@intentius/chant-lexicon-k8s 0.124.31 → 0.124.32

package/dist/lint/post-synth/wk8303.js

@@ -0,0 +1,68 @@
+/**
+ * WK8303: PodDisruptionBudget Recommended for HA Deployments
+ *
+ * Deployments with 2 or more replicas should have a corresponding
+ * PodDisruptionBudget (PDB) to ensure minimum availability during
+ * voluntary disruptions like node drains and cluster upgrades.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const wk8303 = {
+    id: "WK8303",
+    description: "PDB recommended for HA Deployments — ensures availability during voluntary disruptions",
+    check(ctx) {
+        const diagnostics = [];
+        const manifests = docsToManifests(ctx);
+        // Collect all PDB selectors to match against Deployments
+        const pdbSelectors = collectPdbSelectors(manifests);
+        for (const manifest of manifests) {
+            if (manifest.kind !== "Deployment")
+                continue;
+            const spec = manifest.spec;
+            if (!spec)
+                continue;
+            const replicas = spec.replicas;
+            // Only check HA deployments (replicas >= 2)
+            if (typeof replicas !== "number" || replicas < 2)
+                continue;
+            const resourceName = manifest.metadata?.name ?? "Deployment";
+            // Check if any PDB targets this Deployment's labels
+            const selector = spec.selector;
+            const matchLabels = selector?.matchLabels;
+            if (!matchLabels || !hasCoveringPdb(matchLabels, pdbSelectors)) {
+                diagnostics.push({
+                    checkId: "WK8303",
+                    severity: "info",
+                    message: `Deployment "${resourceName}" has ${replicas} replicas but no PodDisruptionBudget — add a PDB to ensure availability during voluntary disruptions`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};
+/**
+ * Collect matchLabels from all PodDisruptionBudget resources.
+ */
+function collectPdbSelectors(manifests) {
+    const selectors = [];
+    for (const manifest of manifests) {
+        if (manifest.kind !== "PodDisruptionBudget")
+            continue;
+        const spec = manifest.spec;
+        if (!spec)
+            continue;
+        const selector = spec.selector;
+        const matchLabels = selector?.matchLabels;
+        if (matchLabels && typeof matchLabels === "object") {
+            selectors.push(matchLabels);
+        }
+    }
+    return selectors;
+}
+/**
+ * Check if any PDB selector covers (is a subset of) the given labels.
+ */
+function hasCoveringPdb(deploymentLabels, pdbSelectors) {
+    return pdbSelectors.some((pdbLabels) => Object.entries(pdbLabels).every(([key, value]) => deploymentLabels[key] === value));
+}

package/dist/lint/post-synth/wk8304.js

@@ -0,0 +1,58 @@
+/**
+ * WK8304: SSL Redirect Without Certificate
+ *
+ * Flags Ingress resources that have `alb.ingress.kubernetes.io/ssl-redirect`
+ * annotation set but are missing `alb.ingress.kubernetes.io/certificate-arn`
+ * or don't have HTTPS in their listen-ports.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const wk8304 = {
+    id: "WK8304",
+    description: "SSL redirect without certificate — ssl-redirect annotation requires a valid certificate-arn and HTTPS listen-ports",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "Ingress")
+                continue;
+            const annotations = manifest.metadata?.annotations;
+            if (!annotations)
+                continue;
+            const sslRedirect = annotations["alb.ingress.kubernetes.io/ssl-redirect"];
+            if (!sslRedirect)
+                continue;
+            const resourceName = manifest.metadata?.name ?? "Ingress";
+            const certArn = annotations["alb.ingress.kubernetes.io/certificate-arn"];
+            if (!certArn) {
+                diagnostics.push({
+                    checkId: "WK8304",
+                    severity: "warning",
+                    message: `Ingress "${resourceName}" has ssl-redirect annotation but no certificate-arn — HTTPS redirect will fail without a TLS certificate`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+                continue;
+            }
+            // Check listen-ports includes HTTPS
+            const listenPorts = annotations["alb.ingress.kubernetes.io/listen-ports"];
+            if (listenPorts) {
+                try {
+                    const ports = JSON.parse(listenPorts);
+                    const hasHttps = ports.some((p) => "HTTPS" in p);
+                    if (!hasHttps) {
+                        diagnostics.push({
+                            checkId: "WK8304",
+                            severity: "warning",
+                            message: `Ingress "${resourceName}" has ssl-redirect but listen-ports does not include HTTPS`,
+                            entity: resourceName,
+                            lexicon: "k8s",
+                        });
+                    }
+                }
+                catch {
+                    // Can't parse listen-ports — skip this check
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8305.js

