[xnoto]

Summary

First implementation stage of the owner-approved internal presentation MCP design: a disposable, PR-only Jupyter Enterprise Gateway qualification fixture. This does not implement or activate the production MCP adapter.

The 33 additions are confined to .github/tests/presentation-qualification/ and .github/workflows/presentation-qualification.yml. Synthetic one-slide PptxGenJS authoring is followed by bounded, digest-verified channel transport into a fresh rendering kernel, LibreOffice/Poppler conversion, and PNG decoding. Authentication, namespace-scoped RBAC, fixed pod configuration, and cancellation are exercised separately.

Type of change

• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state
• Container image publication
• CI / reusable workflow
• Breaking change

Validation

• Required pull-request checks pass
• Qualification static and runtime checks pass
• No generated or centrally distributed production files changed

CI is the validation environment; no local test or runtime execution is claimed. First execution is this PR CI at commit 97213b8e70d0c0d0f3df72ac4664ebba5d23c341.

Completed-code and infrastructure-security source re-reviews returned ADVANCE with no remaining Critical/High findings after repairs. The CI-integration review remains HOLD for incomplete supplied callee evidence (Medium); its snapshot false-green finding was repaired. QA identified unexecuted CLI/acquisition regression coverage and UID examples as gaps. These are not represented as executed checks. This PR remains draft pending CI and integration follow-up.

Network isolation and overall production qualification remain INCOMPLETE even if core CI passes: default KIND networking does not enforce the supplied static policy example, which is never applied. Snapshot checks observe endpoint metadata only, not transient between-snapshot activity. Mutable apt/npm/pip transitives and runner kubectl are documented fixture-only limitations.

Impact and rollout

Producer: these test-owned files in makeitworkcloud/charts. Consumer: an isolated GitHub-hosted runner and its disposable KIND cluster. Test images are built and loaded locally, never published. No OpenCode chart files, versions, packaged skills, provider configuration, cluster Secrets/PVCs, image pins, or GitOps Applications change.

The existing chart validation workflow is unchanged. Since this diff changes only .github, changed-chart detection selects no chart: no OCI publication or automatic OpenCode GitOps-pin update is intended. Authored/committed is the current stage; CI validation is automatic on this PR. Production backend publication, selection, reconciliation, health, and actual provider image-review acceptance remain separate, confirmation-gated work.

Rollback: reviewed revert of the fixture/workflow; no production rollout or database rollback. No merge, package publication, workflow dispatch, or deployment is authorized by opening this PR.

Safety and secrets

• Contains no plaintext production secrets, decrypted SOPS values, state files, kubeconfigs, credentials, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed
• Breaking or irreversible effects and remaining gates are described above

Synthetic runtime authentication only. No raw gateway/kernel logs, environments, kubeconfigs, or connection material are printed or uploaded. Snapshot persistence projects namespace/name/UID only. Explicit disposable kubeconfig/context, restrictive file creation, and exit cleanup are used.

Materially AI-authored. No runtime containment, deck-quality, Office-fidelity, licensing-complete helper packaging, provider-visible preview, production artifact export, or multi-tenant authorization qualification is claimed.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.

[xnoto]

Initial CI — failed; runtime not executed

At head 97213b8e70d0c0d0f3df72ac4664ebba5d23c341, fixture CI failed its static job (128 tests; one error and one failure), so runtime qualification was skipped. Repository CI failed hygiene: multi-document YAML and synthetic bad-token curl-header literals. Helm validation succeeded; changed-chart detection succeeded; package publication and GitOps updater jobs were skipped.

Repairs are being authored for the missing same-parent build-status fixture, comment-sensitive assertion, single-document Kubernetes List packaging, and dynamically generated unauthorized test tokens. No secret-scanner exemption, dispatch, production mutation, or runtime pass is claimed. PR stays draft. Network and overall qualification remain INCOMPLETE.

[xnoto]

Initial CI repairs are committed in ac30d49. Both completed-code and security review of the five-file repair returned ADVANCE with no Critical/High findings. The automatic PR checks are being monitored at this new head. No manual workflow dispatch or scanner exemption was used.

The initial failed iteration still establishes no runtime proof. Draft status and network/overall INCOMPLETE boundaries remain unchanged pending current-head CI and integration follow-up.

[xnoto]

Second iteration: static and repository checks passed; runtime failed before build

At ac30d4917c965b98f72387246569d0fc2dfd51c6, all 128 fixture unit tests and repository hygiene/Helm checks passed. Runtime executed but stopped at its client/server skew guard: the hosted runner supplied kubectl 1.37 against the fixture node 1.33. No image build or kernel execution occurred in that run.

a23b2a8 now selects the existing checksum-verified download path for kubectl 1.33.4, matching the node. Its SHA-256 was verified against the official dl.k8s.io checksum; README updated. Automatic current-head CI is being monitored. No manual dispatch, merge, image publication, or deployment occurred; draft status and production gates remain unchanged.

