Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/gpu-h100-inference-test.yaml:
- Around line 75-82: The GPU H100 inference workflow trigger list is missing
vendor changes, so updates to vendored Go dependencies can bypass the
conformance run. Add vendor/** to the path filters alongside go.mod/go.sum in
the workflow condition for the aicr-related sources so any dependency vendoring
that can affect the binary still triggers this gate.

In @.github/workflows/gpu-h100-training-test.yaml:
- Around line 75-82: The GPU training workflow path filter is missing vendored
dependency changes, so a vendor-only update can bypass the conformance run.
Update the path list in the workflow to also include vendor/** alongside go.mod
and go.sum, keeping the change aligned with the aicr validation and recipe
bundling triggers.

In @.github/workflows/gpu-smoke-test.yaml:
- Around line 64-68: The GPU smoke workflow path filter still misses
dependency-only changes, so update the trigger logic in the workflow to also
match go.mod, go.sum, and vendor/** alongside the existing pkg/validator,
pkg/cli, and cmd/aicr paths. This ensures dependency updates that change the
built aicr binary still run the smoke job; adjust the same paths block in the
workflow YAML so these dependency files are included.

In @.github/workflows/kwok-recipes.yaml:
- Around line 25-32: Update the workflow trigger filters in the kwok-recipes
workflow so both the push and pull_request path lists include vendor/**
alongside go.mod and go.sum. The issue is that vendor-only dependency changes
still bypass this workflow, so mirror the vendored-dependency trigger in both
matching blocks that cover pkg/recipe, pkg/bundler, pkg/cli, cmd/aicr, go.mod,
and go.sum.

In @.github/workflows/recipe-evidence.yaml:
- Around line 46-54: The workflow path filter for the evidence gate is missing
vendor changes, so updates to dependencies can bypass this check. In the
.github/workflows/recipe-evidence.yaml trigger list, add the vendor directory
alongside go.mod and go.sum so changes affecting bundled dependencies rerun the
gate. Use the existing aicr evidence verify gate entries as the anchor when
updating the paths.

In @.github/workflows/sigstore-scaffolding-e2e.yaml:
- Around line 44-48: The Sigstore e2e path filter is missing vendored dependency
changes, so updates under vendor/** can still skip coverage. Update the
workflow’s changed-path list in the Sigstore scaffolding e2e trigger to include
vendor/** alongside go.mod and go.sum, using the existing path patterns in the
workflow file so dependency-only and vendored-tree changes both trigger the job.

In @.github/workflows/vuln-scan-images.yaml:
- Around line 181-183: The workflow’s permissions block grants packages: write
without explanation, which triggers the undocumented-permissions warning. Add a
short inline rationale comment near the permissions block in the
vuln-scan-images workflow, and keep the existing contents: read / packages:
write settings unchanged. Reference the workflow permissions section so it’s
easy to locate even if the YAML shifts.

In `@Makefile`:
- Around line 713-714: The KWOK install steps in the Makefile only time out the
kubectl API call, not the remote YAML fetch. Update the two kubectl apply
invocations in the KWOK setup target to fetch each manifest with an explicit
client-side timeout first, then pipe the downloaded content into kubectl apply
so the network download itself is bounded. Use the existing KWOK_VERSION-based
URLs and keep the change localized to the KWOK manifest download commands.

In `@pkg/bundler/checksum/checksum.go`:
- Around line 46-48: GenerateChecksums only checks ctx.Err() before starting, so
cancellation during the file-hashing loop is ignored. Update GenerateChecksums
to re-check the context inside the checksum-processing loop (and before writing
checksums.txt), using ctx.Err() or ctx.Done() so the function exits promptly on
timeout. Keep the fix localized around GenerateChecksums and the per-file
hashing/write path.

In `@pkg/collector/os/sysctl.go`:
- Around line 49-63: Preserve the callback’s timeout classification at the
collectSysctl boundary: the walk callback now returns a structured
ErrCodeTimeout, but collectSysctl still converts any WalkDir error into
ErrCodeInternal and loses that signal. Update the error handling around the
WalkDir call in collectSysctl to use errors.PropagateOrWrap(err, errCode,
message) (or equivalent structured propagation) so a timeout from the callback
remains ErrCodeTimeout while other walk failures are still wrapped
appropriately. Refer to collectSysctl and the WalkDir callback logic when
applying the change.

