Parent: #1263 · Labels: enhancement · Size: L · Depends on: TG3
(needs processed trees) (new service path needs a labeler glob — see Key files)

Goal. A greenfield AICR-native, read-only API exposing the processed
grid//tabs//summary/ trees with AICR-criteria-aware navigation — replacing the
upstream TestGrid API + aggregator — resolving the stable per-recipe deep-link
coordinate and exposing a coordinate-presence signal the recipe-quality epic RQ2 can
key off. The API alone is the minimal-launch dependency and is enough to validate the
processed trees end-to-end before any UI exists.

Scope.

• API (read-only objectViewer, the serving SA from TG1): expose the grid
  matrix (Header[] columns × Row[] of Cell[]), tab/dashboard summaries, and a
  qualification/rollup view. The wire shape can follow the upstream TestGrid REST
  surface
  (/dashboard-groups, /dashboards/{d}/tabs, /.../rows, /.../tab-summaries,
  status codes 0–15; test-result-ingestion-reference.md §6) so standard mental
  models carry over, but the service is AICR-owned and AICR-criteria-aware.
• Criteria-aware endpoints: CSP-first group/dashboard/tab navigation; criteria
  facets (filter by service/accelerator/os/intent/platform) plus first-class
  k8s-version and aicr-version facets/filters that expose both k8s_version and
  aicr_version as queryable/groupable column dimensions (acceptance-criterion-level,
  not a minor note) so a tab can be grouped, sliced, and pivoted by observed k8s
  major.minor (recovering the regression attribution the k8s-in-column decision
  otherwise costs) and by AICR version (because main + the previous N stable
  releases yield multiple columns per recipe coordinate that users must slice, group,
  and compare across AICR versions, parallel to the k8s facet); verified
  provenance/signer fields (signer identity + issuer, source uat/community,
  evidence digest) per column; stable per-recipe deep-link resolution for a
  (group, dashboard, tab) coordinate (the URL contract TG6 specifies, computed via
  the shared coordinate helper — k8s in column means it does not churn).
• Coordinate-presence endpoint. A named endpoint that lists which coordinates
  have at least one build (and per coordinate, whether any column exists). The
  recipe-quality epic RQ2's link-integrity bot depends on this concretely to
  distinguish a legitimately-empty coordinate (no run yet) from a broken link.
• Served-content integrity. Verify each served column against its recorded
  evidence-bundle digest (or run a periodic auditor), so a tampered processed tree
  (a worker objectAdmin write going wrong) is detectable; surface digest + signer.
• Qualification fan-out is load-bearing, not a parenthetical. The qualification
  matrix view fans out across dashboards × tabs (a qualification view at scale can
  need ~250 requests, blowing
  past the browser per-origin connection cap), and CSP-first + k8s-in-column
  increase column and dashboard×tab cardinality at the 79-overlay target. Build a
  server-side fan-out layer with bounded concurrency, single-flight, a short TTL
  with stale-while-revalidate, and startup pre-warm, with /readyz gating the
  Service. Quantify the expected dashboard×tab cardinality at the full matrix so the
  fan-out budget is designed, not discovered in production.
• Liveness/readiness probes (operability owned by TG7; TG4a delivers the signals).
• Deployment manifests under infra/testgrid/k8s/ (onto the TG1 host cluster).

Out of scope. The UI (TG4b); ingestion (TG5); the taxonomy spec/docs (TG6). No
write access from the serving layer.

Key files. New service tree (language/path per maintainer choice); the shared
pkg/recipe coordinate helper (imported, not re-derived); deployment manifests
under infra/testgrid/k8s/; wire-shape reference test-result-ingestion-reference.md
§6–§8. If the service is Go and lives under pkg/, it inherits an existing
area/* glob; if it is a new top-level dir (e.g. services/testgrid/), add a
labeler.yml glob (the * @nvidia/aicr-write CODEOWNERS catch-all already owns it;
a narrower entry is optional).

Tests. API handler tests against fixture processed trees (grid matrix shape,
summary rollups, status-code mapping, facet filtering incl. the k8s facet,
deep-link resolution, coordinate-presence listing); a contract test that the
deep-link URL for a known recipe is stable across a simulated k8s major.minor bump;
a fan-out test asserting bounded concurrency / single-flight under a wide matrix;
served-content digest-mismatch detection; readiness/liveness probes. 75% floor
on any new Go package.

Acceptance. The API serves the processed trees read-only with criteria-aware
navigation (incl. k8s and aicr-version facets/grouping dimensions) and verified
provenance, resolves stable per-recipe deep-links across a simulated k8s bump,
exposes a coordinate-presence endpoint and a bounded qualification fan-out with
readiness gating, detects digest-mismatched columns, and has no write access.

Child of #1263 · staged from docs/design/010-aicr-testgrid.md (TG4a).