> ## Documentation Index > Fetch the complete documentation index at: https://docs.infercrane.com/llms.txt > Use this file to discover all available pages before exploring further. # Feature qualification matrix # InferCrane feature qualification matrix This is the authoritative inventory for whole-product qualification. `AUTOMATED_QUALIFIED` means the strongest safe local boundary is green in repository CI. `AWS_REAL_PASSED` records the narrower real L40S boundary in [AWS real-infrastructure evidence](./aws-real-evidence.md); it does not qualify another provider, topology, or model. `REAL_INFRA_REQUIRED` and `MANUAL_REQUIRED` remain explicit and are never satisfied by fixtures. Fixture evidence never qualifies real provider or GPU behavior. | Feature | User-visible / operational behavior | Implementation | Existing evidence/tests | Qualification level and automated strategy | Manual requirement | Current status | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | | CLI bootstrap/config contexts | `init`, context selection and missing-config remediation | `cmd/infercrane`, `internal/config` | command/config tests | Unit + local API CLI E2E | None expected | AUTOMATED\_QUALIFIED | | Doctor | Dependency, auth and configuration diagnostics | `cmd/infercrane`, `internal/doctor`, control API | doctor/API/CLI tests | Deterministic fixture + malformed config | Provider credential validity is external | AUTOMATED\_QUALIFIED | | Fleet inbox | Rank persisted endpoint/deployment attention without mutation | CLI over tenant-scoped fleet APIs | command/model tests + live local API | Severity/order/limits/unknown state/partial-read fail-closed/content exclusion | Fresh diagnosis and provider truth remain explicit follow-up | AUTOMATED\_QUALIFIED | | Semantic plan | Side-effect-free deployment diff | `internal/planning`, CLI/API | planning and command tests | Unit + stack assertion of zero mutation | Provider price display needs sourced data | AUTOMATED\_QUALIFIED | | Hermetic product demo | One command proves adoption through rejected-candidate cleanup | `scripts/demo-product.sh`, Docker stack, public CLI | acceptance safety + black-box execution | Isolated Compose project, fixture label, exact active-revision invariant, zero provisioning commands | Cannot qualify GPU, provider, model quality, or performance | AUTOMATED\_QUALIFIED | | Deployment apply/deploy | Durable provider-neutral lifecycle | `internal/workflows`, `store`, control API | workflow/store/stack/fault suites | PostgreSQL + fixture provider E2E/restart | Real provider lifecycle | AUTOMATED\_QUALIFIED | | Durable operations | Watch/resume/cancel after disconnect | `internal/operations`, `store`, CLI | operations, failure recovery, acceptance | State-machine + process restart + CLI disconnect | Real in-flight provider call | AUTOMATED\_QUALIFIED | | Provider ensure adoption | Lost-create-response and exactly-one intent | `internal/provision`, `workflows`, conformance | provider contracts/fault fixtures | Fault injection + repeated idempotency | Real provider adoption semantics | AUTOMATED\_QUALIFIED | | Readiness/model identity | Health plus intended served model | `runtime`, `reconcile`, `workflows` | runtime/reconcile/stack tests | Fake vLLM malformed/delayed/wrong identity | AWS vLLM/SGLang/custom OCI passed; other providers remain separate | AUTOMATED\_QUALIFIED / AWS\_REAL\_PASSED | | Safe delete/orphans | Route withdrawal, drain, idempotent cleanup, inventory | workflows/store/routes/acceptance | fault and acceptance fixtures | Restart/delete boundary + inventory equality | AWS worker and root-volume cleanup passed; other providers remain separate | AUTOMATED\_QUALIFIED / AWS\_REAL\_PASSED | | Immutable DeploymentSpec/revisions | Versioned strict spec and immutable candidate history | `spec`, `store`, `domain` | spec/migration/store