Module encapsulates 

EncapsulatesSpec — how a Process relates to pre-existing in-cluster state.

The substrate move: every long-running workload on a pleme-io cluster — raw HelmReleases, Flux Kustomizations, bare Deployments — becomes a Process without disruption. Three modes:

• Manage (default) — Process IS the control loop. New HR/Kustomization emitted by the reconciler use ownerRefs pointing at the Process; cascade-delete on Reaped.

• Adopt — Take over an existing HR/Kustomization in place. Reconciler emits a new HR with releaseName matching the running release; helm-controller adopts the existing release under new management. No pod restart; no values diff unless operator changes them. The original raw HR can be deleted from git after the takeover confirms.

• Observe — Read-only awareness. Process watches the existing state for postcondition pillars + emits routing/exports/ attestation, but does NOT modify or own the underlying HR/Kustomization. Useful for adding DNS + observability to legacy stacks without taking over.

These compose progressively: Observe an HR first to confirm shape, promote to Adopt for zero-downtime takeover, then to Manage once the Process drives values.

Lisp authoring:

:encapsulates (:kind (:existing-helm-release
                      :namespace    "akeyless"
                      :name         "akeyless-saas"
                      :release-name "akeyless-saas-consolidated")
               :mode Adopt)

Structs

BareWorkload

Pointer to a bare in-cluster workload (not Flux-managed). The reconciler identifies the underlying Pods by selector and adds ownerRefs / routing without emitting a new HR/Kustomization.

EncapsulatesSpec

How a Process wraps pre-existing in-cluster state.

EncapsulationKind

Three concrete kinds the substrate knows how to wrap. Exactly- one-Option pattern matching Intent / Lifetime — additive on the wire, every variant typed.

ExistingHelmRelease

Pointer to an existing FluxCD HelmRelease the Process wraps.

ExistingKustomization

Pointer to an existing FluxCD Kustomization the Process wraps.

UnknownEncapsulationMode

UnknownEncapsulationTarget

Enums

EncapsulationKindError

EncapsulationKindVariant

Resolved enum view used by the render phase.

EncapsulationMode

Three modes the reconciler dispatches on at render time.

EncapsulationTarget

Closed-set discriminator over EncapsulationKind’s three tagged-union slots. Single source of truth that drives EncapsulationKind::variant’s ambiguity + emptiness resolver, the EncapsulationKindError::Empty diagnostic message, and the reverse EncapsulationKindVariant::target projection. Adding a fourth encapsulation target (e.g., a future ExistingNamespace, ExistingDaemonSet, or ExistingService) lands at one ALL entry + one as_str arm + one select arm + one EncapsulationKindVariant::target arm — exhaustively checked by the compiler.