website: add the Back to StackQL Docs link and the source repo link - #1

- fetch_nvcf_spec.mjs downloads https://api.nvcf.nvidia.com/v3/openapi
  (the OpenAPI Spec link on https://docs.nvidia.com/nvcf/api) and records
  the source in download_manifest.json; fails without writing on non-OpenAPI
  payloads
- pinned in spec_pin.json: version 2.245.1, sha256, 35 paths / 54 operations
- swagger-parser validation is clean, no repairs required
- two-host finding recorded: management on api.ngc.nvidia.com, invocation
  and queue details on api.nvcf.nvidia.com, carried per operation group

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- harvest_ngc_spec.mjs extracts the definition list from the explorer JS
  bundle at docs.ngc.nvidia.com/api/ and fetches every in-scope definition;
  unreachable and out-of-scope entries are recorded with evidence in
  download_manifest.json
- harvested: ngc_kas.json (NGC API Documentation v3.249.6 - orgs, teams,
  users; 77 paths) and ngc_models.json (Models API - registry artifact
  metadata; 231 paths). Org Mgmt / User IAM / Search / Metadata / Publishing
  hosts are not publicly routable - recorded, re-probe with a key in task 4
- clean_specs.mjs applies deterministic repair rules (missing version stamp,
  relative-server repair for ngc_kas) and validates all three sources with
  swagger-parser 12.1.0; all clean; full fix report in clean_report.json
- ngcCoreDecision recorded in spec_pin.json: harvest-usable, ngcsdk
  archetype-2 fallback not invoked

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- NGC_API_KEY absent from the environment: live bearer verification,
  authenticated spec-endpoint probes and the NVCF enablement check are
  recorded blocked-on-key (vsphere blocked-on-lab pattern); everything
  offline proceeds
- public-read hypothesis confirmed on the wire: catalog search
  (/v2/search/catalog/resources/{type}?q={json}) and guest artifact
  metadata (/v2/models/{org}/{name}) serve 200 unauthenticated;
  org-scoped registry, orgs/users and all NVCF routes are 401
- gateway v1 -> v2 path rewrite proven: harvested models-spec /v1 paths
  serve at api.ngc.nvidia.com/v2
- two key types recorded: personal keys direct-bearer (documented path),
  legacy keys via the authn.nvidia.com token exchange

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

build_inventory.mjs classifies all 489 operations (54 nvcf, 435 ngc-core)
with deterministic rules and fails without writing on any unclassified
operation or duplicate method. Results:

- 223 mapped: 102 select, 40 insert, 29 update, 33 delete, 16 exec,
  3 replace across nvcf_functions (22), nvcf_deployments (18),
  nvcf_invocation (10), nvcf_queues (3), orgs (26), registry (94),
  catalog (50)
- 266 skipped with reason codes: 141 deprecated team-scoped twins
  (schedule 2026-09), 36 deprecated-inline, 34 internal-admin,
  23 service-infra, 22 data-plane file transfer, 7 duplicate endpoint
  families, 2 superseded v2 twins, 1 inbound webhook
- per-operation host carry (api.ngc.nvidia.com management,
  api.nvcf.nvidia.com invocation/queues/assets/tokens), auth_declared and
  observed_public_read columns (dockerhub precedent), pagination params,
  response envelopes, invocation form (nvcf pexec = polling, scoped in)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- seven services recorded in service_names.json: orgs, registry, catalog,
  nvcf_functions, nvcf_deployments, nvcf_queues, nvcf_invocation
- catalog confirmed distinct from registry (guest path families, public
  auth posture); nvcf_invocation added vs the candidate list (pexec,
  assets, assertion tokens - the api.nvcf.nvidia.com surface); no usage
  service - no billing/measurement surface in the harvest
- service_rules.mjs drives split assignment from the inventory CSV (single
  source of truth; throws on any operation the inventory does not know)
- inventory rule refinements ahead of the signature checks: product shares
  as own resources, function_ids resource, legacy share twin and duplicate
  file-listing family skipped with reasons
- CLAUDE.md candidate list replaced with the decided split

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- split produced 7 service specs from the 3 cleaned sources via the
  inventory-driven service_rules.mjs (HEAD/OPTIONS recorded as
  non-generator-verb skips after split surfaced kas headPing)
- generate-mappings (provider-utils analyze) wrote all_services.csv:
  222 rows, exactly the 221 inventory-mapped operations
- map_operations.mjs fills resource/method/verb/objectKey from the
  inventory and validates: full coverage both directions, unique methods
  per resource, unique path-param signatures per SQL verb - all green
- result: 221 operations, 81 resources (select 101, insert 40, update 29,
  delete 32, replace 3, exec 16)
- pilot proofs: nvcf_functions grants-as-data (authorizations list SELECT /
  add INSERT / remove DELETE / set REPLACE / delete_all EXEC),
  nvcf_deployments estate (cluster_groups.list $.clusterGroups, deployments
  CRUD), registry proves the harvested source end to end (32 resources)
- host-service alignment is 1:1, so the NVCF two-host carry reduces to
  service-level server assignment (pre_normalize, phase 2)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- NOTES.md: service split and host alignment, pilot results, pagination
  sweep (offset paging -> parameter-driven, keycloak precedent), envelope
  table, refreshed open questions (search definition, PUT semantics,
  authorizations envelope, 3.1 through normalize, teams vs the schedule,
  v3 org creation), phase 2 obligations
- README.md: service coverage table, inventory summary line, zero-setup
  public-read callout (dockerhub precedent), grants-as-data note

