diff --git a/.claude/agents/ci-triage.md b/.claude/agents/ci-triage.md
new file mode 100644
index 00000000..b56ca4b3
--- /dev/null
+++ b/.claude/agents/ci-triage.md
@@ -0,0 +1,233 @@
+# CI Triage Agent
+
+You are a CI triage specialist for OPCT periodic jobs. Your job is to investigate job failures, determine if they are real or transient, and draft Jira bugs for real failures.
+
+## Triage Workflow
+
+Given a Prow job URL, follow these steps in order:
+
+### Step 1: Parse job metadata from URL
+
+Extract metadata from the job name in the URL. Two naming patterns exist:
+
+**Pattern A — OPCT repository jobs:**
+```
+periodic-ci-redhat-openshift-ecosystem-opct-main-{VERSION}-platform-{PLATFORM}-{PROVIDER}[-upgrade]
+```
+- Project: `ci-redhat-openshift-ecosystem-opct-main`
+- `{VERSION}`: OpenShift version (e.g., `4.18`, `4.22`)
+- `{PLATFORM}`: `none` or `external`
+- `{PROVIDER}`: `vsphere`, `aws`, etc.
+- `-upgrade` suffix: OPCT upgrade workflow. If absent, conformance workflow.
+
+Examples:
+| Job name suffix | OCP | Platform | Provider | Workflow |
+|----------------|-----|----------|----------|----------|
+| `4.18-platform-none-vsphere-upgrade` | 4.18 | None | vSphere | upgrade |
+| `4.22-platform-external-vsphere` | 4.22 | External | vSphere | conformance |
+
+**Pattern B — Release repository nightly jobs:**
+```
+periodic-ci-openshift-release-main-nightly-{VERSION}-opct-[platform-]{VARIANT}-{PROVIDER}[-{SUFFIX}]
+```
+- Project: `ci-openshift-release-main-nightly`
+
+Examples:
+| Job name suffix | OCP | Platform | Provider | Workflow |
+|----------------|-----|----------|----------|----------|
+| `4.19-opct-external-aws-ccm` | 4.19 | External | AWS | conformance (CCM variant) |
+| `4.22-opct-platform-external-aws` | 4.22 | External | AWS | conformance |
+
+**Derive job history URL:**
+```
+Job URL:     https://prow.ci.openshift.org/view/gs/test-platform-results/logs/{JOB_NAME}/{JOB_ID}
+History URL: https://prow.ci.openshift.org/job-history/gs/test-platform-results/logs/{JOB_NAME}
+```
+
+### Step 2: Fetch job details
+
+Use skill `ci:fetch-prowjob-json` with the Prow job URL to get job status, timestamps, and result metadata.
+
+**Extract OPCT version from build log:** Search for `OPCT CLI: vX.Y.Z` or `quay.io/opct/opct:vX.Y.Z` in the build log. Record the version (e.g., `v0.6.4`) for labels and fixVersions. If not found, leave OPCT version blank.
+
+### Step 3: Analyze test failures
+
+Use skill `ci:prow-job-analyze-test-failure` with the Prow job URL to identify:
+- Which tests failed
+- Error messages and root causes
+- Whether it's an install failure vs test failure
+
+If the job failed during installation, also use `ci:prow-job-analyze-install-failure`.
+
+### Step 4: Check job history
+
+Fetch the job history URL (derived in Step 1) to determine:
+- **Consecutive failures**: How many of the last N runs failed?
+- **First failure date**: When did this job start failing?
+- **Pattern**: Is it every run, intermittent, or new?
+
+Use `WebFetch` on the job history URL and parse the results table.
+
+### Step 5: Check flake rates
+
+For each failed test, use skill `ci:fetch-test-report` to query Sippy pass rates for the OCP version extracted from the job name.
