{
  "date": "2026-03-29",
  "graph_version": "0.1",
  "scope": "manifest_level_dependency_edges",
  "source_documents": [
    "knowledge/deployment/app-delivery-object-mapping.json",
    "knowledge/deployment/deployment-graph.json",
    "knowledge/deployment/deployment-environment-graph.json",
    "app-delivery manifests and config files"
  ],
  "notes": [
    "This graph captures only manifest/config-level dependency edges with direct, text-level evidence in the app-delivery tree.",
    "Edges are intentionally limited to high-confidence service references such as kubernetes:///..., in-cluster DNS service names, and internal HTTP service URLs.",
    "RBAC relationships, ServiceAccount links, notification webhooks, and generic external endpoints are excluded from this graph.",
    "Host aliases such as serverless-svc-grpc are normalized to the corresponding deployment object serverless-svc.",
    "This file complements deployment-graph.json rather than replacing it: the older file stays as the high-level topology summary.",
    "Some edges use public or load-balancer endpoints that normalize back to a mapped deployment object, and these are marked as external_mapped_object_url with slightly lower confidence.",
    "Addon dependencies derived from ExternalSecret apiVersion and ClusterSecretStore references are included when the target bundle is already mapped in KB.",
    "CRD dependencies are included when a controller role or manifest explicitly targets an API group or resource that another deployment object installs.",
    "Each dependency edge includes a stable edge_id, a derivation_rule, and normalized evidence location lists."
  ],
  "summary": {
    "dependency_edge_count": 50,
    "unique_from_object_count": 22,
    "unique_to_object_count": 15,
    "reference_type_counts": {
      "dns_service_addr": 4,
      "http_service_url": 4,
      "kubernetes_service_addr": 19,
      "api_group_crd": 8,
      "cluster_secret_store_ref": 7,
      "external_mapped_object_url": 8
    },
    "confidence_counts": {
      "high": 42,
      "medium-high": 8
    },
    "relation_counts": {
      "manifest_references_service": 27,
      "manifest_requires_addon_crd": 7,
      "manifest_references_secret_store": 7,
      "manifest_requires_crd": 1,
      "manifest_references_mapped_endpoint": 8
    },
    "environment_graph_alignment": {
      "applicationset_count": 84,
      "mapped_applicationset_count": 84,
      "placement_count": 468
    },
    "edge_id_count": 50,
    "edges_with_evidence_locations": 50
  },
  "dependency_edges": [
    {
      "from_object": "account-svc",
      "to_object": "tempo-proxy",
      "relation": "manifest_references_service",
      "reference_type": "dns_service_addr",
      "confidence": "high",
      "environments": [
        "prod"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/account-svc/envs/prod/config.yaml",
          "line": 37,
          "snippet": "coreSvcAddr: tempo-proxy.tidb-management-service:10102",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/account",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "notes": "The current scan surfaced an explicit tempo-proxy address in the prod account-svc configuration.",
      "edge_id": "edge:account-svc:manifest-references-service:tempo-proxy",
      "derivation_rule": "Extracted from manifest or config values using raw service DNS addresses.",
      "evidence_files": [
        "app-delivery/account-svc/envs/prod/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/account-svc/envs/prod/config.yaml",
          "line": 37,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "config-manager",
      "to_object": "core-svc",
      "relation": "manifest_references_service",
      "reference_type": "dns_service_addr",
      "confidence": "high",
      "environments": [
        "nightly",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/config-manager/envs/nightly/config.yaml",
          "line": 2,
          "snippet": "coreSvcAddr: \"dbaas-core-svc-server-grpc.nightly-ms:8888\"",
          "environment": "nightly"
        },
        {
          "file": "app-delivery/config-manager/envs/staging/config.yaml",
          "line": 2,
          "snippet": "coreSvcAddr: \"dbaas-core-svc-server-grpc.staging-ms:8888\"",
          "environment": "staging"
        },
        {
          "file": "app-delivery/config-manager/envs/prod/config.yaml",
          "line": 2,
          "snippet": "coreSvcAddr: \"dbaas-core-svc-server-grpc.prod-ms:8888\"",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/infra-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/core-svc",
        "source_family": null
      },
      "edge_id": "edge:config-manager:manifest-references-service:core-svc",
      "derivation_rule": "Extracted from manifest or config values using raw service DNS addresses.",
      "evidence_files": [
        "app-delivery/config-manager/envs/nightly/config.yaml",
        "app-delivery/config-manager/envs/prod/config.yaml",
        "app-delivery/config-manager/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/config-manager/envs/nightly/config.yaml",
          "line": 2,
          "environment": "nightly"
        },
        {
          "file": "app-delivery/config-manager/envs/staging/config.yaml",
          "line": 2,
          "environment": "staging"
        },
        {
          "file": "app-delivery/config-manager/envs/prod/config.yaml",
          "line": 2,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "core-svc",
      "to_object": "config-service",
      "relation": "manifest_references_service",
      "reference_type": "http_service_url",
      "confidence": "high",
      "environments": [
        "nightly",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/core-svc/envs/nightly/core-portal-config.yaml",
          "line": 80,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "nightly"
        },
        {
          "file": "app-delivery/core-svc/envs/staging/core-portal-config.yaml",
          "line": 80,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "staging"
        },
        {
          "file": "app-delivery/core-svc/envs/prod/core-portal-config.yaml",
          "line": 79,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/core-svc",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/config-service",
        "source_family": null
      },
      "edge_id": "edge:core-svc:manifest-references-service:config-service",
      "derivation_rule": "Extracted from manifest or config values using in-cluster HTTP service URLs.",
      "evidence_files": [
        "app-delivery/core-svc/envs/nightly/core-portal-config.yaml",
        "app-delivery/core-svc/envs/prod/core-portal-config.yaml",
        "app-delivery/core-svc/envs/staging/core-portal-config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/core-svc/envs/nightly/core-portal-config.yaml",
          "line": 80,
          "environment": "nightly"
        },
        {
          "file": "app-delivery/core-svc/envs/staging/core-portal-config.yaml",
          "line": 80,
          "environment": "staging"
        },
        {
          "file": "app-delivery/core-svc/envs/prod/core-portal-config.yaml",
          "line": 79,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "core-svc",
      "to_object": "serverless-svc",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "nightly",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/core-svc/envs/nightly/core-svc-config.yaml",
          "line": 40,
          "snippet": "serverlessSvcAddr: \"kubernetes:///serverless-svc-grpc:10000\"",
          "environment": "nightly"
        },
        {
          "file": "app-delivery/core-svc/envs/staging/core-svc-config.yaml",
          "line": 40,
          "snippet": "serverlessSvcAddr: \"kubernetes:///serverless-svc-grpc:10000\"",
          "environment": "staging"
        },
        {
          "file": "app-delivery/core-svc/envs/prod/core-svc-config.yaml",
          "line": 39,
          "snippet": "serverlessSvcAddr: \"kubernetes:///serverless-svc-grpc:10000\"",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/core-svc",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/serverless-service"
      },
      "edge_id": "edge:core-svc:manifest-references-service:serverless-svc",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/core-svc/envs/nightly/core-svc-config.yaml",
        "app-delivery/core-svc/envs/prod/core-svc-config.yaml",
        "app-delivery/core-svc/envs/staging/core-svc-config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/core-svc/envs/nightly/core-svc-config.yaml",
          "line": 40,
          "environment": "nightly"
        },
        {
          "file": "app-delivery/core-svc/envs/staging/core-svc-config.yaml",
          "line": 40,
          "environment": "staging"
        },
        {
          "file": "app-delivery/core-svc/envs/prod/core-svc-config.yaml",
          "line": 39,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dataflow-service-ng",
      "to_object": "config-service",
      "relation": "manifest_references_service",
      "reference_type": "http_service_url",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dev/dataflow-service-ng/env/dev/config.yaml",
          "line": 43,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/dataflow-service-ng/env/staging/config.yaml",
          "line": 43,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-service-ng/env/prod/config.yaml",
          "line": 43,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/dataflow-service",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/config-service",