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…g template, tests, docs, CI

Phase 2 refresh on the supabase / k8s pattern:

- Makefile as the operator surface (make all / upgrade / build / test /
  smoke* / docs / website); latest @stackql/provider-utils 0.7.10 and
  @stackql/pgwire-lite 1.0.2; the provider-utils CLI entry points as npm
  scripts; Docusaurus 3.10.2 microsite with showLastUpdateTime
- upstream refresh accepted and pinned: NVCF 2.256.0, NGC API definition
  v3.249.17 (served by the public gateway), the models definition with
  vendor response schemas and the new NIM metadata endpoint; the explorer
  moved to a hosted platform so the harvester carries the pinned URL
  catalogue; downloads written as canonical JSON (the servers are not
  byte-stable); the ngcsdk 4.36.6 wheel parsed into response schemas as
  the recorded fallback for response-less operations
- deterministic clean rules (v2 gateway prefix, snake_case path params,
  mismatched parameter names, cookie and prose parameters)
- endpoint inventory as the single source of truth: org-scope rebase onto
  path-level server templates (org_name via x-stackQL-envVar NGC_ORG),
  per-service hosts, casing, pagination, objectKey rules; the deprecation
  schedule applied precisely (NVCF-family /teams/{team} skipped, Private
  Registry team scoping mapped as *_by_team methods)
- service registry renamed private_registry (reserved word)
- post-processing: server templates, nativeCasing camel/kebab,
  page_number pagination + LIMIT pushdown, opaque body wrapper, scalar-list
  and invocation-status transforms, media type fixes
- tests: offline validation, mock NGC + NVCF integration suite (both
  hosts, bearer enforced, 44 assertions), meta-route walk (338 methods, 83
  resources), tiered pystackql smoke suite with --live and the gated NVCF
  deploy lifecycle
- docs: landing page with the GPU inventory / fleet state / sharing audit /
  registry estate queries, sanitize-docs with snake_case parameter
  rendering and resource recount; CI with drift gate, gated smoke and the
  weekly upstream + deprecation-page drift job
- all_services.csv committed as the durable mapping record; README,
  CLAUDE.md and NOTES.md rewritten with the evidence

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

… smoke harness

- downloads written as canonical JSON: the definition servers serialise
  maps in a non-deterministic key order, so raw-byte pins drifted between
  two fetches of identical content (NOTES.md item 20)
- models.delete / resources.delete (org and team forms) injected from
  ngcsdk evidence: the definition declares no DELETE for either and the
  generic artifacts family only takes helm-charts, endpoints, agents,
  blueprints, apis, playbooks and skills - "delete via artifacts with
  artifact_type = models" was never possible; docs, mock, integration and
  smoke updated (342 mapped operations)
- smoke harness: pystackql 3.8.4 execute() swallows an HTTP error on a
  SELECT into an empty result, so a 403 passed as "no rows"; empty SELECTs
  are re-probed through executeStmt(); the catalog probe discovers a model
  instead of guessing one; the invalid `containers` artifact type replaced
- NOTES.md item 21a records the first live run against the INDIVIDUAL
  org: public catalog works with the key, every org / registry / NVCF call
  is refused (403 Access Denied on NGC, 401/403 on NVCF) - the signature
  of a key without the Private Registry / Cloud Functions service scopes;
  the legacy token exchange and the ApiKey/basic variants are ruled out

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…epo link

Bumps @stackql/provider-utils to 0.7.11, passes --source-project to the
doc generation target and regenerates the markdown docs, so the provider
summary links to the source repository.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Opens the docs sidebar with a link to /stackqldocs, the redirect to the
main stackql.io docs, matching the query library site and the provider
template. Styled by the new .sidebar-back-link rules in the site
stylesheet. No generated docs or dependencies change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

clean_specs.mjs stamped the report with the run date on every build, so
the generation-drift check failed on any day after the report was
committed. The date now records the last run whose findings changed:
when the per-source results are identical, the previous date is kept.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Keeps the doc generation dependency on the current release. 0.7.12 only
changes the generate-docs-v2 index page (Markdown hard breaks in the
Provider Summary); this provider uses the v1 generator, whose output is
unchanged, so the regenerated docs are identical.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

The GitHub Pages test and deploy workflows pinned Node 20, but the
website lockfile resolves the shared mermaid theme to mermaid 12, whose
engine range starts at 22.12, so yarn install --frozen-lockfile fails on
the PR build. The site's own engines field already asks for 22.19.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>