feat(release): separate stack artifact inventories

.github/workflows/release-tags.yml

@@ -17,7 +17,7 @@ on:
         required: false
         type: string
       inventory_tag:
-        description: Optional self-managed stack tag to render and validate without publishing.
+        description: Optional stack tag to render and validate without publishing.
         required: false
         type: string
       release_tag:
@@ -117,7 +117,7 @@ jobs:
           ./tools/ci/github-release auto
 
   inventory-preflight:
-    name: self-managed inventory preflight
+    name: stack inventory preflight
     if: github.event_name == 'workflow_dispatch' && inputs.inventory_tag != ''
     runs-on: linux-amd64-cpu4
     permissions:
@@ -166,23 +166,45 @@ jobs:
         run: |
           set -euo pipefail
           case "${INVENTORY_TAG}" in
-            deploy/stacks/self-managed/v*) ;;
+            deploy/stacks/self-managed/v*|deploy/stacks/nvcf-compute-plane/v*|deploy/stacks/observability/v*) ;;
             *)
-              echo "ERROR: inventory_tag must be a deploy/stacks/self-managed/v* tag." >&2
+              echo "ERROR: inventory_tag must identify a registered deploy/stacks/*/v* release." >&2
               exit 1
               ;;
           esac
-          version="${INVENTORY_TAG#deploy/stacks/self-managed/v}"
+          case "${INVENTORY_TAG}" in
+            deploy/stacks/self-managed/v*) inventory_config="deploy/stacks/self-managed/release-inventory.yaml" ;;
+            deploy/stacks/nvcf-compute-plane/v*) inventory_config="deploy/stacks/nvcf-compute-plane/release-inventory.yaml" ;;
+            deploy/stacks/observability/v*) inventory_config="deploy/stacks/observability/release-inventory.yaml" ;;
+          esac
+          bootstrap_config="${GITHUB_WORKSPACE}/${inventory_config}"
+          version="${INVENTORY_TAG##*/v}"
           commit="$(git rev-list -n 1 "${INVENTORY_TAG}")"
           test -n "${commit}"
           git worktree add --detach "${RUNNER_TEMP}/inventory-source" "${INVENTORY_TAG}"
           cd "${RUNNER_TEMP}/inventory-source"
+          inventory_args=()
+          if [ -f "${inventory_config}" ] && grep -q '^states:' "${inventory_config}"; then
+            inventory_config="${RUNNER_TEMP}/inventory-source/${inventory_config}"
+          else
+            echo "WARNING: ${INVENTORY_TAG} predates its per-stack inventory states; using ${bootstrap_config}." >&2
+            inventory_config="${bootstrap_config}"
+            inventory_args+=(--allow-unavailable-source-charts)
+          fi
           "${RUNNER_TEMP}/docs-version-sync" \
-            --generate-stack-inventory "${RUNNER_TEMP}/nvcf-self-managed-stack-inventory.json" \
-            --inventory-config "${GITHUB_WORKSPACE}/deploy/stacks/self-managed/release-inventory.yaml" \
+            --generate-stack-inventory "${RUNNER_TEMP}/stack-inventory.json" \
+            --inventory-config "${inventory_config}" \
             --stack-version "${version}" \
             --stack-source-tag "${INVENTORY_TAG}" \
-            --stack-source-commit "${commit}"
+            --stack-source-commit "${commit}" \
+            "${inventory_args[@]}"
+
+      - name: Upload rendered inventory
+        uses: actions/upload-artifact@v4
+        with:
+          name: stack-inventory
+          path: ${{ runner.temp }}/stack-inventory.json
+          if-no-files-found: error
 
   tag-release-notes:
     name: tag release
@@ -216,12 +238,12 @@ jobs:
           echo "NVCF_RELEASE_SOURCE_ROOT=${RUNNER_TEMP}/release-source" >> "${GITHUB_ENV}"
 