@@ -0,0 +1,96 @@
+/**
+ * WK8305: Ingress Port Not Matching Service
+ *
+ * Flags Ingress backends whose `service.port.number` does not match
+ * any declared port on the referenced Service in the manifest set.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const wk8305 = {
+    id: "WK8305",
+    description: "Ingress port not matching Service — backend port must match a declared Service port",
+    check(ctx) {
+        const diagnostics = [];
+        const manifests = docsToManifests(ctx);
+        // Build a map of Service name+namespace → set of port numbers
+        const servicePorts = collectServicePorts(manifests);
+        for (const manifest of manifests) {
+            if (manifest.kind !== "Ingress")
+                continue;
+            const ingressName = manifest.metadata?.name ?? "Ingress";
+            const ingressNamespace = manifest.metadata?.namespace ?? "default";
+            const spec = manifest.spec;
+            if (!spec)
+                continue;
+            const rules = spec.rules;
+            if (!rules)
+                continue;
+            for (const rule of rules) {
+                const http = rule.http;
+                if (!http)
+                    continue;
+                const paths = http.paths;
+                if (!paths)
+                    continue;
+                for (const pathEntry of paths) {
+                    const backend = pathEntry.backend;
+                    if (!backend)
+                        continue;
+                    const service = backend.service;
+                    if (!service)
+                        continue;
+                    const svcName = service.name;
+                    const port = service.port;
+                    const portNumber = port?.number;
+                    if (!svcName || portNumber === undefined)
+                        continue;
+                    // Look up the Service in the manifest set
+                    const key = `${ingressNamespace}/${svcName}`;
+                    const knownPorts = servicePorts.get(key);
+                    // Skip if the Service is not in the manifest set (external service)
+                    if (!knownPorts)
+                        continue;
+                    if (!knownPorts.has(portNumber)) {
+                        diagnostics.push({
+                            checkId: "WK8305",
+                            severity: "warning",
+                            message: `Ingress "${ingressName}" references Service "${svcName}" port ${portNumber}, but the Service only declares ports [${[...knownPorts].join(", ")}]`,
+                            entity: ingressName,
+                            lexicon: "k8s",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};
+/**
+ * Collect port numbers from all Service manifests, keyed by namespace/name.
+ */
+function collectServicePorts(manifests) {
+    const result = new Map();
+    for (const manifest of manifests) {
+        if (manifest.kind !== "Service")
+            continue;
+        const name = manifest.metadata?.name;
+        const namespace = manifest.metadata?.namespace ?? "default";
+        if (!name)
+            continue;
+        const key = `${namespace}/${name}`;
+        const ports = new Set();
+        const spec = manifest.spec;
+        if (spec) {
+            const specPorts = spec.ports;
+            if (specPorts) {
+                for (const p of specPorts) {
+                    const port = p.port;
+                    if (port !== undefined) {
+                        ports.add(port);
+                    }
+                }
+            }
+        }
+        result.set(key, ports);
+    }
+    return result;
+}

package/dist/lint/post-synth/wk8306.js

@@ -0,0 +1,38 @@
+/**
+ * WK8306: Container Command Starts With Flag
+ *
+ * If `command[0]` starts with `-` or `--`, it's almost certainly a mistake —
+ * the first element should be the binary/entrypoint, flags belong in `args`.
+ * This causes OCI runtime errors because the container runtime tries to
+ * execute the flag as a binary.
+ */
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers.js";
+export const wk8306 = {
+    id: "WK8306",
+    description: "Container command starts with flag — first element should be a binary, not a flag",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind))
+                continue;
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            const containers = extractContainers(manifest);
+            for (const container of containers) {
+                const command = container.command;
+                if (!Array.isArray(command) || command.length === 0)
+                    continue;
+                const firstArg = String(command[0]);
+                if (firstArg.startsWith("-")) {
+                    diagnostics.push({
+                        checkId: "WK8306",
+                        severity: "error",
+                        message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has command[0]="${firstArg}" which starts with a flag — the first element should be the binary, flags belong in args`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8401.js

