additionalPrinterColumns"]
+        .as_array()
+        .unwrap();
+    let paths: Vec<_> = columns
+        .iter()
+        .map(|c| c["jsonPath"].as_str().unwrap())
+        .collect();
+    assert_eq!(
+        paths,
+        [
+            ".status.phase",
+            ".status.runId",
+            ".metadata.creationTimestamp"
+        ]
+    );
+}
+
+#[test]
+fn an_unset_status_field_is_omitted_never_null() {
+    assert_eq!(
+        serde_json::to_value(KatesTestStatus::default()).unwrap(),
+        json!({})
+    );
+}
+
+#[test]
+fn status_uses_report_summary_field_names() {
+    let status: KatesTestStatus = serde_json::from_value(json!({
+        "phase": "Succeeded",
+        "summary": {"avgThroughputMBPerSec": 1.5, "p999LatencyMs": 9.0, "totalRecords": 10},
+    }))
+    .unwrap();
+    assert_eq!(status.phase, Some(Phase::Succeeded));
+    let summary = serde_json::to_value(&status).unwrap()["summary"].clone();
+    assert_eq!(
+        summary,
+        json!({"avgThroughputMBPerSec": 1.5, "p999LatencyMs": 9.0, "totalRecords": 10})
+    );
+}
+
+#[test]
+fn conditions_merge_by_type_under_server_side_apply() {
+    let conditions = &schema()["properties"]["status"]["properties"]["conditions"];
+    assert_eq!(conditions["x-kubernetes-list-type"], json!("map"));
+    assert_eq!(conditions["x-kubernetes-list-map-keys"], json!(["type"]));
+}
diff --git a/operator/crds/katestests.kates.io.yaml b/operator/crds/katestests.kates.io.yaml
new file mode 100644
index 000000000..9aaf2d9c7
--- /dev/null
+++ b/operator/crds/katestests.kates.io.yaml
@@ -0,0 +1,563 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: katestests.kates.io
+spec:
+  group: kates.io
+  names:
+    kind: KatesTest
+    plural: katestests
+    singular: katestest
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.phase
+      name: Phase
+      type: string
+    - jsonPath: .status.runId
+      name: Run
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: "One Kates run. crd-version: 1"
+        properties:
+          spec:
+            description: One Kates run, as `kubectl apply` takes it.
+            properties:
+              backend:
+                description: "Execution backend: native (the API's default) or trogdor."
+                nullable: true
+                type: string
+              scenario:
+                properties:
+                  backend:
+                    description: "Benchmark execution engine: native or trogdor."
+                    type: string
+                  baseSpec:
+                    description: Base TestSpec inherited by all phases unless overridden in phases[].spec.
+                    properties:
+                      acks:
+                        description: "Producer acknowledgment mode: \"all\", \"-1\", \"1\", or \"0\"."
+                        nullable: true
+                        x-kubernetes-int-or-string: true
+                      batchSize:
+                        description: Producer batch.size in bytes (1..16,777,216).
+                        type: integer
+                      compressionType:
+                        description: "Producer compression codec: none, gzip, snappy, lz4, or zstd."
+                        type: string
+                      consumerGroup:
+                        description: >-
+                          Consumer group ID (1..255 printable ASCII chars). Allowed only on single-phase
+                          LOAD, ENDURANCE, and INTEGRITY runs.
+                        type: string
+                      durationMs:
+                        description: >-
+                          Maximum test duration in milliseconds (0 for record-count bounded, or
+                          1,000..86,400,000).
+                        type: integer
+                      enableCrc:
+                        description: Enable CRC32 payload validation (allowed only on single-phase INTEGRITY runs).
+                        type: boolean
+                      enableIdempotence:
+                        description: "Enable producer idempotence (requires acks: \"all\")."
+                        type: boolean
+                      enableTransactions:
+                        description: "Enable Kafka transactions (requires acks: \"all\", enableIdempotence: true, and backend: native)."
+                        type: boolean
+                      fetchMaxWaitMs:
+                        description: >-
+                          Consumer fetch.max.wait.ms (1..60,000). Allowed only on single-phase LOAD,
+                          ENDURANCE, and INTEGRITY runs.
+                        type: integer
+                      fetchMinBytes:
+                        description: >-
+                          Consumer fetch.min.bytes (1..16,777,216). Allowed only on single-phase LOAD,
+                          ENDURANCE, and INTEGRITY runs.
+                        type: integer
+                      lingerMs:
+                        description: Producer linger.ms in milliseconds (0..60,000).
