Add pinned-image live smoke for generic installs

Author: a-a-k

.github/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: ci
 
+permissions:
+  contents: read
+  packages: read
+
 on:
   pull_request:
   push:
@@ -30,6 +34,12 @@ jobs:
       - name: Adapter end-to-end contracts
         run: make e2e-adapters
 
+      - name: Generic live smoke with pinned GHCR images
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: make k8s-smoke-generic-pinned
+
       - name: Package chart
         run: make chart-package
 

.gitignore

@@ -5,4 +5,5 @@ __pycache__/
 *.pyc
 .pytest_cache/
 .mb3r/
+.tmp/
 *.tgz

Makefile

@@ -1,6 +1,6 @@
 PYTHON ?= python
 
-.PHONY: lint validate smoke-generic e2e-generic k8s-smoke-generic e2e-adapters smoke-otel-demo e2e-otel-demo package-assets chart-package release-dry-run stack-manifest
+.PHONY: lint validate smoke-generic e2e-generic k8s-smoke-generic k8s-smoke-generic-pinned e2e-adapters smoke-otel-demo e2e-otel-demo package-assets chart-package release-dry-run stack-manifest
 
 lint:
 	$(PYTHON) scripts/tasks.py lint
@@ -17,6 +17,9 @@ e2e-generic:
 k8s-smoke-generic:
 	$(PYTHON) scripts/tasks.py k8s-smoke-generic
 
+k8s-smoke-generic-pinned:
+	$(PYTHON) scripts/tasks.py k8s-smoke-generic-pinned
+
 e2e-adapters:
 	$(PYTHON) scripts/tasks.py e2e-adapters
 

README.md

@@ -66,6 +66,7 @@ make validate
 make smoke-generic
 make e2e-generic
 make k8s-smoke-generic
+make k8s-smoke-generic-pinned
 make e2e-adapters
 make smoke-otel-demo
 make e2e-otel-demo
@@ -80,10 +81,13 @@ Direct Python equivalents are also available:
 ```bash
 python scripts/tasks.py validate
 python scripts/tasks.py e2e-generic
+python scripts/tasks.py k8s-smoke-generic-pinned
 python scripts/tasks.py e2e-adapters
 python scripts/tasks.py release-dry-run
 ```
 
+`make k8s-smoke-generic` verifies the live generic runtime contract with locally rebuilt images from the pinned release binaries. `make k8s-smoke-generic-pinned` verifies the clean-cluster startup path for the chart's default pinned `ghcr.io/mb3r-lab/bering` and `ghcr.io/mb3r-lab/sheaft` images, using anonymous pull by default and a temporary `imagePullSecret` when `MB3R_GHCR_USERNAME` and `MB3R_GHCR_TOKEN` are set. Repository CI wires that pinned-image smoke through `GITHUB_TOKEN` with `packages:read` so pull/auth regressions fail on push.
+
 ## Compatibility Notes
 
 The compatibility files in `compat/` are the source of truth for stack-level assertions. The current `0.2.0` bundle is recorded as a `candidate` integration statement backed by upstream release manifests, live generic smoke evidence, and Sheaft's published compatibility manifest, not as a broader verified operations guarantee. OpenTelemetry Demo remains one example profile and one acceptance scenario, not the design center of the core bundle.

docs/verification/generic-e2e.md

@@ -5,6 +5,7 @@ This is the required non-OTel acceptance path for the repository.
 ```bash
 make e2e-generic
 make k8s-smoke-generic
+make k8s-smoke-generic-pinned
 ```
 
 What it checks:
@@ -14,6 +15,10 @@ What it checks:
 - stable artifact emission from Bering
 - Sheaft batch and serve consumption of that artifact
 - report generation and persisted history output
-- optional live-cluster install smoke through `kind` with the same generic synthetic profile
+- live-cluster install smoke through `kind` with locally rebuilt images from the pinned release binaries
+- clean-cluster startup of the chart's default pinned `ghcr.io/mb3r-lab/bering` and `ghcr.io/mb3r-lab/sheaft` images
+- anonymous pull by default for pinned-image smoke, with an optional temporary `imagePullSecret` from `MB3R_GHCR_USERNAME` and `MB3R_GHCR_TOKEN`
+- pinned-image smoke wired into repository CI through `GITHUB_TOKEN` with `packages:read`
+- explicit failure attribution when Kubernetes reports image-pull or auth errors instead of letting them collapse into a generic timeout
 
 If this path fails, generic stack readiness is not proven even if the OTel Demo profile still passes.

scripts/acceptance_common.py

@@ -186,6 +186,34 @@ def ensure_kind() -> Path:
     return binary_path
 
 
+def ensure_kubectl() -> Path:
+    explicit = os_environ().get("KUBECTL_BIN")
+    if explicit:
+        kubectl = Path(explicit)
+        check(kubectl.exists(), f"KUBECTL_BIN does not exist: {kubectl}")
+        return kubectl
+
+    found = shutil.which("kubectl")
+    if found:
+        return Path(found)
+
+    os_name, arch = current_platform()
+    binary_name = "kubectl.exe" if os_name == "windows" else "kubectl"
+    destination_dir = TOOLS_DIR / f"kubectl-{os_name}-{arch}"
+    binary_path = destination_dir / binary_name
+    if binary_path.exists():
+        return binary_path
+
+    destination_dir.mkdir(parents=True, exist_ok=True)
+    print("[download] kubectl stable", flush=True)
+    stable_version = urllib.request.urlopen("https://dl.k8s.io/release/stable.txt").read().decode("utf-8").strip()
+    download(f"https://dl.k8s.io/release/{stable_version}/bin/{os_name}/{arch}/{binary_name}", binary_path)
+    if os_name != "windows":
+        binary_path.chmod(0o755)
+    check(binary_path.exists(), f"kubectl binary not found after download: {binary_path}")
+    return binary_path
+
+
 def helm_env(helm_root: Path) -> dict[str, str]:
     env = os_environ()
     repo_dir = helm_root.parent / "helm-repo"