Description
The 2026-09-06 k3d cycle (SKT-0012.05) captured a non-EKS cluster whose provider was correctly undetermined, and skforge still emitted a loadable AWS/EKS-shaped skeleton with placeholder account, VPC and us-east-1 region (internal/forge/mapper.go:88-140). It records a Gap, but the artefact itself is plausible-but-wrong: an operator can load, validate and run it and get AWS-shaped telemetry for a cluster that is not AWS. SKT-0012 AC6 established the behaviour; AC9 requires it corrected in the tool.
The v1 blueprint schema is aws-only (BLUEPRINT-SCHEMA.md environments[].cloud.provider: aws (v1)), so the fix is not to invent gke/aks cloud blocks. Decide and implement one of: refuse to emit a skeleton for a non-EKS provider unless an explicit –assume-aws flag is passed; or emit a skeleton with no cloud block and no AWS-only constructs so it loads as a pure Kubernetes estate. Record the decision and its reason in the task, and make the k3d harness (e2e/lab/skcapture/run.sh, just skcapture-k3d) exercise the chosen path so the proof is repeatable. The capture is never altered.
Acceptance Criteria
- #1 A non-EKS or undetermined capture no longer produces an AWS-shaped loadable skeleton by default; the chosen behaviour is stated with its reason
- #2 An EKS capture still forges exactly as before, pinned by the existing tests
- #3 just skcapture-k3d exercises the non-EKS path and its result record states which behaviour fired
- #4 docs/tools.md describes the behaviour an operator sees on a non-EKS cluster
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Test the undetermined provider defect first. Prefer cloudless output if the existing loader supports it, otherwise refuse clearly. Exercise the local capture harness, document behavior, and integrate with the root image route and live evidence.
Implementation Notes
Chose explicit refusal because blueprint.Load requires a cloud block for cluster environments. Existing EKS tests pass. Repaired-image just skcapture-k3d exited 0; result records provider undetermined and refusal naming –assume-aws. Both target architectures pass capture/kubectl image smoke checks. Full just check and safe explicit dump passed. CodeRabbit batch completed; final Docker e2e follows integration.
Final Summary
Integrated in 63c183ac77ccf237fb76351cd5a27537a5910523. The loader requires cloud identity for cluster declarations, so unsupported or undetermined providers now fail clearly by default and name –assume-aws. Existing EKS tests pass; both k3d runs prove refusal and encrypted retrieval, including the repaired multi-architecture image. docs/tools.md describes the operator result. just check, safe dump and agent-disabled e2e passed. Conditional just gen is not applicable.