+                        type: integer
+                      minInsyncReplicas:
+                        description: Topic min.insync.replicas (1..10). Must be <= replicationFactor.
+                        type: integer
+                      numConsumers:
+                        description: Number of concurrent consumer tasks (1..64).
+                        type: integer
+                      numProducers:
+                        description: Number of concurrent producer tasks (1..64).
+                        type: integer
+                      numRecords:
+                        description: Number of records each producer task sends (1..100,000,000).
+                        type: integer
+                      partitions:
+                        description: Number of topic partitions (1..1,000).
+                        type: integer
+                      recordSize:
+                        description: Payload size of each record in bytes (1..10,485,760).
+                        type: integer
+                      replicationFactor:
+                        description: Topic replication factor (1..10). Must be >= minInsyncReplicas.
+                        type: integer
+                      targetThroughput:
+                        description: "Alias for throughput: target producer rate in records/sec, or -1 for unlimited."
+                        type: integer
+                      throughput:
+                        description: Target producer throughput in records/sec per producer, or -1 for unlimited.
+                        type: integer
+                      topic:
+                        description: Kafka topic name (1..249 ASCII alphanumeric, '.', '_', or '-' chars).
+                        type: string
+                    type: object
+                  description:
+                    description: Human-readable description of the multi-phase scenario.
+                    type: string
+                  labels:
+                    additionalProperties:
+                      type: string
+                    description: Arbitrary key/value string labels attached to the scenario.
+                    type: object
+                  name:
+                    description: Scenario name (1..128 characters).
+                    type: string
+                  phases:
+                    description: Ordered sequence of execution phases (WARMUP, RAMP, STEADY, SPIKE, COOLDOWN).
+                    items:
+                      description: A single execution phase within a multi-phase TestScenario.
+                      properties:
+                        durationMs:
+                          description: Phase duration in milliseconds (0 or 1,000..86,400,000).
+                          type: integer
+                        name:
+                          description: Phase display name (1..100 characters).
+                          type: string
+                        phaseType:
+                          description: "Alias for type: execution phase behavior (WARMUP, RAMP, STEADY, SPIKE, or COOLDOWN)."
+                          type: string
+                        rampSteps:
+                          description: >-
+                            Number of incremental throughput steps (2..100). Only used when phase type is
+                            RAMP.
+                          type: integer
+                        spec:
+                          description: Phase-specific TestSpec overrides merged onto scenario.baseSpec.
+                          properties:
+                            acks:
+                              description: "Producer acknowledgment mode: \"all\", \"-1\", \"1\", or \"0\"."
+                              nullable: true
+                              x-kubernetes-int-or-string: true
+                            batchSize:
+                              description: Producer batch.size in bytes (1..16,777,216).
+                              type: integer
+                            compressionType:
+                              description: "Producer compression codec: none, gzip, snappy, lz4, or zstd."
+                              type: string
+                            consumerGroup:
+                              description: >-
+                                Consumer group ID (1..255 printable ASCII chars). Allowed only on single-phase
+                                LOAD, ENDURANCE, and INTEGRITY runs.
+                              type: string
+                            durationMs:
+                              description: >-
+                                Maximum test duration in milliseconds (0 for record-count bounded, or
+                                1,000..86,400,000).
+                              type: integer
+                            enableCrc:
+                              description: Enable CRC32 payload validation (allowed only on single-phase INTEGRITY runs).
+                              type: boolean
+                            enableIdempotence:
+                              description: "Enable producer idempotence (requires acks: \"all\")."
+                              type: boolean
+                            enableTransactions:
+                              description: "Enable Kafka transactions (requires acks: \"all\", enableIdempotence: true, and backend: native)."
+                              type: boolean
+                            fetchMaxWaitMs:
+                              description: >-
+                                Consumer fetch.max.wait.ms (1..60,000). Allowed only on single-phase LOAD,
+                                ENDURANCE, and INTEGRITY runs.
+                              type: integer
+                            fetchMinBytes:
+                              description: >-
+                                Consumer fetch.min.bytes (1..16,777,216). Allowed only on single-phase LOAD,
+                                ENDURANCE, and INTEGRITY runs.
+                              type: integer
+                            lingerMs:
+                              description: Producer linger.ms in milliseconds (0..60,000).
+                              type: integer
+                            minInsyncReplicas:
+                              description: Topic min.insync.replicas (1..10). Must be <= replicationFactor.
+                              type: integer
+                            numConsumers:
+                              description: Number of concurrent consumer tasks (1..64).
