[aberkowCollibra]

🎯 What does this PR do?

DEV-228794: moves collibra/chip's single PESTO pack, ai-services/chip-legacy, into this repository as a git-backed pack, following the new layout and rules. It references the shared magneto spec and provision/build scripts from collibra/ai-evals rather than copying them. chip is deprecated, so the pack stays only until chip retires and no ladder of smaller packs is added.

Packs

pack	what it does	$/attempt
chip-legacy	implement → one review/fix round → PR, ledger and green CI → build the branch's chip into a chip-binary image → provision an OAuth DGC whose ai-copilot runs that digest → a fresh validate-ac calls chip's tools through /rest/mcp and posts per-criterion evidence. Fixes nothing it finds unmet	$126

What changed

• .pesto/packs/ai-services/chip-legacy.pack.yaml: ported from chip-legacy@2. One review round in repeat_groups (count 1). The PR now opens after the review round, and a publish-ledger node posts the findings ledger. teardown-env has always_run: true and ALLOW_FAILED_DEPLOYMENTS: "true". There is no inline script:, and all per-run values are <<NAME - explanation>> placeholders.
• Shared files are read from collibra/ai-evals at ref: main: dgc-ai-copilot.magneto.yaml (bound as SPEC_B64), run-dq-step.sh (provision and teardown) and wait-for-ci-image.sh (bound to build-chip).
• Two chip-owned files in .pesto/packs/ai-services/files/:
  • build-chip-binary.sh is the old inline build-chip script, moved to a file.
  • go-tests.sh is the post_script that runs go build ./... and go test -count=1 -p 2 ./....
• .pesto/README.md: the pack table with cost per attempt, the conventions and the files.
• Node prompts carry this repo's build/test commands, the CI checks (build, tag, Snyk), the Conventional Commits subject with the Jira key, the PR template and the review standards (docs/TOOL_CONTRIBUTION_STANDARDS.md, SKILLS.md, the stepdown rule).

Shared-files source

I read the shared files from collibra/ai-evals branch feature/DEV-228794-git-backed-ai-services-packs at be2d7ec, which appeared after about 8 minutes of polling. I copied its layout, manifest conventions and README format, and took the task_env keys from each script's header.

Assumptions

• Two shared scripts are not used. build-chip-service.sh builds ./cmd/chip-service and ensure-chip-binary.sh downloads a released binary; neither builds this branch's chip. So build-chip runs the chip-owned build-chip-binary.sh.
• wait-for-ci-image.sh is bound but idle by default. chip's CI publishes no image, so it is bound to build-chip and used only with CHIP_SOURCE=ci plus a CI_IMAGE_REPO. The default is CHIP_SOURCE=source.
• Some listed shared files are not used. The pack calls chip's tools directly and runs no evals, so it does not take load-maestro-dataset.sh, check-env.sh, run-evals.sh or ensure-chip-binary.sh.
• Stack values. The spec is filled for an OAuth stack (authServiceEnabled: true), with the front door, copilot-service 0.24.1, disabledTools: [list_asset_types], chip in binary mode, Vertex location global and stack name dgc-chip-legacy. The DGC version is now the shared spec's pinned 2026.11.601 instead of ontrack latest gold.
• Review node. chip has no REVIEW.json, so review is a plain fresh-session reviewer writing collibra-review-shaped findings, as chip-legacy@2 did. It does not use the collibra-review tool.
• No fix lap. chip-legacy@2 validated only, and the brief says "no ladder".
• Commit convention. Subjects put the Jira key first (<key> <type>(scope): …), matching the latest merged commits. Older history puts it at the end.
• .pesto/ is in this clone's .git/info/exclude. The files were added with git add -f.

Structural lint (Appendix B)

I ran it with EXPECTED_PACKS='chip-legacy' OWN_REPO='collibra/chip': 34/35 checks passed, 1 failed.

• The failing check is FAIL one shared magneto spec across packs. It counts every file bound to provision-env as a spec, so the run-dq-step.sh script binding shows up as a second spec.
• ai-evals' own packs fail this same check, with the same two paths.
• Clearing it would need an inline script: or the deprecated script_ref, which the rules forbid. I left it and recorded it here.

Nothing was registered with PESTO; registration happens after merge.

✅ Checklist

• My code follows the style guidelines of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation (if needed).
• My commit messages follow the Conventional Commits standard.

[aberkowCollibra]

Review: ai-services/chip-legacy pack (#159)

I compared this against the collibra/ai-evals branch feature/DEV-228794-git-backed-ai-services-packs (tip be2d7ec). It's the only ai-evals branch whose tip has .pesto/packs/ai-services/files/run-dq-step.sh. /tmp/pesto-context/ai-evals wasn't in this pod, so I cloned collibra/ai-evals fresh and selected the branch as the brief describes.

Verdict: the pack should run as wired. One lint FAIL (a false positive in the lint) and two SHOULD HAVE fixes, listed below. No inline scripts, one review round, teardown is correct, and the README and cost table are accurate.

