almaslennikov · Oct 29, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -45,6 +45,11 @@ jobs:
           cache: pip
           cache-dependency-path: requirements-docs.txt
 
+      - name: Check generated workflow documentation
+        run: |
+          python -m unittest discover -s scripts -p 'test_generate_workflow_docs.py' -v
+          python scripts/generate-workflow-docs.py --check
+
       - name: Install docs dependencies
         run: python -m pip install -r requirements-docs.txt
 

diff --git a/AGENTS.md b/AGENTS.md
@@ -40,11 +40,11 @@ for every source change.
 
 | Task | Implementation | Documentation and repository skill |
 | --- | --- | --- |
-| CLI, target routing, command compatibility | `pkg/cmd`, `pkg/target`, `pkg/target/host`, `pkg/options`, `pkg/app` | [Targets](docs/advanced/targets.md), [CLI](docs/reference/cli.md), [pipeline](skills/k8s-launch-kit-pipeline/SKILL.md) |
+| CLI, target routing, command compatibility | `pkg/cmd`, `pkg/target`, `pkg/target/host`, `pkg/options`, `pkg/app` | [Targets](engineering/advanced/targets.md), [CLI](docs/reference/cli.md), [pipeline](skills/k8s-launch-kit-pipeline/SKILL.md) |
 | Configuration, defaults, CLI overrides | `pkg/config`, `pkg/configinput`, `pkg/configflags`, `pkg/resolve` | [Configuration](docs/reference/configuration.md), [config](skills/k8s-launch-kit-config/SKILL.md) |
 | Discovery and topology presets | `pkg/nicconfigdaemon`, `pkg/networkoperatorplugin/discovery*`, `pkg/presets` | [Discovery](docs/user/discovery.md), [presets](docs/user/presets.md), [discover](skills/k8s-launch-kit-discover/SKILL.md) |
 | Profiles, grouping, templates, networking | `pkg/profiles`, `profiles`, `pkg/networkoperatorplugin/templates.go`, `pkg/networkoperatorplugin/scopes.go`, `pkg/networkoperatorplugin/spectrumx` | [Generation](docs/advanced/generation.md), [heterogeneous clusters](docs/user/heterogeneous-clusters.md), [Spectrum-X](docs/user/spectrum-x.md), [generate](skills/k8s-launch-kit-generate/SKILL.md), [networking context](skills/k8s-network-engineer/SKILL.md) |
-| Artifact parsing and lifecycle handoff | `pkg/bundle`, `pkg/app`, `pkg/target/host`, `pkg/networkoperatorplugin` | [Artifact bundle](docs/architecture/artifact-bundle.md), [architecture](docs/architecture/overview.md) |
+| Artifact parsing and lifecycle handoff | `pkg/bundle`, `pkg/app`, `pkg/target/host`, `pkg/networkoperatorplugin` | [Artifact bundle](engineering/architecture/artifact-bundle.md), [architecture](engineering/architecture/overview.md) |
 | Deployment, preflight, readiness | `pkg/networkoperatorplugin/deploy*`, `pkg/networkoperatorplugin/preflight`, `pkg/networkoperatorplugin/crstate`, `pkg/networkoperatorplugin/helmclient`, `pkg/target/host/deploy.go` | [Deployment](docs/advanced/deployment.md), [deploy](skills/k8s-launch-kit-deploy/SKILL.md), [dry run](skills/k8s-launch-kit-dryrun/SKILL.md) |
 | Validation, connectivity, reports | `pkg/target/host/validate*`, `pkg/networkoperatorplugin/connectivity`, `pkg/networkoperatorplugin/crstate` | [Validation](docs/user/validation.md), [validate](skills/k8s-launch-kit-validate/SKILL.md) |
 | OpenShift flavor | `pkg/config/flavor.go`, `pkg/networkoperatorplugin/ocp_config.go`, flavor-specific profiles and lifecycle code | [OpenShift](docs/user/openshift.md); relevant lifecycle skill's OpenShift section |

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -57,12 +57,24 @@ the [documentation impact map](AGENTS.md#required-documentation-updates) to
 identify affected guides, README examples, architecture diagrams and skill
 playbooks, including their bundled references.
 
