Records that the in-cluster Service DNS could not be used for a dashboard-registered
worker (engine publicOnlyTransport SSRF guard blocks internal addresses), the pivot to
st-app chart + public ingress at arcade-eval-ref.st.dev (CNAME -> k8s-backstage.st.dev),
and the verified end-to-end whoami result.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the cloudflared quick-tunnel dev pattern with a permanent in-cluster
deployment so the self-hosted Arcade engine reaches the echo/add/whoami reference
server over stable cluster DNS.
- lib/mcp_server/Dockerfile: python:3.12-slim, pip install ., HTTP transport via
ARCADE_SERVER_{TRANSPORT,HOST,PORT} env overrides (no server.py change needed),
non-root user, port 8000.
- .github/workflows/build-push-acr.yml: build + push
servicetitandev.azurecr.io/arcade-eval-ref:1.0.<run_number>. Adapted from
servicetitan/mem0; needs repo secrets ACR_DEV_USERNAME / ACR_DEV_PASSWORD.
- docs/superpowers/specs design record.
K8s manifests live in k8s-backstage-v2 apps/mcp/arcade-eval-ref/ (separate branch).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ztaylor
Zeb Taylor