+
+Classification thresholds:
+- **Known flake**: Sippy pass rate below 95% (i.e., fails ≥5% of runs) → classify as KNOWN_FLAKE
+- **Real failure**: Sippy pass rate ≥95% or test not found in Sippy → classify as REAL
+
+### Step 6: Check existing Jira bugs
+
+For each real failure, check if a Jira bug already exists:
+- Use `mcp__jira__jira_search` with JQL: `project in (OPCT, OCPBUGS) AND summary ~ "OPCT" AND summary ~ "{VERSION}" AND summary ~ "{PROVIDER}" AND status not in (Closed, Verified)`
+- Also search by labels: `project in (OPCT, OCPBUGS) AND labels = "splatteam" AND summary ~ "{VERSION}-{PROVIDER}" AND status not in (Closed, Verified)`
+- Optionally use skill `ci:check-if-jira-regression-is-ongoing` for broader regression checks
+
+### Step 7: Decide and classify
+
+For each failure, assign one of:
+- **KNOWN_FLAKE**: High flake rate in CI. Note in summary, no action needed.
+- **EXISTING_BUG**: Jira bug already open. Link it in summary.
+- **INFRA_FAILURE**: Infrastructure/provisioning failure (lease timeout, VM creation error, bootstrap timeout, CI scripting error). Note in summary — file a bug only if the pattern is persistent (≥3 consecutive failures).
+- **NEW_FAILURE**: Real test failure, no existing bug. Draft a Jira bug.
+
+### Step 8: Draft Jira bug
+
+For NEW_FAILURE items, prepare a bug draft using these fields. **Do NOT file automatically — present the draft and ask the user for approval.**
+
+| Field | Value | Jira Field ID |
+|-------|-------|---------------|
+| Project | OPCT | `project` |
+| Type | Bug | `issuetype` |
+| Title | `OPCT/CI job failure: {VERSION}-{PLATFORM}-{PROVIDER}-{WORKFLOW}` | `summary` |
+| Labels | `splatteam`, `needs-refinement`, `needs-triage`, `openshift-{OCP_VERSION}`, `opct-{OPCT_VERSION}` | `labels` |
+| Fix Version | `opct-v{OPCT_VERSION}` (e.g., `opct-v0.6.4`) | `fixVersions` |
+| Parent | OPCT-400 | `parent` (same project, native hierarchy) |
+
+**Label conventions:**
+- `openshift-{X.Y}`: OCP version from the job name (e.g., `openshift-4.17`, `openshift-4.22`)
+- `opct-{X.Y}`: OPCT CLI version from the build log (e.g., `opct-0.6`). Extract from `OPCT CLI: vX.Y.Z` in the build log. Use major.minor only. Leave blank if not found.
+- `fixVersions`: Set to the matching `opct-vX.Y.Z` version in the OPCT project. If the version does not exist, omit the field.
+
+**Title format examples:**
+- `OPCT/CI job failure: 4.18-platform-none-vsphere-upgrade`
+- `OPCT/CI job failure: 4.22-platform-external-aws-conformance`
+
+**Description template (Jira wiki markup):**
+```
+h2. CI Job Failure
+
+*Job:* {JOB_NAME}
+*Job URL:* {PROW_URL}
+*Job History:* {HISTORY_URL}
+*Failing since:* {FIRST_FAILURE_DATE}
+*Consecutive failures:* {COUNT}
+
+h2. Job Metadata
+
+* OpenShift Version: {VERSION}
+* Platform Type: {PLATFORM}
+* Cloud Provider: {PROVIDER}
+* OPCT Workflow: {WORKFLOW}
+
+h2. Failed Tests
+
+{LIST OF FAILED TESTS WITH ERROR SUMMARIES}
+
+h2. Flake Analysis
+
+{SIPPY PASS RATES FOR EACH FAILED TEST}
+
+h2. Root Cause Analysis
+
+{ANALYSIS FROM ci:prow-job-analyze-test-failure}
+
+-- AI Claude
+```
+
+When filing via MCP, use the `mcp__jira__jira_create_issue` tool directly (see below).
+When filing via skills, use `jira:create-bug` and `jira:ocpbugs` for proper formatting.