+Keep `docs/` focused on operator procedures and reference material: what the
+command does, where operations run, required inputs, outputs and recovery actions.
+Keep architecture, implementation plans and contributor tooling in
+[engineering documentation](engineering/README.md). Do not publish specific lab
+clusters or development test-run history in user guides.
+
 Before opening a PR:
 
 - Update existing sections and examples to describe the resulting behavior.
 - Check examples, links and any affected generated documentation.
 - Run `make build` and `python3 scripts/check-docs.py --binary build/l8k` to
   check documented flags, navigation and offline generation examples.
+- For procedural workflow changes, edit the repository-owned definitions under
+  `openspec/workflows/` and regenerate with `python3 scripts/generate-workflow-docs.py`.
+  Run `python3 -m unittest discover -s scripts -p 'test_generate_workflow_docs.py'`
+  and `python3 scripts/generate-workflow-docs.py --check`. See the
+  [workflow source contract](openspec/workflows/README.md); these are documentation
+  inputs, not executable OpenSpec workflows or a runtime dependency.
 - For site changes, install `requirements-docs.txt` in an isolated Python
   environment and run `mkdocs build --strict`.
 - List documentation updates and validation in the PR description. If no

diff --git a/README.md b/README.md
@@ -4,7 +4,12 @@ Kubernetes Launch Kit (`l8k`) helps platform teams deploy NVIDIA networking on K
 Standard SR-IOV, RDMA-shared and host-device profiles enable NIC tuning by default; opt out with `--deploy-nic-configuration-template=false`. See [NIC configuration](docs/reference/configuration.md#nic-configuration-and-naming) for fabric-specific settings and operator ownership.
 
 
-The current lifecycle uses the `host` target by default. The reserved `dpf` target does not have available lifecycle phases; see [target extension](docs/advanced/targets.md) for its implementation status.
+The current lifecycle uses the `host` target by default. The `dpf` target provides an [experimental inventory discovery preview](docs/user/dpf-discovery.md); its provisioning phases remain unavailable.
+DPF inventory can use explicit host/ARM SSH or BMC Redfish sources without an existing
+management cluster. Inventory success is separate from provisioning readiness.
+DPF BMC discovery verifies TLS by default; lab endpoints can explicitly opt in to
+`tls.insecureSkipVerify: true`, recorded in discovery reports. See the preview guide
+for its scope and security implications.
 
 Spectrum-X RA2.4 and RA3.1 support Network Operator 26.10 and newer catalogued releases;
 RA2.3 is limited to 26.7. Both use a doSPCX bundle and derive per-group platform
@@ -166,7 +171,7 @@ Available Commands:
   version     Print the version number
 
 Target Selection Flags:
-      --target string   Deployment target: host (default) or dpf (reserved; phases are unavailable until the DPF driver is added) (default "host")
+      --target string   Deployment target: host (default) or dpf (experimental inventory discovery) (default "host")
 
 Host Target Common Flags:
       --config-dir string                   Directory containing optional l8k-config.yaml and presets/ overrides
@@ -255,14 +260,6 @@ Use the [container installation example](docs/user/installation.md#container). I
 
 Use the [OpenShift deployment guide](docs/user/openshift.md) for externally installed operators, flavor-specific resources, validation permissions, and qualification limits.
 
-## Development
+## Contributing
 
-Read [AGENTS.md](AGENTS.md) and [CONTRIBUTING.md](CONTRIBUTING.md) before editing. The [architecture guide](docs/architecture/overview.md) covers the component map and Go discovery-library entry point. [Documentation publishing](docs/reference/docs-publishing.md) gives the build and consistency checks. The [extension contracts](openspec/README.md) cover shared behavior and conformance scenarios for new configuration, probes, profiles, resource kinds, and checks.
-
-### Library API
-
-See the [Go discovery-library integration](docs/architecture/overview.md#go-discovery-library) for the Helm-free public entry point, release and preset options, and logging/concurrency considerations.
-
-## Repository Automation
-
-Contributor automation and review workflow live in [AGENTS.md](AGENTS.md) and [CONTRIBUTING.md](CONTRIBUTING.md).
+See [CONTRIBUTING.md](CONTRIBUTING.md) and the [engineering documentation](engineering/README.md) for development guidance.
diff --git a/THIRD_PARTY_NOTICES b/THIRD_PARTY_NOTICES
@@ -9197,3 +9197,38 @@ Apache license:
    See the License for the specific language governing permissions and
    limitations under the License.
 