@@ -0,0 +1,86 @@
+/**
+ * WK8401: shmSize exceeds container memory limit
+ *
+ * A RayCluster pod uses an emptyDir volume with medium: Memory for /dev/shm.
+ * Kubernetes counts that memory against the container's memory limit — if the
+ * sizeLimit exceeds the container's memory limit the pod will never schedule
+ * (Kubelet rejects it with "Invalid value … must be less than or equal to memory limit").
+ */
+import { docsToManifests, parseMemoryBytes } from "./k8s-helpers.js";
+export const wk8401 = {
+    id: "WK8401",
+    description: "shmSize must not exceed the container memory limit — pod will not schedule if it does",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "RayCluster")
+                continue;
+            const clusterName = manifest.metadata?.name ?? "RayCluster";
+            const spec = manifest.spec;
+            if (!spec)
+                continue;
+            const groups = [];
+            // Head group
+            const headGroupSpec = spec.headGroupSpec;
+            if (headGroupSpec) {
+                const tmpl = headGroupSpec.template;
+                const podSpec = tmpl?.spec;
+                if (podSpec)
+                    groups.push({ label: "head", templateSpec: podSpec });
+            }
+            // Worker groups
+            const workerGroupSpecs = spec.workerGroupSpecs;
+            if (Array.isArray(workerGroupSpecs)) {
+                for (const wg of workerGroupSpecs) {
+                    const name = wg.groupName ?? "worker";
+                    const tmpl = wg.template;
+                    const podSpec = tmpl?.spec;
+                    if (podSpec)
+                        groups.push({ label: `worker "${name}"`, templateSpec: podSpec });
+                }
+            }
+            for (const { label, templateSpec } of groups) {
+                // Find the emptyDir Memory volume (dshm)
+                const volumes = templateSpec.volumes;
+                if (!Array.isArray(volumes))
+                    continue;
+                for (const vol of volumes) {
+                    const emptyDir = vol.emptyDir;
+                    if (!emptyDir || emptyDir.medium !== "Memory")
+                        continue;
+                    const sizeLimit = emptyDir.sizeLimit;
+                    if (!sizeLimit)
+                        continue;
+                    const shmBytes = parseMemoryBytes(sizeLimit);
+                    if (isNaN(shmBytes))
+                        continue;
+                    // Find memory limit from the first container that mounts this volume
+                    const containers = templateSpec.containers;
+                    if (!Array.isArray(containers))
+                        continue;
+                    for (const container of containers) {
+                        const resources = container.resources;
+                        const limits = resources?.limits;
+                        const memLimit = limits?.memory;
+                        if (!memLimit)
+                            continue;
+                        const memBytes = parseMemoryBytes(memLimit);
+                        if (isNaN(memBytes))
+                            continue;
+                        if (shmBytes > memBytes) {
+                            diagnostics.push({
+                                checkId: "WK8401",
+                                severity: "error",
+                                message: `RayCluster "${clusterName}" ${label}: shmSize "${sizeLimit}" exceeds memory limit "${memLimit}" — pod will not schedule`,
+                                entity: clusterName,
+                                lexicon: "k8s",
+                            });
+                        }
+                        break; // Only check the first container per group
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8402.js

@@ -0,0 +1,31 @@
+/**
+ * WK8402: RayCluster missing spec.rayVersion
+ *
+ * KubeRay uses spec.rayVersion to select the Ray autoscaler sidecar image.
+ * Without it, KubeRay defaults to the "latest" tag — autoscaler and Ray head
+ * may run mismatched versions, leading to silent protocol failures.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+export const wk8402 = {
+    id: "WK8402",
+    description: "RayCluster should set spec.rayVersion so KubeRay selects the correct autoscaler image",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "RayCluster")
+                continue;
+            const name = manifest.metadata?.name ?? "RayCluster";
+            const rayVersion = manifest.spec?.rayVersion;
+            if (!rayVersion) {
+                diagnostics.push({
+                    checkId: "WK8402",
+                    severity: "warning",
+                    message: `RayCluster "${name}" is missing spec.rayVersion — KubeRay autoscaler will pull the "latest" image tag`,
+                    entity: name,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8403.js

@@ -0,0 +1,49 @@
+/**
+ * WK8403: spec.rayVersion does not match head image tag
+ *
+ * When spec.rayVersion is set but doesn't match the version in the head
+ * container image tag, the KubeRay autoscaler sidecar will run a different
+ * Ray version than the cluster. This can cause gRPC compatibility failures.
+ */
+import { docsToManifests, extractRayVersion } from "./k8s-helpers.js";
+export const wk8403 = {
+    id: "WK8403",
+    description: "spec.rayVersion should match the Ray version in the head container image tag",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "RayCluster")
+                continue;
+            const clusterName = manifest.metadata?.name ?? "RayCluster";
+            const spec = manifest.spec;
+            if (!spec)
+                continue;
+            const rayVersion = spec.rayVersion;
+            if (!rayVersion)
+                continue; // WK8402 covers the missing case
+            // Extract version from head container image
+            const headGroupSpec = spec.headGroupSpec;
+            const tmpl = headGroupSpec?.template;
+            const podSpec = tmpl?.spec;
+            const containers = podSpec?.containers;
+            if (!Array.isArray(containers) || containers.length === 0)
+                continue;
+            const image = containers[0].image;
+            if (!image)
+                continue;
+            const imageVersion = extractRayVersion(image);
+            if (!imageVersion)
+                continue; // Can't determine version from tag
+            if (imageVersion !== rayVersion) {
+                diagnostics.push({
+                    checkId: "WK8403",
+                    severity: "warning",
+                    message: `RayCluster "${clusterName}": spec.rayVersion "${rayVersion}" does not match head image tag "${imageVersion}" — autoscaler may run a mismatched Ray version`,
+                    entity: clusterName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8404.js