tests | Schema/property + persistence tests | None expected | AUTOMATED\_QUALIFIED | | Rollout/provision/promote/reject/rollback | Safe revision lifecycle | workflows/releaseguard/routes | rollout/guard/fault tests | E2E active/candidate and stale action rejection | Real generation-safe GPU rollout | AUTOMATED\_QUALIFIED | | Release Guard | Deterministic persisted accept/reject/monitor/rollback | `releaseguard`, store, API/CLI | unit/store/API/acceptance | Strong local candidate E2E + stale/missing evidence | Real performance/cost evidence; InferCrane enforces signed external semantic evidence but does not itself judge answer quality | AUTOMATED\_QUALIFIED | | External task-quality evidence | Ingest aggregate evaluator results, bind/sign/attach exact revision evidence | `qualityevidence`, evaluation CLI, control API | strict schema/content/tamper/key/API tests | Unknown fields, prompt/output content, oversize/trailing JSON, invalid evidence and attachment failures fail closed; signed file survives API failure | Evaluator calibration, representative private datasets, key custody and real task quality remain customer evidence | AUTOMATED\_QUALIFIED | | Router supervision/generations | Instance-owned router lifecycle and safe generations | `router`, `routes`, workflows | router/routes/HA tests | Process crash/restart and active stream route swap | Real long-running vLLM stream | AUTOMATED\_QUALIFIED | | OpenAI Chat Completions | Buffered and streaming proxy | `gateway`, `openaicompat` | gateway/stack/SDK tests | Local fake runtime E2E success/failure/cancel | Real vLLM compatibility | AUTOMATED\_QUALIFIED | | Responses API | Faithful capability-gated proxy | gateway/runtime contract | gateway/protocol tests | Qualified fixture, malformed/upstream errors | Qualified real runtime | AUTOMATED\_QUALIFIED | | Embeddings | Faithful capability-gated proxy | gateway/runtime contract | gateway/protocol tests | Qualified fixture and dimensional payload preservation | Qualified real model/runtime | AUTOMATED\_QUALIFIED | | Completions | Legacy compatible proxy | gateway/runtime contract | gateway/protocol tests | Fixture contract + streaming | Qualified real runtime | AUTOMATED\_QUALIFIED | | Chat batch | Online batch proxy/capability | gateway/runtime contract | gateway/protocol tests | Fixture body/response/error preservation | Qualified real runtime | AUTOMATED\_QUALIFIED | | Tool calling/structured output | Protocol pass-through and capability claim | gateway/integration profiles | acceptance/contract tests | Local schema/tool payload preservation | AWS vLLM/Qwen path passed; every additional runtime/model pair remains separate | AWS\_REAL\_PASSED / REAL\_INFRA\_REQUIRED | | Request IDs/tracing/retries | Stable request/trace identity and bounded retries | gateway/telemetry/admission | gateway tests | Failure sequence, cancel and no streaming retry | None expected | AUTOMATED\_QUALIFIED | | Telemetry/metrics | OTel GenAI identity, latency/token/error/cold metrics plus fresh revision-bound hardware evidence | gateway/metrics/store/control API/CLI | metrics/gateway/store/API/CLI tests | Local request E2E, bounded DCGM parsing, tenant/revision/idempotency/freshness, and content exclusion | Real DCGM/GPU field availability and complete fleet labeling | AUTOMATED\_QUALIFIED | | Stable logical models/environments/endpoints | Stable app identity independent of backend | store/routes/API/CLI | endpoint/store/API tests | Tenant/reference/digest/route E2E | None expected | AUTOMATED\_QUALIFIED | | Backend bindings/serving plans | Active/candidate/fallback plan compilation | store/routes/control API | endpoint/routes tests | Weighted/manual/fallback and generation pinning | External managed target network | AUTOMATED\_QUALIFIED | | Managed external endpoint bindings | Stage authenticated