fix(container): update llmkube group

[smurf-bot]

This PR contains the following updates:

Package	Update	Change
ghcr.io/defilantech/charts/foreman	patch	0.9.6 → 0.9.7
ghcr.io/defilantech/charts/llmkube	patch	0.9.6 → 0.9.7
ghcr.io/misospace/llmkube-coder (source)	digest	0719943 → 1f1594f
ghcr.io/misospace/llmkube-coder-go (source)	digest	58ab5f5 → 5cbd863
ghcr.io/misospace/llmkube-coder-node (source)	digest	2b21e74 → 623b543
ghcr.io/misospace/llmkube-coder-python (source)	digest	fd70996 → 427ce93

---

Release Notes

defilantech/LLMKube (ghcr.io/defilantech/charts/foreman)

v0.9.7

Compare Source

Features

• cli: envtest-verify the slicer's integrated branch (Fixes #​1137) (#​1141) (a7622c2)
• foreman: guide coders to verify volatile external facts via MCP research tools (#​1134) (390c945)
• foreman: opt-in coder escalation on capability-wall failures (#​1108) (#​1128) (68e2211)
• metal-agent: expose oMLX paged SSD cache configuration (#​278) (#​1129) (095e4a2)
• router: in-memory rolling-window budget accounting engine (#​434) (#​1130) (c6ba850)
• scripts: add foreman-finalize.sh post-GO branch finalizer (#​1126) (8d17e25)
• Support pinned multi-file Hugging Face models (#​1110) (#​1138) (e2d3441)

Bug Fixes

• foreman: abort orphaned agent loop when its AgenticTask is deleted (Fixes #​1136) (#​1140) (471a00c)
• scripts: foreman-finalize handles Foreman CRDs, clean-tree, and title override (#​1131) (db3eeaf)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[smurf-bot]

konflate — summary

Note

✅ No rendered changes.

View the full rendered diff →

_{konflate · rendered 4edd391 · advisory, not a gate}

[its-saffron]

AI Automated Review

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR Review — fix(container): update llmkube group (0.9.6 → 0.9.7)

Recommendation: Approve.

This is a standard patch-level update for the defilantech/LLMKube charts (foreman and llmkube, both 0.9.6 → 0.9.7) and their associated container images. The upstream release contains seven features, two bug fixes, and CRD field additions that are all additive and backward-compatible. The configured HelmRelease values are unaffected.

---

Changed Files (7 files, ±14 lines)

File	Change
ocirepository.yaml (foreman)	chart tag 0.9.6 → 0.9.7
ocirepository.yaml (llmkube)	chart tag 0.9.6 → 0.9.7
helmrelease.yaml (foreman)	coder image digest refresh
helmrelease-llmkube.yaml	coder-go image digest refresh
agents/coder-go.yaml	image digest refresh
agents/coder-node.yaml	image digest refresh
agents/coder-python.yaml	image digest refresh

---

Required Checks — Explicit Findings

1. Validate manifest against target cluster version ✓

• Konflate rendered-diff passed cleanly (exit code 0). All 13 resources (2 CRDs, 3 Deployments, 3 Agents, 2 HelmReleases, 2 OCIRepositories, 1 Kustomization) rendered successfully with no errors.
• No API version changes introduced. All apiVersion fields remain unchanged.
• The new EscalateOnFailure field in the workloads.foreman.llmkube.dev CRD is a pure additive field (optional *bool); it does not break existing resources.
• Image digests are from the expected registry (GHCR.io/misospace and GHCR.io/defilantech), which aligns with repository allowlist conventions.

2. Check for resource quota / limit changes ✓

• No resource limits or requests were added, removed, or modified. The Agent YAMLs retain their existing resource blocks unchanged.
• No ResourceQuota or LimitRange resources are present in the diff.
• The upgrade-impact evidence explicitly confirms: "none intersect the values this repo sets — no configured value was renamed, removed, or re-defaulted."

---

Standards Compliance

• HelmRelease pattern: Uses spec.chartRef with a named OCIRepository, correct pattern per AGENTS.md. No inline spec.chart.
• OCIRepository: Pinned by tag (0.9.7), not digest — consistent with the OCI artifact exemption in AGENTS.md.
• spec.interval: Set to 1h on both HelmReleases.
• metadata.namespace: Absent on HelmReleases — intentional per the repository namespace convention.
• Secrets: No new secrets introduced; existing foreman-agent secret references are unchanged.
• No breaking changes detected: All upstream changes are additive features and bug fixes. The CRD additions (EscalateOnFailure, PagedSSDCacheDir, HotCacheMaxSize, pagedSSDCacheMaxSize) are purely optional fields that default to nil.

---

Evidence Provider Findings

Konflate rendered-diff (ok, severity: info):

• 13 resources changed, 0 added, 0 removed.
• workloads.foreman.llmkube.dev CRD gains the EscalateOnFailure field and updated escalationCoderAgentRef description.
• inferenceservices.inference.llmkube.dev CRD gains hotCacheMaxSize, pagedSSDCacheDir, and pagedSSDCacheMaxSize fields.
• Controller and operator Deployment images updated: llmkube-controller:0.9.7, llmkube-foreman-operator:0.9.7.
• All coder image digests refreshed.
• No data-loss, immutable-field, RBAC, or suspend/prune cautions.

Upgrade-impact (ok, severity: info):

• foreman chart: no configured values changed upstream.
• llmkube chart: no configured values changed upstream.
• Release notes verified from GitHub compare (10 commits between v0.9.6 and v0.9.7).

---

Unknowns / Needs Verification

OCI revision labels missing on coder images (non-blocking caveat):

All five coder container images (llmkube-coder, llmkube-coder-go, llmkube-coder-node, llmkube-coder-python) lack OCI revision labels (org.opencontainers.image.revision, org.opencontainers.image.source, org.opencontainers.image.created). The digest-provenance analysis reports "revision changed: unknown — missing OCI revision labels." This is a pre-existing gap in the upstream container images, not introduced by this PR. The tag is stable (0.9.6), and the repository name and tag are consistent across the digest update, so this is a non-blocking caveat for this change.