[Kevin Cho (chokevin)]

The lower Project Signal layers define certification contracts, reconciliation, and participant execution, but they do not package or deploy the runtime. This top stack layer adds the build, image, manifest, RBAC, WorkflowTemplate, and controller Deployment integration needed to run the proven cross-node MPI orchestration path.

Stack

• Layer 4/4, stacked on feat(signal): add certification adapter #1025
• Lower layers: feat(signal): define certification contracts #1021 (contracts) -> feat(signal): add certification controller #1023 (controller) -> feat(signal): add certification adapter #1025 (adapter)
• feat(images): publish Project Signal baseline runner #1001 remains a separate prerequisite for the certification runner image; this PR only accepts that image as an immutable manifest input
• Carved from source monolith feat(signal): add first-class MPIJob certification #963

Scope

• Add namespace, service account, RBAC, fixed participant adapter WorkflowTemplate, and controller Deployment templates under deploy/signal/.
• Render the Signal templates plus the CRDs supplied by layer 1 through make signal-manifests.
• Add controller and adapter binary/image targets and Containerfiles.
• Exclude generated manifests from container build contexts.

Non-goals

• No CRD changes; those remain in feat(signal): define certification contracts #1021.
• No controller or adapter Go changes; those remain in feat(signal): add certification controller #1023 and feat(signal): add certification adapter #1025.
• No runner implementation or runner image target; that remains in feat(images): publish Project Signal baseline runner #1001.
• No claims or integration for soak testing, collectives, CUDA/NCCL behavior, or general image registry authentication.

Verification

• Passed: make signal-manifests
• Passed: make project-signal-controller-build project-signal-adapter-build
• Passed: go test ./api/signal/... ./cmd/project-signal-controller/... ./cmd/project-signal-adapter/... ./internal/signal/...
• Passed: local controller and adapter image builds; both loaded and inspected as Linux ARM64 images
• Passed: git diff --check
• Passed: exact changed-file boundary check against the 12 assigned paths
• Repository-wide go test ./... was run, but cannot pass on this macOS host because existing Linux-specific packages reference unavailable unix APIs and unrelated host-sensitive symlink tests fail. The Signal-specific packages above pass.

Review guide

1. Start with the signal-manifests and image targets in Makefile.
2. Review deploy/signal/04-adapter-workflowtemplate.yaml.tmpl and 06-deployment.yaml.tmpl for the fixed orchestration and immutable image wiring.
3. Check RBAC in 02-rbac.yaml.tmpl and 03-adapter-serviceaccount-rbac.yaml.tmpl against the controller and adapter responsibilities.
4. Confirm the runner remains an external image input rather than duplicated implementation.

Evidence

A 15-second recording shows the specific deployment/config diff, rendered manifest wiring, and successful build behavior. Detailed command logs are intentionally kept separate.

AI assistance: GitHub Copilot helped carve the assigned files, reconcile shared build wiring, run validation, create the evidence recording, and draft this description. The claims and final text were verified against the branch diff and command output.

signal-deployment-layer.mp4