feat(opencode): stage inactive memory pilot with home-PVC persistence - #255
Merged
Merged
Conversation
xnoto
marked this pull request as ready for review
September 20, 2026 03:55
xnoto
added a commit
to makeitworkcloud/charts
that referenced
this pull request
Sep 20, 2026
… TEI (#107) ## Summary Implement the owner-approved, TEI-free `opencode-mem` pilot as an opt-in mode of `opencode-server` **0.4.1**. Reconciled with concurrent main **0.4.0** while preserving its cloud-architecture reviewer and all 24 production agents. - Default production mode remains memory-disabled. - Pilot mode renders only a dedicated ConfigMap and one-container `Recreate` Deployment, locked to isolated resource/Secret/PVC names. - Select `opencode-mem@2.26.0`, local embeddings, disabled cleanup, and restricted synthetic-only agent configuration. - Persist memory data/model cache under `/home/opencode/.opencode-mem/data`; no production home, artifacts, OAuth seed, or MCP mounts. - No TEI sidecar, remote embedding API, custom image, or backup service. - Correct inherited CI false-green behavior (`tee` pipeline failure propagation and recursive Make output); add 31 regression tests. - Add only the missing final newline to packaged `qa-engineer.md`; agent instruction text is unchanged. Its checksum impact is explicit below. Issue: N/A — owner-approved implementation and explicit TEI-removal instruction. ## Type of change - [x] Bug fix - [x] Feature / enhancement - [x] Documentation - [x] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets) - [x] CI / reusable workflow ## Validation - [x] Required pull-request checks pass — [run 35486595405](https://github.com/makeitworkcloud/charts/actions/runs/35486595405) at head `18d4cd12082348cc5b5bdaed3f4ea2ec621b9e22`: `test`, `detect`, and `package opencode-server` succeeded; GitOps updater skipped as expected for a PR. - [x] Generated or centrally distributed files were not hand-edited — canonical inputs only; Helm owns rendered resources. Primary inspected the actual test log: **31 tests ran and passed**, alongside hygiene, strict Helm lint/template, existing agent contract/render/archive checks, and packaging. Tests compare original baseline ConfigMap semantics and every agent's source bytes, allowing only the exact missing-EOF-newline correction in `qa-engineer.md`. Whole-manifest comparison, including checksum, uses baseline `32a6b91cc3a881b861bdac087655c3935bb15454` plus that single enumerated correction. Initial green run 35482301899 was rejected as evidence because `tee` masked an actual Make failure and pilot tests were not reached. Strict Bash/pipefail and recursive-Make fixes now fail closed; later failing runs were corrected, not waived. Independent adversarial review ADVANCE including final EOF/test delta; infrastructure security ADVANCE for inactive staging; QA found no test-logic blocker and final CI supplies the missing execution evidence. DevOps DESIGN review ADVANCE for delivery contracts (not a completed-code audit). Independent release-readiness fallback reviewed staging; the specialized Kimi release-review model was unavailable. No unresolved Critical/High inactive-staging finding. No local validation or runtime memory test is claimed. ## Impact and rollout Producer: `makeitworkcloud/charts/opencode-server:0.4.1`. Companion: [kustomize-cluster PR #255](makeitworkcloud/kustomize-cluster#255). **Merge/publication requires separate explicit confirmation.** A charts main merge publishes OCI and the existing workflow opens an auto-merge-enabled production chart-pin PR. That production consumer does not enable pilot mode. The hygiene-required EOF correction changes the configuration checksum, so normal production pod rollout can occur after chart selection even with memory disabled; do not describe this as byte-identical production manifests. The companion pilot Application is outside active Kustomizations with no automated sync. Later activation requires published-chart verification, native local ONNX/Alpine compatibility and runtime checks, package/model provenance, isolated SOPS-managed provider/server Secrets, controlled synthetic-client access, published-chart Service linkage, separately approved Application registration and manual sync. Review/pin the retained init image before activation. **Runtime remains unverified:** local ONNX embeddings have not been demonstrated compatible with the stock Alpine image. TCP probes prove only a listening server, not plugin/model readiness. The plugin retains raw prompts and its import/export tool performs filesystem I/O; synthetic-only use is operating policy, not a redaction sandbox. Local Hugging Face library/model downloads remain; only TEI is removed. Owner accepts home-PVC persistence; off-node backup/restore hardening is deferred, with no HA or node-loss recovery promise. No main merge, publication, Application registration, sync, or restart performed by this work. Rollback requires separately reviewed chart selection; never overwrite an OCI version. ## Safety and secrets - [x] No plaintext secrets, decrypted SOPS values, state, kubeconfigs, tokens, or new private endpoints - [x] No local OpenTofu init/plan/apply/destroy/import/state operations run or claimed - [x] Publication consequences, checksum rollout, and rollback limits described above AI-assisted; primary and independent specialist review applied. Kept draft to make pending rollout/runtime gates explicit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stage the owner-approved, TEI-free OpenCode memory pilot without registering or deploying it. Reconciled with current main without reverting SMS retirement or the production chart 0.4.0 pin.
opencode-server:0.4.1and the matching PVC/Service overlay./home/opencode; no production claim sharing.Issue: N/A — owner design/implementation approval and explicit TEI-removal instruction.
Type of change
Validation
5223e6f0f1d440bb759cb29f6d2c550088daf92e:testanddns-cleanup-scriptsucceeded.Independent adversarial and infrastructure-security reviews ADVANCE for inactive staging. QA reviewed exact contracts and deliberate activation-only gaps; DevOps DESIGN review ADVANCE for delivery contracts. Concurrency reconciliation preserved production ownership and inactive pilot. No Critical/High inactive-staging finding remains. No local execution or live runtime verification claimed.
Impact and rollout
Producer companion: charts PR #107, proposed 0.4.1 (publication still a later gate).
workloads/opencode-memory-pilot/application.yamlis absent fromworkloads/appsand excluded from its own overlay. Merging this preparation does not create the pilot Application, PVC, Service, or Deployment. Existing main CI/root sync can run normally but cannot reach this staged pilot. No automated child sync; onlyCreateNamespace=true, without the unnecessary missing-resource dry-run exemption.Activation is separately approved after chart publication, local-embedding runtime compatibility checks, isolated SOPS/KSOPS Secret provisioning, controlled synthetic-client access, and published-chart Service-selector/port verification. Register the Application in a separate activation PR, intentionally update the inactivity guard, and obtain explicit manual-sync confirmation.
No TEI or replacement hosted embedding API. Local ONNX compatibility on Alpine remains unverified. Raw prompts persist; synthetic-only is procedural. ClusterIP is cluster-reachable, not namespace isolation; dedicated Basic authentication is the access boundary, with no NetworkPolicy enforcement claim.
Owner accepts home-PVC persistence for now; external backup/encryption/restore hardening deferred, with no node-loss DR promise. No production home, artifacts, agent definitions or credentials changed. No main merge, publication, registration, sync or restart performed.
Safety and secrets
AI-assisted; independent specialist scrutiny applied. Kept draft to make deferred activation explicit.