[makeitworkbot]

Summary

Select published opencode-server chart 0.5.5 from charts PR #130. Coordinate the existing strict chart/API assertion to (0.5.5, 2); API selector remains 2. Exactly two one-line changes: generated Application pin and companion test expectation. No image, provider, Secret, permission, network, pilot or workflow orchestration changes.

Type of change

• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• CI / reusable workflow

Validation

• Required pull-request checks pass: run 40152331367 at head 5862aab; test and ci-logging succeeded.
• Generated pin was produced by charts automation; only its companion assertion was coordinated manually.
• Producer main run succeeded, including Publish chart. Registry bytes were not separately pulled.
• Independent adversarial and infra-security reviews ADVANCE; release readiness accepted subject to green CI (now satisfied). QA assesses the supplied invocation/conditions/assertion/failure-propagation evidence as COVERED. DevOps review remains HOLD on a Medium full-workflow supplied-material evidence gap, with no implementation defect identified. Primary inspected the SHA-pinned workflow and execution path directly: PR synchronize runs test, Python heredoc contains TestContracts and unittest.main, no step/job condition or error suppression. This is a scoped primary decision, not independent approval of the unchanged full workflow. No Critical/High finding or owner waiver.
• No local tests claimed. Static CI does not prove effective model effort, entitlement, inference, tool calls or quota use.

Impact and rollout

Owner explicitly requested rollout. Producer chart 0.5.5 is published; image/appVersion 2.0.22 unchanged. Three Kimi agent model headers advance to regular K3.1 Pro with preserved efforts; reduced-quota 256K worker remains unchanged.

Consumer pin and assertion change here. After merge, unchanged main CI automatically triggers sync.yml, which submits the tested SHA to bootstrap Applications; gitops-workloads updates the opencode child and automated reconciliation selects the chart. Submission, reconciliation, health and functional verification are separate stages and will be checked afterward. No manual sync, restart, dispatch or live patch is planned. Single-replica Recreate may briefly interrupt service/session. Rollback requires separately authorized reviewed prior published pin plus matching assertion; no image downgrade, retagging or database operation.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed.
• Effects and rollback are described above.

AI-assisted consumer assertion coordination and scoped review; generated pin remains publisher-owned.