        "source_family": null
      },
      "edge_id": "edge:dataflow-service-ng:manifest-references-service:config-service",
      "derivation_rule": "Extracted from manifest or config values using in-cluster HTTP service URLs.",
      "evidence_files": [
        "app-delivery/dataflow-service-ng/env/prod/config.yaml",
        "app-delivery/dev/dataflow-service-ng/env/dev/config.yaml",
        "app-delivery/staging/dataflow-service-ng/env/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dev/dataflow-service-ng/env/dev/config.yaml",
          "line": 43,
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/dataflow-service-ng/env/staging/config.yaml",
          "line": 43,
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-service-ng/env/prod/config.yaml",
          "line": 43,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dataflow-service-ng",
      "to_object": "tempo-proxy",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dev/dataflow-service-ng/env/dev/config.yaml",
          "line": 36,
          "snippet": "coreSvcAddr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/dataflow-service-ng/env/staging/config.yaml",
          "line": 36,
          "snippet": "coreSvcAddr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-service-ng/env/prod/config.yaml",
          "line": 36,
          "snippet": "coreSvcAddr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/dataflow-service",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:dataflow-service-ng:manifest-references-service:tempo-proxy",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/dataflow-service-ng/env/prod/config.yaml",
        "app-delivery/dev/dataflow-service-ng/env/dev/config.yaml",
        "app-delivery/staging/dataflow-service-ng/env/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dev/dataflow-service-ng/env/dev/config.yaml",
          "line": 36,
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/dataflow-service-ng/env/staging/config.yaml",
          "line": 36,
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-service-ng/env/prod/config.yaml",
          "line": 36,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dataflow-svc",
      "to_object": "config-service",
      "relation": "manifest_references_service",
      "reference_type": "http_service_url",
      "confidence": "high",
      "environments": [
        "nightly",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dataflow-svc/envs/nightly/config.yaml",
          "line": 43,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "nightly"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/staging/config.yaml",
          "line": 43,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/prod/config.yaml",
          "line": 43,
          "snippet": "configServiceURL: http://config-service.gitops:8090",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/dataflow-service"
      },
      "to_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/config-service",
        "source_family": null
      },
      "edge_id": "edge:dataflow-svc:manifest-references-service:config-service",
      "derivation_rule": "Extracted from manifest or config values using in-cluster HTTP service URLs.",
      "evidence_files": [
        "app-delivery/dataflow-svc/envs/nightly/config.yaml",
        "app-delivery/dataflow-svc/envs/prod/config.yaml",
        "app-delivery/dataflow-svc/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dataflow-svc/envs/nightly/config.yaml",
          "line": 43,
          "environment": "nightly"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/staging/config.yaml",
          "line": 43,
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/prod/config.yaml",
          "line": 43,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dataflow-svc",
      "to_object": "tempo-proxy",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "nightly",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dataflow-svc/envs/nightly/config.yaml",
          "line": 36,
          "snippet": "coreSvcAddr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "nightly"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/staging/config.yaml",
          "line": 36,
          "snippet": "coreSvcAddr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/prod/config.yaml",
          "line": 36,
          "snippet": "coreSvcAddr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/dataflow-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:dataflow-svc:manifest-references-service:tempo-proxy",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/dataflow-svc/envs/nightly/config.yaml",
        "app-delivery/dataflow-svc/envs/prod/config.yaml",
        "app-delivery/dataflow-svc/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dataflow-svc/envs/nightly/config.yaml",
          "line": 36,
          "environment": "nightly"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/staging/config.yaml",
          "line": 36,
          "environment": "staging"
        },
        {
          "file": "app-delivery/dataflow-svc/envs/prod/config.yaml",
          "line": 36,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dedicated-3-layer-migrate",
      "to_object": "config-center",
      "relation": "manifest_references_service",
      "reference_type": "dns_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/dev/config.yaml",
          "line": 16,
          "snippet": "configCenterAddr: config-center.devops.svc:8080",
          "environment": "dev"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/staging/config.yaml",
          "line": 16,
          "snippet": "configCenterAddr: config-center.devops.svc:8080",
          "environment": "staging"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/prod/config.yaml",
          "line": 37,
          "snippet": "configCenterAddr: config-center.devops.svc:8080",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/config-center",
        "source_family": null
      },
      "edge_id": "edge:dedicated-3-layer-migrate:manifest-references-service:config-center",
      "derivation_rule": "Extracted from manifest or config values using raw service DNS addresses.",
      "evidence_files": [
        "app-delivery/dedicated-3-layer-migrate/envs/dev/config.yaml",
        "app-delivery/dedicated-3-layer-migrate/envs/prod/config.yaml",
        "app-delivery/dedicated-3-layer-migrate/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/dev/config.yaml",
          "line": 16,
          "environment": "dev"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/staging/config.yaml",
          "line": 16,
          "environment": "staging"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/prod/config.yaml",
          "line": 37,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dedicated-3-layer-migrate",
      "to_object": "tempo-migrate",
      "relation": "manifest_references_service",
      "reference_type": "dns_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/dev/config.yaml",
          "line": 13,
          "snippet": "globalMigrationServiceAddr: tempo-migrate-service.tidb-management-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/staging/config.yaml",
          "line": 13,
          "snippet": "globalMigrationServiceAddr: tempo-migrate-service.tidb-management-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/prod/config.yaml",
          "line": 31,
          "snippet": "globalMigrationServiceAddr: tempo-migrate-service.tidb-management-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:dedicated-3-layer-migrate:manifest-references-service:tempo-migrate",
      "derivation_rule": "Extracted from manifest or config values using raw service DNS addresses.",
      "evidence_files": [
        "app-delivery/dedicated-3-layer-migrate/envs/dev/config.yaml",
        "app-delivery/dedicated-3-layer-migrate/envs/prod/config.yaml",
        "app-delivery/dedicated-3-layer-migrate/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/dev/config.yaml",
          "line": 13,
          "environment": "dev"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/staging/config.yaml",
          "line": 13,
          "environment": "staging"
        },
        {
          "file": "app-delivery/dedicated-3-layer-migrate/envs/prod/config.yaml",
          "line": 31,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dedicated-global-service",
      "to_object": "config-center",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dedicated-global-service/envs/dev/config.yaml",
          "line": 33,
          "snippet": "configCenterAddr: kubernetes:///config-center.devops:8080",
          "environment": "dev"
        },
        {
          "file": "app-delivery/dedicated-global-service/envs/staging/config.yaml",
          "line": 32,
          "snippet": "configCenterAddr: kubernetes:///config-center.devops:8080",
          "environment": "staging"
        },
        {
          "file": "app-delivery/dedicated-global-service/envs/prod/config.yaml",
          "line": 32,
          "snippet": "configCenterAddr: kubernetes:///config-center.devops:8080",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/config-center",
        "source_family": null
      },
      "edge_id": "edge:dedicated-global-service:manifest-references-service:config-center",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/dedicated-global-service/envs/dev/config.yaml",
        "app-delivery/dedicated-global-service/envs/prod/config.yaml",
