flowchart TB
  subgraph L0["Merge request & bounded MCP tools"]
    direction LR
    L0N0["GitLab merge request<br/>Engineer commits · Helm / Kustomize / application code"]
    L0N1["Pre-flight copilot<br/>Draft manifests · readiness report · change diff"]
    L0N0 -->|"Webhook / requested review"| L0N1
    L0N2["Schema-restricted MCP server<br/>Typed tools · server-enforced read-scoped identities"]
    L0N1 -->|"Validated tool calls"| L0N2
  end
  subgraph L1["Approved execution boundary"]
    direction LR
    L1N0["Private model endpoint<br/>Self-hosted OpenShift AI / vLLM inside perimeter"]
    L1N1["Read-only cluster inspection<br/>Quotas · SCCs · current topology; no production mutations"]
    L1N2["HashiCorp Vault / External Secrets<br/>External Secrets Operator · controlled runtime access"]
  end
  subgraph L2["Deterministic delivery gates"]
    direction LR
    L2N0["GitLab CI security stage<br/>Trivy / Grype · Syft SBOM · Cosign signing"]
    L2N1["Policy validation<br/>OPA / Kyverno · SCC compatibility · quotas"]
    L2N0 -->|"Build &amp; scan artifacts"| L2N1
    L2N2["Protected human approval<br/>Required reviewers · branch protections · approved merge"]
    L2N1 -->|"Pass configured checks"| L2N2
  end
  subgraph L3["GitOps runtime &amp; evidence"]
    direction LR
    L3N0["Argo CD<br/>ApplicationSets · approved desired state"]
    L3N1["OpenShift production<br/>Admission controls · workload RBAC · configured mTLS"]
    L3N0 -->|"Reconcile after approval"| L3N1
    L3N2["SIEM &amp; evidence store<br/>Redacted events · attestations · retention policy"]
    L3N1 -->|"Runtime events &amp; evidence"| L3N2
  end
  L0N1 -.->|"Copilot attaches the manifest diff and readiness report for human review."| L0N0
  L0N1 -.->|"Model traffic uses an approved private endpoint and processing region."| L1N0
  L0N2 -.->|"Read-only tool identity can inspect state; it cannot deploy to production."| L1N1
  L0N0 -.->|"The merge request starts CI; AI output does not bypass the gates."| L2N0
  L2N2 -.->|"Only the approved merge changes the GitOps desired state."| L3N0
  L1N2 -.->|"ESO retrieves authorized runtime secrets."| L3N1
  L0N2 -.->|"Redacted tool events are collected under the approved audit policy."| L3N2
  L3N0 -.->|"Sync receipts join build attestations in the evidence store."| L3N2
  %% MCP servers enforce strict JSON Schema validation and read-only cluster/OSS credentials. Every state change must pass GitLab CI security stages, OPA/Kyverno admission policy and human CODEOWNERS sign-off before Argo CD sync.
  %% Reference topologies, not a statement of fit for your estate. Protocol versions, network boundaries, roles and service targets are set in the low-level design during the Assessment Sprint.