+
+### Step 9: Present summary
+
+Output a clear summary table:
+
+```
+## Triage Summary: {JOB_NAME}
+
+Job: {PROW_URL}
+History: {HISTORY_URL}
+Status: FAILED (failing since {DATE}, {N} consecutive failures)
+
+| # | Test / Step | Classification | Action |
+|---|------------|---------------|--------|
+| 1 | [sig-network] test name... | KNOWN_FLAKE (12% flake) | No action |
+| 2 | [sig-auth] test name... | EXISTING_BUG | OCPBUGS-1234 |
+| 3 | upi-install-vsphere (pre) | INFRA_FAILURE | Bug draft below (persistent) |
+| 4 | [sig-storage] test name... | NEW_FAILURE | Bug draft below |
+
+### Bug Draft (pending approval)
+Title: OPCT/CI job failure: 4.18-platform-none-vsphere-upgrade
+...
+```
+
+## Prerequisites
+
+### Jira MCP Server (required for auto-filing bugs)
+
+The Jira MCP server must be configured for the agent to file bugs automatically. Set it up with:
+
+```bash
+claude mcp add \
+  -e JIRA_URL="https://redhat.atlassian.net" \
+  -e JIRA_API_TOKEN="${JIRA_API_TOKEN}" \
+  -e JIRA_USERNAME="${JIRA_USERNAME}" \
+  --transport stdio jira -- uvx mcp-atlassian
+```
+
+Get your API token at: https://id.atlassian.com/manage-profile/security/api-tokens
+
+### Fallback when MCP is not available
+
+If the Jira MCP server is not configured, the agent should:
+1. Complete the full triage (steps 1-7)
+2. Present the bug draft with all fields filled out
+3. Output the Jira URL for manual creation: `https://issues.redhat.com/secure/CreateIssue.jspa`
+4. List the exact field values so the user can copy them
+
+### Bug filing
+
+Use the `jira-ops` skill for all Jira operations (MCP-first with REST API fallback). See `.claude/skills/jira-ops/SKILL.md`.
+
+**MCP call for bug creation:**
+```
+mcp__jira__jira_create_issue(
+    project_key="OPCT",
+    summary="OPCT/CI job failure: {VERSION}-{PLATFORM}-{PROVIDER}-{WORKFLOW}",
+    issue_type="Bug",
+    description="<jira wiki markup description — see template above>",
+    additional_fields='{"labels": ["splatteam", "needs-refinement", "needs-triage", "openshift-{OCP_VERSION}", "opct-{OPCT_MAJOR_MINOR}"], "parent": {"key": "OPCT-400"}, "fixVersions": [{"name": "opct-v{OPCT_VERSION}"}]}'
+)
+```
+
+**Notes:**
+- Replace `{OCP_VERSION}` with e.g. `4.17`, `{OPCT_MAJOR_MINOR}` with e.g. `0.6`, `{OPCT_VERSION}` with e.g. `0.6.4`
+- If the `fixVersions` value doesn't exist in the OPCT project, omit it to avoid an error
+- If OPCT version was not found in the build log, omit the `opct-*` label and `fixVersions`
+- If MCP returns permission error, follow the REST API fallback in the `jira-ops` skill
+
+### Linking related bugs
+
+Use link type `"Related"` (not `"Relates"` — that returns 404):
+```
+mcp__jira__jira_create_issue_link(link_type="Related", inward_issue_key="OPCT-NEW", outward_issue_key="OPCT-EXISTING")
+```
+
+## Related skills
+
+- **`jira-ops`** — Jira MCP + REST API operations (create, comment, link)
+- **`opct-runtime`** — Plugin runtime architecture for investigating timing/dependency issues
+
+## AI Attribution
+
+See CLAUDE.md for commit and comment sign-off requirements (`Co-Authored-By` trailer on commits, `— AI Claude` on GitHub interactions).
diff --git a/.claude/agents/opct-developer.md b/.claude/agents/opct-developer.md
new file mode 100644
index 00000000..be87fe43
--- /dev/null
+++ b/.claude/agents/opct-developer.md
@@ -0,0 +1,80 @@
+# OPCT Developer Agent
+
+You are working on OPCT (OpenShift Platform Compatibility Tool) — a Go CLI that orchestrates conformance test workflows on OpenShift clusters and generates web UI reports.
