docs: fix stale references, casing, and index gaps ahead of release

Release-prep proofreading sweep over the root governance docs and the
docs/ tree. Generated artifacts (THIRD_PARTY_NOTICES.md, conformance
evidence) and historical ADRs under docs/design/ were left untouched.

Correctness:
- Key Packages listed pkg/validator/helper, which does not exist; the
  package is validators/helper.
- docs/README.md "Find Your Path" pointed the Integrator row at
  integrator/automation.md instead of the section index.
- Tech Stack claimed "Kubernetes 1.33+", unchanged since repo init while
  k8s.io/api moved to v0.36.3 and kindest/node to v1.36.1. Unpinned from
  that line, as golangci-lint already was in #925.
- contributor/recipe.md claimed deployers other than argocd-helm have no
  supported install-time value surface. --dynamic is supported on helm,
  flux, and helmfile; only plain argocd rejects it. Reworded to describe
  the actual split: the bundle-time gate is the whole enforcement for
  those three (closed surface, only declared paths), argocd-helm needs an
  additional template-time guard because it exposes the parent chart's
  .Values openly, and plain argocd has no such surface.

Stale versions: three example image/tarball tags had drifted apart
(0.15.0, v0.11.1, v0.1.0); normalized to v0.19.0.

Terminology: ArgoCD -> Argo CD (3 sites vs 101 already correct), TCPxO ->
TCPXO (3 vs 37), GPU Daemonsets -> DaemonSets, vanilla kubernetes ->
Kubernetes, and a sentence-initial "Argocd-helm" reworded.

Completeness: the api-reference component table was missing 7 registry
components and had the mariadb-* rows out of order; user/index.md was
missing fabric-attached-training.md; contributor/index.md was missing
four pages that exist but were unlinked. Dropped an agent attribution
from an investigation-doc byline.

Signed-off-by: Yuan Chen <yuanchen97@gmail.com>

Author: yuanchen8911

.claude/CLAUDE.md

@@ -28,7 +28,7 @@ NVIDIA AI Cluster Runtime (AICR) generates validated GPU-accelerated Kubernetes
  state         config         vs actual     manifests
 ```
 
-**Tech Stack:** Go 1.26, Kubernetes 1.33+, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
+**Tech Stack:** Go 1.26, Kubernetes, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
 
 ## Commands
 
@@ -116,7 +116,7 @@ workspace paths. Use local file paths only when explicitly requested.
 | `pkg/snapshotter` | System state snapshot orchestration | Yes |
 | `pkg/k8s/client` | Singleton Kubernetes client | Yes |
 | `pkg/k8s/pod` | Shared K8s Job/Pod utilities (wait, logs, ConfigMap URIs) | Yes |
-| `pkg/validator/helper` | Shared validator helpers (PodLifecycle, test context) | Yes |
+| `validators/helper` | Shared validator helpers (PodLifecycle, GPU/resource utilities) | Yes |
 | `pkg/defaults` | Centralized timeout and configuration constants | Yes |
 
 **Critical Architecture Principle:**

AGENTS.md

@@ -28,7 +28,7 @@ NVIDIA AI Cluster Runtime (AICR) generates validated GPU-accelerated Kubernetes
  state         config         vs actual     manifests
 ```
 
-**Tech Stack:** Go 1.26, Kubernetes 1.33+, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
+**Tech Stack:** Go 1.26, Kubernetes, golangci-lint, Ko for images (pinned versions in `.settings.yaml`)
 
 ## Commands
 
@@ -116,7 +116,7 @@ workspace paths. Use local file paths only when explicitly requested.
 | `pkg/snapshotter` | System state snapshot orchestration | Yes |
 | `pkg/k8s/client` | Singleton Kubernetes client | Yes |
 | `pkg/k8s/pod` | Shared K8s Job/Pod utilities (wait, logs, ConfigMap URIs) | Yes |
-| `pkg/validator/helper` | Shared validator helpers (PodLifecycle, test context) | Yes |
+| `validators/helper` | Shared validator helpers (PodLifecycle, GPU/resource utilities) | Yes |
 | `pkg/defaults` | Centralized timeout and configuration constants | Yes |
 
