Track ranked review of stable-stack follow-up pull requests

[mikeyrcamp]

Why

The self-managed stable-stack follow-up produced several independently
reviewable pull requests across profile export, compute registration, routing,
API documentation, and BDD coverage. This issue provides one ranked review
queue so dependencies, readiness, and remaining gates are visible without
replacing the implementation issues linked from each pull request.

The order prioritizes direct installation and registration correctness, then
public API behavior, routing, and automated coverage.

Ranked review queue

1. fix(nvcf-cli): derive profile endpoints from stack domain #1234 - Derive exported control-plane endpoints from the selected stack
   domain while preserving local behavior and explicit overrides. Related:
   fix(cli): derive exported control-plane profile endpoints from selected environment #1231.
2. fix(nvcf-compute-plane): use generated profile for registration #1236 - Restore generated-profile compute registration, default
   configuration, kube-context propagation, and LLM-disabled behavior. Related:
   restore self-hosted compute CLI default config generation #1147.
3. fix(cli): tolerate kubectl attach fallback diagnostics #1233 - Keep kubectl attach-fallback diagnostics from corrupting a valid
   exported profile while preserving genuine errors. Related: fix(cli): tolerate kubectl attach fallback diagnostics during profile export #1228.
4. docs(llm): clarify body format contract #1238 - Clarify and test the accepted LLM body formats, default behavior,
   OpenAI-compatible payloads, and echo-versus-token-generation distinction.
   Related: docs(llm): clarify the function body-format contract for OpenAI-compatible routes #1227.
5. fix(self-managed): validate external LLM routing #1204 - Validate and document external and split-cluster LLM routing,
   provider exposure, DNS/SNI/trust responsibilities, and partial-config guards.
6. test(bdd): guard multi-cluster NVCF gRPC mode #1208 - Pin the multi-cluster BDD fixture to its temporary plaintext
   gRPC mode without representing it as the permanent TLS solution.
7. fix(local-cluster): make destroy-all cleanup POSIX-portable #1263 - Make the documented destroy-all-ncp-local cleanup target
   POSIX-portable under Dash while preserving selective cluster deletion and
   command-failure propagation. Related: fix(local-cluster): make destroy-all cleanup portable across POSIX shells #1261.
8. fix(self-managed): restore Helmfile profile registration #1262 - Restore the canonical exported-profile registration handoff,
   config-scoped CLI state, secure transport trust, and transient OpenBao
   certificate-read handling. Related: Helmfile live BDDs fail because register-cluster requires an unexported profile #1254; prerequisite for test(bdd): single-cluster PKI feature with a secured LLM invoke #1075's merged
   follow-on fix(bdd): use exported profile trust for PKI #1266.
9. test(bdd): single-cluster PKI feature with a secured LLM invoke #1075 - Add single-cluster PKI/LLM BDD coverage for trust propagation,
   worker registration, reverse QUIC, secured invocation, and cleanup. Related:
   test(bdd): single-cluster PKI feature with a secured LLM invoke #1076.
10. test(bdd): cover multi-cluster LLM routing #1235 - Add bounded multi-cluster fixed-response routing,
    authentication, and cleanup coverage without claiming secure gRPC or token
    performance. Related: BDD suites: single and multi cluster with PKI and LLM function coverage #1019.
11. docs(cli): document stack paths for source builds #1203 - Document source-built CLI stack paths and the distinct profile,
    registration, and installation workflows. Related: docs(cli): document stack paths for source-built self-hosted CLI #1202.