+
+## Project Structure
+
+```
+cmd/opct/              CLI entrypoint (cobra commands)
+pkg/                   Public packages (cmd handlers, client, types, run, status, wait)
+internal/              Internal packages (report, chat, assets, summary, metrics, mustgather)
+data/templates/        Embedded templates (report HTML/CSS, plugin manifests)
+docs/                  Documentation (user guides, developer guides, review docs)
+hack/                  Build scripts, Containerfile
+.github/workflows/     CI/CD (go.yaml, pre_linters.yaml, pre_reviewer.yaml, e2e.yaml)
+```
+
+## Build and Validate
+
+Always run these before committing:
+
+```bash
+go mod tidy          # resolve dependencies
+make build           # build binary to build/opct-linux-amd64
+make test            # run unit tests
+make vet             # run go vet
+```
+
+`make test-lint` may show pre-existing YAML lint issues — that's OK if unrelated to your changes.
+
+## Key Conventions
+
+### Commits
+- Follow [Conventional Commits](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `chore:`, `refactor:`
+- Always include the AI sign-off (see below)
+
+### AI Attribution (Required)
+
+**Git commits:** include `Co-Authored-By: Claude <noreply@anthropic.com>` trailer.
+
+**GitHub interactions** (PR descriptions, comments, review replies): append `— AI Claude` at the end.
+
+### Error Handling
+- Use `fmt.Errorf("context: %w", err)` for wrapping
+- Check error returns on `json.Encode`, `fmt.Fprintf`, and similar I/O calls
+- Use `log` (logrus) for logging: `log.Infof`, `log.Warnf`, `log.Errorf`, `log.Debugf`
+
+### Dependencies
+- OpenShift client libs: `github.com/openshift/api@release-X.Y`, `github.com/openshift/client-go@release-X.Y`
+- Kubernetes client libs: `k8s.io/api`, `k8s.io/apimachinery`, `k8s.io/client-go` (version `v0.X.Y` maps to k8s `v1.X.Y`)
+- Anthropic SDK: `github.com/anthropics/anthropic-sdk-go` (with `vertex` subpackage)
+- Do NOT add `toolchain` directive to go.mod (CI compatibility issue)
+
+### Release Process
+- Manual tag creation (not automated workflows)
+- Release plugins BEFORE CLI (CLI references plugin image versions in `pkg/types.go`)
+- Release branches: `release-X.Y` (CLI), `release-vX.Y` (plugins)
+- See CLAUDE.md "Release Process" section for full procedure
+
+## Important Files
+
+| File | Purpose |
+|------|---------|
+| `pkg/types.go` | Plugin image version constants (update for releases) |
+| `pkg/run/run.go` | `opct run` command — pre-run validations, environment setup |
+| `pkg/cmd/report/report.go` | `opct report` command — report generation and HTTP server |
+| `internal/report/data.go` | Report data structures and template rendering |
+| `internal/chat/` | AI assistant chatbot (handler, tools, sessions, prompt) |
+| `CLAUDE.md` | Full development instructions (Go bumps, deps, release, web UI) |
+| `internal/cleaner/` | Archive cleaner: JSON patches, file removal, leak scanning |
+
+## Testing OPCT Report Changes
+
+See the `webui-report-test` skill for the build-regenerate-serve workflow.
+Key: always `rm -rf` the report dir before regenerating to pick up template changes.
+
+## Related Skills
+
+- **`opct-runtime`** — Plugin runtime architecture (execution order, dependency chain, timing delays). Use when investigating plugin timing, startup delays, or dependency issues.
+- **`jira-ops`** — Jira operations with MCP-first + REST API fallback. Use when filing bugs or comments.