In `@pkg/errors/errors_test.go`:
- Around line 24-39: The IsTransient test table in TestIsTransient is missing
coverage for a mixed unwrap chain where a non-timeout outer error wraps a
timeout inner error. Add a case using Wrap with ErrCodeInternal on the outside
and New(ErrCodeTimeout, ...) inside, and assert IsTransient returns true so the
test explicitly covers timeout detection anywhere in the unwrap chain.

In `@pkg/evidence/verifier/inventory.go`:
- Around line 141-145: The inventory verification logic in Verify currently only
iterates attestation.AllPhases and skips missing entries, which allows unknown
or misspelled keys in pred.Phases to pass unchecked. Update the phase validation
in pkg/evidence/verifier/inventory.go so Verify explicitly rejects any predicate
phase key not present in attestation.AllPhases, rather than silently continuing.
Use the existing pred.Phases, attestation.AllPhases, and Verify flow to add a
fail-closed check before concluding inventory success.

In `@pkg/serializer/reader_test.go`:
- Around line 493-501: The oversize-file test in NewFileReader only checks the
error text, so it can miss a regression in error classification. Update the
assertion in reader_test.go to verify the returned error is classified as
ErrCodeInvalidRequest for the oversize YAML input, using the NewFileReader
result and the existing error handling path, and keep the size-limit message
check only as a secondary validation if needed.

In `@pkg/serializer/reader.go`:
- Around line 166-168: The local read path in reader.go still blocks inside
io.ReadAll without enforcing ctx cancellation, so the timeout guarantee in the
surrounding comment is overstated. Update the read flow in the local-read branch
of the reader logic to keep checking ctx.Done() during the long-running read
instead of only before it starts, using the existing context handling around the
read loop or helper in reader.go. Make sure the symbols involved in this path,
especially the local-read branch around io.ReadAll, actually stop promptly on
deadline rather than relying on a pre-check alone.
- Around line 231-234: The structured errors returned by
NewFileReaderWithContext are being flattened to INTERNAL in the
FromFileWithKubeconfigContext path. Update the error handling in
FromFileWithKubeconfigContext so it preserves existing structured codes like
INVALID_REQUEST, TIMEOUT, and NOT_FOUND instead of always wrapping with
ErrCodeInternal; use errors.PropagateOrWrap(err, errCode, message) at the call
site that handles reader-construction failures. Keep the fix focused on the
reader construction flow and the related error-wrapping logic in
pkg/serializer/reader.go.

In `@tools/cleanup`:
- Around line 202-209: The CRD cleanup path in the cleanup logic is swallowing
API failures by using `|| true`, so timed-out or unhealthy apiserver calls can
still report success while leaving CRDs behind. Update the `all_crds` lookup and
the `kubectl delete` call in the cleanup loop to surface real failures instead
of masking them, while still keeping the bounded `--request-timeout` behavior
and only ignoring genuinely missing resources with `--ignore-not-found`.

In `@validators/conformance/helpers.go`:
- Around line 78-80: The oversize response classification from helpers.httpGet
is being lost because ai_service_metrics_check’s httpGet caller wraps every
non-timeout error as SERVICE_UNAVAILABLE. Update the caller to preserve
structured errors by using errors.PropagateOrWrap instead of unconditionally
wrapping, so ErrCodeInvalidRequest from httpGet can pass through while still
mapping unstructured failures to the service-unavailable path. Focus on the
httpGet handling logic in the AI service metrics check flow.

In `@validators/performance/inference_perf_constraint.go`:
- Around line 1119-1131: The watch-close handling in
inference_perf_constraint.go is dropping the re-check failure and always falling
back to ErrCodeUnavailable. Update the namespace/deployment watch-close branches
so the follow-up Get/readback error is propagated or wrapped instead of ignored,
and only return ErrCodeUnavailable when the confirmation Get succeeds but the
resource is still present/in the wrong state. Use errors.PropagateOrWrap(err,
errCode, message) in the affected reconciliation paths (including the later
deployment check) so existing structured error codes from clients.Get are
preserved.

