agent: add deterministic Service endpoint diagnosis

[hellices]

Summary

• add a pure, versioned Service-to-EndpointSlice analyzer with structured findings, evidence, and explicit evidence gaps
• project native EndpointSlice readiness safely even when Kubernetes LIST items omit TypeMeta, while protecting same-kind CRDs by authoritative API group
• expose diagnose_service as one shared read-only structured-YAML tool for the full agent, small agent, and MCP, with follow mode opening the Service describe view
• make request-ceiling regression tests derive their budget from the registry tool schema

Why

Pod and Deployment diagnosis was already deterministic, but Service connectivity still depended on model inference. This first vertical slice of #191 identifies missing/no-ready endpoints without per-object GET fan-out and never reports healthy when EndpointSlice evidence is denied, unavailable, or stale.

Verification

• make check: Ruff, mypy, pytest (4106 passed, 21 skipped), tach
• task-by-task spec and quality reviews
• final whole-branch review: READY

Scope

This implements the Service/EndpointSlice phase of #191. PVC, PDB, node/scheduling, and missing-reference analyzer families remain follow-up work.

[Copilot]

Pull request overview

Adds deterministic Service-to-EndpointSlice diagnosis across agent and MCP surfaces.

Changes:

• Introduces versioned Service endpoint analysis with structured evidence and gaps.
• Adds EndpointSlice projection, tool registration, and follow-mode support.
• Expands regression tests and documentation.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/korvid/core/service_analysis.py	Implements deterministic analysis.
src/korvid/tools/executor.py	Executes Service diagnosis.
src/korvid/tools/registry.py	Registers the shared tool.
src/korvid/tools/follow.py	Opens Service describe views.
src/korvid/k8s/models.py	Adds EndpointSlice summaries.
src/korvid/k8s/client.py	Passes authoritative API groups.
src/korvid/evals/fake_kube.py	Aligns evaluation projections.
tests/core/test_service_analysis.py	Tests analysis rules.
tests/tools/test_executor.py	Tests tool execution and bounds.
tests/tools/test_registry.py	Tests registration and format.
tests/tools/test_follow.py	Tests follow behavior.
tests/tools/test_list_resources.py	Tests EndpointSlice rendering.
tests/k8s/test_models.py	Tests summary projection.
tests/k8s/test_client.py	Tests TypeMeta-less list items.
tests/agent/test_runtime.py	Derives request ceilings from schemas.
docs/agent.md	Documents agent diagnosis.
docs/mcp.md	Documents MCP exposure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/korvid/tools/executor.py:1595

• This fetches every EndpointSlice in the namespace and only filters by kubernetes.io/service-name after all response objects have been transferred and summarized. In namespaces with many Services/endpoints, a diagnosis becomes O(total namespace slices) in network, memory, and CPU even though Kubernetes supports filtering this LIST by the Service-name label. Please extend the read boundary/client to accept a server-side label selector and request kubernetes.io/service-name=<service> here.

            summaries = await self._kube.list_objects(slice_meta, namespace)

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/korvid/tools/executor.py:1601

• EndpointSlice LIST failures are not limited to ApiStatusError: transport and response-decoding failures can escape _request_json as other exceptions. Those currently turn this structured diagnostic into an ERROR: result instead of the promised outcome: incomplete evidence gap for unavailable slice evidence. Convert any LIST failure to a gap while continuing to let the Service GET fail normally.

        except ApiStatusError as exc:
            report = analyze_service_endpoints(
                service,
                (),
                EvidenceGap("endpointslices", _api_gap_reason(exc)),
            )