Summary

Backfill healthCheck.assertFile content for the three registry
components that don't yet have one, so the deployment phase's Chainsaw
coverage matches the registry once PR 2 ships the runner.

Depends on #660 PR 1 (hydration) + PR 2 (runtime).

Components Needing Backfill

gke-nccl-tcpxo

• Predecessor Add registry-driven deployment readiness for all components #622 named nccl-tcpxo-installer and device-injector
  DaemonSets in kube-system; confirm these are the target before
  writing the check.
• Add recipes/checks/gke-nccl-tcpxo/health-check.yaml with read-only
  assert / error content only.
• Live-run against h100-gke-cos-training (or document why that
  environment was unavailable).

dynamo-crds

• CRD-only component. The pinned chart is not vendored in-repo.
• Document the CRD-name extraction procedure (e.g., helm template
  against the pinned chart version) and pin the enumerated list of
  CRD names in the assert file.
• Assert exact CRD names show Established=True.

kgateway-crds

• CRD-only component. Pinned chart:
  oci://cr.kgateway.dev/kgateway-dev/charts/kgateway-crds:v2.0.0
  (declared in recipes/registry.yaml:400-408).
• Per the comment in recipes/components/kgateway-crds/values.yaml:15-22,
  the chart installs six CRDs (Backends, DirectResponses,
  GatewayExtensions, GatewayParameters, HTTPListenerPolicies,
  TrafficPolicies — all under gateway.kgateway.dev).
• The Gateway API and Inference Extension CRDs under
  recipes/components/kgateway-crds/manifests/ are prerequisites, not
  CRDs this chart creates. Scope of the check:
  • If the bundler installs both the chart and the vendored manifests
    under this component's install path, assert both sets.
  • If the vendored manifests are owned by a different component or by
    a separate bundle step, keep this check to the chart's six CRDs
    only and file a follow-up to stand up a prerequisite component
    (e.g., gateway-api-crds / inference-extension-crds) with its
    own health check.
• Re-verify the exact CRD set against the pinned upstream chart; if
  any names drift from the values.yaml comment, reconcile both in
  the same PR.

Acceptance Criteria

• recipes/checks/gke-nccl-tcpxo/health-check.yaml exists; corresponding
  healthCheck.assertFile entry added to recipes/registry.yaml.
• recipes/checks/dynamo-crds/health-check.yaml exists; CRD list
  pinned; extraction procedure documented in the PR body.
• recipes/checks/kgateway-crds/health-check.yaml exists; the six
  chart CRDs verified against the pinned chart; vendored-manifest scope
  decision documented.
• All three checks use only the read-only assert / error allowlist
  (PR 2 / PR 5 contract).
• After this PR lands, every current registry component has a
  healthCheck.assertFile.
• Live-cluster validation run against
  h100-eks-ubuntu-inference-dynamo is included in the PR description;
  if gke-nccl-tcpxo is added/changed, also run against
  h100-gke-cos-training or document unavailability.

Related

• Parent epic: [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660
• Depends on: [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 1, [EPIC] Reuse Chainsaw health checks in aicr validate --phase deployment #660 PR 2