[xnoto]

Summary

Prepare codebase-memory consumer compatibility in chart 0.5.6 before any separately approved backend migration. Application remains 2.0.22 and backend remains 0.10.8.

• Select legacy/candidate call arguments from exact advertised schemas; never send new arguments to the legacy backend.
• Require explicit full/JSON source and coverage diagnostics when supported; retain verified cache provenance, the strict 500-line complete-file bound, and verified-SHA GitHub fallback. Reject outlines, omitted/clipped source, unresolved continuations, and incomplete coverage evidence.
• Update all ten identical primary retrieval blocks, shared worker floor, two Kimi policies, canonical docs, and existing static/render/archive tests. Preserve historical baselines, role policy, model selections, and permission boundaries.
• No backend pin, ToolConfig, endpoint, image, resource, credential, storage, or workflow changes.

Candidate contract: pinned upstream v0.12.1 source. This PR does not select that backend.

Type of change

• Feature / enhancement
• Documentation
• GitOps desired state (charts)
• CI / validation assertions (existing test files; workflows unchanged)

Validation

• Required pull-request tests and packaging passed at reviewed HEAD 38a794e (CI); no local checks were run.
• Generated-file ownership preserved: no rendered/published copies were hand-edited; existing CI renders/packages authored inputs and checks parity.

Independent adversarial and infrastructure-security reviewers inspected the complete 19-file diff including the documentation correction and advanced without Critical/High findings. QA confirmed bounded static coverage; release review is ready; DevOps advanced the exact chart/Makefile/delivery-documentation changes.

CI validates hygiene, contract markers, ten-primary equality, historical allowlisted transformations, Helm rendering, and archive parity. It does not prove agent adherence, live old/new-schema compatibility, or candidate backend resource/recovery behavior.

Impact and rollout

Initial preparation boundary: merge/publication/deployment were initially unapproved. The owner subsequently confirmed proceeding; chart merge completed as 09a08579, authorizing publication and the documented downstream pin flow. Backend migration remains unapproved.

Stage	Status / gate
Authoring	Changed: consumer policy, docs, existing tests; chart 0.5.6
PR validation	Automatic after opening; hygiene, make test, packaging
Publication	Confirmation-gated: a charts/main merge publishes the immutable OCI chart
GitOps pin	Existing publisher opens/updates the pin PR and enables auto-merge after required checks; no independent human deployment gate is created
Consumer coordination	After publication, update the desired pin AND exact chart assertion atomically in the same consumer PR to 0.5.6 / API 2. Never merge assertion-only first or bypass checks
Reconciliation / health	Unperformed; verify root, OpenCode child, replacement Pod, and health separately after approved selection
Functional acceptance	Unperformed; use fresh sessions to verify the still-legacy backend path before considering the separate upgrade; validate the candidate path in an approved candidate environment
Backend migration	Unchanged at 0.10.8; separately held pending approval and cold-start, resource-fit, read-only-artifact, symlink, UI-off, and recovery validation

Current downstream assertion at 353c260f requires 0.5.5 / API 2, blocking an uncoordinated 0.5.6 pin. Required checks are a coordination gate, not a substitute for owner approval. Recheck current consumers before merge.

Rollback of this consumer release, if needed, is a separately approved GitOps selection of a previous immutable chart with its matching assertion. Do not revert compatible consumer instructions while a candidate backend still depends on them. Candidate index-format downgrade safety is not established here.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, credentials, or newly introduced private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed.
• Breaking-contract considerations, delivery consequences, and rollback gates are described above.

AI-assisted change coordinated by the Make IT Work Cloud agent. No live mutation, workflow dispatch, publication, or deployment was performed.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.

[xnoto]

Owner confirmed proceeding after review and passing PR CI. Merged the reviewed HEAD 38a794e as 09a08579a2b0023044875b131477dd05b0e638fc using the ordinary protected-branch merge route. This authorizes chart publication and the documented downstream auto-pin flow, not backend migration. Backend remains 0.10.8. Main publication and downstream selection/reconciliation/function remain separate verification stages; pin and exact cluster assertion must advance together.

[xnoto]

Publication verified: main run 40394821220 completed successfully at merge 09a08579, including Publish chart, GitOps PR creation, and auto-merge enablement. Consumer kustomize-cluster #294 now contains the reviewed atomic pin/assertion pair; its corrected HEAD is afa27a0 and fresh cluster CI is pending. The prior pin-only assertion failure was not bypassed. Publication is established; consumer selection, reconciliation, health, and functional acceptance are not yet claimed. Backend remains 0.10.8.