[xnoto]

Pinned-client iteration: runtime readiness failure

All checks at a23b2a833c5cd44eab7e6cc9e4a443759630cb93 are terminal: fixture static tests and repository checks passed; runtime qualification executed and failed with gateway API never became ready. Packaging and the GitOps updater were skipped.

The underlying cause is not established by that message. A narrow diagnostic change is under source review: bounded HTTP status, port-forward liveness, and sanitized pod status reason/count projections only. No gateway/kernel logs, environments, credentials, response bodies, pod specifications, or raw port-forward output will be retrieved. No auth/RBAC/resource workaround is being made without evidence. No core pass or executed network verdict is claimed; PR remains draft.

[xnoto]

Resume checkpoint and review closure

The qualification checks associated with head ff946b6cb67e6ebe0cd812a6d8ce3023351794a1 completed successfully. Previously verified runtime markers: RESULT_FULL_OK, three kernel POST responses of 201, QUALIFICATION_CORE=PASS, QUALIFICATION_NETWORK_ISOLATION=INCOMPLETE, and QUALIFICATION_OVERALL=INCOMPLETE. No previous failing iteration is being relabeled as passed, and the earlier missing-pod failure remains unexplained/not reproduced.

Bounded CI-integration follow-up now ADVANCE; the missing evidence packet and packaging-attribution questions are closed. Packaging ran on synthetic merge 0da1f85ac3cbb4537db6161979478e25d7a1adb4 (merging the fixture branch into newer main 70c96e408c6bc0e04532a055c8558a38c2d861be), while detection compared against base 16bf4353195ec97cc35dfff8f3bad4301808956c. That candidate contains OpenCode chart 0.5.3 versus 0.5.2 on the fixture branch. Thus successful packaging is not evidence that this fixture changed or published a production chart. PR changes remain confined to .github.

QA confirmed source-supported executed core coverage. Nonblocking gaps remain for deliberate runtime snapshot-query failure injection, missing chunks injected over the live websocket, and CLI/acquisition failure checks. Snapshot endpoint comparisons are not continuous monitoring.

Documentation-only commit 4bc94e26a23a00f5d8440a61b6fc1a47386fb795 corrects README WARNING to WARN; new automatic checks are being monitored, with no manual rerun or dispatch. PR stays draft. Target-CNI network-negative proof, production producer/publication contracts, and actual provider-visible preview acceptance remain separate gates. No merge, publication, GitOps selection, deployment, or production-health claim.

[xnoto]

Observation race confirmed; deterministic gate authored

Current predecessor a991cc27158355b744098229ebdab4fec605592b failed the observation gate even though its full client returned exit 0 and a validated ok=true result (two kernel-start HTTP 201 responses). This establishes an observer synchronization defect; that run remains failed and does not establish core qualification.

Commit 4b9efc556c35d724dbfcbfbcafc58ee53584186e now holds the ready build kernel before execution until the host observes the exact app-plus-kernel-ID pod and the existing invariant probe passes. A fresh private directory carries bounded, strict versioned UUID messages and a matching acknowledgement. No success fallback based only on a completed client is allowed. Timeouts, malformed/wrong/stale messages, query/probe errors, and cleanup remain fail-closed. Worker mounts, auth, RBAC, dependencies, networking, chart versions, and production selection are unchanged.

Code, infrastructure-security, and bounded CI-integration reviews returned ADVANCE. QA-required selector/readiness/deadline cases are included in the new stdlib regression suite; QA advanced source coverage to CI. No local tests were executed. Automatic current-head checks are being monitored. Network isolation and overall qualification remain separate incomplete gates; no merge, publication, deployment, or production-readiness approval is implied.

[xnoto]

Synchronized observation: current-head CI passed

At PR head 4b9efc556c35d724dbfcbfbcafc58ee53584186e, all checks are terminal: static tests, runtime qualification, repository validation, detection and PR packaging succeeded; the GitOps updater was skipped. Runtime evidence was independently inspected through bounded safe markers:

• KERNEL_OBSERVATION_DIAGNOSTIC outcome=running_verified before the render-kernel start and RESULT_FULL_OK
• QUALIFICATION_CORE=PASS
• QUALIFICATION_NETWORK_ISOLATION=INCOMPLETE
• QUALIFICATION_OVERALL=INCOMPLETE

The corrected ordering executed successfully: the live build-pod observation/invariant gate completed before the client continued. Earlier failing observations remain failed; this is current-iteration evidence, not a blanket stability or production-isolation claim. Workflow metadata associates this run with the stated feature head; its exact synthetic merge tree was not separately verified in this check.

PR remains draft. Test images are not published, and PR chart packaging is not publication. No merge, GitOps selection, deployment, target-network acceptance, or provider-visible visual inspection is claimed. No manual workflow dispatch or rerun was used.