Compose this component only with ../cluster-ai. It enables the caller-driven failure-diagnosis capability inside the existing Cluster AI process; it does not add an HTTP route, queue, watcher, timer, PostgreSQL pool, provider, or Model Gateway.

Before production use:

Replace the example provider, model and egress policy revision in copilot-configmap.yaml. Keep config.json canonical, one-line JSON with one trailing newline.
Provision these three Secrets out of band, each containing a canonical keyring.json: ql3-cluster-ai-copilot-invocation-keyring, ql3-cluster-ai-copilot-result-keyring, and ql3-cluster-ai-copilot-output-keyring.
Keep old decryptable keys during rotation. Invocation, Tool result and Copilot output keys are independent authorities and must never reuse material.
Keep Worker ingress and its bounded S3 log-range reader enabled. Startup fails closed if the log capability, canonical config, any keyring, or the shared successful-completion sink is unavailable.

All projections are read-only mode 0440. The component adds no Kubernetes API permission and does not change the default AI-free deployment.