        "app-delivery/dedicated-global-service/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dedicated-global-service/envs/dev/config.yaml",
          "line": 33,
          "environment": "dev"
        },
        {
          "file": "app-delivery/dedicated-global-service/envs/staging/config.yaml",
          "line": 32,
          "environment": "staging"
        },
        {
          "file": "app-delivery/dedicated-global-service/envs/prod/config.yaml",
          "line": 32,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "dedicated-global-service",
      "to_object": "serverless-svc",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dedicated-global-service/envs/dev/config.yaml",
          "line": 30,
          "snippet": "serverlessSvcAddr: kubernetes:///serverless-svc-grpc.nightly-ms:10000",
          "environment": "dev"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/serverless-service"
      },
      "notes": "Only the dev manifest currently carries an explicit serverlessSvcAddr line in the scanned app-delivery tree.",
      "edge_id": "edge:dedicated-global-service:manifest-references-service:serverless-svc",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/dedicated-global-service/envs/dev/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dedicated-global-service/envs/dev/config.yaml",
          "line": 30,
          "environment": "dev"
        }
      ]
    },
    {
      "from_object": "gardener-provider",
      "to_object": "config-service",
      "relation": "manifest_references_service",
      "reference_type": "http_service_url",
      "confidence": "high",
      "environments": [
        "nightly",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/gardener-provider/envs/nightly/config.yaml",
          "line": 1,
          "snippet": "configServiceUrl: http://config-service.gitops:8090",
          "environment": "nightly"
        },
        {
          "file": "app-delivery/gardener-provider/envs/staging/config.yaml",
          "line": 1,
          "snippet": "configServiceUrl: http://config-service.gitops:8090",
          "environment": "staging"
        },
        {
          "file": "app-delivery/gardener-provider/envs/prod/config.yaml",
          "line": 1,
          "snippet": "configServiceUrl: http://config-service.gitops:8090",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/config-service",
        "source_family": null
      },
      "edge_id": "edge:gardener-provider:manifest-references-service:config-service",
      "derivation_rule": "Extracted from manifest or config values using in-cluster HTTP service URLs.",
      "evidence_files": [
        "app-delivery/gardener-provider/envs/nightly/config.yaml",
        "app-delivery/gardener-provider/envs/prod/config.yaml",
        "app-delivery/gardener-provider/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/gardener-provider/envs/nightly/config.yaml",
          "line": 1,
          "environment": "nightly"
        },
        {
          "file": "app-delivery/gardener-provider/envs/staging/config.yaml",
          "line": 1,
          "environment": "staging"
        },
        {
          "file": "app-delivery/gardener-provider/envs/prod/config.yaml",
          "line": 1,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "serverless-global-service",
      "to_object": "serverless-svc",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/serverless-global-service/envs/dev/config.yaml",
          "line": 30,
          "snippet": "serverlessSvcAddr: kubernetes:///serverless-svc-grpc.nightly-ms:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/serverless-global-service/envs/staging/config.yaml",
          "line": 30,
          "snippet": "serverlessSvcAddr: kubernetes:///serverless-svc-grpc.staging-ms:10000",
          "environment": "staging"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/serverless-service"
      },
      "notes": "The current scan surfaced explicit service addresses in dev and staging variants.",
      "edge_id": "edge:serverless-global-service:manifest-references-service:serverless-svc",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/serverless-global-service/envs/dev/config.yaml",
        "app-delivery/serverless-global-service/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/serverless-global-service/envs/dev/config.yaml",
          "line": 30,
          "environment": "dev"
        },
        {
          "file": "app-delivery/serverless-global-service/envs/staging/config.yaml",
          "line": 30,
          "environment": "staging"
        }
      ]
    },
    {
      "from_object": "tempo-migrate",
      "to_object": "dedicated-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-migrate/envs/dev/config.yaml",
          "line": 55,
          "snippet": "dedicate-global-addr: kubernetes:///dedicated-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/staging/config.yaml",
          "line": 55,
          "snippet": "dedicate-global-addr: kubernetes:///dedicated-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/prod/config.yaml",
          "line": 48,
          "snippet": "dedicate-global-addr: kubernetes:///dedicated-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-migrate:manifest-references-service:dedicated-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-migrate/envs/dev/config.yaml",
        "app-delivery/tempo-migrate/envs/prod/config.yaml",
        "app-delivery/tempo-migrate/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-migrate/envs/dev/config.yaml",
          "line": 55,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/staging/config.yaml",
          "line": 55,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/prod/config.yaml",
          "line": 48,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tempo-migrate",
      "to_object": "tempo-proxy",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-migrate/envs/dev/config.yaml",
          "line": 58,
          "snippet": "core-svc-proxy-addr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/staging/config.yaml",
          "line": 58,
          "snippet": "core-svc-proxy-addr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/prod/config.yaml",
          "line": 51,
          "snippet": "core-svc-proxy-addr: kubernetes:///tempo-proxy.tidb-management-service:10102",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-migrate:manifest-references-service:tempo-proxy",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-migrate/envs/dev/config.yaml",
        "app-delivery/tempo-migrate/envs/prod/config.yaml",
        "app-delivery/tempo-migrate/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-migrate/envs/dev/config.yaml",
          "line": 58,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/staging/config.yaml",
          "line": 58,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-migrate/envs/prod/config.yaml",
          "line": 51,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tempo-proxy",
      "to_object": "dedicated-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-proxy/envs/dev/config.yaml",
          "line": 23,
          "snippet": "dedicatedGlobalAddr: kubernetes:///dedicated-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/staging/config.yaml",
          "line": 23,
          "snippet": "dedicatedGlobalAddr: kubernetes:///dedicated-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/prod/config.yaml",
          "line": 23,
          "snippet": "dedicatedGlobalAddr: kubernetes:///dedicated-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-proxy:manifest-references-service:dedicated-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-proxy/envs/dev/config.yaml",
        "app-delivery/tempo-proxy/envs/prod/config.yaml",
        "app-delivery/tempo-proxy/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-proxy/envs/dev/config.yaml",
          "line": 23,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/staging/config.yaml",
          "line": 23,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/prod/config.yaml",
          "line": 23,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tempo-proxy",
      "to_object": "serverless-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-proxy/envs/dev/config.yaml",
          "line": 22,
          "snippet": "serverlessGlobalAddr: kubernetes:///serverless-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/staging/config.yaml",
          "line": 22,
          "snippet": "serverlessGlobalAddr: kubernetes:///serverless-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/prod/config.yaml",
          "line": 22,
          "snippet": "serverlessGlobalAddr: kubernetes:///serverless-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-proxy:manifest-references-service:serverless-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-proxy/envs/dev/config.yaml",
        "app-delivery/tempo-proxy/envs/prod/config.yaml",
        "app-delivery/tempo-proxy/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-proxy/envs/dev/config.yaml",
          "line": 22,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/staging/config.yaml",
          "line": 22,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/prod/config.yaml",
          "line": 22,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tempo-proxy",
      "to_object": "tidb-mgmt-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-proxy/envs/dev/config.yaml",
          "line": 21,
          "snippet": "tiDBMgmtAddr: kubernetes:///tidb-mgmt-service:10001",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/staging/config.yaml",