@@ -0,0 +1,36 @@
+/**
+ * WK8404: GPU request without a matching toleration
+ *
+ * A pod that requests `nvidia.com/gpu` but carries no toleration for the
+ * `nvidia.com/gpu` taint won't schedule onto a tainted GPU node pool (see
+ * `GpuNodePool`, #987, which taints its nodes `nvidia.com/gpu=present` by
+ * default). The pod sits `Pending` with `0/N nodes are available` until a
+ * toleration is added.
+ */
+import { docsToManifests, extractContainers, extractPodSpec, requestsGpu, toleratesGpu, GPU_POD_KINDS, } from "./k8s-helpers.js";
+export const wk8404 = {
+    id: "WK8404",
+    description: "GPU request without a matching nvidia.com/gpu toleration",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !GPU_POD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            if (!requestsGpu(containers))
+                continue;
+            const podSpec = extractPodSpec(manifest);
+            if (toleratesGpu(podSpec?.tolerations))
+                continue;
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            diagnostics.push({
+                checkId: "WK8404",
+                severity: "error",
+                message: `${manifest.kind} "${resourceName}" requests nvidia.com/gpu but has no toleration for the nvidia.com/gpu taint — it will not schedule onto a tainted GPU node pool`,
+                entity: resourceName,
+                lexicon: "k8s",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8405.js

@@ -0,0 +1,65 @@
+/**
+ * WK8405: Serving workload without a PodDisruptionBudget
+ *
+ * An InferenceService (or a Deployment carrying a serving
+ * `app.kubernetes.io/component` label — e.g. `inference-service` or
+ * `vllm-serving-runtime`) with no PodDisruptionBudget selecting it can lose
+ * every replica at once during a voluntary disruption (node drain, cluster
+ * upgrade), taking the model endpoint down. Serving workloads should ship
+ * with a PDB.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+/** `app.kubernetes.io/component` values this lexicon's composites use for serving workloads. */
+const SERVING_COMPONENTS = new Set(["inference-service", "vllm-serving-runtime", "model-serving"]);
+function isServingWorkload(manifest) {
+    if (manifest.kind === "InferenceService")
+        return true;
+    if (manifest.kind !== "Deployment" && manifest.kind !== "StatefulSet")
+        return false;
+    const component = manifest.metadata?.labels?.["app.kubernetes.io/component"];
+    return component !== undefined && SERVING_COMPONENTS.has(component);
+}
+export const wk8405 = {
+    id: "WK8405",
+    description: "Serving workload (InferenceService / serving Deployment) has no PodDisruptionBudget",
+    check(ctx) {
+        const diagnostics = [];
+        const manifests = docsToManifests(ctx);
+        const pdbSelectors = collectPdbSelectors(manifests);
+        for (const manifest of manifests) {
+            if (!isServingWorkload(manifest))
+                continue;
+            const labels = manifest.metadata?.labels;
+            const resourceName = manifest.metadata?.name ?? manifest.kind ?? "workload";
+            if (!labels || !hasCoveringPdb(labels, pdbSelectors)) {
+                diagnostics.push({
+                    checkId: "WK8405",
+                    severity: "info",
+                    message: `${manifest.kind} "${resourceName}" is a serving workload with no PodDisruptionBudget — add a PDB so a node drain or cluster upgrade cannot take down every replica at once`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};
+function collectPdbSelectors(manifests) {
+    const selectors = [];
+    for (const manifest of manifests) {
+        if (manifest.kind !== "PodDisruptionBudget")
+            continue;
+        const spec = manifest.spec;
+        if (!spec)
+            continue;
+        const selector = spec.selector;
+        const matchLabels = selector?.matchLabels;
+        if (matchLabels && typeof matchLabels === "object") {
+            selectors.push(matchLabels);
+        }
+    }
+    return selectors;
+}
+function hasCoveringPdb(workloadLabels, pdbSelectors) {
+    return pdbSelectors.some((pdbLabels) => Object.entries(pdbLabels).every(([key, value]) => workloadLabels[key] === value));
+}