+                              type: integer
+                            numProducers:
+                              description: Number of concurrent producer tasks (1..64).
+                              type: integer
+                            numRecords:
+                              description: Number of records each producer task sends (1..100,000,000).
+                              type: integer
+                            partitions:
+                              description: Number of topic partitions (1..1,000).
+                              type: integer
+                            recordSize:
+                              description: Payload size of each record in bytes (1..10,485,760).
+                              type: integer
+                            replicationFactor:
+                              description: Topic replication factor (1..10). Must be >= minInsyncReplicas.
+                              type: integer
+                            targetThroughput:
+                              description: "Alias for throughput: target producer rate in records/sec, or -1 for unlimited."
+                              type: integer
+                            throughput:
+                              description: Target producer throughput in records/sec per producer, or -1 for unlimited.
+                              type: integer
+                            topic:
+                              description: Kafka topic name (1..249 ASCII alphanumeric, '.', '_', or '-' chars).
+                              type: string
+                          type: object
+                        targetThroughput:
+                          description: Target producer throughput for this phase in records/sec, or -1 for unlimited.
+                          type: integer
+                      type: object
+                    type: array
+                  sla:
+                    description: SLA definition evaluated across the scenario run.
+                    properties:
+                      maxAvgLatencyMs:
+                        description: Maximum allowed average latency in milliseconds (> 0).
+                        type: number
+                      maxDataLossPercent:
+                        description: Maximum allowed data loss percentage (0.0..100.0).
+                        type: number
+                      maxErrorRate:
+                        description: Maximum allowed error rate as a fraction between 0.0 and 1.0.
+                        type: number
+                      maxP999LatencyMs:
+                        description: Maximum allowed p99.9 latency in milliseconds (> 0).
+                        type: number
+                      maxP99LatencyMs:
+                        description: Maximum allowed p99 latency in milliseconds (> 0).
+                        type: number
+                      maxRpoMs:
+                        description: Maximum allowed Recovery Point Objective (RPO) in milliseconds (> 0).
+                        type: number
+                      maxRtoMs:
+                        description: Maximum allowed Recovery Time Objective (RTO) in milliseconds (> 0).
+                        type: number
+                      minRecordsProcessed:
+                        description: Minimum total records processed (>= 1).
+                        type: integer
+                      minThroughputRecPerSec:
+                        description: Minimum required throughput in records/second (> 0).
+                        type: number
+                    type: object
+                  type:
+                    description: Primary test type for the scenario.
+                    type: string
+                type: object
+              sla:
+                description: >-
+                  Service Level Agreement thresholds used by Kates SlaGrader to grade a test or
+                  disruption run.
+                properties:
+                  maxAvgLatencyMs:
+                    description: Maximum allowed average latency in milliseconds (> 0).
+                    type: number
+                  maxDataLossPercent:
+                    description: Maximum allowed data loss percentage (0.0..100.0).
+                    type: number
+                  maxErrorRate:
+                    description: Maximum allowed error rate as a fraction between 0.0 and 1.0.
+                    type: number
+                  maxP999LatencyMs:
+                    description: Maximum allowed p99.9 latency in milliseconds (> 0).
+                    type: number
+                  maxP99LatencyMs:
+                    description: Maximum allowed p99 latency in milliseconds (> 0).
+                    type: number
+                  maxRpoMs:
+                    description: Maximum allowed Recovery Point Objective (RPO) in milliseconds (> 0).
+                    type: number
+                  maxRtoMs:
+                    description: Maximum allowed Recovery Time Objective (RTO) in milliseconds (> 0).
+                    type: number
+                  minRecordsProcessed:
+                    description: Minimum total records processed (>= 1).
+                    type: integer
+                  minThroughputRecPerSec:
+                    description: Minimum required throughput in records/second (> 0).
+                    type: number
+                type: object
+              spec:
+                description: >-
+                  Kates API wire-format TestSpec. Uses numRecords, numProducers, recordSize,
+                  durationMs, and throughput.
+                properties:
+                  acks:
+                    description: "Producer acknowledgment mode: \"all\", \"-1\", \"1\", or \"0\"."
+                    nullable: true
+                    x-kubernetes-int-or-string: true
+                  batchSize:
+                    description: Producer batch.size in bytes (1..16,777,216).
+                    type: integer
+                  compressionType:
+                    description: "Producer compression codec: none, gzip, snappy, lz4, or zstd."
+                    type: string
+                  consumerGroup:
+                    description: >-
+                      Consumer group ID (1..255 printable ASCII chars). Allowed only on single-phase
+                      LOAD, ENDURANCE, and INTEGRITY runs.
