[dcmcand]

Summary

Reviews of #211 and #221 kept enforcing the same design rules by hand. This writes them down in AGENTS.md, so human and agent reviewers can treat a break as a blocker, and adds two CI checks for the parts a script can check.

AGENTS.md covers:

• the Helm chart: one namespace helper, whoever creates a namespace deletes it, optional features leave the default render unchanged, everything works under helm template, setup Jobs named by a hash of their pod;
• services: fail closed, 503 with Retry-After for "can't check right now", gateway sign-in for new UIs (Move the key manager to gateway sign-in, like the usage console #222), shared code stays shared;
• docs and examples: updated in the same PR as any values change, plus an Upgrading entry when an upgrade needs action.

Example render check (make chart-check-examples, runs in the lint-helm job). Renders the chart values of every Argo CD Application under examples/ against the local chart. It also checks that the pinned chart version matches Chart.yaml and that destination.namespace matches the pack's namespace.

Default render diff (make chart-diff-render, new chart-render workflow). Renders the chart with only its required values (scripts/chart-render-values.yaml) and diffs that against the base branch. A diff means every existing install changes on upgrade, so the check fails unless the PR has the new default-render-change label. Either way, the diff appears in the job summary. Version bumps and intended default changes take the label.

Fixes found by the new check. The Argo CD Applications in examples/argocd-application.yaml, installation.md and README.md pinned chart 0.1.2 and didn't render even at 0.1.2:

• all three lacked frontend.keycloak.url;
• README also lacked keyManager.nebariApp.hostname.

They now pin 0.1.4, the current release, with the missing values added. The docs tests that pin the version move to 0.1.4 with them.

Test plan

• make chart-check-examples passes. It fails when destination.namespace is wrong, the pin is stale, or an example can't be parsed.
• make chart-diff-render reports no change against origin/main. It fails with the diff on a Chart.yaml version bump. Against Per-request LLM usage metering, with an optional bundled OpenMeter #211's head it's also clean, so Per-request LLM usage metering, with an optional bundled OpenMeter #211 with OpenMeter off leaves the default render unchanged.
• I ran the workflow's diff step locally with simulated env. Unchanged passes, changed fails, and changed with the label passes.
• The installation.md and README Applications render against the current chart.
• cd docs && npx vitest run: 31 passed.
• actionlint (I couldn't run it locally). Confirm both workflows run green on this PR.

This PR adds the diff script, so chart-render runs here too. It should pass with no diff, since nothing under charts/ changes.

[github-actions]

📄 Docs preview for chore/agents-md-chart-checks:
https://chore-agents-md-chart-checks.llm-serving-pack.pages.dev