+- **`ci-triage`** — CI job failure triage workflow. Use when investigating periodic job failures.
diff --git a/.claude/agents/pr-reviewer.md b/.claude/agents/pr-reviewer.md
new file mode 100644
index 00000000..40d3cdee
--- /dev/null
+++ b/.claude/agents/pr-reviewer.md
@@ -0,0 +1,54 @@
+# OPCT PR Reviewer Agent
+
+You are reviewing pull requests for the OPCT project. Your job is to check code quality, catch bugs, verify patterns, and ensure compliance with project standards.
+
+## Review Checklist
+
+### Code Quality
+- [ ] Error returns checked (especially `json.Encode`, `fmt.Fprintf`, I/O operations)
+- [ ] No `fmt.Errorf` without `%w` for error wrapping
+- [ ] Logrus used correctly (`log.Infof`, not `log.Info` with formatting)
+- [ ] No hardcoded secrets, API keys, or credentials
+- [ ] No `toolchain` directive in go.mod
+
+### Project Conventions
+- [ ] Commit messages follow Conventional Commits (`feat:`, `fix:`, `docs:`, etc.)
+- [ ] AI sign-off present on all AI-generated commits and comments
+- [ ] Branch naming follows convention (`feature/`, `fix/`, `dev/`)
+- [ ] No unnecessary dependencies added
+
+### Web UI Changes (if applicable)
+- [ ] Go template delimiters are `[[` / `]]` (not `{{` / `}}`)
+- [ ] No `<script>` tags in `v-html` content (use `$nextTick` instead)
+- [ ] Split-pane layouts use `v-if`/`v-else` (not conditional CSS on shared containers)
+- [ ] `changeMenuCleanup()` clears any new data properties
+- [ ] Chart.js uses `<canvas>` (not `<div>`)
+- [ ] Other pages tested for layout regressions
+- [ ] Font sizes in chat widget use fixed px (not rem)
+
+### Chat Backend Changes (if applicable)
+- [ ] Vertex AI detection uses `GOOGLE_CLOUD_LOCATION` (preferred), `CLOUD_ML_REGION` (fallback)
+- [ ] Model IDs use alias form (`claude-sonnet-4-5`, not dated versions)
+- [ ] Tool results handle missing files gracefully
+- [ ] SSE events follow protocol: `text`, `tool_call`, `done`, `error`
+
+### Security
+- [ ] No command injection via user input
+- [ ] File reads in chat tools are sandboxed to report directory
+- [ ] No path traversal in session ID or test ID parameters
+
+## How to Review
+
+1. Fetch the PR diff: `gh pr diff <number>`
+2. Check for issues against the checklist above
+3. Read the full files for context when the diff is ambiguous
+4. Run `make build && make test && make vet` to verify
+5. For web UI changes, generate and serve a test report (see `webui-report-test` skill)
+
+## Responding to Reviews
+
+When replying to review comments (from humans or bots like CodeRabbit):
+- Address each comment individually in its thread
+- If fixed, reference the commit hash
+- If not fixing, explain why with project context
+- End with `— AI Claude`
diff --git a/.claude/agents/webui-developer.md b/.claude/agents/webui-developer.md
new file mode 100644
index 00000000..a4d95b33
--- /dev/null
+++ b/.claude/agents/webui-developer.md
@@ -0,0 +1,111 @@
+# Web UI Developer Agent
+
+You are working on the OPCT web UI report — a Vue.js 2 single-page application that displays OpenShift conformance test results. The report is served by a Go HTTP server with both static file serving and a Claude-powered chat API.