          "line": 21,
          "snippet": "tiDBMgmtAddr: kubernetes:///tidb-mgmt-service:10001",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/prod/config.yaml",
          "line": 21,
          "snippet": "tiDBMgmtAddr: kubernetes:///tidb-mgmt-service:10001",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-proxy:manifest-references-service:tidb-mgmt-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-proxy/envs/dev/config.yaml",
        "app-delivery/tempo-proxy/envs/prod/config.yaml",
        "app-delivery/tempo-proxy/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-proxy/envs/dev/config.yaml",
          "line": 21,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/staging/config.yaml",
          "line": 21,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-proxy/envs/prod/config.yaml",
          "line": 21,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tempo-wrapper",
      "to_object": "dedicated-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-wrapper/envs/dev/config.yaml",
          "line": 25,
          "snippet": "dedicatedGlobalAddr: kubernetes:///dedicated-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/staging/config.yaml",
          "line": 25,
          "snippet": "dedicatedGlobalAddr: kubernetes:///dedicated-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/prod/config.yaml",
          "line": 25,
          "snippet": "dedicatedGlobalAddr: kubernetes:///dedicated-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-wrapper:manifest-references-service:dedicated-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-wrapper/envs/dev/config.yaml",
        "app-delivery/tempo-wrapper/envs/prod/config.yaml",
        "app-delivery/tempo-wrapper/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-wrapper/envs/dev/config.yaml",
          "line": 25,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/staging/config.yaml",
          "line": 25,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/prod/config.yaml",
          "line": 25,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tempo-wrapper",
      "to_object": "serverless-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-wrapper/envs/dev/config.yaml",
          "line": 24,
          "snippet": "serverlessGlobalAddr: kubernetes:///serverless-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/staging/config.yaml",
          "line": 24,
          "snippet": "serverlessGlobalAddr: kubernetes:///serverless-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/prod/config.yaml",
          "line": 24,
          "snippet": "serverlessGlobalAddr: kubernetes:///serverless-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-wrapper:manifest-references-service:serverless-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-wrapper/envs/dev/config.yaml",
        "app-delivery/tempo-wrapper/envs/prod/config.yaml",
        "app-delivery/tempo-wrapper/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-wrapper/envs/dev/config.yaml",
          "line": 24,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/staging/config.yaml",
          "line": 24,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/prod/config.yaml",
          "line": 24,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tempo-wrapper",
      "to_object": "tidb-mgmt-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tempo-wrapper/envs/dev/config.yaml",
          "line": 23,
          "snippet": "mgmtSvcAddr: kubernetes:///tidb-mgmt-service:10001",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/staging/config.yaml",
          "line": 23,
          "snippet": "mgmtSvcAddr: kubernetes:///tidb-mgmt-service:10001",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/prod/config.yaml",
          "line": 23,
          "snippet": "mgmtSvcAddr: kubernetes:///tidb-mgmt-service:10001",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tempo-wrapper:manifest-references-service:tidb-mgmt-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tempo-wrapper/envs/dev/config.yaml",
        "app-delivery/tempo-wrapper/envs/prod/config.yaml",
        "app-delivery/tempo-wrapper/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tempo-wrapper/envs/dev/config.yaml",
          "line": 23,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/staging/config.yaml",
          "line": 23,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tempo-wrapper/envs/prod/config.yaml",
          "line": 23,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tidb-mgmt-portal",
      "to_object": "dedicated-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/dev/config.yaml",
          "line": 27,
          "snippet": "address: kubernetes:///dedicated-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/staging/config.yaml",
          "line": 26,
          "snippet": "address: kubernetes:///dedicated-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/prod/config.yaml",
          "line": 25,
          "snippet": "address: kubernetes:///dedicated-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tidb-mgmt-portal:manifest-references-service:dedicated-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tidb-mgmt-portal/envs/dev/config.yaml",
        "app-delivery/tidb-mgmt-portal/envs/prod/config.yaml",
        "app-delivery/tidb-mgmt-portal/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/dev/config.yaml",
          "line": 27,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/staging/config.yaml",
          "line": 26,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/prod/config.yaml",
          "line": 25,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tidb-mgmt-portal",
      "to_object": "tidb-mgmt-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/dev/config.yaml",
          "line": 17,
          "snippet": "address: kubernetes:///tidb-mgmt-service:10001",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/staging/config.yaml",
          "line": 17,
          "snippet": "address: kubernetes:///tidb-mgmt-service:10001",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/prod/config.yaml",
          "line": 17,
          "snippet": "address: kubernetes:///tidb-mgmt-service:10001",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tidb-mgmt-portal:manifest-references-service:tidb-mgmt-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tidb-mgmt-portal/envs/dev/config.yaml",
        "app-delivery/tidb-mgmt-portal/envs/prod/config.yaml",
        "app-delivery/tidb-mgmt-portal/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/dev/config.yaml",
          "line": 17,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/staging/config.yaml",
          "line": 17,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-portal/envs/prod/config.yaml",
          "line": 17,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tidb-mgmt-service",
      "to_object": "dedicated-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
          "line": 32,
          "snippet": "url: kubernetes:///dedicated-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/staging/config.yaml",
          "line": 36,
          "snippet": "url: kubernetes:///dedicated-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
          "line": 35,
          "snippet": "url: kubernetes:///dedicated-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tidb-mgmt-service:manifest-references-service:dedicated-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
        "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
        "app-delivery/tidb-mgmt-service/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
          "line": 32,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/staging/config.yaml",
          "line": 36,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
          "line": 35,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tidb-mgmt-service",
      "to_object": "nextgen-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
          "line": 34,
          "snippet": "url: kubernetes:///nextgen-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/staging/config.yaml",
          "line": 40,
          "snippet": "url: kubernetes:///nextgen-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
          "line": 39,
          "snippet": "url: kubernetes:///nextgen-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tidb-mgmt-service:manifest-references-service:nextgen-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
        "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
        "app-delivery/tidb-mgmt-service/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
          "line": 34,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/staging/config.yaml",
          "line": 40,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
          "line": 39,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "tidb-mgmt-service",
      "to_object": "serverless-global-service",
      "relation": "manifest_references_service",
      "reference_type": "kubernetes_service_addr",
      "confidence": "high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
          "line": 29,
          "snippet": "url: kubernetes:///serverless-global-service:10000",
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/staging/config.yaml",
          "line": 31,
          "snippet": "url: kubernetes:///serverless-global-service:10000",
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
          "line": 30,
          "snippet": "url: kubernetes:///serverless-global-service:10000",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/tidb-management-service"