       - uses: actions/setup-go@v5
-        if: startsWith(inputs.release_tag || github.ref_name, 'deploy/stacks/self-managed/v')
+        if: startsWith(inputs.release_tag || github.ref_name, 'deploy/stacks/')
         with:
           go-version-file: tools/go-toolchain/go.mod
 
       - name: Install Helm release tool
-        if: startsWith(inputs.release_tag || github.ref_name, 'deploy/stacks/self-managed/v') || startsWith(inputs.release_tag || github.ref_name, 'deploy/helm/')
+        if: startsWith(inputs.release_tag || github.ref_name, 'deploy/stacks/') || startsWith(inputs.release_tag || github.ref_name, 'deploy/helm/')
         run: |
           set -euo pipefail
           cd "${RUNNER_TEMP}"
@@ -235,7 +257,7 @@ jobs:
           echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
 
       - name: Install Helmfile inventory tool
-        if: startsWith(inputs.release_tag || github.ref_name, 'deploy/stacks/self-managed/v')
+        if: startsWith(inputs.release_tag || github.ref_name, 'deploy/stacks/')
         run: |
           set -euo pipefail
           cd "${RUNNER_TEMP}"

deploy/stacks/AGENTS.md

@@ -0,0 +1,66 @@
+# AGENTS.md - Deployment Stacks
+
+## Purpose
+
+This subtree owns the Helmfile stacks and their release inventories. Read
+[`INVENTORY.md`](INVENTORY.md) before adding, removing, or changing a chart,
+container image, hook image, operator-created image, or downloadable stack
+resource.
+
+## Stack Boundaries
+
+- `self-managed/` owns the NVCF control-plane stack.
+- `nvcf-compute-plane/` owns the NVCF compute-plane stack.
+- `observability/` owns shared observability infrastructure.
+- Each stack owns its own `release-inventory.yaml` and release asset.
+- Do not reference another stack's Helmfile state from an inventory config.
+- Keep a dependency in the stack that installs or creates it.
+- Follow the nearest nested `AGENTS.md` when it adds stack-specific guidance.
+
+## Dependency Changes
+
+For every dependency change:
+
+1. Update the owning Helmfile, chart values, or stack configuration.
+2. Give an optional release an explicit condition and inventory render profile.
+3. Update the owning stack's `release-inventory.yaml`.
+4. Add registry and repository overrides for images that customers must mirror.
+5. Record images that do not appear in rendered Kubernetes `image` fields.
+6. Update the artifact classification in `docs/version-catalog/main.yaml`.
+7. Run the stack tests and the inventory and documentation checks described in
+   [`INVENTORY.md`](INVENTORY.md).
+8. After the stack release publishes its inventory asset, update the catalog
+   and generated manifest in a documentation sync change.
+
+A dependency is not fully distributed when the released inventory or generated
+manifest omits one of its charts, images, or downloadable resources.
+
+## Required and Optional Artifacts
+
+- Mark an artifact `required` when the default stack installation needs it to
+  become ready or perform its baseline function.
+- Mark an artifact `optional` when only an optional feature, provider, add-on,
+  or non-default mode needs it.
+- An artifact used only by an optional release remains optional for the stack.
+- List a customer-provided prerequisite as a prerequisite, not as a distributed
+  stack artifact.
+
+## Validation
+
+Run from the repository root unless a command says otherwise:
+
+```bash
+make -C deploy/stacks/self-managed test
+make -C deploy/stacks/nvcf-compute-plane test-local
+make -C deploy/stacks/observability test
+go test -C tools/docs-version-sync ./...
+go run -C tools/docs-version-sync . --target main
+./tools/ci/check-doc-version-sync
+./tools/ci/check-docs
+git diff --check
+```
+
+Do not hand-edit generated blocks in `docs/user/manifest.md`. The CI check
+against the latest released inventory is warn-only for now. Generated-document
+consistency remains blocking. Treat a release-drift warning as follow-up work
+and keep the local checks clean for a dependency change.

deploy/stacks/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md