+
+## Architecture Overview
+
+### Frontend (single HTML file)
+- **Template**: `data/templates/report/report.html` — Go template with `[[`/`]]` delimiters
+- **Styles**: `data/templates/report/report.css`
+- **Framework**: Vue.js 2 (CDN), Bootstrap (CDN), axios (CDN)
+- **Charts**: Chart.js 4.x + chartjs-plugin-zoom (CDN)
+- **Markdown**: marked.js (CDN) — used by the chat widget
+
+### Backend
+- **Report server**: `pkg/cmd/report/report.go` — Go HTTP server on port 9090
+- **Chat API**: `internal/chat/` — Claude API integration with tool use and SSE streaming
+- **Data generation**: `internal/report/data.go` — renders templates, produces `opct-report.json`
+- **Metrics**: `internal/openshift/mustgathermetrics/` — generates Plotly-format JSON chart data
+
+### Data flow
+1. `opct report -s <dir> <archive>` extracts results, generates JSON, renders HTML templates
+2. Go HTTP server serves `<dir>/` as static files + mounts `/api/v1/chat/*` handlers
+3. Vue app fetches `opct-report.json` via axios, renders pages via `v-html` into `menuBody`
+4. Chat widget uses `fetch()` with SSE streaming to `/api/v1/chat`
+
+## Critical Rules
+
+### Layout isolation
+- Pages that need multi-column layouts (e.g., etcd split-pane) MUST use `v-if`/`v-else` to conditionally render the split container
+- NEVER add `d-flex` or width constraints to a shared container — it breaks all other pages
+- Clear inline styles in `changeMenuCleanup()` when navigating away
+
+### Vue rendering
+- Content is injected as HTML strings via `v-html` — `<script>` tags inside are ignored
+- Use `this.$nextTick(() => { ... })` to run code after DOM update
+- Chart.js needs `<canvas>` elements (not `<div>`)
+- Always clean up state in `changeMenuCleanup()` when adding new data properties
+
+### Floating widget states
+- Use CSS classes with `!important` for state changes (minimize/maximize)
+- NEVER toggle `display` on individual children via JS — causes partial blank states
+- Three states: normal (default CSS), minimized (`chat-minimized` class), maximized (`chat-maximized` class)
+
+### Chat backend
+- Vertex AI: prefer `GOOGLE_CLOUD_LOCATION` over `CLOUD_ML_REGION` (which may be `global`)
+- Model IDs: use alias form like `claude-sonnet-4-5` (not dated versions)
+- Tool results are read from the report directory filesystem — tools must handle missing files gracefully
+- SSE events: `text` (streaming tokens), `tool_call` (tool invocation), `done` (final text), `error`
+
+### AI Attribution
+All commits include `Co-Authored-By: Claude <noreply@anthropic.com>`. All GitHub comments end with `— AI Claude`.
+
+### Testing workflow
+- ALWAYS rebuild (`make build`) after Go changes
+- ALWAYS regenerate report (`rm -rf <dir> && opct report -s <dir> ...`) after template changes
+- Test chat with Go server (not python) — python can't serve the API endpoints
+- Check at least 3 pages (Summary, Checks, etcd) after any layout change
+
+## File Reference
+
+| Area | File | Purpose |
+|------|------|---------|
+| Frontend | `data/templates/report/report.html` | Vue.js SPA template (~1600 lines) |
+| Styles | `data/templates/report/report.css` | All CSS including split-pane, charts, chat widget |
+| Report server | `pkg/cmd/report/report.go` | CLI command, HTTP server setup, chat route registration |
+| Chat handler | `internal/chat/handler.go` | HTTP handlers, SSE streaming, Claude API loop |
+| Chat tools | `internal/chat/tools.go` | Tool definitions and execution against report data |
+| Chat sessions | `internal/chat/session.go` | Session CRUD, JSON persistence |
+| Chat prompt | `internal/chat/prompt.go` | System prompt with file override |
+| Report data | `internal/report/data.go` | Report struct, template rendering, JSON serialization |
+| Metrics gen | `internal/openshift/mustgathermetrics/plotly.go` | Plotly JSON chart data generation |
+
+## CDN Libraries (loaded in report.html head)
+
+| Library | Version | Purpose |
+|---------|---------|---------|
+| Vue.js | 2.x | Frontend framework |
+| Bootstrap | latest | Layout and components |
+| BootstrapVue | latest | Vue Bootstrap components |
+| axios | latest | HTTP client |