      },
      "edge_id": "edge:tidb-mgmt-service:manifest-references-service:serverless-global-service",
      "derivation_rule": "Extracted from manifest or config values using kubernetes:/// or in-cluster service DNS targets.",
      "evidence_files": [
        "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
        "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
        "app-delivery/tidb-mgmt-service/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/tidb-mgmt-service/envs/dev/config.yaml",
          "line": 29,
          "environment": "dev"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/staging/config.yaml",
          "line": 31,
          "environment": "staging"
        },
        {
          "file": "app-delivery/tidb-mgmt-service/envs/prod/config.yaml",
          "line": 30,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "chaos-provider",
      "to_object": "external-secrets-operator",
      "relation": "manifest_requires_addon_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "third-party addon bundle"
      },
      "edge_id": "edge:chaos-provider:manifest-requires-addon-crd:external-secrets-operator",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml",
          "line": 1,
          "environment": null
        }
      ]
    },
    {
      "from_object": "cluster-service",
      "to_object": "external-secrets-operator",
      "relation": "manifest_requires_addon_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [
        "prod-aws"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 17,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 33,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": "prod-aws"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "third-party addon bundle"
      },
      "notes": "The secret manifests live under the dedicated-cluster-service package and normalize to the cluster-service deployment object in KB.",
      "edge_id": "edge:cluster-service:manifest-requires-addon-crd:external-secrets-operator",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 1,
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 17,
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 33,
          "environment": "prod-aws"
        }
      ]
    },
    {
      "from_object": "config-manager",
      "to_object": "external-secrets-operator",
      "relation": "manifest_requires_addon_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [
        "dev-us-east-1"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": null
        },
        {
          "file": "app-delivery/config-manager/envs/dev-us-east-1/config-manager-external-secrets.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": "dev-us-east-1"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/infra-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "third-party addon bundle"
      },
      "edge_id": "edge:config-manager:manifest-requires-addon-crd:external-secrets-operator",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml",
        "app-delivery/config-manager/envs/dev-us-east-1/config-manager-external-secrets.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml",
          "line": 1,
          "environment": null
        },
        {
          "file": "app-delivery/config-manager/envs/dev-us-east-1/config-manager-external-secrets.yaml",
          "line": 1,
          "environment": "dev-us-east-1"
        }
      ]
    },
    {
      "from_object": "eks-provider",
      "to_object": "external-secrets-operator",
      "relation": "manifest_requires_addon_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "exact_unscanned_repo",
        "source_repo": "tidbcloud/eks-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "third-party addon bundle"
      },
      "edge_id": "edge:eks-provider:manifest-requires-addon-crd:external-secrets-operator",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml",
          "line": 1,
          "environment": null
        }
      ]
    },
    {
      "from_object": "gardener-provider",
      "to_object": "external-secrets-operator",
      "relation": "manifest_requires_addon_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 18,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "third-party addon bundle"
      },
      "edge_id": "edge:gardener-provider:manifest-requires-addon-crd:external-secrets-operator",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/gardener-provider/base/kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 1,
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 18,
          "environment": null
        }
      ]
    },
    {
      "from_object": "gke-provider",
      "to_object": "external-secrets-operator",
      "relation": "manifest_requires_addon_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1beta1",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/gke-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "third-party addon bundle"
      },
      "edge_id": "edge:gke-provider:manifest-requires-addon-crd:external-secrets-operator",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml",
          "line": 1,
          "environment": null
        }
      ]
    },
    {
      "from_object": "chaos-provider",
      "to_object": "cluster-secret-store",
      "relation": "manifest_references_secret_store",
      "reference_type": "cluster_secret_store_ref",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": null
        },
        {
          "file": "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml",
          "line": 9,
          "snippet": "name: default               # name of the SecretStore (or kind specified)",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "deployment bundle"
      },
      "edge_id": "edge:chaos-provider:manifest-references-secret-store:cluster-secret-store",
      "derivation_rule": "Extracted from ExternalSecret or SecretStore references that require the cluster secret store bundle.",
      "evidence_files": [
        "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml",
          "line": 8,
          "environment": null
        },
        {
          "file": "app-delivery/chaos-provider/base/infra-kubeconfig-secret.yaml",
          "line": 9,
          "environment": null
        }
      ]
    },
    {
      "from_object": "cluster-service",
      "to_object": "cluster-secret-store",
      "relation": "manifest_references_secret_store",
      "reference_type": "cluster_secret_store_ref",
      "confidence": "high",
      "environments": [
        "prod-aws"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 24,
          "snippet": "kind: ClusterSecretStore",
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 40,
          "snippet": "kind: ClusterSecretStore",
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 9,
          "snippet": "name: default               # name of the SecretStore (or kind specified)",
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 25,
          "snippet": "name: default               # name of the SecretStore (or kind specified)",
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 41,
          "snippet": "name: default               # name of the SecretStore (or kind specified)",
          "environment": "prod-aws"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "deployment bundle"
      },
      "notes": "The secret manifests live under the dedicated-cluster-service package and normalize to the cluster-service deployment object in KB.",
      "edge_id": "edge:cluster-service:manifest-references-secret-store:cluster-secret-store",
      "derivation_rule": "Extracted from ExternalSecret or SecretStore references that require the cluster secret store bundle.",
      "evidence_files": [
        "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 8,
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 24,
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 40,
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 9,
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 25,
          "environment": "prod-aws"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/variants/prod-aws/secrets.yaml",
          "line": 41,
          "environment": "prod-aws"
        }
      ]
    },
    {
      "from_object": "config-manager",
      "to_object": "cluster-secret-store",
      "relation": "manifest_references_secret_store",
      "reference_type": "cluster_secret_store_ref",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": null
        },
        {
          "file": "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml",
          "line": 9,
          "snippet": "name: default               # name of the SecretStore (or kind specified)",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/infra-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "deployment bundle"
      },
      "edge_id": "edge:config-manager:manifest-references-secret-store:cluster-secret-store",
      "derivation_rule": "Extracted from ExternalSecret or SecretStore references that require the cluster secret store bundle.",
      "evidence_files": [
        "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml",
          "line": 8,
          "environment": null
        },
        {
          "file": "app-delivery/config-manager/base/config-manager-gcp-credentials-secret.yaml",
          "line": 9,
          "environment": null
        }
      ]
    },
    {
      "from_object": "eks-provider",
      "to_object": "cluster-secret-store",
