feat(sdk): derive evidence attestation options from AICRConfig

[mchmarny]

Summary

Adds Config.EvidenceAttestationOptions(), the derivation for
spec.validate.evidence.attestation, and clears the three review nits deferred
from #2243.

Motivation / Context

#2538 landed the last of the three facade derivations (slices 1-3 of #2245).
This picks up the pieces that were scoped into #2245 but not delivered with
them: the evidence derivation the spec.validate breakdown calls for, and the
three nits the issue folds in "because they are cheaper to do alongside this
work than on their own".

Also corrects a docs table row from #2538 that claimed SnapshotAgentConfig()
reads spec.snapshot.output. It does not, and the godoc plus the detailed
section both say so explicitly — the summary table was the only place that
disagreed.

Fixes: N/A
Related: #2245, #2243, #2538

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• API server (cmd/aicrd, pkg/server)
• Recipe engine / data (pkg/recipe)
• Bundlers (pkg/bundler, pkg/component/*)
• Collectors / snapshotter (pkg/collector, pkg/snapshotter)
• Validator (pkg/validator)
• Core libraries (pkg/errors, pkg/k8s)
• Docs/examples (docs/, examples/)
• Other: SDK facade (pkg/client/v1)

Implementation Notes

Why EvidenceAttestationOptions() and not EvidenceOptions().
spec.validate.evidence carries two kinds — cncf and attestation — and
EvidenceOptions maps only to the attestation half. There is no facade entry
point that emits CNCF AI Conformance evidence, so a method named for the whole
section would advertise coverage it does not have. Naming it for the half it
carries also leaves room for an EvidenceCNCFOptions() later without a
breaking rename.

Why it returns a bool. out is the enable gate, matching
EvidenceAttestationSpec.Out's own contract: an empty out leaves the path off
even when the other fields are populated. EmitRecipeEvidence rejects an empty
OutDir with ErrCodeInvalidRequest, so a zero-value EvidenceOptions alone
could not tell a caller whether the document declined the bundle or fumbled it.
The bool separates the two; a malformed section is still an error.

Four fields stay caller-owned, and two of them are a control, not a gap.
Commit names the running binary and OIDCResolve is a short-lived secret the
spec deliberately excludes. NoSign and Full are command-line-only for the
same reason as IgnoreTLog and failOnError: both weaken a run, and a
checked-in file that can silently disable signing is a supply-chain downgrade
no reviewer would see in a diff. That reasoning is in the godoc so it does not
get "fixed" later.

Known duplication. buildRecipeEvidenceConfig (pkg/cli/validate_evidence.go)
still maps the same five fields inline. Migrating it is slice 4's job, which
#2245 defers on purpose; the coupling is noted in the godoc so a change to one
prompts a look at the other.

Nits from #2243:

1. pkg/cli/root.go now logs the concrete directory on the spec.recipe.data
   branch, as the --data branch already did. Read from the same
   Recipe().DataDir() accessor RecipeSource() uses, so the two cannot
   disagree. Deliberately did not add a Config.RecipeDataDir() accessor for
   this — new SDK surface for a log line is the wrong trade this close to the
   freeze, and slice 4 is the right place to revisit it.
2. TestConfig_RawAccessors could only count opaque options. The folded values
   are now asserted in a new internal test that applies them against
   recipeResolveConfig. Uses customer-managed + enabled rather than
   disabled twice, since both enums accept disabled and a same-value fixture
   would not catch a swap.
3. The WrapConfig-reachable error branches on BundleVerifyOptions,
   RecipeResolveOptions, and RecipeAccountingMode now have a table-driven
   test asserting ErrCodeInvalidRequest, with the new derivation covered by
   the same table.

Testing

make qualify
golangci-lint run -c .golangci.yaml ./pkg/client/v1/... ./pkg/cli/...
go test -race ./pkg/client/v1/... ./pkg/cli/...

make qualify passes. api-diff reports (*Config).EvidenceAttestationOptions: added
under Compatible changes, with "No incompatible SDK facade or transparent-alias
target changes since v0.20.0" — the new surface is purely additive. openapi-diff
reports 0 breaking changes. golangci-lint: 0 issues. Race tests pass on both
changed packages.

Coverage, measured against origin/main via a baseline worktree:

• pkg/client/v1: 84.1% → 84.4% (+0.3%)
• pkg/cli: 75.8% → 75.8% (0.0%)

EvidenceAttestationOptions is at 100% statement coverage.

The new tests were mutation-checked rather than assumed: removing the out
gate fails TestConfig_EvidenceAttestationOptions_OutIsTheGate, and swapping
BOMPath/Push fails TestConfig_EvidenceAttestationOptions.

Risk Assessment

• Low — Isolated change, well-tested, easy to revert
• Medium — Touches multiple components or has broader impact
• High — Breaking change, affects critical paths, or complex rollout

Rollout notes: Purely additive to the SDK facade — one new method, no
signature or behavior changes to existing surface, confirmed by api-diff
against v0.20.0. The only behavior change outside pkg/client/v1 is one
additional slog key on an existing INFO line. N/A for migration.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S) — GPG signing info

[github-actions]

🌿 Preview your docs: https://nvidia-preview-fix-2245-facade-followups.docs.buildwithfern.com/aicr

[github-actions]

Recipe evidence check

No leaf overlays affected by this PR.

This gate is warning-only and never blocks merge.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 44ad6006-45fe-4898-8788-d09a37d09335

📥 Commits

Reviewing files that changed from the base of the PR and between 291649b and 7e26f7f.

📒 Files selected for processing (6)

• docs/integrator/go-library.md
• pkg/cli/root.go
• pkg/client/v1/config.go
• pkg/client/v1/config_options_internal_test.go
• pkg/client/v1/config_test.go
• pkg/client/v1/stability_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The Go client now derives recipe-evidence attestation options from spec.validate.evidence.attestation. The method maps supported output, BOM, push, HTTP, and TLS fields and uses out as the enablement gate. Documentation describes the projection boundaries and CNCF evidence handling. Tests cover valid, absent, disabled, and malformed configurations. Recipe data-provider logging now includes the resolved data directory.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🔵 Low · up to 7e26f

The new SDK method exposes evidence settings that can select local files, registry destinations, and insecure transport modes when evidence is explicitly emitted. The change is mergeable, but integrations should treat these configuration values as trusted input and apply appropriate policy before use.

Suggested reviewers: almaslennikov

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: deriving evidence attestation options from AICRConfig.
Description check	✅ Passed	The description directly explains the new SDK method, related documentation and logging changes, tests, compatibility checks, and implementation decisions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2245-facade-followups

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Coverage Report ✅

Metric	Value
Coverage	84.2%
Threshold	80%
Status	Pass

Coverage Badge

![Coverage](https://img.shields.io/badge/coverage-84.2%25-brightgreen)

Merging this branch will increase overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/NVIDIA/aicr/pkg/cli	75.80% (ø)
github.com/NVIDIA/aicr/pkg/client/v1	84.41% (+0.30%)	👍

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/NVIDIA/aicr/pkg/cli/root.go	79.87% (ø)	154	123	31
github.com/NVIDIA/aicr/pkg/client/v1/config.go	93.46% (+3.46%)	153 (+13)	143 (+17)	10 (-4)	👍

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.