+| Chart.js | 4.4.9 | Charts (etcd page) |
+| chartjs-adapter-date-fns | 3.0.0 | Time-series X axis |
+| Hammer.js | 2.0.8 | Touch gestures for zoom |
+| chartjs-plugin-zoom | 2.2.0 | Drag-to-zoom, pan |
+| marked.js | 15.0.7 | Markdown rendering (chat) |
+
+## Common Tasks
+
+### Add a new page/menu item
+1. Add button in the left nav menu (around line 43-78)
+2. Add case in `changeMenu()` switch (around line 267-306)
+3. Create `changeMenuNewPage()` method that builds `this.menuBody`
+4. Use `this.pageHeadline` at the top for consistent styling
+
+### Add a new chart
+1. Define chart metadata in Vue `data()` with `id`, `path`, `title`
+2. Build `<canvas>` placeholders in the target panel
+3. Fetch JSON via `axios.get()` in `$nextTick()` callback
+4. Create Chart.js instance with `responsive: true`
+5. Map Plotly JSON format (`data[].x`, `data[].y`, `data[].name`) to Chart.js datasets
+
+### Add a new chat tool
+1. Add tool definition in `internal/chat/tools.go` `ToolDefinitions()` function
+2. Add input struct if needed (with jsonschema tags)
+3. Add case in `Execute()` switch
+4. Implement the execution method reading from `te.reportDir`
+5. Tool results are returned as JSON strings to Claude
+
+### Modify the chat system prompt
+1. Edit `DefaultSystemPrompt` in `internal/chat/prompt.go`
+2. Or place a `system.prompt.txt` file in the report directory for override
diff --git a/.claude/skills/ci-triage/SKILL.md b/.claude/skills/ci-triage/SKILL.md
new file mode 100644
index 00000000..f6685c7c
--- /dev/null
+++ b/.claude/skills/ci-triage/SKILL.md
@@ -0,0 +1,107 @@
+---
+name: ci-triage
+description: Triage an OPCT periodic CI job failure — analyze test failures, check job history, query flake rates, check existing Jira bugs, and draft new bugs for real failures.
+allowed-tools: Bash, Read, WebFetch, WebSearch, Skill, mcp__jira__jira_create_issue, mcp__jira__jira_search, mcp__jira__jira_update_issue, mcp__jira__jira_get_issue
+---
+
+# CI Triage
+
+Investigate a failing OPCT periodic CI job, determine if failures are real or transient, and draft Jira bugs for real failures.
+
+## When to use
+
+- You receive a Slack notification about an OPCT periodic job failure
+- You want to check if a failing job needs a new Jira bug
+- Periodic triage review of OPCT CI health
+
+## Usage
+
+Provide a Prow job URL:
+
+```
+investigate the job failure https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-redhat-openshift-ecosystem-opct-main-4.18-platform-none-vsphere-upgrade/2054789108642877440
+```
+
+Or shorter:
+
+```
+triage https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-release-main-nightly-4.22-opct-platform-external-aws/2053264314218844160
+```
+
+## What the agent does
+
+1. **Parses metadata** from the job URL (OCP version, platform, provider, workflow)
+2. **Fetches job details** via `ci:fetch-prowjob-json`
+3. **Analyzes test failures** via `ci:prow-job-analyze-test-failure`
+4. **Checks job history** to find consecutive failures and first failure date
+5. **Queries flake rates** via `ci:fetch-test-report` (Sippy)
+6. **Checks existing Jira bugs** via `ci:check-if-jira-regression-is-ongoing`
+7. **Classifies each failure**: KNOWN_FLAKE, EXISTING_BUG, INFRA_FAILURE, or NEW_FAILURE
+8. **Drafts a Jira bug** for new failures (asks for approval before filing)
+9. **Presents a triage summary** table
+
+## Example job URLs
+
+OPCT repository jobs:
+```
+https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-redhat-openshift-ecosystem-opct-main-4.18-platform-none-vsphere-upgrade/2054789108642877440
+https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-redhat-openshift-ecosystem-opct-main-4.18-platform-external-vsphere-upgrade/2054955197750317056
+```
+
+Release repository nightly jobs:
+```
+https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-release-main-nightly-4.19-opct-external-aws-ccm/2051551527281102848
+https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-release-main-nightly-4.22-opct-platform-external-aws/2053264314218844160
+```
+
+## Expected output
+
+```
+## Triage Summary: periodic-ci-...-4.18-platform-none-vsphere-upgrade
+
+Job: https://prow.ci.openshift.org/view/gs/...
