feat(nvca): publish storage capability catalog

dependencies.md

@@ -1843,7 +1843,8 @@ Generated by `go run -C ./tools/collect-dependencies .`. Refresh: `go run -C ./t
 - `Node.js`: `zod@4.3.6`
 - `Node.js`: `zwitch@2.0.4`
 - `Python`: `fastapi==0.110.0`
-- `Python`: `pyyaml` (`PyYAML>=5.4.1`, `pyyaml>=6.0.1`)
+- `Python`: `jsonschema==4.10.3`
+- `Python`: `pyyaml` (`PyYAML==6.0.2`, `PyYAML>=5.4.1`, `pyyaml>=6.0.1`)
 - `Python`: `rich>=13.7.0`
 - `Rust`: `async-stream` (`async-stream 0.3`, `async-stream =0.3.6`)
 - `Rust`: `axum` (`axum 0.8`, `axum =0.8.9`)

deploy/helm/nvca-operator/nvca-operator/README.md

@@ -3,6 +3,12 @@
 NVCF Cluster Agent (NVCA) Operator installs and manages reconfiguration, upgrades, and health checks of NVCA
 used in Kubernetes Clusters to run NVCF Workloads.
 
+## Storage capability catalog
+
+The chart installs the versioned `nvcf-storage-capabilities` ConfigMap in the Helm release namespace. For each exact CSI provisioner the catalog records only the PVC access modes qualified end to end in an NVCF cache workflow, plus the mount options for reader volumes NVCA creates. Nothing about the flow is declared: NVCA derives it from those modes. An empty `accessModes` list means nothing is qualified yet, so caching stays off for that driver. Container cache is outside NVCA and is not part of this catalog.
+
+This release does not wire the catalog into backend selection. Runtime use requires a durable cache plan and safe legacy-request migration so retries and agent restarts cannot change backends. Managed deployments will inspect the exact `nvcf-sc` StorageClass when that follow-up is implemented. Editing this ConfigMap does not enable a storage backend today.
+
 ## Parameters
 
 ### NVCA Operator parameters

deploy/helm/nvca-operator/nvca-operator/files/nvcf-storage-capabilities-v1alpha1.schema.json

@@ -0,0 +1,199 @@
+{
+  "$comment": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. SPDX-License-Identifier: Apache-2.0",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://nvcf.nvidia.com/schemas/storage-capability-catalog-v1alpha1.json",
+  "title": "NVCF storage capability catalog",
+  "description": "PVC access modes qualified per exact CSI provisioner. NVCA derives the cache flow from these modes; nothing about the flow is declared here.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "apiVersion",
+    "kind",
+    "drivers"
+  ],
+  "properties": {
+    "apiVersion": {
+      "const": "storage.nvcf.nvidia.com/v1alpha1"
+    },
+    "kind": {
+      "const": "StorageCapabilityCatalog"
+    },
+    "drivers": {
+      "type": "object",
+      "minProperties": 1,
+      "propertyNames": {
+        "type": "string",
+        "minLength": 1,
+        "pattern": "\\S"
+      },
+      "additionalProperties": {
+        "$ref": "#/$defs/driver"
+      }
+    }
+  },
+  "$defs": {
+    "accessMode": {
+      "type": "string",
+      "enum": [
+        "ReadWriteOnce",
+        "ReadOnlyMany",
+        "ReadWriteMany"
+      ]
+    },
+    "driver": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "provider",
+        "accessModes",
+        "readerMountOptions"
+      ],
+      "properties": {
+        "provider": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "\\S"
+        },
+        "accessModes": {
+          "description": "Modes qualified end to end in an NVCF cache workflow, not modes the driver accepts. Empty means the driver is not enabled.",
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/accessMode"
+          }
+        },
+        "readerMountOptions": {
+          "description": "Mount options for reader PVs NVCA creates. Only the ReadWriteOnce plus ReadOnlyMany shape creates them, and it must include \"ro\".",
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/readerMountOption"
+          },
+          "allOf": [
+            {
+              "not": {
+                "allOf": [
+                  {
+                    "contains": {
+                      "const": "ro"
+                    }
+                  },
+                  {
+                    "contains": {
+                      "const": "rw"
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "not": {
+                "allOf": [
+                  {
+                    "contains": {
+                      "const": "recovery"
+                    }
+                  },
+                  {
+                    "contains": {
+                      "const": "norecovery"
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "not": {
+                "allOf": [
+                  {
+                    "contains": {
+                      "const": "uuid"
+                    }
+                  },
+                  {
+                    "contains": {
+                      "const": "nouuid"
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      },
+      "allOf": [
+        {
+          "$comment": "A driver qualified for the ReadOnlyMany reader shape creates reader PVs, so it must mount them read-only.",
+          "if": {
+            "properties": {
+              "accessModes": {
+                "allOf": [
+                  {
+                    "contains": {
+                      "const": "ReadWriteOnce"
+                    }
+                  },
+                  {
+                    "contains": {
+                      "const": "ReadOnlyMany"
+                    }
+                  }
+                ]
+              }
+            },
+            "required": [
+              "accessModes"
+            ]
+          },
+          "then": {
+            "properties": {
+              "readerMountOptions": {
+                "contains": {
+                  "const": "ro"
+                }
+              }
+            }
+          }
+        },
+        {
+          "$comment": "ReadOnlyMany describes readers. Without a writer mode alongside it there is nothing to populate the cache.",
+          "if": {
+            "properties": {
+              "accessModes": {
+                "contains": {
+                  "const": "ReadOnlyMany"
+                }
+              }
+            },
+            "required": [
+              "accessModes"
+            ]
+          },
+          "then": {
+            "properties": {
+              "accessModes": {
+                "anyOf": [
+                  {
+                    "contains": {
+                      "const": "ReadWriteOnce"
+                    }
+                  },
+                  {
+                    "contains": {
+                      "const": "ReadWriteMany"
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        }
+      ]
+    },
+    "readerMountOption": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^\\S(?:.*\\S)?$"
+    }
+  }
+}

