plane(1.4): up.sh by profile -- context, registry, pool and images file from kind.toml

ops/ax/up.sh reads kube_context, registry, pools.default and the images path
with `python -m openultrasast.plane.profile --print`, writes the runner digest to
ops/k8s/profiles/kind-images.json instead of ~/.cache/.../runner-image, renders
ops/ax/workerpool.yaml.tmpl from the profile's pool (POOL_NAME/REPLICAS/CPU/
MEMORY, WORKER_IMAGE), and keeps an existing pool and an ax CLI newer than its
checkout instead of rebuilding them (ko and go install would refill several GB
of Go cache on this disk). smoke-run.sh takes the runner from `--print
images.runner` and runs the checkout's code with OUSAST_PYTHON. repin_templates
reads the JSON images file (runner key; the one-line pin still reads). `--print
images` returns the file path (the first live rerun fell over this). Templates
and the generated validation-46 Tasks re-pinned to the rebuilt image (128
lines, one digest).

Live: up.sh reran idempotently on kind in 38 s (every step kept except the
runner build); smoke-run.sh done in 24 s on the new image, facts.json 451 B,
summary.json 238 B delivered (record: benchmarks/measurements/2026-10-02-k8s-01-profile/).

Gates: pytest 2010 passed, 42 skipped, exit 0; ruff check 0; ruff format 0;
mypy 0; mkdocs build --strict 0.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_plane_increment.py

@@ -292,6 +292,23 @@ def test_case_record_carries_sites_in_set_and_cost_and_the_image_is_repinned(tmp
         repin_templates(paths["plane"], tmp_path / "runner-image")
 
 
+def test_repin_reads_the_profiles_images_file(tmp_path: Path) -> None:
+    """plane-on-kubernetes 1.4: ``ops/ax/up.sh`` writes ``kind-images.json`` ({"runner": ...}); repin reads it, the
+    older one-line pin still reads, and a file without a runner key or without a digest is refused by name."""
+    paths = _fixture(tmp_path)
+    digest = "localhost:5001/ousast-runner@sha256:" + "cd" * 32
+    images = tmp_path / "kind-images.json"
+    images.write_text(json.dumps({"runner": digest}) + "\n")
+    assert repin_templates(paths["plane"], images) == digest
+    assert {t.image for t in load_manifests(sorted((paths["plane"] / "tasks").glob("*.yaml"))).tasks.values()} == {digest}
+    images.write_text(json.dumps({"engine": digest}))
+    with pytest.raises(ValueError, match="no runner image"):
+        repin_templates(paths["plane"], images)
+    images.write_text(json.dumps({"runner": "localhost:5001/ousast-runner:dev"}))
+    with pytest.raises(ValueError, match="not digest-pinned"):
+        repin_templates(paths["plane"], images)
+
+
 def test_workspaces_go_to_the_profiles_atespace(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     """plane-on-kubernetes 1.2: ``generate.ATESPACE`` is a default; ``increment`` takes the profile's atespace."""
     paths = _fixture(tmp_path)

tests/test_plane_profile.py

@@ -144,6 +144,8 @@ def test_print_for_shell_scripts(capsys: pytest.CaptureFixture[str], tmp_path: P
     fields = ["registry", "kube_context", "images.runner", "pools.default.replicas"]
     assert profile_module.main(["--profile", str(path), "--print", *fields]) == 0
     assert capsys.readouterr().out.splitlines() == ["registry.test:5000", "kind-test", f"registry.test:5000/ousast-runner@{DIGEST}", "3"]
+    assert profile_module.main(["--profile", str(path), "--print", "images"]) == 0, "the images file's path itself (up.sh writes it)"
+    assert capsys.readouterr().out.strip() == str(tmp_path / "images.json")
     assert profile_module.main(["--profile", str(path), "--print", "images.engine"]) == 2
     assert "no image named 'engine'" in capsys.readouterr().err
     assert profile_module.main(["--profile", str(path), "--print", "nothing"]) == 2