      "relation": "manifest_references_secret_store",
      "reference_type": "cluster_secret_store_ref",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": null
        },
        {
          "file": "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml",
          "line": 9,
          "snippet": "name: default # name of the SecretStore (or kind specified)",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "exact_unscanned_repo",
        "source_repo": "tidbcloud/eks-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "deployment bundle"
      },
      "edge_id": "edge:eks-provider:manifest-references-secret-store:cluster-secret-store",
      "derivation_rule": "Extracted from ExternalSecret or SecretStore references that require the cluster secret store bundle.",
      "evidence_files": [
        "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml",
          "line": 8,
          "environment": null
        },
        {
          "file": "app-delivery/eks-provider/base/infra-kubeconfig-secret.yaml",
          "line": 9,
          "environment": null
        }
      ]
    },
    {
      "from_object": "gardener-provider",
      "to_object": "cluster-secret-store",
      "relation": "manifest_references_secret_store",
      "reference_type": "cluster_secret_store_ref",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 25,
          "snippet": "kind: ClusterSecretStore",
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 9,
          "snippet": "name: default # name of the SecretStore (or kind specified)",
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 26,
          "snippet": "name: default # name of the SecretStore (or kind specified)",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "deployment bundle"
      },
      "edge_id": "edge:gardener-provider:manifest-references-secret-store:cluster-secret-store",
      "derivation_rule": "Extracted from ExternalSecret or SecretStore references that require the cluster secret store bundle.",
      "evidence_files": [
        "app-delivery/gardener-provider/base/kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 8,
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 25,
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 9,
          "environment": null
        },
        {
          "file": "app-delivery/gardener-provider/base/kubeconfig-secret.yaml",
          "line": 26,
          "environment": null
        }
      ]
    },
    {
      "from_object": "gke-provider",
      "to_object": "cluster-secret-store",
      "relation": "manifest_references_secret_store",
      "reference_type": "cluster_secret_store_ref",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml",
          "line": 10,
          "snippet": "kind: ClusterSecretStore",
          "environment": null
        },
        {
          "file": "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml",
          "line": 11,
          "snippet": "name: default               # name of the SecretStore (or kind specified)",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/gke-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "addon_bundle",
        "source_repo": null,
        "source_family": "deployment bundle"
      },
      "edge_id": "edge:gke-provider:manifest-references-secret-store:cluster-secret-store",
      "derivation_rule": "Extracted from ExternalSecret or SecretStore references that require the cluster secret store bundle.",
      "evidence_files": [
        "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml",
          "line": 10,
          "environment": null
        },
        {
          "file": "app-delivery/gke-provider/base/infra-kubeconfig-secret.yaml",
          "line": 11,
          "environment": null
        }
      ]
    },
    {
      "from_object": "o11y-agent-control-server",
      "to_object": "o11y-cluster-agent-crd",
      "relation": "manifest_requires_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [],
      "evidence_samples": [
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 14,
          "snippet": "- agent.observability.pingcap.com",
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 32,
          "snippet": "- agent.observability.pingcap.com",
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 44,
          "snippet": "- agent.observability.pingcap.com",
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 17,
          "snippet": "- o11yclusters",
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 35,
          "snippet": "- o11yclusters/finalizers",
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 47,
          "snippet": "- o11yclusters/status",
          "environment": null
        },
        {
          "file": "app-delivery/o11y-cluster-agent-crd/base/agent.observability.pingcap.com_o11yclusters.yaml",
          "line": 8,
          "snippet": "name: o11yclusters.agent.observability.pingcap.com",
          "environment": null
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/observability"
      },
      "to_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/observability"
      },
      "notes": "The controller role explicitly requests access to the o11yclusters resource in the same API group that the o11y-cluster-agent-crd package installs.",
      "edge_id": "edge:o11y-agent-control-server:manifest-requires-crd:o11y-cluster-agent-crd",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/o11y-agent-control-server/base/role.yaml",
        "app-delivery/o11y-cluster-agent-crd/base/agent.observability.pingcap.com_o11yclusters.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 14,
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 32,
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 44,
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 17,
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 35,
          "environment": null
        },
        {
          "file": "app-delivery/o11y-agent-control-server/base/role.yaml",
          "line": 47,
          "environment": null
        },
        {
          "file": "app-delivery/o11y-cluster-agent-crd/base/agent.observability.pingcap.com_o11yclusters.yaml",
          "line": 8,
          "environment": null
        }
      ]
    },
    {
      "from_object": "cluster-service",
      "to_object": "clinic",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev-us-west-2",
        "prod-us-west-2",
        "staging-us-west-2"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/envs/dev-us-west-2/root-config.yaml",
          "line": 31,
          "snippet": "clinicEndpoint: \"http://clinic-dev-1923272735.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "dev-us-west-2"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/envs/staging-us-west-2/root-config.yaml",
          "line": 32,
          "snippet": "clinicEndpoint: \"http://clinic-staging-1072990385.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "staging-us-west-2"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/envs/prod-us-west-2/root-config.yaml",
          "line": 33,
          "snippet": "clinicEndpoint: \"https://clinic.pingcap.com\"",
          "environment": "prod-us-west-2"
        }
      ],
      "from_mapping": {
        "mapping_type": "multi_binary_family",
        "source_repo": null,
        "source_family": "tidbcloud/infra-provider"
      },
      "to_mapping": {
        "mapping_type": "deployment_bundle",
        "source_repo": null,
        "source_family": "tidbcloud/clinic-cd"
      },
      "notes": "The evidence lives under the dedicated-cluster-service/cluster-controller package, which the KB mapping normalizes to the deployment object cluster-service.",
      "edge_id": "edge:cluster-service:manifest-references-mapped-endpoint:clinic",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/dedicated-cluster-service/cluster-controller/envs/dev-us-west-2/root-config.yaml",
        "app-delivery/dedicated-cluster-service/cluster-controller/envs/prod-us-west-2/root-config.yaml",
        "app-delivery/dedicated-cluster-service/cluster-controller/envs/staging-us-west-2/root-config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/envs/dev-us-west-2/root-config.yaml",
          "line": 31,
          "environment": "dev-us-west-2"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/envs/staging-us-west-2/root-config.yaml",
          "line": 32,
          "environment": "staging-us-west-2"
        },
        {
          "file": "app-delivery/dedicated-cluster-service/cluster-controller/envs/prod-us-west-2/root-config.yaml",
          "line": 33,
          "environment": "prod-us-west-2"
        }
      ]
    },
    {
      "from_object": "config-manager",
      "to_object": "clinic",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev-us-east-1",
        "nightly",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/config-manager/envs/dev-us-east-1/config.yaml",
          "line": 10,
          "snippet": "clinicEndpoint: \"http://clinic-dev-1923272735.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "dev-us-east-1"
        },
        {
          "file": "app-delivery/config-manager/envs/nightly/config.yaml",
          "line": 9,
          "snippet": "clinicEndpoint: \"http://clinic-dev-1923272735.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "nightly"
        },
        {
          "file": "app-delivery/config-manager/envs/staging/config.yaml",
          "line": 10,
          "snippet": "clinicEndpoint: \"http://clinic-staging-1072990385.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "staging"
        },
        {
