Description
The two halves of SKT-0012 the 2026-08-27 validation run could not reach. Deferred with a concrete blocker each, not skipped.
In-cluster RBAC. Everything validated so far ran from outside the cluster, through kubectl, under an admin context. The shipped RBAC has therefore never been exercised, so the claim that skcapture needs only the permissions it declares is unproven — and it is a claim the documentation and the tool security posture both rest on. Proving it means running skcapture in-cluster as a Job under its own ServiceAccount, which is a cluster WRITE and so the cluster owner decision rather than a validation lane one. That is the specific thing to ask for.
Non-EKS substrate. A k3d cluster is the deliberate contrast: credential-free, disposable, and definitively not AWS. Anything skforge produces that assumes AWS identity shows up there as a defect. The question that matters is not whether it degrades but HOW: a tool that fails clearly on a substrate it does not support is fine, and a tool that silently emits something plausible and wrong is not, because the operator has no signal that anything went wrong. At the time of the run no k3d cluster was available (the kubeconfig entry was stale and its API server refused connections).
Sequence this after the identity and node-pool fixes. Comparing forged-blueprint telemetry against the real cluster is meaningless while the blueprint still carries the wrong cluster identity and synthetic node groups.
Acceptance Criteria
- #1 skcapture runs in-cluster as a Job under its shipped ServiceAccount and RBAC
- #2 Any permission it needs beyond what it declares is recorded, and the shipped RBAC is corrected to match reality
- #3 A capture and forge cycle runs against a k3d cluster
- #4 Behaviour on the non-EKS substrate is established, stating explicitly whether wrong AWS assumptions fail clearly or silently produce something plausible
- #5 Telemetry from a blueprint forged off a real capture is compared against that cluster real telemetry using the existing fidelity comparator
- #6 The in-cluster Job workflow in docs/tools.md matches what an operator actually has to do
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
2026-09-06 reconciliation: use the authorized live image route only if an already-pullable skcapture image exists; otherwise park that half without a registry write. Complete the disposable k3d capture, forge, load, run, and fidelity comparison, then record the non-EKS behavior.
Implementation Notes
2026-09-06 evidence: no already-pullable live-lab skcapture image route was found, and publishing a new image was outside the run authority, so the in-cluster Job and shipped live RBAC were not exercised. The disposable k3d path completed capture, encrypted round-trip, forge, blueprint load and run, and fidelity comparison. It exposed AWS and EKS assumptions that produced plausible output rather than failing clearly; the capture was not altered. Local just check, the explicit non-agent dump, and just e2e passed.
The shared reusable release v1.21.0 is published with default-preserving image selection and disjoint digest namespaces. Initial edge capture publish failed actual Trivy findings in old kubectl and OpenSSL; the integrated image repair updates verified kubectl checksums, base packages and target architecture. Both architecture smoke builds and the repaired local Job passed. Live Job remains pending the repaired image publication; release publication of the second image is a proposed follow-up.
Live capture container completed under shipped base ServiceAccount and RBAC using the published immutable image. In-pod permission audit: seven declared topology types get/list; Secret listing denied. Capture log permission-denial hits: 0. Encrypted retrieval and offline decryption succeeded. Recursive scan: 89 Secret objects present, zero captured secret-bearing values. Base identity remains name_source=default; optional collector identity permission was not added. docs/tools.md now records observed retrieval, audit, identity fallback and admission-init behavior. First wrapper used quiet just, which suppressed JSON; its cleanup succeeded, then a corrected wrapper repeated the capture. Whole-Job helper completion is tracked in the terminal run evidence. just check, safe explicit dump comparison and agent-disabled e2e passed; schema generation not applicable.
Final Summary
2026-09-06: Parked with AC3-AC5 proven by the disposable k3d capture, forge, run, and fidelity cycle. AC1, AC2, and AC6 remain at the exact boundary: publish or otherwise provide an already-pullable skcapture image for the live lab, then run the shipped Job and RBAC, audit permissions, and reconcile the operator workflow.
Current run supersedes the prior image-route park: all six ACs are proven. Live shipped-RBAC capture, Secret denial, encrypted retrieval and zero-secret scan are observed; k3d refusal and fidelity proof remain recorded. docs/tools.md matches the actual path. Parent resemblance remains unproven because base permissions yield fallback cluster identity.