Repository navigation
chore(opencode): upgrade suitable Kimi agents to K3.1 Pro (0.5.5) - #130
Merged
Merged
Conversation
Chart CI passedRepository hygiene and Helm validation passed. View the workflow run. |
7 tasks done
xnoto
added a commit
to makeitworkcloud/kustomize-cluster
that referenced
this pull request
Oct 25, 2026
## Summary Select published opencode-server chart **0.5.5** from [charts PR #130](makeitworkcloud/charts#130). Coordinate the existing strict chart/API assertion to **(0.5.5, 2)**; API selector remains 2. Exactly two one-line changes: generated Application pin and companion test expectation. No image, provider, Secret, permission, network, pilot or workflow orchestration changes. ## Type of change - [x] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets) - [x] CI / reusable workflow ## Validation - [x] Required pull-request checks pass: [run 40152331367](https://github.com/makeitworkcloud/kustomize-cluster/actions/runs/40152331367) at head 5862aab; test and ci-logging succeeded. - [x] Generated pin was produced by charts automation; only its companion assertion was coordinated manually. - Producer [main run](https://github.com/makeitworkcloud/charts/actions/runs/40151663550) succeeded, including Publish chart. Registry bytes were not separately pulled. - Independent adversarial and infra-security reviews ADVANCE; release readiness accepted subject to green CI (now satisfied). QA assesses the supplied invocation/conditions/assertion/failure-propagation evidence as COVERED. DevOps review remains HOLD on a Medium full-workflow supplied-material evidence gap, with no implementation defect identified. Primary inspected the SHA-pinned workflow and execution path directly: PR synchronize runs test, Python heredoc contains TestContracts and unittest.main, no step/job condition or error suppression. This is a scoped primary decision, not independent approval of the unchanged full workflow. No Critical/High finding or owner waiver. - No local tests claimed. Static CI does not prove effective model effort, entitlement, inference, tool calls or quota use. ## Impact and rollout Owner explicitly requested rollout. Producer chart 0.5.5 is published; image/appVersion 2.0.22 unchanged. Three Kimi agent model headers advance to regular K3.1 Pro with preserved efforts; reduced-quota 256K worker remains unchanged. Consumer pin and assertion change here. After merge, unchanged main CI automatically triggers sync.yml, which submits the tested SHA to bootstrap Applications; gitops-workloads updates the opencode child and automated reconciliation selects the chart. Submission, reconciliation, health and functional verification are separate stages and will be checked afterward. No manual sync, restart, dispatch or live patch is planned. Single-replica Recreate may briefly interrupt service/session. Rollback requires separately authorized reviewed prior published pin plus matching assertion; no image downgrade, retagging or database operation. ## Safety and secrets - [x] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints. - [x] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed. - [x] Effects and rollback are described above. AI-assisted consumer assertion coordination and scoped review; generated pin remains publisher-owned. --------- Co-authored-by: makeitworkbot[bot] <321979582+makeitworkbot[bot]@users.noreply.github.com> Co-authored-by: Steven Welch <steven@makeitwork.cloud>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refresh Kimi-backed subagents for the owner-requested K3.1 investigation. OpenCode’s provider-filtered catalog on 2026-10-25 lists the exact active ID
kimi-code-plan-cn/k3.1-prowithlow/high/maxvariants. The configured provider, endpoint, account and Secret references remain unchanged.kimikimi-code-plan-cn/k3.1-prodocs-writerkimi-code-plan-cn/k3.1-prorelease-engineerkimi-code-plan-cn/k3.1-prokimi-256kkimi-code-plan-cn/k3-256k(unchanged)Official Kimi documentation lists no K3.1 256K successor. Preserve the explicitly reduced-quota worker rather than silently changing its purpose. Highspeed has the same capabilities at approximately twice regular Pro’s quota use and is not selected. Regular Pro’s quota consumption relative to the old models is unverified; no quota-neutrality, savings, performance or free-usage claim is made.
Only three packaged model-header lines change. Bump chart
0.5.4→0.5.5; image/appVersion2.0.22, global Sol selection, all primaries, permissions, steps, prompts, other workers, provider wiring, MCPs, pilot and workflows are unchanged. Update existing Makefile/package assertions, regression tests and three documentation files. No associated issue.Type of change
Validation
8acf7f2d2853c7e5d27b7b09de5e10efd16643d6: run 40151510924.test,detect, andpackage opencode-serversucceeded; the main-only GitOps updater was correctly skipped. CI is the validation environment; no local checks claimed.The historical
32a6b91baseline remains fixed. A separate exact, three-file, header-only transform follows the historical provider migration and asserts each old block occurs once. Independent source/render tests enforce all four Kimi model/variant/mode selections, reject duplicate/missing/wrong selections and extra/missing agents, and retain full baseline, prompt/permission, source/ConfigMap and archive-byte parity protections. Makefile exact metadata/archive expectations advance to0.5.5.Independent static reviews: adversarial ADVANCE; infra-security ADVANCE; QA COVERED; DevOps ADVANCE bounded to the two Makefile literals and supplied unchanged integration; release READY bounded to source/package consistency (no owner waiver or rollout approval). No Critical/High finding remains. These are not executed CI checks or authorization for later delivery.
Catalog validation is not account entitlement, effective request effort, inference or tool-call verification. Pro requires thinking enabled. After an explicitly authorized rollout, use fresh sessions and synthetic inputs to verify selected models/efforts, inference and representative delegated tool calls; preserve the bounded worker’s behavior. Membership-dependent context limits and actual quota use require separate verification.
Impact and rollout
Producer:
makeitworkcloud/charts/opencode-server. Consumers: packaged OpenCode subagents and cluster-ownedworkloads/apps/opencode-app.yamlinmakeitworkcloud/kustomize-cluster.automation/opencode-server-0.5.5, changing only the consumer chart pin, with required-check-gated squash auto-merge; updater workflow unchanged.(0.5.4, 2). A generated0.5.5pin cannot pass until a separate consumer change coordinates its expected chart version to0.5.5, retaining API selector2. This PR does not edit consumer desired state/tests or bypass checks. This prerequisite is not waived by the charts merge approval. Publication can complete while selection stays blocked.Rollback is a separately authorized GitOps revision to a previous published chart and matching assertion; no image downgrade, credential change or database operation is part of this change.
Safety and secrets
AI-assisted implementation by a bounded worker, verified by the makeitwork primary with independent reviewer subagents. The organization-default pull-request template was applied.