CAPSTONE  ·  DAY 2

Ship the Acme AI Support Platform

Every module snapped together into one deployable product — end-to-end

M1 · M2 M3 · M4 M5 · M6 M7 · M8 Acme AI ships on any OCI runtime

Gourav Shah  ·  School of DevOps & AI  ·  Capstone · Day 2

CAP·01

What you'll assemble — the whole platform

One dispatch centre: a native brain, containerized teams, a sealed supply chain.

Host — native Ollama :11434 shared brain Containers Docs Assistant M5 Support Agent M6 Incident Crew M7 ChromaDB ToolHive Supply chain ModelKit M4 SBOM · sign M8 CI ship M8
CAP·02

How the modules connect

Each rung you built maps to exactly one capability of the shipped platform.

M1 · container-native + host wiring M2 · OpenAI-compatible serving M3 · vLLM CPU serving path M4 · ModelKit — versioned artifact M5 · Docs Assistant — naive RAG M6 · declarative agent + MCP M7 · Incident Crew — multi-agent M8 · SBOM · scan · sign · CI Acme AI Support Platform
CAP·03

Move 1 — Serve the model

One brain, two homes: Ollama native on Mac, or vLLM in a container on CPU / GPU.

Ollama — native Metal · unified memory vLLM — container CPU (SmolLM2) or GPU /v1 OpenAI API Every consumer app · agent · crew
CAP·04

Move 2 — Run the Incident Crew

Four specialists in sequence, sharing one model and two shared services.

Triage Investigate Fix Review ToolHive · MCP ChromaDB · docs one native model serves all four agents
CAP·05

Move 3 — Package as a ModelKit

Weights, system prompt, and quantization config sealed into one OCI artifact.

model weights system prompt quant config ModelKit one OCI artifact kit push Registry GHCR · versioned
CAP·06

Move 4 — Secure the image

Inventory it, scan it, sign it — and sandbox every tool the agents run.

SBOM Scan Sign Verify Syft Trivy · Grype Cosign any consumer fail threshold → rejected Sandboxed tool execution ToolHive isolates every MCP tool call
CAP·07

Move 5 — Ship via CI

Push to main and the pipeline builds, scans, signs, and publishes on its own.

push build scan sign to main image gate cosign GHCR signed failed scan blocks the push — nothing ships
CAP·08

Move 6 — The portability proof

Swap the runtime, re-run platform-check.sh — the output is identical.

Colima Rancher OrbStack Same platform OCI images · Compose Spec host.docker.internal ModelKit · Cosign referrers Identical output
CAP·09

The arc you shipped

Naive RAG → Agentic RAG → Crew — each pattern earning its keep in turn.

Naive RAG Agentic RAG Crew always retrieves routes, then acts decomposes the task simple & predictable ————————→ capable & auditable
CAP·10

YOU SHIPPED IT

You can now ship AI on any runtime

Same architecture, new domain — swap the runbooks, keep the wiring.

serve · run · package · secure · ship Acme AI Any runtime

Now open Capstone · Lab.  ·  Gourav Shah · School of DevOps & AI

CAP·11