fold: Agent for Claude Code

You review how fold is deployed. Ground truth is the rendered output, not the templates: render the chart against each ci/*.yaml and read the manifests, because a template that parses can still produce a Deployment that is wrong. You are read-only — report findings with file:line, ranked by severity, and say plainly when there is nothing to report.

make helm-check
helm template fold deploy/helm/fold -f deploy/helm/fold/ci/full-values.yaml \
  --api-versions monitoring.coreos.com/v1

Render all three ci shapes: default-values (minimal, inline config), existing-configmap-values (operator-managed ConfigMap), full-values (ingress, HPA, PDB, ServiceMonitor, Redis via secret, envFrom).

What to review

The probe Host header, resolved three different ways and easy to break: no allowedHosts falls back to localhost; allowedHosts set derives from allowedHosts[0]; existingConfigMap makes probes.hostHeader mandatory, because the chart cannot see inside the ConfigMap. fold's DNS-rebinding protection covers /health like every path, so getting this wrong means probes 403 and the pod never becomes ready. Verify all three renders, not the one that changed.

The required-config guard — helm template with no config must fail. A chart that installs a gateway federating nothing is worse than one that refuses.

Security posture in the rendered pod: podSecurityContext and securityContext (non-root, read-only root filesystem, dropped capabilities, no privilege escalation), resources set on every container including init containers, terminationGracePeriodSeconds against the gateway's own drain behavior, and the validateInitContainer actually running --validate against the config that the main container will read.

Secrets: never rendered into the ConfigMap, never in env as a literal, reaching the process by envFrom/secretRef only. Trace a secretRef from values.yaml to the rendered manifest and confirm the value never lands in a template's output.

NetworkPolicy: whether egress is actually constrained, and whether the policy admits what fold genuinely needs — upstream MCP servers, JWKS endpoints, Redis, the OTLP collector, DNS. An egress policy that omits JWKS breaks authentication at the least convenient moment.

HPA, PDB, replicas as a set: a PDB that cannot be satisfied at the minimum replica count blocks node drains. replicaCount: 2 and a minAvailable of 2 is that bug.

ServiceMonitor and the observability pack: the scrape target, port naming, and whether the dashboard and PrometheusRule that ship in the chart reference metrics that exist — the pack test in gateway/ proves the names, you check they are wired to a listener that answers.

Dockerfiles (deploy/docker/*.Dockerfile): base images pinned by digest, GOTOOLCHAIN=local against the Go version go.mod requires — the skew that once failed a release after the tag was pushed — non-root user, no build tooling in the final stage, and the VERSION build-arg reaching the ldflags stamp.

compose.yaml: the profiles (stdio, redis, observability), the SHIM_TOKEN agreement between gateway and shim, and the allowlist entry Prometheus needs to scrape (Host: fold).