OpenRouter or generic OpenAI-compatible capacity behind a stable endpoint without browser-visible credentials | external/store/reconcile/control API/CLI | strict policy, tenant, budget, credential-reference, authenticated model-probe and route-compilation tests | PostgreSQL-backed hard reservation, fail-closed consent, candidate-only console flow, successful-probe caching | Real provider protocol, streaming and billing semantics remain target-specific | AUTOMATED\_QUALIFIED | | Reusable provider connections | Configure an external API once and bind it without exposing credentials or silently authorizing spend | store/control API/CLI | tenant/idempotency/adapter/credential-reference/binding compilation tests | Reference-only persistence, explicit per-binding consent and hard budgets, non-destructive delete | Real provider credential, protocol, streaming, and billing semantics | AUTOMATED\_QUALIFIED | | Endpoint Release Guard | Compare and govern serving plans | store/releaseguard/API | endpoint guard tests | Deterministic persisted candidate comparison | Real cross-backend evidence | AUTOMATED\_QUALIFIED | | Import/adopt ownership | Observe-only then traffic-managed adoption | store/control API/CLI | adoption/API/route tests | Ownership enforcement and idempotent atomicity | Real existing endpoint | AUTOMATED\_QUALIFIED | | Bare-metal GPU discovery | Read-only concrete local NVIDIA inventory before endpoint adoption | `nodediscovery`, CLI | parser/command-boundary/CLI tests | No shell, five-second deadline, bounded output/count/fields, explicit unavailable state, no lifecycle transfer or compatibility claim | Real NVIDIA driver matrix; AMD/ROCm and remote hosts unavailable | AUTOMATED\_QUALIFIED (LOCAL CONTRACT) / REAL\_INFRA\_REQUIRED | | Request Inspector | Reconstruct request metadata without content | store/API/CLI | diagnostic/store/API tests | Tenant/content exclusion E2E | Provider-hidden timing | AUTOMATED\_QUALIFIED | | Deterministic Doctor/explain | Evidence-backed operational findings | `doctor`, explain CLI/store | doctor/CLI tests | Rule coverage + stale/missing evidence | None expected | AUTOMATED\_QUALIFIED | | Signed alerts | Policy evaluation and signed webhook retry | `alert`, store/API/CLI | alert/API tests | Local TLS webhook failure/retry/signature | Slack/PagerDuty adapters not implemented | AUTOMATED\_QUALIFIED | | Admission control and request deadlines | Concurrency/queue/size/token/priority/load shedding plus one endpoint-wide latency budget | `admission`, gateway, store, CLI/API/console | admission/gateway/store/API/CLI/browser tests | Concurrent local E2E, cancellation, queue expiry, bounded buffered retries, streaming expiry, PostgreSQL persistence, and cancelled-context evidence recording | Real-runtime cancellation and overload calibration remain exact-tuple evidence | AUTOMATED\_QUALIFIED / REAL\_INFRA\_REQUIRED | | Tenant request quota | Distributed bounded lease without DB data path | `requestquota`, store/gateway | quota/store tests | Concurrency/property/failure tests | Multi-host timing at scale | AUTOMATED\_QUALIFIED | | Async inference | Idempotent encrypted queued jobs, cancel, signed webhook | `asyncinference`, API/CLI | async/API tests | Worker/restart/deadline/retry/cancel E2E | Real long-running inference | AUTOMATED\_QUALIFIED | | Autoscaling | Min/max, 1ā†’Nā†’1, safe scale down | `autoscale`, workflows/store | autoscale/workflow/acceptance | Deterministic clock/pressure/restart/drain | Real GPU provider scaling | AUTOMATED\_QUALIFIED | | External governed fallback | Explicit privacy plus hard request/cost budget | `external`, store/gateway/CLI | external/store/gateway tests | Concurrent budget reservation and fail closed | Real external provider | AUTOMATED\_QUALIFIED | | Burst Guard | Fresh sustained health/queue/cost bounded