Description
The approved engine packet deliberately excluded chart wiring. Existing chart HA wiring already uses operator-precreated named state and Lease resources; SM Job is still file-only. Extend that accepted seam after SKT-0099 (diskless SM provisioning) is accepted and landed, rather than manufacture mutable chart state. Keep engine and chart ownership separate. The job needs an exact SM slot and dedicated provisioner Lease, narrow named get/update permissions, projected API credential and downward PodUID, bounded runtime and no shared PVC/co-location in Kubernetes mode. File mode behavior remains unchanged. No implementation is admitted by this follow-up.
Acceptance Criteria
- #1 Kubernetes SM Job uses an explicit precreated aggregate state ConfigMap and a dedicated provisioner Lease distinct from emitter Lease, with no volume or forced co-location.
- #2 Rendered Role/RoleBinding restrict named get/update authority to the job SM state and provisioner Lease; no emitter Lease mutation, resource creation/list/watch, unrelated Secrets or broad environment inheritance.
- #3 Chart schemas/operator guidance describe the external named-resource contract and explicit version-matched apply/restart; existing file-mode validation and least-privilege behavior remain intact.
- #4 Local chart render/runtime fake-SM proof observes actual named state and Lease use, retained pending failure evidence and safe byte-identical operator-owned resources.
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Use accepted diskless engine seam to wire chart-only named precreated SM state and distinct provisioner Lease, no volume/co-location/broad env or RBAC. Fail-first rendered RBAC proof, real CLI/fake SM+Kubernetes runtime and byte-identical operator resources, local check, independent security and CodeRabbit, then serial exact-SHA CI proof before Done.
Integrate with declarative source input, reject any SM/input ConfigMap alias, and retain the exact non-secret Go race option as a value-only scanner exception with source/patch canary controls; full exact-SHA CI remains final composed proof.
Implementation Notes
loop17: zero cycles, never admitted; prerequisite SKT-0127 (SM lost-response fixture synchronization and engine re-land) not published. Resume only after that exact-SHA green CI.
loop18: three change/verify cycles, review-repairround2; no fourth rescue. Job-only Kubernetes named aggregate state/dedicated Lease, exact get/update RBAC, isolated credentials/env, unchanged file branch and actual rendered-config/accepted CLI fake SM+Kubernetes/pending-no-replay/Helm whole-object proof passed local gate and independent full review. Combined chart emitter HA+SM remains excluded; emitter mapping/RBAC/image selection external prerequisites. Root integrated source input, reproduced two unsafe aliases, added exact refusal and positive distinct-input case; composition securityPASS and CodeRabbit9of9complete0. Initial c5d026d exact CI38281436251 terminalred solely secret-scan; diagnostic proved generic heuristic matched non-secret GORACE runtime option, not credential. Third rescue adds exact anchored value-only exemption and guard: fail-first2suppression failures, final allcontrols green with19synthetic detections; no path/default-rule/history/test/probe/timeout weakening, source fixture unchanged. Repair securityPASS, script-only CodeRabbitdelta complete0. Forward4d07f83c0c51dc10c4e8c3204ce1e9c45a8a0f4e exact CI38288330134 attempt1 all11required jobs success, history scan/configguard executedsuccess, no skips/cancels. Default full-history CI is proof; local expanded diagnostic counts853/852vsCI842 were not asserted equivalent or exhaustive. Original red retained, no workflow rerun, credential rotation or history rewrite. Owner CI-first composed amendment used. Accepted/Done, no live cluster/projected-token/image activation or combined emitter lifecycle claim.
Final Summary
Standalone diskless SM Job accepted at4d07f83c0c51dc10c4e8c3204ce1e9c45a8a0f4e, all-required exact CI38288330134 green after narrowly guarded scanner false-positive repair. Job-only scope, external emitter configuration and matching image prerequisites remain explicit.