[chokevin]

Azure#949 added grouped participant admission and the fail-closed Workflow contract, but intentionally left backend execution to operators. This follow-up adds an upstream generic adapter that now runs one independently pinned Pod or MPIJob per participant, records API-assigned backend identities, aggregates typed results, and cleans up every created resource while preserving Inconclusive at infrastructure boundaries.

• Adds project-signal-adapter, a Go executable that validates the ordered participant snapshot, immutable script/image inputs, queue and lifecycle policy, and the 64-participant bound.
• Renders one Node-pinned Pod for ordinary diagnostics or one kubeflow.org/v2beta1 MPIJob per participant for MPI diagnostics. Each MPIJob has one zero-GPU launcher and one Node-pinned GPU worker, with a configurable Kueue queue label, Workflow deadline, backoff, TTL, cleanPodPolicy: All, and replica-level restartPolicy: Never.
• Observes real workload UIDs and participant labels, captures bounded typed script results, and requires exact backend/result coverage before a grouped Pass. Backend execution failure takes precedence over diagnostic failure and remains Inconclusive.
• Runs participant backends concurrently, samples MPI launcher results before operator cleanup can remove Pods, and foreground-deletes all created resources. Workflow ownership provides a second cleanup boundary if the adapter process exits unexpectedly.
• Adds an optional project-signal-participant-adapter WorkflowTemplate, namespace-scoped ServiceAccount/RBAC, adapter container build, manifest wiring, and operator documentation.

Scope boundary

No certification scripts, runner packaging, hardware thresholds, deployment overlays, queue or flavor values, tolerations, cluster or node identifiers, credentials, endpoints, or live-resource actions are included. The adapter supports the existing Pod and MPIJob contract only; other backends remain operator-supplied.

Evidence

The attached 15-second recording shows the exact Workflow contract, MPIJob lifecycle/topology policy, and the focused rendering, fail-closed aggregation, and cleanup tests.

Verification

• Passed: go test -race ./api/signal/v1alpha1 ./internal/signal ./internal/signaladapter ./cmd/project-signal-controller ./cmd/project-signal-adapter ./deploy/signal
• Passed: golangci-lint run ./api/signal/v1alpha1 ./internal/signal ./internal/signaladapter ./cmd/project-signal-controller ./cmd/project-signal-adapter ./deploy/signal
• Passed: make signal-manifests
• Passed: go build ./cmd/project-signal-controller ./cmd/project-signal-adapter
• Passed: git diff --check
• Not run: adapter container build because no Docker daemon was available.
• Not run: live cluster validation; this change performed no live reads or mutations.

Risk

The main risk is compatibility with MPI Operator Pod labeling and cleanup timing. The adapter matches launcher Pods by the created MPIJob UID plus the launcher container name, samples results while execution is active, and fails closed if identity, status, logs, outputs, or cleanup cannot be proven. Rollback is this single commit and the two optional adapter manifests.

Review guide

1. Start with internal/signaladapter/adapter.go for participant validation, Pod/MPIJob rendering, output bounds, and aggregation precedence.
2. Review internal/signaladapter/runner.go for concurrent observation, API-assigned identity collection, result capture, and foreground cleanup.
3. Review deploy/signal/04-adapter-workflowtemplate.yaml.tmpl and 03-adapter-serviceaccount-rbac.yaml.tmpl for the feat(signal): add grouped certification controller Azure/unbounded#949 invocation path and permission boundary.
4. Review internal/signaladapter/*_test.go and deploy/signal/manifest_test.go for malformed identities, partial failures, bounds, lifecycle policy, and cleanup coverage.

AI assistance: GitHub Copilot assisted with implementation, tests, investigation, documentation, video preparation, and PR drafting. The author verified the claims and final text.

project-signal-adapter.mp4

[chokevin]

Superseded by the user-requested upstream draft Azure#963, opened directly against main. This fork-local PR was only the temporary clean stack while Azure#949 remained unmerged.