[architect] SBOM stream-id namespace restated at 6 consumers with no drift gate — PRODUCT_SPECS, OS_STREAM_SPECS, IMAGE_CONFIGS, SBOM_STREAM_PREFIX, card-feed-parser join fetch-github-sbom STREAM_SPECS by raw string

[kubestellar-hive]

Architecture Finding

Type: coupling / unenforced contract
Affected area: scripts/ SBOM pipeline (fetch-github-sbom.js and its consumers)

scripts/fetch-github-sbom.js STREAM_SPECS is the authoritative SBOM stream-id namespace (21 ids: bluefin-stable, bluefin-lts, dakota-latest, utah-testing, ...). Six consumer sites restate those ids as raw string literals with no gate keeping them resolvable:

Site	Restatement
scripts/fetch-github-images.js PRODUCT_SPECS	sbomStreamId, nvidiaSbomStreamId, nvidiaSbomFallbackStreamId per product
scripts/fetch-firehose.js OS_STREAM_SPECS	streamId + hardcoded "bluefin-nvidia-open-stable" inside buildOsApp
scripts/fetch-update-churn.js IMAGE_CONFIGS	sbomStreamId per image
scripts/fetch-github-driver-versions.js	SBOM_STREAM_PREFIX map (10 ids) + "bluefin-lts-nvidia"/"bluefin-gdx-lts" literals
scripts/lib/card-feed-parser.mjs	sbomKeyForRelease stream→streamId map + "dakota-latest"/"dakota-nvidia-latest" literals
scripts/lib/factory-monthly-metrics.mjs + others	assorted stream-id literals

The existing signing-trust.test.js drift gates cover keyRepo/keyless/cosignKeyUrl only — the stream-id join itself is ungated.

Impact

A typo or rename in any consumer silently yields absent data on the published site (missing version chips, empty churn cards, missing driver rows) rather than a build failure. This already happened once: PRODUCT_SPECS for bluefin-lts names nvidiaSbomStreamId: "bluefin-lts-nvidia", which does not exist in STREAM_SPECS today — it resolves only because resolveNvidiaVersion silently falls back to the bluefin-gdx-lts stream (PR #1212 is in flight to add the real stream). Nothing flagged the gap.

Recommendation

Add a reachability gate test (modeled on signing-trust.test.js) that imports STREAM_SPECS plus every consumer table and asserts: every sbomStreamId/streamId resolves to a declared stream id, and every nvidiaSbomStreamId either resolves or carries a resolvable nvidiaSbomFallbackStreamId (the documented forward-reference pattern). Longer term, consumers should derive ids from a shared stream registry instead of restating them.

---

Filed by architect agent (ACMM L5 — hold-gated mode)

🐝 Hive Agent: architect | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=architect backend=copilot model=kimi-k3 copilot=1.0.78