 **Critical Architecture Principle:**

README.md

@@ -72,7 +72,7 @@ AICR recipes compose components from the following groups:
 | Group | Examples |
 |-------|----------|
 | **GPU stack** | GPU Operator, DRA GPU Driver, Network Operator, NFD, NVSentinel |
-| **Cloud integration** | AWS EFA, AWS EBS CSI, GKE NCCL TCPxO |
+| **Cloud integration** | AWS EFA, AWS EBS CSI, GKE NCCL TCPXO |
 | **Node tuning** | Nodewright Operator and customizations, cert-manager |
 | **Observability** | kube-prometheus-stack, Prometheus Operator CRDs, Prometheus Adapter, ephemeral-storage metrics |
 | **Training platforms** | Kubeflow Trainer, Slinky Slurm Operator, KAI Scheduler, Kueue |

ROADMAP.md

@@ -74,7 +74,7 @@ so future changes can warn before they break.
 **Bundle output as a stable surface.** The bundle is what downstream consumers
 integrate against; v1 hardens it as a first-class contract. This includes a generic
 Helm bundle format that is deployer-neutral, deferring teardown to the deployer's
-native uninstall path (helm, ArgoCD, Flux) rather than shipping bundle-side
+native uninstall path (helm, Argo CD, Flux) rather than shipping bundle-side
 scripts, and decoupling environment specifics (e.g., StorageClass) from recipe
 content so bundles are portable.
 

docs/README.md

@@ -15,7 +15,7 @@ overview, see the [repository README](https://github.com/NVIDIA/aicr).
 | If you are a... | Start here |
 |-----------------|-----------|
 | **User** — operator deploying AICR to provision or validate a cluster | [User Guide](user/index.md) |
-| **Integrator** — engineer embedding AICR in a CI/CD pipeline, GitOps flow, or larger platform | [Integrator Guide](integrator/automation.md) |
+| **Integrator** — engineer embedding AICR in a CI/CD pipeline, GitOps flow, or larger platform | [Integrator Guide](integrator/index.md) |
 | **Contributor** — developer extending AICR or shipping recipes | [Contributor Guide](contributor/index.md) |
 
 ### User Guide

docs/contributor/index.md

@@ -315,6 +315,10 @@ By contributor task:
 - **Publishing the evidence dashboard to GitHub Pages (GP5)** → [evidence-dashboard-publish.md](evidence-dashboard-publish.md)
 - **Maintaining recipes and cutting releases** → [maintaining.md](maintaining.md)
 - **Writing or running tests (unit, chainsaw, KWOK, e2e)** → [tests.md](tests.md)
+- **Requesting a real-hardware UAT run or adding a reservation** → [uat.md](uat.md)
+- **Signing with Rekor v2** → [rekor-v2-signing.md](rekor-v2-signing.md)
+- **Allowlisting registry egress for CI and air-gapped builds** → [registry-egress.md](registry-egress.md)
+- **Investigating inference-perf run-to-run fluctuation** → [inference-perf-fluctuation.md](inference-perf-fluctuation.md)
 - **Using the project's Claude skills (snapshot analysis, docs audit, demos, decks, OpenVEX, release notes)** → [skills.md](skills.md)
 
 By reference:

docs/contributor/inference-perf-fluctuation.md

@@ -1,7 +1,7 @@
 # Inference-Perf Validation — TTFT Fluctuation & Worker-Stall Investigation
 
 **Date:** 2026-06-04
-**Author:** Yuan Chen (with Claude Code)
+**Author:** Yuan Chen
 **Related:** NVIDIA/aicr #1192, #1193, #1194, #1196
 **Status:** root cause characterized; mitigations shipped/in-PR; long-term fix proposed
 

docs/contributor/recipe.md

@@ -261,8 +261,13 @@ profile-owned values. Bundle and mirror compare final candidate state with the
 hydrated recipe before creating output. Exact, ancestor, or descendant dynamic
 paths reject unconditionally; static writes reject only when the effective
 three-state observation (present bytes, absent, or blocked) diverges.
-Argocd-helm emits the corresponding structural template-time guard. Other
-deployers have no supported install-time value surface.
+That bundle-time rejection is the whole enforcement for `helm`, `flux`, and
+`helmfile`, whose install-time surface is closed — only the paths `--dynamic`
+declares. The `argocd-helm` deployer additionally emits a structural
+template-time guard, because it exposes component values through the parent
+chart's `.Values`, an open-ended surface the bundle-time gate cannot
+enumerate. Plain `argocd` rejects `--dynamic` and has no install-time value
+surface.
 
