feat(opencode): prepare isolated home-persistent memory pilot without TEI

[xnoto]

Summary

Implement the owner-approved, TEI-free opencode-mem pilot as an opt-in mode of opencode-server 0.4.1. Reconciled with concurrent main 0.4.0 while preserving its cloud-architecture reviewer and all 24 production agents.

• Default production mode remains memory-disabled.
• Pilot mode renders only a dedicated ConfigMap and one-container Recreate Deployment, locked to isolated resource/Secret/PVC names.
• Select opencode-mem@2.26.0, local embeddings, disabled cleanup, and restricted synthetic-only agent configuration.
• Persist memory data/model cache under /home/opencode/.opencode-mem/data; no production home, artifacts, OAuth seed, or MCP mounts.
• No TEI sidecar, remote embedding API, custom image, or backup service.
• Correct inherited CI false-green behavior (tee pipeline failure propagation and recursive Make output); add 31 regression tests.
• Add only the missing final newline to packaged qa-engineer.md; agent instruction text is unchanged. Its checksum impact is explicit below.

Issue: N/A — owner-approved implementation and explicit TEI-removal instruction.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• CI / reusable workflow

Validation

• Required pull-request checks pass — run 35486595405 at head 18d4cd12082348cc5b5bdaed3f4ea2ec621b9e22: test, detect, and package opencode-server succeeded; GitOps updater skipped as expected for a PR.
• Generated or centrally distributed files were not hand-edited — canonical inputs only; Helm owns rendered resources.

Primary inspected the actual test log: 31 tests ran and passed, alongside hygiene, strict Helm lint/template, existing agent contract/render/archive checks, and packaging. Tests compare original baseline ConfigMap semantics and every agent's source bytes, allowing only the exact missing-EOF-newline correction in qa-engineer.md. Whole-manifest comparison, including checksum, uses baseline 32a6b91cc3a881b861bdac087655c3935bb15454 plus that single enumerated correction.

Initial green run 35482301899 was rejected as evidence because tee masked an actual Make failure and pilot tests were not reached. Strict Bash/pipefail and recursive-Make fixes now fail closed; later failing runs were corrected, not waived.

Independent adversarial review ADVANCE including final EOF/test delta; infrastructure security ADVANCE for inactive staging; QA found no test-logic blocker and final CI supplies the missing execution evidence. DevOps DESIGN review ADVANCE for delivery contracts (not a completed-code audit). Independent release-readiness fallback reviewed staging; the specialized Kimi release-review model was unavailable. No unresolved Critical/High inactive-staging finding. No local validation or runtime memory test is claimed.

Impact and rollout

Producer: makeitworkcloud/charts/opencode-server:0.4.1. Companion: kustomize-cluster PR #255.

Merge/publication requires separate explicit confirmation. A charts main merge publishes OCI and the existing workflow opens an auto-merge-enabled production chart-pin PR. That production consumer does not enable pilot mode. The hygiene-required EOF correction changes the configuration checksum, so normal production pod rollout can occur after chart selection even with memory disabled; do not describe this as byte-identical production manifests.

The companion pilot Application is outside active Kustomizations with no automated sync. Later activation requires published-chart verification, native local ONNX/Alpine compatibility and runtime checks, package/model provenance, isolated SOPS-managed provider/server Secrets, controlled synthetic-client access, published-chart Service linkage, separately approved Application registration and manual sync. Review/pin the retained init image before activation.

Runtime remains unverified: local ONNX embeddings have not been demonstrated compatible with the stock Alpine image. TCP probes prove only a listening server, not plugin/model readiness. The plugin retains raw prompts and its import/export tool performs filesystem I/O; synthetic-only use is operating policy, not a redaction sandbox. Local Hugging Face library/model downloads remain; only TEI is removed.

Owner accepts home-PVC persistence; off-node backup/restore hardening is deferred, with no HA or node-loss recovery promise. No main merge, publication, Application registration, sync, or restart performed by this work. Rollback requires separately reviewed chart selection; never overwrite an OCI version.

Safety and secrets

• No plaintext secrets, decrypted SOPS values, state, kubeconfigs, tokens, or new private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations run or claimed
• Publication consequences, checksum rollout, and rollback limits described above

AI-assisted; primary and independent specialist review applied. Kept draft to make pending rollout/runtime gates explicit.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.

[xnoto]

CI evidence correction: run 35482301899 is green at the job level, but the Helm log contains make[1]: *** [Makefile:29: test-changed-charts] Error 1 and make: *** [Makefile:24: test] Error 2. The pipeline through tee masked that failure; the new memory-pilot tests were not reached. This run is not accepted as validation. I am correcting shell failure propagation and the nested Make output handling before accepting CI. No publication/deployment occurred; this PR remains draft.