+
+---
+## github.com/gofrs/flock v0.13.0
+
+Copyright (c) 2018-2025, The Gofrs
+Copyright (c) 2015-2020, Tim Heckman
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+* Neither the name of gofrs nor the names of its contributors may be used
+  to endorse or promote products derived from this software without
+  specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+---
diff --git a/docs/advanced/concepts.md b/docs/advanced/concepts.md
@@ -11,8 +11,9 @@ The [planning guide](../user/profiles.md) uses these terms to choose a
 deployment. An `l8k` binary version, a Network Operator release line, a
 Spectrum-X RA version, a Kubernetes/OpenShift flavor, a deployment profile,
 and a topology preset describe different choices. Pinning one does not pin the
-others. The `host` target covers the current lifecycle; the reserved `dpf`
-target has no available phases.
+others. The `host` target provides the networking lifecycle described here.
+The separate `dpf` target provides [experimental inventory discovery](../user/dpf-workflows.md);
+its provisioning phases are unavailable.
 
 ## Hardware
 

diff --git a/docs/advanced/deployment.md b/docs/advanced/deployment.md
@@ -39,8 +39,7 @@ Launch Kit loads and checks the complete flat artifact directory before Helm
 installation, preflight remediation, or resource apply. Invalid YAML, missing
 resource identity fields, and duplicate declared resources stop deployment
 with the file and document number in the error. Only `values.yaml` is treated
-as Helm values; rename `values.yml` or case variants to `values.yaml`. The
-expected preflight inventory and applied objects come from that same snapshot.
+as Helm values; rename `values.yml` or case variants to `values.yaml`. Keep the bundle unchanged while deployment runs.
 
 ## IPPool address collision guard
 
@@ -98,7 +97,7 @@ authorizing overwrite.
 
 ## Helm Install Or Upgrade
 
-When the bundle contains `values.yaml` and the selected release supplies a Helm repository URL, Launch Kit uses the Helm Go SDK to manage the `network-operator` release:
+When the bundle contains `values.yaml` and the selected release supplies a Helm repository URL, Launch Kit manages the `network-operator` Helm release:
 
 - No release: install the selected chart in `networkOperator.namespace`.
 - Matching chart and values: no-op.
@@ -229,7 +228,7 @@ resource with missing configuration fails rather than falling back to this mode.
 
 ## Terminal State
 
-The shared resource-state registry classifies generated objects as:
+Deployment reports each generated resource in one of these states:
 
 | State | Meaning |
 | --- | --- |
@@ -245,9 +244,9 @@ CNI applied states when both desired and live specs leave those components
 external. It still requires ready status for every configured component in
 either spec and retains other component failures. Missing coverage waits;
 unrecognized or malformed evidence and policy-level reasons retain the original
-aggregate verdict. This is the same classifier used by
-[validation](../user/validation.md#external-networking-prerequisites); it does
-not change deployment's ownership guards or controller-observation gate.
+readiness result. [Validation](../user/validation.md#external-networking-prerequisites)
+also checks external networking prerequisites. Deployment still checks resource
+ownership and waits for controllers to observe the requested configuration.
 
 For `NicConfigurationTemplate` and `NicFirmwareTemplate`, Launch Kit first waits for the operator to publish matched device names in `status.nicDevices` and for that name set to reflect the current `nodeSelector`, NIC type, PCI-address, serial-number, and part-number selectors. It then evaluates only those `NicDevice` objects and waits for the corresponding `spec.configuration` or `spec.firmware` field to reflect the current template payload. A successful device condition is accepted only after its `observedGeneration` catches up with the `NicDevice` generation. A configuration template checks `FirmwareUpdateInProgress` only when the matched device carries `spec.firmware`; without a deployed firmware template, a stale firmware condition from an older device generation does not block configuration reconciliation. Other discovered NICs do not block on configuration or firmware state. Changed templates are also observation-gated before this status is accepted, so status left by an earlier generation cannot produce a false success.
 