Structural lint (check-packs): 34/35 passed

• FAIL "one shared magneto spec across packs" (F1). The lint counts every file bound to provision-env as a spec, so run-dq-step.sh (bound as destination: script) gets counted alongside the real spec. The pack binds both files exactly as ai-evals' evals-chip-service and ai-evals-implement-review-verifyAC do, and the only spec it reads is the shared dgc-ai-copilot.magneto.yaml. The fix belongs in the lint, not the pack. I've listed it as a finding because every FAIL counts as one.

Would it run? Wiring, artifacts and inputs

• Inputs come from depends_on:
  • remediate-review and publish-ledger read .pesto/inputs/review_findings/review, and both depend on review.
  • validate-ac reads .pesto/inputs/result/build-chip and .pesto/inputs/result/provision-env, and depends on both.
  • provision-env's SPEC_VARS_FROM: build-chip names a direct dependency, as run-dq-step.sh requires.
• Artifact contracts:
  • build-chip-binary.sh writes result and test_report, which are build-chip's required artifacts.
  • Its result has top-level CHIP_IMAGE, which fills __PESTO_VAR_CHIP_IMAGE__, plus image, digest, source_sha and version. Those are exactly the recorded fields validate-ac's identity gate reads (source_sha == HEAD, pod imageID == digest).
• Spec placeholders: the shared spec has six. STACK, CHIP_MODE, VERTEX_LOCATION, DGC_AUTH and COPILOT are answered by task_env, and CHIP_IMAGE by build-chip's result. None is left unanswered.
• Node settings match ai-evals: resume_session chain, ci_watch, pr_draft: false, repeat_groups count 1, and teardown-env with always_run: true, ALLOW_FAILED_DEPLOYMENTS: "true", REQUIRE_SESSION: "false".
• Build script details:
  • MAGNETO_SESSION_TAG image naming follows build-chip-service.sh.
  • The ldflags target github.com/collibra/chip/pkg/chip.Version matches .goreleaser.yaml.
  • The crane append/mutate sequence matches ensure-chip-binary.sh.
• Gap (F3): unlike ai-evals' validate-ac, this one isn't always_run. A failed build or provision therefore leaves the PR with no verdict at all, even though the prompt describes an ENVIRONMENT-fault outcome.

Does each prompt carry this repository's facts?

• CI facts match .github/workflows/build.yaml: Go 1.26.10, go mod download, go test -race -v ./..., go build -v ./..., golangci-lint v2.15.0.
• Files the prompts cite all exist: cmd/chip, docs/TOOL_CONTRIBUTION_STANDARDS.md, SKILLS.md, pkg/skills/files/collibra/, and AGENTS.md's stepdown rule.
• PR template: the open-pr prompt names .github/pull_request_template.md's real headings (## 🎯 What does this PR do?, ## ✅ Checklist).
• Commit-subject convention is wrong (F2): the prompts give it as key-first and cite .githooks/commit-message-check and CONTRIBUTING.md. Both require type-first (the hook's regex is anchored on the type), and most of main's history is type-first with the key at the end (d2e67f5 feat(dq): … DEV-219055).

Shared files: referenced, not copied

• Referenced from collibra/ai-evals ref: main: dgc-ai-copilot.magneto.yaml, wait-for-ci-image.sh and run-dq-step.sh. Bindings and keys match ai-evals (SPEC_B64 base64, WAIT_FOR_CI_IMAGE_SH, script).
• Not used, correctly: build-chip-service.sh builds chip-service, and ensure-chip-binary.sh only wraps a published chip release. Neither can build this branch's chip. load-maestro-dataset.sh, check-env.sh and run-evals.sh serve eval runs this pack doesn't make.
• Chip-owned files are reasonable: the two local scripts (build-chip-binary.sh, go-tests.sh) are chip-specific, not copies of shared files, and the commit message records the assumption behind them.
• Small item for the ai-evals side, not this PR: ai-evals' README lists ensure-chip-binary.sh as read by "chip". No chip pack reads it, so that row should drop "chip".

Notes, not findings

• go test ./... in pods: go-tests.sh runs go test -count=1 -p 2 ./... (61 packages, no -race) as the post_script of every node that commits. This deployment's pod guidance warns against unscoped go test ./.... -p 2 bounds it, and ai-evals runs its whole pytest suite the same way. I did not run it here to measure memory, so whether it fits the pod is not verified.
• Rules checked:
  • No ticket key, person or email under .pesto/packs/.
  • Description has Use when: and Cannot settle:.
  • Per-run values are <<NAME - …>> placeholders.
  • README has the one table, and its $126 equals the summed agent budgets (30+20+20+8+8+10+30).

[betty-pr-factory-app]

This pull request was created by the BETTY PR Factory App GitHub App on behalf of aberkowCollibra, through PESTO engineer git delegation.

PESTO run: dev-228794-chip-packs

The commits and the pull request are authored by the engineer's own GitHub account; the App's involvement is recorded by this comment, by the betty-pr-factory-app label and by the Co-authored-by trailer on the commit.

[aberkowCollibra]

Closing: collibra/chip is out of scope for DEV-228794 — the server-side ai-services/chip-legacy pack stays as it is.