k8s__update_security_baseline

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 5 props · 2 required

{
  "type": "object",
  "required": [
    "baseline_id",
    "enforcement_mode"
  ],
  "properties": {
    "baseline_id": {
      "type": "string"
    },
    "policy_updates": {
      "type": "object",
      "properties": {
        "network_policies": {
          "type": "boolean"
        },
        "admission_controllers": {
          "type": "boolean"
        },
        "pod_security_standards": {
          "type": "boolean"
        }
      }
    },
    "detection_rules": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "enabled": {
            "type": "boolean"
          },
          "rule_id": {
            "type": "string"
          },
          "severity": {
            "enum": [
              "critical",
              "high",
              "medium",
              "low"
            ],
            "type": "string"
          }
        }
      }
    },
    "enforcement_mode": {
      "enum": [
        "enforce",
        "warn",
        "dry-run"
      ],
      "type": "string"
    },
    "apply_immediately": {
      "type": "boolean",
      "default": false
    }
  }
}

registry name changes propagate to the decoy surface on the next drain