Rancher capture environment and its first corpus capture

Description

A Rancher capture environment plus its capture, tagged substrate: rancher.

Rancher is the self-managed case: no cloud controller manager, node identity that comes from the provisioner rather than a cloud API, and a control plane that is fully scrapeable in a way no managed offering is. It is the closest substrate to the on-premises estates synthkit is asked to model, and nothing in the corpus represents it today.

Lower priority than AKS and GKE: the two managed clouds close the larger evidence gap first. Sequence it after them.

Acceptance Criteria

• #1 A Rancher environment stands up and tears down from terraform in the frozen module shape
• #2 A capture lands in the reality corpus tagged substrate rancher, with provenance
• #3 The self-managed control-plane surface absent from every managed capture is recorded

Definition of Done

• #1 terraform validate and fmt -check pass
• #2 The environment applies and destroys cleanly, verified post-destroy

Implementation Plan

Wave 2026-09-09: review all four immutable captures by exact hash, add exhaustive exact-family routing, promote each document separately, run signal fidelity, record substrate divergences, and reconcile the Rancher provenance.

Wave 2026-09-10: add the frozen optional limitations contract test-first, promote the reviewed Rancher route and document, run fidelity, and reconcile only from committed evidence.

Implementation Notes

Per-AC evidence map: AC1 unproven because the full collector apply failed after AMI-driven node replacement invalidated kubeconfig. AC2 unproven: no capture or promotion occurred. AC3 source configuration and docs identify control-plane toggles, but live scrapes remain unproven. RKSY-0031 records the initial invalid-description fix, recipe fail-closed correction, AMI replacement boundary, and successful teardown: 15 resources destroyed; scoped AWS orphan sweep standing=0 unknown=0. Terraform fmt and validation passed. Resume at a run-pinned AMI and replacement-safe kubeconfig, then complete the documented capture lifecycle.

2026-09-06 final lifecycle: first stable-AMI apply failed API readiness and destroyed15/sweep0. Staged retry used add-ons off, two Ready nodes, same AMI, then add-ons on; created17. Verbatim plan and cleanup:

rancher: second-phase node plan = no-op for both nodes
rancher: final node set unchanged; kubeconfig refreshed
Destroy complete! Resources: 17 destroyed.
Scoped rancher result: standing=0 unknown=0

Two-hour loaded soak, midpoint/pre-capture nodes2Ready2/loadpod1Running1; completed browser iterations3656->3659 then6951->6953, interrupted0. Initial post-soak capture and destroy failed SDK SSO refresh; CLI retained a valid same-account role session. Reusing it in memory through the same recipes recovered cleanup without login, profile mutation or permission expansion. A multiword variadic capture argument failed before queries; corrected single-token argument produced a retrospective last-hour capture during teardown, exit0. All four signal stages ok; metrics/logs/profiles scoped, traces unscoped. 1314families/1567series names;909unknown types. Live control-plane targets apiserver/controller-manager/scheduler/etcd each1up; proxy0 because chart k8s-app selector differs from RKE2 component label. Capture contains95apiserver,18scheduler,86etcd families; managed captures15/16/16apiserver and0scheduler/etcd. All four contain0kubeproxy families. 270family names appear only in the self-managed candidate. Exact producer/configuration route review and proxy coverage remain open; raw capture is not promoted or modified. No exemption added. AC1/3 proven; AC2 remains parked, destroyed. docs/rancher.md records the exact recovery boundary.

2026-09-09 routing review completed against all four immutable capture hashes without changing any raw capture. Promotion is parked because the schema cannot truthfully represent the requested inputs: the Rancher candidate has 92 direct-producer scheduler/etcd families without one exact signals area, while unrouted entries permit only producerless reasons; the new AWS, Azure and GCP documents would duplicate existing area/source/substrate/permutation identities because no collector-permutation field exists; and the projection has no place for the required Rancher discovery-gap and retained-telemetry limitations. No route or corpus document was committed and no fidelity exemption was added. Resume by extending the reviewed routing and corpus identity/provenance contracts, then regenerate one exact-hash route and document per candidate and run signal fidelity.

Root decisions 2026-09-07 for the resume: the Rancher candidate routes every direct-producer family to the generic 00-canon area exactly as the seven existing routes do; the wave-goal wording that routed scheduler_ and etcd_ families only on catalogue membership was withdrawn as a rule the corpus contract does not have. The kube-proxy and DNS discovery gap and the retained-telemetry capture window are recorded through an additive, optional limitations list on the manifest route projected into a matching capture_limitations list on the corpus document (reviewed generic text, no identifiers). A fresh Rancher capture taken during the RKSY-0032 proof cycle merges into the same document by cumulative union.

2026-09-10 added and tested the frozen optional route limitations and document capture_limitations projection, reviewed the existing and fresh Rancher captures, and preserved both raw inputs unchanged. Promotion remains unproven. Applying the frozen direct routes to the current corpus creates 27 unexempted signal-fidelity contradictions against existing ambiguous_direct_producer evidence. The run allowed no route alteration, second schema change, or exemption, so no route or corpus document was committed. Resume by reconciling the direct-route semantics with the existing ambiguity evidence, then project and CanonicalMerge the reviewed same-identity captures and require green fidelity with zero new exemptions.

Wave 2026-09-11 correction: the representational schema exists; the remaining blocker is measured same-producer contradiction, not an absent routing or limitations field. Initial reviewed projection validates with 1314 families and both original limitations intact, but has 25 unexempted contradictions under producer-scoped comparison. The fresh reviewed direct route was projected and CanonicalMerged in scratch: 1314 -> 1366 families, 52 new names and 546 new label-key pairs, all values elided and no tag_ labels. Fresh union has 53 unexempted contradictions, 15716 raw coverage gaps and 6 no-comparable-producer findings; both existing exemptions match. Fresh capture closes proxy/DNS discovery for that observation; CanonicalMerge keeps the earlier limitation as historical evidence. No raw capture, route, corpus document or exemption was changed. Resume with reviewed job-shape evidence under the already frozen same-producer comparison, then require green fidelity before promotion.

Final Summary

Parked after exhaustive exact-family review. The current routing, identity, and provenance schemas cannot represent the four promotions truthfully; raw captures remain unchanged and no exemption was added.

Parked with AC2 open. The lifecycle and control-plane evidence are proven, and the limitations contract exists, but the Rancher corpus promotion would create 27 unexempted contradictions under the frozen route semantics.

AC1 and AC3 retain historical proof; AC2 is still open. Both initial and fresh cumulative candidates are validated and preserved, but neither is promoted because fidelity remains red.

Cumulative Rancher document committed at 75e7b79 to reality-corpus/00-canon/capture-v2-rancher.json. Initial 1314 families plus 52 fresh families gives 1366, with no removal; all five reviewed limitations retained, including both older limitations verbatim. Isolated just check and signal fidelity passed: zero unexempted contradictions, zero added exemptions. Earlier lifecycle acceptance remains historical; no new cloud operation ran.