+                    type: string
+                  durationMs:
+                    description: >-
+                      Maximum test duration in milliseconds (0 for record-count bounded, or
+                      1,000..86,400,000).
+                    type: integer
+                  enableCrc:
+                    description: Enable CRC32 payload validation (allowed only on single-phase INTEGRITY runs).
+                    type: boolean
+                  enableIdempotence:
+                    description: "Enable producer idempotence (requires acks: \"all\")."
+                    type: boolean
+                  enableTransactions:
+                    description: "Enable Kafka transactions (requires acks: \"all\", enableIdempotence: true, and backend: native)."
+                    type: boolean
+                  fetchMaxWaitMs:
+                    description: >-
+                      Consumer fetch.max.wait.ms (1..60,000). Allowed only on single-phase LOAD,
+                      ENDURANCE, and INTEGRITY runs.
+                    type: integer
+                  fetchMinBytes:
+                    description: >-
+                      Consumer fetch.min.bytes (1..16,777,216). Allowed only on single-phase LOAD,
+                      ENDURANCE, and INTEGRITY runs.
+                    type: integer
+                  lingerMs:
+                    description: Producer linger.ms in milliseconds (0..60,000).
+                    type: integer
+                  minInsyncReplicas:
+                    description: Topic min.insync.replicas (1..10). Must be <= replicationFactor.
+                    type: integer
+                  numConsumers:
+                    description: Number of concurrent consumer tasks (1..64).
+                    type: integer
+                  numProducers:
+                    description: Number of concurrent producer tasks (1..64).
+                    type: integer
+                  numRecords:
+                    description: Number of records each producer task sends (1..100,000,000).
+                    type: integer
+                  partitions:
+                    description: Number of topic partitions (1..1,000).
+                    type: integer
+                  recordSize:
+                    description: Payload size of each record in bytes (1..10,485,760).
+                    type: integer
+                  replicationFactor:
+                    description: Topic replication factor (1..10). Must be >= minInsyncReplicas.
+                    type: integer
+                  targetThroughput:
+                    description: "Alias for throughput: target producer rate in records/sec, or -1 for unlimited."
+                    type: integer
+                  throughput:
+                    description: Target producer throughput in records/sec per producer, or -1 for unlimited.
+                    type: integer
+                  topic:
+                    description: Kafka topic name (1..249 ASCII alphanumeric, '.', '_', or '-' chars).
+                    type: string
+                type: object
+              ttlSecondsAfterFinished:
+                description: |-
+                  Seconds after the end of the run to delete this resource. Never set it on a resource Flux
+                  or Argo CD holds: the tool re-creates it, and the run repeats every TTL.
+                format: int32
+                minimum: 0.0
+                nullable: true
+                type: integer
+              type:
+                description: "`TestType`, as `POST /api/tests` takes it."
+                enum:
+                - LOAD
+                - STRESS
+                - SPIKE
+                - ENDURANCE
+                - VOLUME
+                - CAPACITY
+                - ROUND_TRIP
+                - INTEGRITY
+                - TUNE_REPLICATION
+                - TUNE_ACKS
+                - TUNE_BATCHING
+                - TUNE_COMPRESSION
+                - TUNE_PARTITIONS
+                - INTEGRATION_CDC
+                type: string
+            required:
+            - type
+            type: object
+          status:
+            nullable: true
+            properties:
+              conditions:
+                items:
+                  description: >-
+                    Condition contains details for one aspect of the current state of this API
+                    Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: >-
+                        lastTransitionTime is the last time the condition transitioned from one status
+                        to another. This should be when the underlying condition changed.  If that is not
+                        known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: >-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      type: string
+                    observedGeneration:
+                      description: >-
+                        observedGeneration represents the .metadata.generation that the condition was
+                        set based upon. For instance, if .metadata.generation is currently 12, but the
+                        .status.conditions[x].observedGeneration is 9, the condition is out of date with
+                        respect to the current state of the instance.
+                      format: int64
+                      type: integer
+                    reason:
+                      description: >-
+                        reason contains a programmatic identifier indicating the reason for the
+                        condition's last transition. Producers of specific condition types may define expected
+                        values and meanings for this field, and whether the values are considered a
+                        guaranteed API. The value should be a CamelCase string. This field may not be empty.
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              finishedAt:
+                description: >-
+                  Time is a wrapper around time.Time which supports correct marshaling to YAML
+                  and JSON.  Wrappers are provided for many of the factory methods that the time
+                  package offers.
