Description
Root cause of the silent-skip finding that SKT-0012.04 made visible but could not fix, because it lives in a different lane files.
internal/capture/k8s.go:718-733 carries wellKnownNamespaces and wellKnownDeploymentNames. Five platform products confirmed running in the EKS lab cluster have no entry in either, so they never enter the addon list at all — not even as an unmapped name with an empty kind. Crossplane, external-secrets, the GitHub Actions runner controller, a GitHub-to-OTel bridge, and OpenCost.
SKT-0012.04 added a forge-side detector that names them in the coverage report, so an operator can now see they were skipped. That is the honest stopgap. The durable fix is capture-side detection, so the products are recognised once, in the place that already owns product recognition, rather than being pattern-matched a second time downstream.
Two of the five are worth a second look while doing this: OpenCost has cost telemetry synthkit models elsewhere in the k8s cost surface, and the GitHub Actions runner controller drives node churn through Karpenter, which synthkit does model. So “no construct exists” may be the wrong verdict for those two rather than merely an undetected name — establish which, and record the answer either way.
Once capture recognises them, the forge-side detector should shrink to whatever capture still cannot see, rather than being left as a permanent parallel table. Two tables claiming to know the same thing is how they drift.
Acceptance Criteria
- #1 The named platform products are detected by capture rather than only by the downstream report
- #2 Whether OpenCost and the Actions runner controller genuinely have no construct is established and recorded, not assumed from the current absence of a mapping
- #3 The forge-side detector shrinks to what capture still cannot see, so two tables do not claim the same knowledge
- #4 Verified against the lab capture: each product appears with the correct verdict
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
2026-09-05 captured-contract run: implement only owned captured or documented contracts under frozen switches; preserve defaults; root integrates shared changes, verifies safe inventory and exact-SHA CI, and records unconfirmed shapes as capture boundaries.
Final Summary
Capture now detects the five named platform products; registry-backed tests classify OpenCost as an unmapped k8s_cluster surface and the runner controller as no matching construct. Forge retains only its image fallback, with registry-host matching hardened after CodeRabbit. The frozen run contract accepts fixture proof: platform fixtures pass; no new live platform capture is claimed. Verified scoped capture/forge tests, build and vet; integrated just check exit 0; explicit 28-blueprint dump exit 0 and signal-fidelity gate passed. CodeRabbit BC completed; valid image-host finding fixed and scoped checks passed. Schema generation passed at root wiring; this lane changes no blueprint config struct.