package/dist/lint/post-synth/wk8406.js

@@ -0,0 +1,50 @@
+/**
+ * WK8406: No resource limits on a GPU pod
+ *
+ * A container that requests `nvidia.com/gpu` but sets no cpu/memory limits
+ * can starve other pods on the same (expensive, scarce) GPU node of CPU and
+ * memory headroom. Unlike WK8201's general resource-limits guidance, this
+ * check is scoped to GPU-requesting containers specifically, since GPU node
+ * capacity is costlier and more contended than a general-purpose pool.
+ */
+import { docsToManifests, extractContainers, GPU_POD_KINDS, NVIDIA_GPU_RESOURCE } from "./k8s-helpers.js";
+export const wk8406 = {
+    id: "WK8406",
+    description: "GPU-requesting container has no cpu/memory resource limits",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (!manifest.kind || !GPU_POD_KINDS.has(manifest.kind))
+                continue;
+            const containers = extractContainers(manifest);
+            const resourceName = manifest.metadata?.name ?? manifest.kind;
+            for (const container of containers) {
+                const requests = container.resources?.requests;
+                const limits = container.resources?.limits;
+                const requestsGpu = Boolean(requests?.[NVIDIA_GPU_RESOURCE]) || Boolean(limits?.[NVIDIA_GPU_RESOURCE]);
+                if (!requestsGpu)
+                    continue;
+                const missing = [];
+                if (!limits || typeof limits !== "object") {
+                    missing.push("cpu", "memory");
+                }
+                else {
+                    if (!limits.cpu)
+                        missing.push("cpu");
+                    if (!limits.memory)
+                        missing.push("memory");
+                }
+                if (missing.length > 0) {
+                    diagnostics.push({
+                        checkId: "WK8406",
+                        severity: "warning",
+                        message: `GPU container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" is missing resource limits for ${missing.join(", ")} — a GPU pod without cpu/memory limits can starve its (scarce, expensive) node`,
+                        entity: resourceName,
+                        lexicon: "k8s",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8407.js

@@ -0,0 +1,58 @@
+/**
+ * WK8407: Unpinned model version
+ *
+ * KServe's InferenceService predictor pins a model by `storageUri`. The
+ * `Model` composite (#986) always appends `version` as the trailing path
+ * segment (`scheme://id/version`), so a resolved `Model` reference is
+ * always pinned — but `InferenceService.model` also accepts a raw
+ * `storageUri` string (#985), which can bypass that guarantee (e.g.
+ * `"gs://bucket/model"` with no version segment, or a floating tag like
+ * `"latest"`/`"main"`). An unpinned reference means a redeploy of the same
+ * InferenceService can silently pick up different weights.
+ */
+import { docsToManifests } from "./k8s-helpers.js";
+/** Trailing path segments that mean "no explicit version" even though present. */
+const FLOATING_TAGS = new Set(["latest", "main", "master", "head"]);
+/**
+ * True when `storageUri` has an explicit, non-floating version segment:
+ * `scheme://path/version` with at least two path segments after the
+ * scheme, and the last segment isn't a known floating tag.
+ */
+export function isPinnedStorageUri(storageUri) {
+    const m = /^[a-z][a-z0-9+.-]*:\/\/(.+)$/i.exec(storageUri.trim());
+    if (!m)
+        return false;
+    const segments = m[1].split("/").filter((s) => s.length > 0);
+    if (segments.length < 2)
+        return false;
+    const last = segments[segments.length - 1].toLowerCase();
+    return !FLOATING_TAGS.has(last);
+}
+export const wk8407 = {
+    id: "WK8407",
+    description: "InferenceService model storageUri has no explicit version segment",
+    check(ctx) {
+        const diagnostics = [];
+        for (const manifest of docsToManifests(ctx)) {
+            if (manifest.kind !== "InferenceService")
+                continue;
+            const spec = manifest.spec;
+            const predictor = spec?.predictor;
+            const model = predictor?.model;
+            const storageUri = model?.storageUri;
+            if (!storageUri)
+                continue;
+            if (!isPinnedStorageUri(storageUri)) {
+                const resourceName = manifest.metadata?.name ?? "InferenceService";
+                diagnostics.push({
+                    checkId: "WK8407",
+                    severity: "warning",
+                    message: `InferenceService "${resourceName}": model storageUri "${storageUri}" has no explicit version segment — pin it (e.g. via the Model composite's required \`version\`) so a redeploy can't silently pick up different weights`,
+                    entity: resourceName,
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};