deploy/helm/nvca-operator/nvca-operator/files/nvcf-storage-capabilities-v1alpha1.yaml

@@ -0,0 +1,60 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NVCA owns this catalog and installs it with the NVCA chart. It records, for
+# each exact CSI provisioner, the PVC access modes qualified end to end in an
+# NVCF cache workflow. Nothing else is declared: NVCA derives how caching runs
+# from these modes.
+#
+#   ReadWriteMany              one shared claim; readers mount it read-only
+#   ReadWriteOnce+ReadOnlyMany writer takes the claim; readers get their own
+#
+# An access mode a driver merely accepts is not a qualification. A claim that
+# binds is not either. An empty accessModes list means nothing is qualified
+# yet, so caching stays off for that driver, and a provisioner absent from this
+# file is unsupported. Enabling a backend is an edit here, backed by a
+# qualification run.
+apiVersion: storage.nvcf.nvidia.com/v1alpha1
+kind: StorageCapabilityCatalog
+drivers:
+  nvmesh-csi.excelero.com:
+    provider: nvmesh
+    accessModes:
+      - ReadWriteOnce
+      - ReadOnlyMany
+    # The reader PV is XFS on the same filesystem as the writer, so it needs
+    # nouuid and norecovery or the mount fails outright.
+    readerMountOptions:
+      - ro
+      - norecovery
+      - nouuid
+  csi.weka.io:
+    provider: weka
+    # Fresh ReadWriteMany and ReadOnlyMany claims were tested, but a cache
+    # workflow was not, so nothing is qualified yet.
+    accessModes: []
+    readerMountOptions: []
+  fss.csi.oraclecloud.com:
+    provider: ociFss
+    # A ReadWriteMany claim was tested; its readers used read-only Pod mounts,
+    # which is not evidence for a ReadOnlyMany claim. No cache workflow was
+    # qualified.
+    accessModes: []
+    readerMountOptions: []
+  lustre.csi.oraclecloud.com:
+    provider: ociLustre
+    # No PVC access mode has been qualified in an NVCF cache workflow.
+    accessModes: []
+    readerMountOptions: []

deploy/helm/nvca-operator/nvca-operator/templates/storage-capabilities-configmap.yaml

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- $catalogPath := "files/nvcf-storage-capabilities-v1alpha1.yaml" -}}
+{{- $catalog := .Files.Get $catalogPath -}}
+{{- if not $catalog -}}
+{{- fail (printf "required NVCF storage capability catalog %s is missing" $catalogPath) -}}
+{{- end }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nvcf-storage-capabilities
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "nvcaop.labels" . | nindent 4 }}
+data:
+  storage-provider-capabilities.yaml: |
+{{- $catalog | nindent 4 }}