refactor: relocate remaining bedag/raw helmfile releases into base chart

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
├── chart: ./base → renders base/templates/*.yaml
├── chart: bedag/raw, name: llm-buyer-podmonitor → inline YAML in helmfile
├── chart: bedag/raw, name: erpc-httproute → inline YAML
├── chart: bedag/raw, name: erpc-x402-middleware → inline YAML
├── chart: bedag/raw, name: erpc-metadata → inline YAML
├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
└── chart: bedag/raw, name: obol-frontend-rbac → inline YAML

After

helmfile.yaml
└── chart: ./base → renders base/templates/*.yaml
including the relocated YAML
base/templates/
├── erpc.yaml (new — HTTPRoute, Middleware, ConfigMap)
├── obol-frontend.yaml (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
├── llm.yaml (appended — litellm-x402-buyer PodMonitor)
└── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.