Keep * when a ⋯ sits at the same trie node

pkg/apis/softwarecomposition/network_types.go

@@ -50,6 +50,12 @@ type NetworkPort struct {
 	Name     string // protocol-port
 	Protocol Protocol
 	Port     *int32
+	// PortZero marks an explicit Port==0 across the gob payload round-trip:
+	// gob flattens the pointer and omits zero values, so *0 decodes as nil
+	// (turning a user-authored port-0 literal into an any-port stanza).
+	// Internal-only; stamped on save, consumed on read, never converted out.
+	// json:"-": gob carries it (gob ignores json tags); JSON views must not.
+	PortZero bool `json:"-"`
 }
 
 func (p NetworkPort) String() string {

pkg/apis/softwarecomposition/register.go

@@ -66,6 +66,8 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&VulnerabilitySummary{},
 		&VulnerabilitySummaryList{},
 		&ContainerProfile{},
+		&RogueArtifact{},
+		&RogueArtifactList{},
 		&ContainerProfileList{},
 		&OpenVulnerabilityExchangeContainer{},
 		&OpenVulnerabilityExchangeContainerList{},

pkg/apis/softwarecomposition/rogueartifact_types.go

@@ -0,0 +1,55 @@
+package softwarecomposition
+
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+// RogueArtifact is the in-cluster, discoverable record of a container that is
+// not covered by a verified authored profile. One object per firing container;
+// node-agent creates it on fire and transitions it to Healed on governance.
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type RogueArtifact struct {
+	metav1.TypeMeta
+	metav1.ObjectMeta
+
+	Spec   RogueArtifactSpec
+	Status RogueArtifactStatus
+}
+
+type RogueArtifactSpec struct {
+	// State is why the container is uncovered: rogue (no profile label at all),
+	// unbound (label set but resolves to no profile), unsigned (a profile
+	// resolves but is unsigned while signature verification is on).
+	State string
+	// Learning is true while the container is in kubescape.io/learning mode:
+	// the effective profile is empty (deny-all, alerting) while node-agent
+	// records the real behaviour in the background.
+	Learning bool
+	// Reason is a human-readable detail (the diverging binding name, verify
+	// error class, etc.).
+	Reason        string
+	WorkloadName  string
+	WorkloadKind  string
+	WorkloadUID   string
+	ContainerName string
+	ContainerID   string
+	PodName       string
+	PodUID        string
+	NodeName      string
+}
+
+type RogueArtifactStatus struct {
+	// Phase is Firing while the container remains uncovered, Healed once it is
+	// governed by a verified profile. A departed (e.g. completed Job) object
+	// keeps its last Phase until the TTL sweep.
+	Phase    string
+	FiredAt  metav1.Time
+	HealedAt metav1.Time
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type RogueArtifactList struct {
+	metav1.TypeMeta
+	metav1.ListMeta
+
+	Items []RogueArtifact
+}

pkg/apis/softwarecomposition/v1beta1/conversion.go

@@ -0,0 +1,14 @@
+package v1beta1
+
+import (
+	"github.com/kubescape/storage/pkg/apis/softwarecomposition"
+	conversion "k8s.io/apimachinery/pkg/conversion"
+)
+
+// Convert_softwarecomposition_NetworkPort_To_v1beta1_NetworkPort is manual:
+// the internal type carries the gob-only PortZero marker (no v1beta1 peer),
+// which must never leak to API clients. Restoring Port from the marker is the
+// storage decode layer's job, not conversion's.
+func Convert_softwarecomposition_NetworkPort_To_v1beta1_NetworkPort(in *softwarecomposition.NetworkPort, out *NetworkPort, s conversion.Scope) error {
+	return autoConvert_softwarecomposition_NetworkPort_To_v1beta1_NetworkPort(in, out, s)
+}