In `@validators/performance/nccl_all_reduce_bw_constraint.go`:
- Around line 898-910: The watch-close fallback paths in the NCCL all-reduce BW
constraint reconciliation logic are masking real apiserver/client failures by
returning ErrCodeUnavailable even when the retry read itself fails. Update the
branches around waitCtx.Err, rctClient.Get, and the corresponding List checks to
only return ErrCodeUnavailable after a successful fallback read that still does
not show the expected object, and otherwise propagate the underlying
getErr/listErr using errors.PropagateOrWrap so the original structured error
code and message are preserved.
- Around line 1282-1297: The newestRunnablePod helper currently treats
PodSucceeded as eligible, which can cause waitForPodByLabelSelector to reuse a
completed pod from an earlier run. Update newestRunnablePod to exclude succeeded
pods alongside terminating and failed pods by extending the status filter in the
pod scan loop, keeping the behavior aligned with its non-terminating/runnable
contract.

In `@validators/performance/nccl_preflight_nvreg.go`:
- Around line 272-285: The fallback re-check in the pod watch handling is
dropping the real `Get` failure and always returning a generic unavailable
error. In the `ncclPreflight` watch-closure path, update the logic around
`podsClient.Get` so that a failed re-read returns the original `getErr` using
`errors.PropagateOrWrap` to preserve structured error codes, and only emit
`ErrCodeUnavailable` when the re-read succeeds but still shows a non-terminal
pod phase.

In `@validators/performance/trainer_lifecycle.go`:
- Around line 335-344: The CRD watch-closure fallback in trainer_lifecycle.go is
masking a failed re-check by returning ErrCodeUnavailable even when the
dynamicClient.Resource(crdGVR).Get call fails. Update the recheck logic so a
failed Get propagates or wraps the underlying error using
errors.PropagateOrWrap, and only return the unavailable result when the re-read
succeeds and isCRDEstablished still reports false; keep the existing ctx.Err()
timeout handling and the CRD-established success path intact.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/bundler/checksum/checksum.go`:
- Around line 54-58: The checksum generation flow in GenerateChecksums still has
a small false-pass window because cancellation can happen after the loop ends
but before checksums.txt is written. Add one more ctx.Err() check in
GenerateChecksums immediately after the file-hashing loop and before the final
write so a late cancellation returns the same timeout error instead of
succeeding.

In `@validators/performance/inference_perf_constraint.go`:
- Around line 1245-1260: The fallback re-Get path in the DynamoGraphDeployment
watch handling can misclassify a request timeout as an internal error when
waitCtx expires between the context check and the Get call. Update the switch in
the recheck logic to explicitly detect context deadline exceeded or canceled
from getErr before the default branch, and return ErrCodeTimeout instead of
wrapping it as ErrCodeInternal. Use the existing watch/recheck block around
isDynamoDeploymentReady, apierrors.IsNotFound, and errors.Wrap to keep the
behavior consistent with the other DynamoGraphDeployment readiness paths.

In `@validators/performance/nccl_all_reduce_bw_constraint.go`:
- Around line 905-915: The fallback re-check in the IMEX ResourceClaimTemplate
wait path is misclassifying context/deadline failures as internal errors; update
the switch in the reconciliation logic around the rctClient.Get fallback so
timeout-like errors from that Get are returned as the timeout/unavailable class
instead of ErrCodeInternal. Use the existing IMEX ResourceClaimTemplate
watch-close branch and its aicrErrors.Wrap/aicrErrors.New handling to preserve
the original timeout classification when waitCtx expires before the re-check
completes.

In `@validators/performance/nccl_preflight_nvreg.go`:
- Around line 279-292: The fallback Get in the pod watch completion path is
misclassifying deadline races as internal errors instead of timeouts. In the
branch that handles current, getErr := podsClient.Get(...) inside the wait loop,
re-check waitCtx.Err() before the default error return and map context deadline
or cancellation to aicrErrors.ErrCodeTimeout rather than wrapping it as
ErrCodeInternal. Keep the existing handling in the watch fallback logic around
podsClient.Get, apierrors.IsNotFound, and the current.Status.Phase checks.

In `@validators/performance/trainer_lifecycle.go`:
- Around line 340-351: The new re-check failure codes are being lost because
waitForTrainerCRDsEstablished still wraps every waitForCRDEstablished error as
ErrCodeTimeout, which hides the ErrCodeUnavailable and ErrCodeInternal results
added in the CRD re-check path. Update the error handling in
waitForTrainerCRDsEstablished to use errors.PropagateOrWrap(err, errCode,
message) so existing structured codes from waitForCRDEstablished are preserved,
while only assigning ErrCodeTimeout when the failure is truly a timeout.