overflow | `burstguard`, store/API/CLI | burst unit/API contracts | State transitions, stale evidence and budget boundary | Real overflow/provider cost | AUTOMATED\_QUALIFIED | | Provider-native serverless | Durable endpoint, zero/warm/cold/cancel/delete | provision/workflows/gateway | serverless fixture/fault acceptance | Lost response, cancellation, orphan fixture | RunPod Serverless real cycle | REAL\_INFRA\_REQUIRED | | Cold-start intelligence | Grounded timing boundaries and explanations | gateway/store/metrics | cold-start/store/explain tests | Available-boundary fixture and no fabrication | Real provider hidden stages | AUTOMATED\_QUALIFIED | | ModelArtifact/HF identity | Resolve mutable HF ref to immutable artifact | `artifact`, store | artifact unit/HTTP fixture/store | Local HF HTTP fixture, cache metadata validation | Real HF/Xet transfer/cache | AUTOMATED\_QUALIFIED | | Artifact cache observations/prefetch | Expiring evidence and delegated idempotent intent | `artifactcache`, store/API | artifactcache/provider/API tests | PostgreSQL tenant/idempotency/expiry, stable lost-response adoption, definite-rejection classification, bounded identities, no retry after known preflight rejection, exact-model AWS snapshot, GCP zonal disk, and Kubernetes PVC verification with read-only attachment/mount intent | Real provider attachment, filesystem behavior, cache-hit timing, and node-local/provider-native caches remain external | AUTOMATED\_QUALIFIED (CONTRACT) / REAL\_INFRA\_REQUIRED | | AIPerf benchmark/history | Explicit reproducible measurement | `benchmark`, store/API/CLI | benchmark/API/store tests | Fake AIPerf process + exact args/results/failure | AWS L40S qualification samples passed; representative performance campaigns remain separate | AWS\_REAL\_PASSED / REAL\_INFRA\_REQUIRED | | Recipes | Immutable content-addressed verified serving recipe | `recipe`, store/API/CLI | recipe/store/API tests | Evidence matching/digest/idempotency/tenant | Community/public registry not implemented | AUTOMATED\_QUALIFIED | | Inference Lab | Compare measured candidate evidence | `lab`, store/API/CLI | lab/store/API tests | Measured-only/no hidden provisioning/no invented cost | Real candidate catalog evidence | AUTOMATED\_QUALIFIED | | Optimization proposals | Generate bounded immutable catalog or modeled candidates without mutation | `optimizer`, pinned AIConfigurator adapter, integration/recipe catalogs, CLI | optimizer/CLI tests plus real upstream package contract | Multi-model catalog, deterministic inputs, typed evidence state, credential scrubbing, bounded process output, explicit fallback, topology/mutation-owner safety, strict loadable specs, no modeled-as-measured claim | Estimator calibration and real-hardware candidate qualification | AUTOMATED\_QUALIFIED / REAL\_INFRA\_REQUIRED | | Optimization campaign coordination | Persist, inspect, approve with an expiring hard cost cap, advance proof boundaries durably, rank measured exact-workload candidates, cancel and clean candidates, and require explicit durable activation or guarded promotion | `optimizationcampaign`, Lab, store, control API, CLI | state-machine/coordinator/composite-driver/ranker/operation/store/API/CLI tests plus black-box modules journey | Exact sourced price authority, PostgreSQL durability, explicit new-endpoint versus evolve-endpoint intent, no fabricated guard baseline, mandatory guard for evolution, direct-revision AIPerf, idempotency conflict, stale transition fencing, all-candidate measurement barrier, proposal-order independence, workload/cost/SLO fail-closed ranking, distinct benchmark/quality/Lab/guard evidence, lost-response adoption, approval expiry-to-cleanup, cancellation fencing, tenant isolation, transactional stable-alias publication, route-generation wait, explicit activation, and zero implicit