Current readiness

• All eleven required pull requests are merged to main: fix(nvcf-cli): derive profile endpoints from stack domain #1234, fix(nvcf-compute-plane): use generated profile for registration #1236,
  fix(cli): tolerate kubectl attach fallback diagnostics #1233, docs(llm): clarify body format contract #1238, fix(self-managed): validate external LLM routing #1204, test(bdd): guard multi-cluster NVCF gRPC mode #1208, fix(local-cluster): make destroy-all cleanup POSIX-portable #1263, fix(self-managed): restore Helmfile profile registration #1262, test(bdd): single-cluster PKI feature with a secured LLM invoke #1075, test(bdd): cover multi-cluster LLM routing #1235, and docs(cli): document stack paths for source builds #1203.
• fix(local-cluster): make destroy-all cleanup POSIX-portable #1263 exact head 4c100cf5 merged as 33a879e4 after approval and all
  focused Dash, broader Make, ShellCheck, root Bazel, and CodeRabbit checks
  passed.
• fix(self-managed): restore Helmfile profile registration #1262 exact head ef67bfbc merged as 12a56476 after approval and all
  CodeRabbit, Go, Helm, docs, root Bazel, and release-helper checks passed.
• fix(bdd): use exported profile trust for PKI #1266 is incorporated into test(bdd): single-cluster PKI feature with a secured LLM invoke #1075's squashed source tree. It removes the
  parallel OpenBao rewrite and makes the BDD consume and validate canonical
  exported-profile trust from merged fix(self-managed): restore Helmfile profile registration #1262.
• test(bdd): single-cluster PKI feature with a secured LLM invoke #1075 exact head dcb58f71 merged as fc10e13b after approval. Its source
  tree passed focused OpenBao, LLM-PKI wiring/render,
  registration, full short BDD, full CLI test/build/vet, BDD vet/race, pinned
  compute render/golden, Dash cleanup, Bash, ShellCheck, and diff checks.
  Every automatic GitHub check on this exact head completed successfully or
  was correctly skipped; no optional or manual job was triggered. No review
  thread was unresolved.
• A fresh validation-only integration of the same source content plus the
  required standalone-path parameterization used released API 1.25.1,
  Cassandra 0.20.1/migrations 0.16.0, and ESS 1.7.2/app 0.4.13. The bounded
  BDD passed 4/4 scenarios and 69/69 steps in 14m34s. It verified the real
  issuer/certificate, tokenless profile trust, compute registration, secure
  NVCA settings, healthy backend, function creation/deployment, authenticated
  routed fixed-response invocation, expected 401, and deployment deletion. No
  live resource was patched or Pod manually deleted.
• test(bdd): single-cluster PKI feature with a secured LLM invoke #1075 is merged and its fresh E2E acceptance passes. Publication of the
  validated compatible standalone stack input through a supported writable
  release path remains separate delivery follow-up.

Completion

• Keep implementation discussion and acceptance evidence on the owning pull
  request or related issue.
• Check an item here only after the pull request is approved and merged or
  closed with a documented disposition. These checkboxes are manual; GitHub
  does not automatically synchronize them with pull-request state.

[mikeyrcamp]

Approved and queued in the 2026-08-26 live reconciliation:

• fix(nvcf-cli): derive profile endpoints from stack domain #1234 — exact approved head 77e40c84; already includes current main; all six required checks pass; merge queue position 6 when observed.
• fix(nvcf-compute-plane): use generated profile for registration #1236 — exact approved remote head 32618f75; all six required head checks pass; merge queue position 1, currently awaiting merge-group checks.

For #1236, a rebase onto current main was prepared and verified before the push attempt. git range-diff showed all three commits were patch-identical, make -C deploy/stacks/nvcf-compute-plane test-local passed with the pinned Helm/Helmfile toolchain, and ./tools/ci/check-docs exited 0. The force-with-lease push was rejected because the approver had already queued the PR. It was not dequeued or changed.

No source PR was manually merged during this reconciliation.

[mikeyrcamp]

All eleven required pull requests in this coordination queue are now merged, including #1075 as fc10e13 after the fresh 4/4-scenario, 69/69-step acceptance pass. The checklist is manually synchronized. Publication of the validated compatible standalone-stack input remains separate release-delivery follow-up rather than an open source PR in this queue.