 Unprofiled compositions retain the legacy apiVersion and byte shape.
 Generation-side driver auto-detection skips a path owned by the selected

docs/contributor/uat.md

@@ -89,12 +89,12 @@ Semantics: **`main` is never gated** (it is built from source and carries the ne
 The `deployer` input picks which deployer variant of the intent's test config the pipeline consumes. Set to `helmfile` (the default), the pipeline resolves `tests/uat/<cloud>/tests/<accelerator>-<intent>-config.yaml` — the config every existing cell has always run against. Any other value (currently only `argocd`) resolves `<accelerator>-<intent>-<deployer>-config.yaml` — for example `deployer=argocd` on `aws-h100` training loads `tests/uat/aws/tests/h100-training-argocd-config.yaml`.
 
 ```bash
-# ArgoCD variant of the aws-h100 training cell (issue #2194)
+# Argo CD variant of the aws-h100 training cell (issue #2194)
 gh workflow run uat-run.yaml --repo NVIDIA/aicr --ref main \
   -f reservation=aws-h100 -f intent=training -f deployer=argocd
 ```
 
-The AICRConfig field `spec.bundle.deployment.deployer` is the source of truth `phase_prep`/`phase_install` read; the workflow input is only how the correct config file is *selected*. `phases.sh:phase_install` dispatches to `install_helmfile` (helmfile lane, unchanged) or `install_argocd` (Argo CD install + repo-creds Secret from `GITHUB_TOKEN` + `kubectl apply` of the `nvidia-stack` app-of-apps + terminal-pass wait on every `Application`). The post-install readiness gate is deployer-agnostic — it validates deployed cluster state (`aicr validate --phase deployment`), not the deployment mechanism — so a green ArgoCD cell means the GitOps deploy path converges on the same operator-managed stack the helmfile lane validates.
+The AICRConfig field `spec.bundle.deployment.deployer` is the source of truth `phase_prep`/`phase_install` read; the workflow input is only how the correct config file is *selected*. `phases.sh:phase_install` dispatches to `install_helmfile` (helmfile lane, unchanged) or `install_argocd` (Argo CD install + repo-creds Secret from `GITHUB_TOKEN` + `kubectl apply` of the `nvidia-stack` app-of-apps + terminal-pass wait on every `Application`). The post-install readiness gate is deployer-agnostic — it validates deployed cluster state (`aicr validate --phase deployment`), not the deployment mechanism — so a green Argo CD cell means the GitOps deploy path converges on the same operator-managed stack the helmfile lane validates.
 
 **How the bundle reaches Argo CD.** `phase_prep` calls `aicr bundle --output oci://ghcr.io/nvidia/aicr-bundle-scratch/<config-metadata-name>:run-<id> --repo oci://ghcr.io/nvidia/aicr-bundle-scratch/<config-metadata-name>` — the path segment is the AICRConfig's `metadata.name` (yq-read from the test-config in `phase_prep`), not the recipe coordinate. The `--output` flag pushes the rendered bundle to GHCR (the job already has `packages: write`), and `--repo` sets the `source.repoURL` baked into every generated `Application`. `install_argocd` provisions a prefix-matched `argocd.argoproj.io/secret-type: repo-creds` Secret from `GITHUB_TOKEN` so Argo CD's repo-server can pull the pushed artifact. Concurrent runs on the same recipe are isolated by the `:run-<id>` tag.
 

docs/integrator/components/nodewright.md

@@ -2,7 +2,7 @@
 
 Nodewright and nodewright-customizations are two halves of the integration. [Nodewright](https://github.com/NVIDIA/nodewright) is a Kubernetes Operator that applies [nodewright packages](https://github.com/NVIDIA/nodewright-packages) with consistent, repeatable, and tested lifecycles within a cluster. Nodewright-customizations are instances of the [Skyhook Custom Resource](https://github.com/NVIDIA/nodewright/blob/main/chart/templates/skyhook-crd.yaml) that define one or more nodewright packages to deploy. These packages were selected to provide two main functions:
 1. Optimize a node for inference or training workloads via grub, sysctl and systemd service settings.
-2. Be able to install all of the necessary software to bring a vanilla kubernetes node to the AICR spec.
+2. Be able to install all of the necessary software to bring a vanilla Kubernetes node to the AICR spec.
 
 ## References