diff --git a/docs/advanced/generation.md b/docs/advanced/generation.md
@@ -94,7 +94,7 @@ Generated `SriovNetworkNodePolicy` and NV-IPAM `IPPool` resources carry the
 source identifiers selected for that artifact. Keep the annotation and
 `.l8k/resolved-config.yaml` together. Full merged buckets record all their
 sources; strict subsets record only their selected sources. Source identifiers
-must be unique, including for direct library rendering. The established unnamed
+must be unique. The established unnamed
 single-source configuration keeps its empty identifier and is represented by the
 explicit annotation `[""]`. It resolves only when the supplied configuration has
 exactly that one unnamed source; missing config or multiple sources fails rather
@@ -133,12 +133,10 @@ with a deployed baseline.
 ## Bundle Layout
 
 Launch Kit renders and checks the complete artifact set before replacing the
-selected plugin output directory.
+selected deployment output directory.
 
-Rendered files are structurally checked after ownership annotations and
-before the output directory is cleaned. If this check fails, the previous
-output remains in place. Successful output keeps the rendered bytes, and a
-combined generate/deploy run uses the same checked snapshot. Network Operator
+If a generated file fails validation, the previous output remains in place.
+A combined generate/deploy run applies the generated bundle. Network Operator
 files use this layout:
 
 ```text

diff --git a/docs/index.md b/docs/index.md
@@ -11,9 +11,9 @@ NVIDIA Kubernetes Launch Kit (`l8k`) helps platform teams configure NVIDIA netwo
 
 Use this site when you are deploying SR-IOV, RDMA shared-device, host-device, InfiniBand, or Spectrum-X networking. Start with [Plan your deployment](user/profiles.md) to choose a platform and profile, check what is qualified, and identify the site inputs and permissions you need.
 
-The lifecycle commands operate on the `host` target by default. The reserved
-`dpf` target has no available lifecycle phases; see the
-[target extension contract](advanced/targets.md) if you are extending Launch Kit.
+The lifecycle commands operate on the `host` target by default. The `dpf` target
+provides an [experimental inventory discovery workflow](user/dpf-workflows.md)
+for a separate DPU estate. DPF provisioning phases remain unavailable.
 
 ## Find Your Path
 
@@ -27,7 +27,6 @@ The lifecycle commands operate on the `host` target by default. The reserved
 | Platform engineer managing mixed hardware | [Heterogeneous Clusters](user/heterogeneous-clusters.md) |
 | Spectrum-X operator | [Spectrum-X](user/spectrum-x.md) |
 | CI/CD or GitOps integrator | [Automation](integrator/automation.md) |
-| Integrator adding an infrastructure target | [Target-aware CLI](advanced/targets.md) |
 | AI agent integrator | [AI Skills](integrator/ai-skills.md) |
 | Operator confirming a deployment is ready for use | [Validation](user/validation.md) |
 | Application owner connecting a workload | [Use the network in an application](user/workloads.md) |

diff --git a/docs/integrator/ai-skills.md b/docs/integrator/ai-skills.md
@@ -152,21 +152,3 @@ Acceptance and triage:
 Run the normal validation workflow. If it does not pass, retain the test
 DaemonSet, collect a sosreport, and identify the first failed stage.
 ```
-
-## Developing Launch Kit
-
-For source changes, start with the repository's
-[AGENTS.md](https://github.com/NVIDIA/k8s-launch-kit/blob/main/AGENTS.md).
-It covers development workflow, package boundaries, verification and required
-documentation updates. `CLAUDE.md` points to that shared guide.
-
-For extension work, consult the [contract index](https://github.com/NVIDIA/k8s-launch-kit/blob/main/openspec/README.md). It defines shared integration behavior and scenarios for configuration, discovery, lifecycle, platform, profile, artifacts, resource kinds, ownership, connectivity, and output. Read the applicable baseline exceptions; the specs do not imply that every scenario is already enforced. Update a contract when its shared promise changes, and update the affected user guide and skill alongside implementation. Routine conforming additions do not need a new spec or proposal.
-
-Use operational skills from the checkout being changed when testing CLI
-workflows. Source development can use `make build` and `./build/l8k` from the
-repository root; a global installation and cluster access are not prerequisites.
-
-## Maintaining Skills
-
-Update relevant documentation sections, the corresponding skill and its bundled
-references in the same PR whenever a CLI workflow, flag, default, exit code, or safety requirement changes. Keep examples aligned with `l8k schema` and command help, and keep shared behavior in `k8s-launch-kit-shared` instead of duplicating it across every phase.