[xnoto]

Summary

Change only adversarial-code-reviewer and infra-security-reviewer from GPT-6.1 Sol xhigh to high. Preserve their models, prompt bodies and permissions; retain all ten primary agents, global Sol fallback, other workers, and GLM-Flash max. Bump immutable chart opencode-server from 0.5.7 to 0.5.8; appVersion 2.0.22 and API selector 2 stay unchanged.

Owner-approved risk/cost starting policy following the reasoning-effort investigation, not measured optimality, equivalent review quality, or demonstrated savings. OpenAI recommends reserving xhigh for evaluated benefits; GLM effort labels and intended maximum-reasoning role are distinct.

Fixes: N/A — owner-requested reasoning policy change.

Type of change

• Feature / enhancement
• Documentation
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• CI / reusable workflow

Validation

• Required pull-request checks pass — test, detect, and package opencode-server succeeded at the reviewed HEAD. The post-publish GitOps updater was correctly skipped on this PR. CI is the validation environment; no local checks run.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — canonical packaged inputs only; Helm generates ConfigMap/mount/checksum data during CI.

Expected checks: test, detect, package opencode-server (repository hygiene, strict Helm lint/render, model/variant source/render assertions, baseline parity and archive packaging). Add a separate exact two-header transform after historical reasoning and Terra restoration; preserve both historical baseline SHAs and transforms. Fixtures cover allowlisted changes, unchanged bodies/unrelated files, and missing/wrong/duplicate selections.

Pre-PR reviews at a9d5617b2eb6b8c8b07707e7b7cbae9fdb226100: adversarial ADVANCE, infrastructure-security ADVANCE, DevOps ADVANCE, QA COVERED. Release assessment found no version/packaging defect in supplied evidence; all independent review gates and PR checks are now complete. Merge/publication still require explicit owner confirmation. These are independent agent assessments, not GitHub approvals. No Critical/High finding remains.

Impact and rollout

Canonical producer: makeitworkcloud/charts, target main. Eight paths: Makefile; chart metadata; two reviewer agent definitions; memory-pilot tests; README; architecture and memory-pilot guides. No image, provider, model, workflow, permission, secret, resource or topology change.

• Authored: this branch. PR validation/packaging: automatic.
• Merge/publication: confirmation-gated, not authorized or performed. A confirmed merge triggers existing main publication of OCI chart 0.5.8 to GHCR.
• Consumer handoff: unchanged automation opens/updates makeitworkcloud/kustomize-cluster pin PR with auto-merge enabled and required checks. At verified consumer revision 2edd55319072c9bc52ecece692c36925c28bd715, Application pin and exact chart/API assertion are 0.5.7/2. The future consumer PR must update pin and exact assertion atomically to 0.5.8/2; pin-only automation cannot pass that check. No consumer edit is included.
• Reconciliation/health: future consumer selection can trigger root/child reconciliation and single-replica Recreate replacement via ConfigMap checksum. Config loads at startup, not hot reload. No deployment/sync/restart performed.
• Functional validation: after separately approved rollout, verify fresh reviewer children select Sol/high and exercise representative synthetic reviews; separately verify unchanged primary/Flash selections. Static CI cannot prove review quality or savings.
• Rollback: separately confirmed GitOps pin and coupled assertion reversion to published 0.5.7/API 2; not an image downgrade.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI-assisted implementation and independent review. Merge, publication, consumer adoption, and live rollout require separate confirmation.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.