PRIME PRODUCTS · MISSION CONTROL
AI-first transformation · by TPL · vanos.tpl.one

Docs / 06-decisions/013-chat-corpus-ci-redeploy

ADR-013 Wiki-chat corpus freshness — CI rebuild & redeploy on master push

The chat corpus (baked into the image, ADR-008) is rebuilt by CI on every knowledge-affecting master push — an OKD binary build + rollout in the vanos namespace, authenticated by a scoped service-account token in GitHub Actions secrets. Dormant until the token lands.

type: adr updated: 2026-07-06 owner: taranas

ADR-013 — Wiki-chat corpus freshness: CI rebuild & redeploy on master push

Status

accepted — 2026-07-06 (decided by: taranas). Dormant until the OKD_TOKEN/OKD_SERVER secrets land in GitHub Actions — the workflow skips gracefully meanwhile.

Context

The wiki-chat corpus is baked into the container image at build time (ADR-008); its own README states the intent: “a site deploy and a chat redeploy should ride the same commit.” Today the site half is automatic (CI on master push) but the chat half is manual — so after every ingestion merge the chat answers from a stale vault until someone rebuilds. With the raw-ingestion flow (ADR-012 + the ingest-raw skill) producing regular content merges, the manual step becomes the only broken link in the raw → wiki → UI chain.

Decision

  1. A CI job redeploys the chat on every master push that can change the corpus (.github/workflows/chat-corpus-redeploy.yml): paths filter on knowledge content (**/*.md) and chat/**.
  2. Build where the image lives: oc start-build wiki-chat --from-dir=. --follow --wait — a binary build in the OKD vanos namespace into the internal registry (vanos/wiki-chat:latest), exactly what is done by hand today; then oc rollout restart deployment/wiki-chat + oc rollout status. No external registry, no image credentials in GitHub.
  3. Auth model: a dedicated OKD ServiceAccount ci-chat-deploy in vanos, granted only what the job needs (start builds, restart the one deployment — edit scoped to the namespace is acceptable at this size). Its token goes to GitHub Actions secrets as OKD_TOKEN, with OKD_SERVER=https://api.okd.tpl.one:6443. The token is a secret like any other: 1Password first, then the Actions secret (never in git).
  4. Graceful dormancy: the workflow’s first step checks whether the secrets are configured; if absent it skips with a notice instead of failing — so the repo carries the automation before the cluster side is provisioned.
  5. One-time prerequisites in the cluster (manual, documented in the workflow header): the wiki-chat BuildConfig/ImageStream for binary builds, the ServiceAccount + rolebinding, and API reachability from GitHub runners (if api.okd.tpl.one is not internet-reachable, fall back to a self-hosted runner on r720 — revisit then).

Consequences

  • After an ingestion PR merges, site, graph, timeline AND chat all update from the same commit — the raw → wiki → UI chain has no manual propagation left.
  • A scoped, revocable SA token lives in GitHub Actions — accepted exposure, mitigated by namespace-only permissions and rotation on trigger (secrets conventions apply).
  • Each knowledge merge triggers an image build (~minutes, cheap at this repo size); the corpus prompt-cache resets per deploy — first chat question after a merge pays the ~$1 cache write (ADR-008 cost shape), acceptable at current merge frequency.
  • Board refresh stays nightly (ADR-009) — deliberate: board content is judgment-based, not a build artifact.