          "file": "app-delivery/config-manager/envs/prod/config.yaml",
          "line": 10,
          "snippet": "clinicEndpoint: \"https://clinic.pingcap.com\"",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/infra-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "deployment_bundle",
        "source_repo": null,
        "source_family": "tidbcloud/clinic-cd"
      },
      "notes": "The manifest points at environment-specific Clinic endpoints rather than an in-cluster service name, but the hostname family clearly resolves back to the Clinic deployment object already mapped in KB.",
      "edge_id": "edge:config-manager:manifest-references-mapped-endpoint:clinic",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/config-manager/envs/dev-us-east-1/config.yaml",
        "app-delivery/config-manager/envs/nightly/config.yaml",
        "app-delivery/config-manager/envs/prod/config.yaml",
        "app-delivery/config-manager/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/config-manager/envs/dev-us-east-1/config.yaml",
          "line": 10,
          "environment": "dev-us-east-1"
        },
        {
          "file": "app-delivery/config-manager/envs/nightly/config.yaml",
          "line": 9,
          "environment": "nightly"
        },
        {
          "file": "app-delivery/config-manager/envs/staging/config.yaml",
          "line": 10,
          "environment": "staging"
        },
        {
          "file": "app-delivery/config-manager/envs/prod/config.yaml",
          "line": 10,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "devops-service",
      "to_object": "clinic",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dev/devops-service/aiops-server/envs/dev/config.yaml",
          "line": 16,
          "snippet": "base_url: https://clinic.pingcap.com",
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/devops-service/aiops-server/envs/staging/config.yaml",
          "line": 16,
          "snippet": "base_url: https://clinic.pingcap.com",
          "environment": "staging"
        },
        {
          "file": "app-delivery/devops-service/aiops-server/envs/prod/config.yaml",
          "line": 16,
          "snippet": "base_url: https://clinic.pingcap.com",
          "environment": "prod"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/devops",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "deployment_bundle",
        "source_repo": null,
        "source_family": "tidbcloud/clinic-cd"
      },
      "notes": "The AIOps slice under the devops-service package integrates with Clinic through its public base URL across dev, staging, and prod.",
      "edge_id": "edge:devops-service:manifest-references-mapped-endpoint:clinic",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/dev/devops-service/aiops-server/envs/dev/config.yaml",
        "app-delivery/devops-service/aiops-server/envs/prod/config.yaml",
        "app-delivery/staging/devops-service/aiops-server/envs/staging/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dev/devops-service/aiops-server/envs/dev/config.yaml",
          "line": 16,
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/devops-service/aiops-server/envs/staging/config.yaml",
          "line": 16,
          "environment": "staging"
        },
        {
          "file": "app-delivery/devops-service/aiops-server/envs/prod/config.yaml",
          "line": 16,
          "environment": "prod"
        }
      ]
    },
    {
      "from_object": "eks-provider",
      "to_object": "clinic",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev-us-east-1",
        "prod-us-west-2",
        "stg-us-east-1"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/eks-provider/envs/dev-us-east-1/config.yaml",
          "line": 30,
          "snippet": "clinicEndpoint: \"http://clinic-dev-1923272735.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "dev-us-east-1"
        },
        {
          "file": "app-delivery/eks-provider/envs/stg-us-east-1/config.yaml",
          "line": 29,
          "snippet": "clinicEndpoint: \"http://clinic-staging-1072990385.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "stg-us-east-1"
        },
        {
          "file": "app-delivery/eks-provider/envs/prod-us-west-2/config.yaml",
          "line": 33,
          "snippet": "clinicEndpoint: \"https://clinic.pingcap.com\"",
          "environment": "prod-us-west-2"
        },
        {
          "file": "app-delivery/eks-provider/envs/prod-us-west-2/config.yaml",
          "line": 419,
          "snippet": "clinicEndpoint: \"https://clinic.pingcap.com\"",
          "environment": "prod-us-west-2"
        }
      ],
      "from_mapping": {
        "mapping_type": "exact_unscanned_repo",
        "source_repo": "tidbcloud/eks-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "deployment_bundle",
        "source_repo": null,
        "source_family": "tidbcloud/clinic-cd"
      },
      "notes": "Like GKE provider, EKS provider references Clinic through environment-specific public endpoints rather than an internal service URL.",
      "edge_id": "edge:eks-provider:manifest-references-mapped-endpoint:clinic",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/eks-provider/envs/dev-us-east-1/config.yaml",
        "app-delivery/eks-provider/envs/prod-us-west-2/config.yaml",
        "app-delivery/eks-provider/envs/stg-us-east-1/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/eks-provider/envs/dev-us-east-1/config.yaml",
          "line": 30,
          "environment": "dev-us-east-1"
        },
        {
          "file": "app-delivery/eks-provider/envs/stg-us-east-1/config.yaml",
          "line": 29,
          "environment": "stg-us-east-1"
        },
        {
          "file": "app-delivery/eks-provider/envs/prod-us-west-2/config.yaml",
          "line": 33,
          "environment": "prod-us-west-2"
        },
        {
          "file": "app-delivery/eks-provider/envs/prod-us-west-2/config.yaml",
          "line": 419,
          "environment": "prod-us-west-2"
        }
      ]
    },
    {
      "from_object": "gke-provider",
      "to_object": "clinic",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev-us-west2",
        "prod-us-west1",
        "stg-us-central1"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/gke-provider/envs/dev-us-west2/config.yaml",
          "line": 14,
          "snippet": "clinicEndpoint: \"http://clinic-dev-1923272735.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "dev-us-west2"
        },
        {
          "file": "app-delivery/gke-provider/envs/stg-us-central1/config.yaml",
          "line": 14,
          "snippet": "clinicEndpoint: \"http://clinic-staging-1072990385.us-west-2.elb.amazonaws.com:8085\"",
          "environment": "stg-us-central1"
        },
        {
          "file": "app-delivery/gke-provider/envs/prod-us-west1/config.yaml",
          "line": 12,
          "snippet": "clinicEndpoint: \"https://clinic.pingcap.com\"",
          "environment": "prod-us-west1"
        },
        {
          "file": "app-delivery/gke-provider/envs/prod-us-west1/config.yaml",
          "line": 365,
          "snippet": "clinicEndpoint: \"https://clinic.pingcap.com\"",
          "environment": "prod-us-west1"
        }
      ],
      "from_mapping": {
        "mapping_type": "direct_scanned_repo",
        "source_repo": "tidbcloud/gke-provider",
        "source_family": null
      },
      "to_mapping": {
        "mapping_type": "deployment_bundle",
        "source_repo": null,
        "source_family": "tidbcloud/clinic-cd"
      },
      "notes": "Provider manifests use per-environment Clinic public endpoints for activity/config-change flows.",
      "edge_id": "edge:gke-provider:manifest-references-mapped-endpoint:clinic",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/gke-provider/envs/dev-us-west2/config.yaml",
        "app-delivery/gke-provider/envs/prod-us-west1/config.yaml",
        "app-delivery/gke-provider/envs/stg-us-central1/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/gke-provider/envs/dev-us-west2/config.yaml",
          "line": 14,
          "environment": "dev-us-west2"
        },
        {
          "file": "app-delivery/gke-provider/envs/stg-us-central1/config.yaml",
          "line": 14,
          "environment": "stg-us-central1"
        },
        {
          "file": "app-delivery/gke-provider/envs/prod-us-west1/config.yaml",
          "line": 12,
          "environment": "prod-us-west1"
        },
        {
          "file": "app-delivery/gke-provider/envs/prod-us-west1/config.yaml",
          "line": 365,
          "environment": "prod-us-west1"
        }
      ]
    },
    {
      "from_object": "clinic",
      "to_object": "external-secrets-operator",
      "relation": "manifest_requires_addon_crd",
      "reference_type": "api_group_crd",
      "confidence": "high",
      "environments": [
        "dev",
        "prod-cloud",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/clinic/chaos-api/base/externalsecret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1",
          "environment": "prod-cloud"
        },
        {
          "file": "app-delivery/dev/clinic/cloud-server/base/externalsecret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1",
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/clinic/cloud-server/base/externalsecret.yaml",
          "line": 1,
          "snippet": "apiVersion: external-secrets.io/v1",
          "environment": "staging"
        }
      ],
      "notes": "Clinic bundle workloads define ExternalSecret resources, normalized back to the generic external-secrets-operator addon object.",
