[oldsj]

What

• charts/mainloop: a Helm chart rendering what k8s/apps/mainloop/base plus the overlays did. Deployment-specific parts are values: strategy, resources, site config, control-plane auth, database (CNPG or local), and the dev commands.
• CI publishing (images.yml, new chart job): on each push to main, CI packages the chart as oci://ghcr.io/oldsj/charts/mainloop version 0.1.<run number>, appVersion <sha7>, with that commit's image digests pinned. Run numbers only grow, so a late or re-run job never outranks a newer chart.
• Kind (make kind-up / make dev) installs the chart with values-kind.yaml.
• Live dev instance (make dev-live) installs the chart.
  • Its values and *-dev kagent agents come from $MAINLOOP_DEV_CONFIG, and its kube context from $DEV_LIVE_CONTEXT, either from the environment or from .env.
  • None of the personal instance config lives here any more.
  • ci/live-dev-values.yaml and ci/production-values.yaml are generic examples using example.test.
• Removed: overlays/kind and overlays/dev-live.
• Kept until production moves to the chart: overlays/prod, devloop and the release job. A follow-up removes them.

Verification

• server/internal/deploytest was ported to helm template (59 subtests passing).
• Chart defaults render the same objects as the old base, and Kind renders the same as the old kind overlay. The only difference in both is the backend-ingress Tailscale peer, which was dropped from the defaults.
• Rendering with the infrastructure prod values matches Argo's current prod render apart from the intended resource right-sizing and a checksum/config annotation that replaces the manual config-revision.
• helm lint is clean, and the packaging steps were dry-run locally.
• Not run: make dev / make dev-live through DevSpace (DevSpace isn't installed on the machine I worked on).
  • The live profile uses helm upgrade --take-ownership to adopt the objects kubectl created earlier. That needs Helm ≥ 3.17.

After merge

• The first chart run creates the charts/mainloop package as private. Make it public once in its package settings, as with charts/opencozy, so Argo can pull it without credentials.
• Set MAINLOOP_DEV_CONFIG and DEV_LIVE_CONTEXT before the next make dev-live.

Follow-ups (not in this PR)

• The frontend image still bakes in VITE_API_URL=https://mainloop-api.olds.network (in images.yml and the README).
• docs/specs/warm-state.md has historical run notes naming personal hosts.

🤖 Generated with Claude Code