Description
Found by lane L10, 2026-08-27, and deliberately left unfixed because it is unverifiable on the current lab cluster.
groupNodes detects the cloud provider by testing node labels for eks.amazonaws.com/, cloud.google.com/gke- and kubernetes.azure.com/. Karpenter-provisioned EKS nodes carry karpenter.k8s.aws/* and no eks.amazonaws.com/* labels at all — 8 of the lab cluster 10 nodes had zero of them.
The lab cluster only reports eks because one managed nodegroup happens to exist alongside Karpenter. An EKS cluster running Karpenter alone would report provider: unknown, and skforge would then emit a non-AWS blueprint for an AWS cluster — silently, since nothing downstream knows the detection was a guess. Karpenter-only EKS is a common and growing configuration, so this is not a corner case.
L10 left it because on the lab cluster the output is eks either way, so a fix cannot be proven there. It needs either a Karpenter-only cluster or a fixture built from real Karpenter node labels.
Fold in while touching this: Monitoring.ChartVersion is declared and always empty. The collector release-info ConfigMap that SKT-0012.01 now reads also carries a build-info line with the chart version, so populating it is a few lines against data already in hand.
Acceptance Criteria
- #1 A node carrying only karpenter.k8s.aws labels is detected as AWS
- #2 The fix is proven against real Karpenter node labels, not assumed
- #3 Provider detection states when it could not determine a provider rather than leaving downstream to guess
- #4 Monitoring.ChartVersion is populated from the collector release-info the capture already reads
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
2026-09-05 captured-contract run: implement only owned captured or documented contracts under frozen switches; preserve defaults; root integrates shared changes, verifies safe inventory and exact-SHA CI, and records unconfirmed shapes as capture boundaries.
Final Summary
Real four-node labels were sanitized with every key retained. A Karpenter-only projection proves AWS detection independently of EKS-prefixed labels; unknown provider is explicit undetermined. Chart version is read from the exact release-info build metric and never paired with a cluster name from another candidate. No live collector capture was run. Verified scoped capture/forge tests, build and vet; integrated just check exit 0; explicit 28-blueprint dump exit 0 and signal-fidelity gate passed. CodeRabbit BC completed; valid image-host finding fixed and scoped checks passed. Schema generation passed at root wiring; this lane changes no blueprint config struct.