      "edge_id": "edge:clinic:manifest-requires-addon-crd:external-secrets-operator",
      "derivation_rule": "Extracted from controller manifests that require an API group or CRD installed by another deployment object.",
      "evidence_files": [
        "app-delivery/clinic/chaos-api/base/externalsecret.yaml",
        "app-delivery/dev/clinic/cloud-server/base/externalsecret.yaml",
        "app-delivery/staging/clinic/cloud-server/base/externalsecret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/clinic/chaos-api/base/externalsecret.yaml",
          "line": 1,
          "environment": "prod-cloud"
        },
        {
          "file": "app-delivery/dev/clinic/cloud-server/base/externalsecret.yaml",
          "line": 1,
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/clinic/cloud-server/base/externalsecret.yaml",
          "line": 1,
          "environment": "staging"
        }
      ]
    },
    {
      "from_object": "clinic",
      "to_object": "cluster-secret-store",
      "relation": "manifest_references_secret_store",
      "reference_type": "cluster_secret_store_ref",
      "confidence": "high",
      "environments": [
        "dev",
        "prod-cloud",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/clinic/chaos-api/base/externalsecret.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": "prod-cloud"
        },
        {
          "file": "app-delivery/dev/clinic/cloud-server/base/externalsecret.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/clinic/cloud-server/base/externalsecret.yaml",
          "line": 8,
          "snippet": "kind: ClusterSecretStore",
          "environment": "staging"
        }
      ],
      "notes": "Clinic bundle workloads reference ClusterSecretStore-backed ExternalSecret resources.",
      "edge_id": "edge:clinic:manifest-references-secret-store:cluster-secret-store",
      "derivation_rule": "Extracted from ExternalSecret or SecretStore references that require the cluster secret store bundle.",
      "evidence_files": [
        "app-delivery/clinic/chaos-api/base/externalsecret.yaml",
        "app-delivery/dev/clinic/cloud-server/base/externalsecret.yaml",
        "app-delivery/staging/clinic/cloud-server/base/externalsecret.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/clinic/chaos-api/base/externalsecret.yaml",
          "line": 8,
          "environment": "prod-cloud"
        },
        {
          "file": "app-delivery/dev/clinic/cloud-server/base/externalsecret.yaml",
          "line": 8,
          "environment": "dev"
        },
        {
          "file": "app-delivery/staging/clinic/cloud-server/base/externalsecret.yaml",
          "line": 8,
          "environment": "staging"
        }
      ]
    },
    {
      "from_object": "clinic",
      "to_object": "o11y-svc",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev-cloud",
        "prod-cloud",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dev/clinic/clinic-data-service/envs/dev-cloud/configs/config.yaml",
          "line": 78,
          "snippet": "o11yGlobalServerUrl: \"http://www.gs.us-west-2.aws.observability.tidbcloud.com\"",
          "environment": "dev-cloud"
        },
        {
          "file": "app-delivery/clinic/clinic-data-service/envs/prod-cloud/configs/config.yaml",
          "line": 76,
          "snippet": "o11yGlobalServerUrl: \"http://www.gs.us-west-2.aws.observability.tidbcloud.com\"",
          "environment": "prod-cloud"
        },
        {
          "file": "app-delivery/staging/clinic/clinic-data-service/envs/staging/configs/config.yaml",
          "line": 78,
          "snippet": "o11yGlobalServerUrl: \"http://www.gs.us-west-2.aws.observability.tidbcloud.com\"",
          "environment": "staging"
        }
      ],
      "notes": "Clinic data-service configs point at observability global-server endpoints, normalized back to o11y-svc.",
      "edge_id": "edge:clinic:manifest-references-mapped-endpoint:o11y-svc",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/clinic/clinic-data-service/envs/prod-cloud/configs/config.yaml",
        "app-delivery/dev/clinic/clinic-data-service/envs/dev-cloud/configs/config.yaml",
        "app-delivery/staging/clinic/clinic-data-service/envs/staging/configs/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dev/clinic/clinic-data-service/envs/dev-cloud/configs/config.yaml",
          "line": 78,
          "environment": "dev-cloud"
        },
        {
          "file": "app-delivery/clinic/clinic-data-service/envs/prod-cloud/configs/config.yaml",
          "line": 76,
          "environment": "prod-cloud"
        },
        {
          "file": "app-delivery/staging/clinic/clinic-data-service/envs/staging/configs/config.yaml",
          "line": 78,
          "environment": "staging"
        }
      ]
    },
    {
      "from_object": "nextgen-regional-control-plane",
      "to_object": "o11y-svc",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dev/nextgen-regional-control-plane/o11y-agent-control-server/envs/dev-aws-us-east-1-ng/config.yaml",
          "line": 13,
          "snippet": "openAPIAddress: \"https://www.gs.us-west-2.aws.observability.tidbcloud.com\"",
          "environment": "dev"
        },
        {
          "file": "app-delivery/nextgen-regional-control-plane/o11y-agent-control-server/envs/prod-aws-us-west-2-ng/config.yaml",
          "line": 13,
          "snippet": "openAPIAddress: \"https://www.gs.us-west-2.aws.observability.tidbcloud.com\"",
          "environment": "prod"
        },
        {
          "file": "app-delivery/staging/nextgen-regional-control-plane/o11y-agent-control-server/envs/staging-aws-us-west-2-ng-0711/config.yaml",
          "line": 13,
          "snippet": "openAPIAddress: \"https://www.gs.us-west-2.aws.observability.tidbcloud.com\"",
          "environment": "staging"
        }
      ],
      "notes": "Next-gen o11y-agent-control-server configs point at observability global-server endpoints, normalized back to o11y-svc.",
      "edge_id": "edge:nextgen-regional-control-plane:manifest-references-mapped-endpoint:o11y-svc",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/dev/nextgen-regional-control-plane/o11y-agent-control-server/envs/dev-aws-us-east-1-ng/config.yaml",
        "app-delivery/nextgen-regional-control-plane/o11y-agent-control-server/envs/prod-aws-us-west-2-ng/config.yaml",
        "app-delivery/staging/nextgen-regional-control-plane/o11y-agent-control-server/envs/staging-aws-us-west-2-ng-0711/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dev/nextgen-regional-control-plane/o11y-agent-control-server/envs/dev-aws-us-east-1-ng/config.yaml",
          "line": 13,
          "environment": "dev"
        },
        {
          "file": "app-delivery/nextgen-regional-control-plane/o11y-agent-control-server/envs/prod-aws-us-west-2-ng/config.yaml",
          "line": 13,
          "environment": "prod"
        },
        {
          "file": "app-delivery/staging/nextgen-regional-control-plane/o11y-agent-control-server/envs/staging-aws-us-west-2-ng-0711/config.yaml",
          "line": 13,
          "environment": "staging"
        }
      ]
    },
    {
      "from_object": "devops-service",
      "to_object": "o11y-svc",
      "relation": "manifest_references_mapped_endpoint",
      "reference_type": "external_mapped_object_url",
      "confidence": "medium-high",
      "environments": [
        "dev",
        "prod",
        "staging"
      ],
      "evidence_samples": [
        {
          "file": "app-delivery/dev/devops-service/devops-server/envs/dev/configs/config.yaml",
          "line": 297,
          "snippet": "o11yEndpoint: http://www.ds.us-west-2.aws.observability.tidbcloud.com",
          "environment": "dev"
        },
        {
          "file": "app-delivery/devops-service/devops-server/envs/prod/configs/config.yaml",
          "line": 331,
          "snippet": "o11yEndpoint: http://www.ds.us-west-2.aws.observability.tidbcloud.com",
          "environment": "prod"
        },
        {
          "file": "app-delivery/staging/devops-service/devops-server/envs/staging/configs/config.yaml",
          "line": 276,
          "snippet": "o11yEndpoint: http://www.ds.us-west-2.aws.observability.tidbcloud.com",
          "environment": "staging"
        }
      ],
      "notes": "Devops-service tenant configs point at observability endpoints, normalized back to o11y-svc.",
      "edge_id": "edge:devops-service:manifest-references-mapped-endpoint:o11y-svc",
      "derivation_rule": "Extracted from manifests that point at known public or load-balanced endpoints and normalized back to a mapped deployment object.",
      "evidence_files": [
        "app-delivery/dev/devops-service/devops-server/envs/dev/configs/config.yaml",
        "app-delivery/devops-service/devops-server/envs/prod/configs/config.yaml",
        "app-delivery/staging/devops-service/devops-server/envs/staging/configs/config.yaml"
      ],
      "evidence_locations": [
        {
          "file": "app-delivery/dev/devops-service/devops-server/envs/dev/configs/config.yaml",
          "line": 297,
          "environment": "dev"
        },
        {
          "file": "app-delivery/devops-service/devops-server/envs/prod/configs/config.yaml",
          "line": 331,
          "environment": "prod"
        },
        {
          "file": "app-delivery/staging/devops-service/devops-server/envs/staging/configs/config.yaml",
          "line": 276,
          "environment": "staging"
        }
      ]
    }
  ]
}