[FEATURE] Epic: Sliced Workloads: contract-pinned decomposition + reconcile in Foreman

[Defilan]

Feature Description

Graduate the validated slicer/integrator into Foreman as Sliced Workloads: slice one hard issue into disjoint-file slices, dispatch each as a normal coder task, union the results, and reconcile the union against a pinned contract so cross-slice interface drift that a green build cannot see is caught.

This tracks the productization of the experiment that was validated end to end on #700 and #1001. In both, three disjoint slices built clean and green, yet the slices had drifted on shared identifiers (a dashboard querying metric names an exporter never emitted; a broken kube-state-metrics config). A deterministic pinned-identifier check caught the drift the build missed; an LLM sweep corroborated it.

v1 scope: detection + prevention. The reconcile step surfaces drift (fails the Workload, drift list in status) for a human to adjudicate. Automated repair is explicitly deferred to a follow-up (see Additional Context).

Problem Statement

As a fleet operator, I want to hand Foreman one multi-part issue and get a decomposed, interface-consistent PR back from local models, so that mid-size sovereign coders can complete work that they fail as a single whole.

Mid-size local models flunk whole issues but nail small slices. Decomposition works, and disjoint-file slices union cleanly, but the union is blind to semantic interface drift between slices. The pinned contract plus a reconcile pass is the fix. Today it only exists as throwaway scaffolding; it is not usable from Foreman.

Proposed Solution

llmkube slice <issue> runs a planner that emits a pinned SlicePlan (contract + shared_identifiers + disjoint slices), renders a Workload, and applies it. The controller runs the existing PipelineStep DAG with two new task kinds.

# rendered by `llmkube slice 1001`
apiVersion: foreman.llmkube.dev/v1alpha1
kind: Workload
spec:
  pipeline:
    - {name: crs-config, kind: issue-fix, ...}       # disjoint slice
    - {name: dashboard, kind: issue-fix, ...}         # disjoint slice
    - {name: alerts, kind: issue-fix, ...}            # disjoint slice
    - {name: integrate, kind: integrate, dependsOn: [crs-config, dashboard, alerts]}
    - {name: reconcile, kind: reconcile, dependsOn: [integrate]}   # pins in payload

• integrate (new kind): union the disjoint slice branches onto the current base, push the integration branch, gate = build; fail on overlap / apply-conflict.
• reconcile (new kind): run the pinned-identifier check + LLM sweep on the union against shared_identifiers.
• Verdict semantics (validated): pinned-missing (authoritative) -> GATE-FAIL -> Workload review-failed; llm-flagged-only (advisory) -> GATE-PASS + status annotation, does not fail.

No new CRD: the pins ride in the reconcile step payload. The reconcile logic ports to Go under pkg/foreman/slicer/.

Task breakdown

• 1. pkg/foreman/slicer/reconcile.go + tests: Go port of pinned_check (whole-token match) + llm_sweep (injected model client, degrade-open) + Reconcile. Pure library.
• 2. pkg/foreman/slicer/integrate.go + tests: disjoint union onto base with overlap / apply-conflict guards.
• 3. API: add integrate + reconcile to AgenticTaskKind + payload fields; make manifests + chart-crds.
• 4. Executor wiring for the two kinds + reconcile verdict mapping.
• 5. Controller rollup: reconcile verdict -> Workload review-failed.
• 6. CLI llmkube slice (planner + SlicePlan + Workload render + --dry-run).
• 7. e2e: fixture-repo sliced Workload (clean -> Succeeds; injected drift -> review-failed).

Alternatives Considered

• Reconcile folded into the integrate step's gate rather than a separate kind: fewer kinds, but muddier verdicts. Chose two kinds.
• A first-class SlicePlan CRD rather than pins-in-payload: more visible/reusable, more surface. Chose no-CRD for v1; promote if a second consumer appears.
• Controller-side dynamic planning (apply a thin issue-ref Workload, controller plans + expands at runtime): fully hands-off, but requires runtime pipeline mutation. Deferred; v1 is CLI-driven.

Additional Context

• Validated in the slicer experiment (live on [FEATURE] AMD GPU observability: rocm-smi exporter + llama.cpp /metrics + Grafana panel #700, [FEATURE] Expose Foreman CRD status (Workload/AgenticTask/FleetNode) as Prometheus metrics via kube-state-metrics Custom Resource State #1001): pinning prevents drift, reconcile catches it deterministically, bounded repair converges.
• Deferred to a follow-up (v2): automated bounded repair (re-dispatch the offending slice). Blocked on Task branches for direct-push repos aren't synced to the current base → re-dispatched work can revert merged commits #1029 (task-branch base-sync for direct-push repos): a re-dispatched slice on a stale branch would revert merged work.
• Deferred (v2): source-authored vs runtime-emitted pin typing. A metric whose name is composed at runtime (KSM metricNamePrefix, a community exporter image) is not a literal string in the slice source, so the deterministic check flags the emitter slice. Both [FEATURE] AMD GPU observability: rocm-smi exporter + llama.cpp /metrics + Grafana panel #700 and [FEATURE] Expose Foreman CRD status (Workload/AgenticTask/FleetNode) as Prometheus metrics via kube-state-metrics Custom Resource State #1001 hit this.
• Related issues: Task branches for direct-push repos aren't synced to the current base → re-dispatched work can revert merged commits #1029 (prerequisite for repair)

Priority

• High - Would significantly improve my workflow

Willingness to Contribute

• Yes, I can submit a PR