promotion | Real provider/GPU execution, runtime performance, and cleanup remain separate qualification | AUTOMATED\_QUALIFIED (LOCAL CONTROL PLANE) / REAL\_INFRA\_REQUIRED | | Optimization capability registry | Compile only exact qualified model/runtime/version/precision/GPU mechanisms and fail closed on unknown or conflicting combinations | `optimizationcapability`, runtime profiles, optimizer | registry/compiler and multi-model tests | Exact tuple matching, concrete accelerator alias normalization, generic Kubernetes GPU-resource rejection, downgrade/conflict rejection, provenance-linked compiler output, and one Dynamo mutation owner | Attention backend, quantization, speculative, LMCache, and distributed tuples require mechanism-specific GPU qualification | AUTOMATED\_QUALIFIED (CURRENT TUPLES) / REAL\_INFRA\_REQUIRED | | Optimized artifact provenance | Plan and attest immutable quantized checkpoints, speculators, and TensorRT engines through external digest-pinned builders | `optimizedartifact`, store, control API, CLI | artifact state/store/API/CLI tests | Immutable base/tool/config/calibration/hardware/license identity, duplicate/tamper/failure/cross-tenant checks, exact deployment/revision/base-model binding, mismatched-model rejection, and mandatory signed quality evidence | Real LLM Compressor, ModelOpt, Speculators, and TensorRT builds plus GPU qualification | AUTOMATED\_QUALIFIED (PROVENANCE) / REAL\_INFRA\_REQUIRED | | Inference Replay | Content-free workload shape and explicit AIPerf approximation | `replay`, gateway/store/API/CLI | replay/gateway tests | HMAC/content exclusion/digest/window + opt-in CLI | Real workload/GPU approximation | AUTOMATED\_QUALIFIED | | Capacity Intelligence | Tenant-scoped observed success/failure/latency plus deterministic cache-aware placement | store/workflows/API/CLI, `capacity` | workflow/store/capacity contracts | PostgreSQL aggregation, sparse samples, percentiles, expired-cache rejection, readiness/reliability/cost objectives, readiness SLO, and inventory-order independence | Real provider distributions and automatic multi-provider placement remain external | AUTOMATED\_QUALIFIED (DECISION CONTRACT) / REAL\_INFRA\_REQUIRED | | SLO/recommendations | Qualified deterministic serving recommendation | `decision`, store/API/CLI | decision/store/API tests | Missing/stale/cost/qualification fail closed | Real evidence quality | AUTOMATED\_QUALIFIED | | FinOps | Sourced dated hourly cost, no invented savings | `finops`, OpenCost parser, store/API/CLI | finops/store/API/CLI tests | Exact allocation selection, currency/source/window/expiry, active-revision binding, retry conflicts, persistence | Real OpenCost deployment and invoice reconciliation | AUTOMATED\_QUALIFIED | | Advisory Autopilot | Immutable recommendation plan and human approval, no mutation | store/API/CLI | API/contract tests | Idempotency/tenant/state/audit/no side effects | Execute candidate manually | AUTOMATED\_QUALIFIED | | Inference Passport | Signed canonical offline release evidence | `passport`, store/API/CLI | passport/store/API tests | Sign/verify/tamper/byte preservation/tenant | Organizational key custody | AUTOMATED\_QUALIFIED | | Context Passport/session affinity | Durable logical identity, reliability-first hints, no KV promise | `contextpassport`, routes/store/API/CLI | directory/routes tests | Persistence/expiry/tenant/route fallback E2E | Multi-instance snapshot propagation and real worker loss | AUTOMATED\_QUALIFIED | | Request survival capability | Delegated qualified backend claim | `integration` contract | integration test | Invalid/unknown/unqualified matrix | Real Dynamo/qualified backend migration | REAL\_INFRA\_REQUIRED | | Existing-target provider | Register and route customer-managed endpoint | store/routes/API/CLI | target/store/stack tests | Local fake OpenAI endpoint E2E | Customer network endpoint | AUTOMATED\_QUALIFIED | | RunPod elastic adapter | Elastic GPU lifecycle/inventory | provision/workflows profiles | fixtures/contracts | Deterministic provider HTTP fixture | Real RunPod GPU | REAL\_INFRA\_REQUIRED | | RunPod serverless adapter | Provider endpoint lifecycle | provision/workflows profiles | fixtures/fault proxy | Deterministic API fault fixture | Real RunPod Serverless | REAL\_INFRA\_REQUIRED | | AWS EC2/ASG/EKS/SageMaker/Bedrock profiles | BYOC and imported/managed product boundaries | provision/integration profiles | contract/manifest tests | CLI/API fixture and translation conformance | AWS account/GPU/private network | REAL\_INFRA\_REQUIRED | | GCP Compute/MIG/GKE/Vertex profiles | BYOC and managed product boundaries | provision/integration profiles | contract/manifest tests | CLI/API fixture, immutable dependency preflight, Private Google Access enforcement, exact-model zonal Persistent Disk verification and read-only retained attachment, translation conformance, and leak-inventory safety | GCP account/GPU/PSC and real cache mount | REAL\_INFRA\_REQUIRED | | CoreWeave CKS profile | Kubernetes-first provider profile | integration/Kubernetes | contract/manifest tests | Manifest/provider contract | CoreWeave account/GPU | REAL\_INFRA\_REQUIRED | | SkyPilot boundary | Infrastructure provisioning reuse contract | integration/provision docs | profile/contract tests | Ensure core remains adapter neutral | Real SkyPilot/provider execution | REAL\_INFRA\_REQUIRED | | vLLM runtime | Default inference runtime and router | runtime/integration/router | runtime fixture/stack | Local fake runtime protocol/health/drain | AWS L40S vLLM 0.22.0 passed; other providers/GPUs remain separate | AWS\_REAL\_PASSED / REAL\_INFRA\_REQUIRED | | SGLang runtime | Second qualified runtime profile | runtime/integration | profile/conformance tests | Hermetic runtime contract | AWS L40S SGLang 0.5.12 passed; smaller runtime image and other providers remain separate | AWS\_REAL\_PASSED / REAL\_INFRA\_REQUIRED | | Custom OCI runtime | Digest-pinned portable workload contract | runtime/spec/provision | conformance/spec tests | Validation/translation/probes/cancel/drain | AWS L40S portable vLLM workload passed; arbitrary customer images remain separate | AWS\_REAL\_PASSED / REAL\_INFRA\_REQUIRED | | Provider/runtime conformance kit | Idempotency, adoption, inventory, capability evidence | `conformance`, integration | contract qualifier | Run all deterministic adapters repeatedly | Real provider qualification tier | AUTOMATED\_QUALIFIED | | Kubernetes provider | Namespace/SSA/RBAC/restart/delete lifecycle | provision/manifests/tools | manifest + Kind suites | Real Kind API, restart/lost response/zero resources | GPU scheduling | AUTOMATED\_QUALIFIED | | KServe integration | Standard CRD-gated single-owner inference service | provision/manifests | manifest/Kind tests | Missing/present CRD and field ownership | Real KServe GPU runtime | AUTOMATED\_QUALIFIED | | NVIDIA Dynamo DGD adapter | One immutable parent graph, independent vLLM/SGLang images, aggregated/disaggregated topology, KV-aware routing and bounded KVBM intent | servingcontract/provision/workflows/spec | contract, fixture, API, persistence, strict DGD-subset Kind tests | Lost apply response, changed intent, stale/failed status, exact ownership, server-side dry-run/apply/delete-to-zero | Real operator, GPU, NIXL, cache allocation, streaming rollout and performance | AUTOMATED\_QUALIFIED / REAL\_INFRA\_REQUIRED | | PostgreSQL persistence/migrations | Source of truth, upgrade safety, concurrency/checksum | `store`, 50 migrations | store/migration/restore tests | Every-prefix, concurrent startup, downgrade/checksum | Customer managed HA database | AUTOMATED\_QUALIFIED | | HA/fencing/mixed-version | Stateless API, leased workers, stale writer rejection | store/operations/serve | HA/failure/restore suites | Multi-process Docker crash/reclaim/protocol overlap | Multi-host customer topology | AUTOMATED\_QUALIFIED | | Backup/restore | Guarded backup, ledger preservation, reconcile startup | scripts/store/compose | safety + Docker drill | Corrupt/mismatch/restore/reconcile | Customer backup system/RTO | AUTOMATED\_QUALIFIED | | TLS/mTLS/private identity | Production secure transport and rotation checks | config/safehttp/serve | config/production tests | Local TLS/mTLS invalid/rotation | Customer CA/network/IAM | AUTOMATED\_QUALIFIED | | Authentication/RBAC/scopes | Principal auth, roles, scopes, rotation/revocation | authn/authz/store/API | auth/API/store tests | Boundary matrix and concurrent revoke | External identity federation not implemented | AUTOMATED\_QUALIFIED | | Tenant isolation/audit | Every resource scoped and mutation audited | store/API/gateway | store/API security tests | Cross-tenant route/API/property tests | None expected | AUTOMATED\_QUALIFIED | | Secret references/redaction | Reference-only secrets and no leakage | secrets/store/API/logging | secret/security tests | Canary secret through errors/logs/reports | External secret manager access | AUTOMATED\_QUALIFIED | | Embedded terminal UI | Read/operate workspace, responsive navigation | CLI UI | UI snapshot/interaction tests | PTY sizes, empty/error/action handoff | Human visual/keyboard review | MANUAL\_REQUIRED | | Browser console | Endpoint-first stable identity, workload, operation, evidence, API-key and team UI | separate web app/control API | unit + contract fixture tests | Production build + protected auth + responsive Playwright + axe + visual baselines + disposable real Go/PostgreSQL control-plane browser qualification | Hosted Clerk/private-preview and final hosted visual review | AUTOMATED\_QUALIFIED / MANUAL\_HOSTED | | OpenAPI route contract | Server/API schema parity | apicontract/codegen | route drift tests | Generate/check every route/schema | None expected | AUTOMATED\_QUALIFIED | | Python SDK | Generated API plus streaming client/package | `sdk/python` | unittest/wheel/stack | Package and local stack E2E | PyPI publication forbidden | AUTOMATED\_QUALIFIED | | TypeScript SDK | Generated API plus streaming client/package | `sdk/typescript` | node tests/npm pack/stack | Package and local stack E2E | npm publication forbidden | AUTOMATED\_QUALIFIED | | Terraform provider | Deployment/SLO CRUD/import/adoption | `integrations/terraform` | provider tests/automation | Protocol tests against deterministic API | Terraform registry publication forbidden | AUTOMATED\_QUALIFIED | | GitHub delivery integration | CI/release plan and evidence artifact handling | `.github/workflows`, scripts | repository/release checks | Static workflow validation + local scripts | Hosted Actions run | MANUAL\_REQUIRED | | Documentation/Mintlify | Accurate navigation, links, API and commands | `docs` | docs check/context drift | Mintlify build/link/claim audit | Hosted Mintlify rendering | MANUAL\_REQUIRED | | Release packaging | Multi-arch archives/checksums/SBOM/native/Homebrew | release scripts/GoReleaser | qualify/release verification | Exact version build and native smoke | Homebrew/public release publication forbidden | AUTOMATED\_QUALIFIED | | Docker images/Compose | Provider-neutral control plane and opt-in overlays | Dockerfiles/compose | container/stack/production tests | Build/start/health/stop and config matrix | Registry publication forbidden | AUTOMATED\_QUALIFIED | | Acceptance orchestration | Approval lock, run identity, resume, cleanup, report | acceptance scripts | safety tests/local qualification | Shell fault/safety and dry local workflow | Paid suites with user | MANUAL\_REQUIRED |