[dennis-upbound]

Description of your changes

Fixes #416.

A ModelDeployment whose member has template: {} passed admission, because neither the ModelDeployment nor the ModelReplica XRD required template.spec. compose-model-replica then failed an assert in base.engine_container while looking for the engine container, so the user got a function stack trace with nothing pointing at their manifest.

This adds required: [spec] to the member template in both XRDs. kubectl now rejects such a manifest with spec.template.spec.engines[0].members[0].template.spec: Required value. The regenerated models type spec as required, so the asserts and None checks on it in compose-model-replica and compose-model-deployment are gone.

A deployment or replica stored before this change can still lack the field, and the stricter models fail to parse it. Each function now catches that and returns a fatal result with the field's path, such as The ModelReplica doesn't match its schema: spec.engines[0].members[0].template.spec: Field required. compose-model-deployment reads every ModelReplica on the control plane to work out free capacity, so it skips a replica that doesn't parse with a warning instead of failing every deployment. The warning gives the replica's name only when it's in the deployment's own namespace.

This is a breaking change for a manifest without template.spec, which is now rejected. On main it only got as far as the crash.

I checked the other fields the backends read without a guard on the same path. The member template, a non-empty containers, exactly one container named engine (on Workers too), nodeSelector.devices, and the Leader/Worker member shape are already rejected at admission. A Worker without worker is admitted, but both gang backends default it to one node.

Decisions:

• compose-model-deployment skips any ModelReplica that doesn't parse, as compose-serving-stack does for a MetricMapping. Failing would stop every deployment on the control plane over one bad replica. The replica's own fatal result reports the problem. The scheduler can't count nodes for a replica it can't read, so a skipped replica that's still running goes uncharged. A replica without template.spec never composed a workload, so this case doesn't use any nodes.
• The skip warning shows on every deployment, so it gives the replica's name only when the replica is in the deployment's own namespace. A deployment's events don't name another tenant's objects.
• The !has(self.template.spec) guards stay in the existing port CEL rules. With spec required they never hold, but Let engines serve on another port and report health on another path #573 rewrites those rules. Whichever of Let engines serve on another port and report health on another path #573 and this PR merges second removes them.

I tested the XRDs against a real kube-apiserver (envtest 1.34.1, each XRD's schema wrapped in a CRD) with kubectl apply --dry-run=server --validate=strict. All 29 ModelDeployment and ModelReplica manifests under docs/manifests and e2e/manifests pass. A member with template: {} (Standalone, Leader, and a Worker with only metadata) is rejected with Required value on both kinds. The same invalid manifests are admitted against main's XRDs.

I have:

• Read and followed Modelplane's contribution process.
• Run nix flake check (or ./nix.sh flake check) and made sure it passes.
• Added or updated tests covering any composition function changes.
• Signed off every commit with git commit -s.

🤖 Generated with Claude Code

[github-actions]

Docs preview: https://modelplane-docs-pr-577.vercel.app (ready once the site's Content workflow finishes)