+                format: date-time
+                nullable: true
+                type: string
+              lastHandledReconcileAt:
+                description: The `kates.io/reconcile-at` value last acted on.
+                nullable: true
+                type: string
+              observedGeneration:
+                format: int64
+                nullable: true
+                type: integer
+              phase:
+                enum:
+                - Pending
+                - Running
+                - Succeeded
+                - Failed
+                - null
+                nullable: true
+                type: string
+              runId:
+                nullable: true
+                type: string
+              startedAt:
+                description: >-
+                  Time is a wrapper around time.Time which supports correct marshaling to YAML
+                  and JSON.  Wrappers are provided for many of the factory methods that the time
+                  package offers.
+                format: date-time
+                nullable: true
+                type: string
+              summary:
+                description: "`ReportSummary`'s fields verbatim, from `GET /api/tests/{id}/report`."
+                nullable: true
+                properties:
+                  avgLatencyMs:
+                    format: double
+                    nullable: true
+                    type: number
+                  avgThroughputMBPerSec:
+                    format: double
+                    nullable: true
+                    type: number
+                  avgThroughputRecPerSec:
+                    format: double
+                    nullable: true
+                    type: number
+                  durationMs:
+                    format: int64
+                    nullable: true
+                    type: integer
+                  errorRate:
+                    format: double
+                    nullable: true
+                    type: number
+                  maxLatencyMs:
+                    format: double
+                    nullable: true
+                    type: number
+                  p50LatencyMs:
+                    format: double
+                    nullable: true
+                    type: number
+                  p95LatencyMs:
+                    format: double
+                    nullable: true
+                    type: number
+                  p999LatencyMs:
+                    format: double
+                    nullable: true
+                    type: number
+                  p99LatencyMs:
+                    format: double
+                    nullable: true
+                    type: number
+                  peakThroughputRecPerSec:
+                    format: double
+                    nullable: true
+                    type: number
+                  totalErrors:
+                    format: int64
+                    nullable: true
+                    type: integer
+                  totalRecords:
+                    format: int64
+                    nullable: true
+                    type: integer
+                type: object
+            type: object
+        required:
+        - spec
+        title: KatesTest
+        type: object
+        x-kubernetes-validations:
+        - message: exactly one of spec.spec and spec.scenario is required
+          rule: has(self.spec.spec) != has(self.spec.scenario)
+        - message: "spec.sla goes with spec.spec: a scenario carries its own sla"
+          rule: "!has(self.spec.sla) || has(self.spec.spec)"
+        - message: "spec is immutable once the run has started: create a new KatesTest"
+          rule: "!has(oldSelf.status) || !has(oldSelf.status.runId) || oldSelf.spec == self.spec"
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/operator/deny.toml b/operator/deny.toml
new file mode 100644
index 000000000..9c567ccd9
--- /dev/null
+++ b/operator/deny.toml
@@ -0,0 +1,23 @@
+[advisories]
+yanked = "deny"
+
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-3-Clause",
+    "CDLA-Permissive-2.0",
+    "ISC",
+    "MIT",
+    "MIT-0",
+    "Unicode-3.0",
+    "Zlib",
+]
+
+[bans]
+multiple-versions = "allow"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 000000000..10427b943
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.99.1"
+components = ["clippy", "rustfmt"]
diff --git a/versions.env b/versions.env
index 10d3686aa..1d3c15fe5 100755
--- a/versions.env
+++ b/versions.env
@@ -41,6 +41,8 @@ HELM_UNITTEST_VERSION="v0.8.2"
 # carrying its own `env:` block: Helm alone was pinned in six workflows, and
 # scripts/check-versions.sh fails when a workflow hardcodes one again. Go is
 # not here: cli/go.mod is its pin and setup-go reads it (go-version-file).
+# Rust is not here: rust-toolchain.toml is its pin and rustup and
+# setup-rust-toolchain read it.
 HELM_VERSION="v3.17.0"
 KUBECONFORM_VERSION="v0.6.7"
 # The Kyverno that kates deploy installs (chart 3.7.2, cli/cmd/deploy_components.go).
@@ -55,3 +57,4 @@ YAMLLINT_VERSION="1.38.0"
 HADOLINT_VERSION="v2.15.1"
 # Newest x/vuln that builds with the Go in cli/go.mod (v1.8.0 needs Go 1.26).
 GOVULNCHECK_VERSION="v1.7.0"
+CARGO_DENY_VERSION="0.20.2"