Prerequisites

• I searched existing issues

Feature Summary

Extend the --config (AICRConfig) flag to the aicr snapshot command, mirroring the support already present on recipe, bundle, and validate.

Problem/Use Case

Today the AICRConfig schema in pkg/config/config.go covers spec.recipe, spec.bundle, and spec.validate only. pkg/cli/snapshot.go does not read --config, so reproducible end-to-end demos (e.g. demos/cuj1-gke-config.md) still have to pass --namespace, --node-selector, and --toleration as bare CLI flags for the snapshot step while the rest of the pipeline is config-driven.

This breaks the "one file drives the whole flow" property: a contributor or CI job that wants to reproduce a known-good snapshot → recipe → bundle → validate → evidence verify run cannot version-control the snapshot inputs alongside the recipe and bundle inputs.

Proposed Solution

Add a spec.snapshot section to AICRConfig with the same shape as the existing sibling specs, e.g.:

spec:
  snapshot:
    output:
      path: snapshot.yaml
      format: yaml
    agent:
      namespace: aicr-validation
      nodeSelector:
        nodeGroup: gpu-worker
      tolerations:
        - dedicated=gpu-workload:NoSchedule
        - nvidia.com/gpu=present:NoSchedule
      # optional: image, imagePullSecrets, serviceAccountName, requireGpu (already in ValidateAgentSpec)
    execution:
      timeout: 5m
      noCleanup: false

Reuse the existing patterns:

• Mirror ValidateAgentSpec for the agent block (selector/tolerations omitted = inherit, [] = clear).
• Mirror RecipeOutputSpec / ValidateExecutionSpec for output and execution.
• CLI flag wins over config (same stringSliceFlagOrConfig / similar helpers already used in pkg/cli/validate.go).
• Snapshot does not need input (it produces the snapshot; nothing to load).

Wire pkg/cli/snapshot.go through loadCmdConfig like the other commands.

Success Criteria

• aicr snapshot --config aicr-config.yaml works with no additional flags when spec.snapshot.agent.* and spec.snapshot.output.path are populated.
• CLI flags (--namespace, --node-selector, --toleration, --output, etc.) override the matching config fields.
• Existing CLI invocations without --config continue to work unchanged.
• Schema parity check (a test analogous to pkg/cli/config_e2e_test.go) confirms spec.snapshot round-trips and rejects unknown fields / invalid enums.
• demos/cuj1-gke-config.md can be updated so the snapshot step uses --config only.
• Docs: docs/user/cli-reference.md and the AICRConfig reference in docs/contributor/cli.md updated in the same PR.

Alternatives Considered

• Keep snapshot CLI-only and rely on shell wrappers. Rejected: defeats the single-source-of-truth property the rest of the AICRConfig surface already provides.
• Hoist agent settings into a shared top-level spec.agent block consumed by both snapshot and validate. Worth considering, but a larger refactor — ValidateAgentSpec is already in place and copying its shape under spec.snapshot.agent is the least-disruptive path.

Component

CLI (aicr)

Priority

Important (would improve my workflow)

Compatibility / Breaking Changes

Additive: new optional spec.snapshot section. No existing CLI flags removed or renamed. Unknown-field rejection on AICRConfig is unaffected as long as the new fields are added to the schema in the same change.

Operational Considerations

• Same trust surface as today — the CLI still resolves kubeconfig + auth from ambient credentials.
• Reproducibility improves: a snapshot run pinned to a config file is fully version-controllable.
• No new observability or upgrade concerns.

Are you willing to contribute?

Maybe, with guidance