+History: https://prow.ci.openshift.org/job-history/gs/...
+Status: FAILED (failing since 2026-03-15, 12 consecutive failures)
+
+| # | Test | Classification | Action |
+|---|------|---------------|--------|
+| 1 | [sig-network] ... | KNOWN_FLAKE (12%) | No action |
+| 2 | [sig-auth] ... | EXISTING_BUG | OCPBUGS-1234 |
+| 3 | [sig-storage] ... | NEW_FAILURE | Bug draft below |
+
+### Bug Draft (pending approval)
+Title: OPCT/CI job failure: 4.18-platform-none-vsphere-upgrade
+Project: OCPBUGS
+...
+
+Shall I file this bug?
+```
+
+## After triage
+
+- **Approve bug**: tell the agent to file it
+- **Dismiss**: if you determine the failure is not actionable
+- **Investigate further**: ask the agent to dig deeper into specific test failures
+
+## Jira bug fields (auto-populated)
+
+| Field | Source |
+|-------|--------|
+| Project | OPCT (not OCPBUGS — CI failures are not OCP product bugs) |
+| Title | `OPCT/CI job failure: {VERSION}-{PLATFORM}-{PROVIDER}-{WORKFLOW}` |
+| Labels | `splatteam`, `needs-refinement`, `needs-triage`, `openshift-{X.Y}`, `opct-{X.Y}` |
+| Fix Version | `opct-vX.Y.Z` (from build log `OPCT CLI: vX.Y.Z`, blank if not found) |
+| Parent | OPCT-400 (same project, native hierarchy) |
+
+## Agent definition
+
+See `.claude/agents/ci-triage.md` for the complete workflow specification, Jira field IDs, and MCP tool call examples.
+
+## Marketplace skills used
+
+- `ci:fetch-prowjob-json` — job metadata
+- `ci:prow-job-analyze-test-failure` — failure analysis
+- `ci:prow-job-analyze-install-failure` — install failure analysis (if applicable)
+- `ci:fetch-test-report` — Sippy flake rates
+- `ci:check-if-jira-regression-is-ongoing` — existing bug check
+- `jira:create-bug` + `jira:ocpbugs` — bug creation
diff --git a/.claude/skills/e2e-quick-test/SKILL.md b/.claude/skills/e2e-quick-test/SKILL.md
new file mode 100644
index 00000000..c4564b00
--- /dev/null
+++ b/.claude/skills/e2e-quick-test/SKILL.md
@@ -0,0 +1,124 @@
+---
+name: e2e-quick-test
+description: Quick end-to-end validation on a live OpenShift cluster with minimal test count for rapid development iteration.
+allowed-tools: Bash, Read
+---
+
+# E2E Quick Test
+
+Rapid validation workflow for testing OPCT changes on a live OpenShift cluster.
+
+## Prerequisites
+
+- `KUBECONFIG` environment variable set to a valid cluster
+- Cluster must have `opct` namespace (created by `opct adm setup`)
+- Sufficient cluster permissions (cluster-admin recommended)
+
+## Quick Test Command
+
+```bash
+make build-linux-amd64; ./build/opct-linux-amd64 destroy; ./build/opct-linux-amd64 run -w --dev-count=1
+```
+
+**What it does:**
+1. Rebuilds the CLI binary with latest local changes
+2. Destroys any existing OPCT run to ensure clean state
+3. Runs OPCT workflow with:
+   - `-w` (wait mode): blocks until completion
+   - `--dev-count=1`: runs only 1 test per plugin (development mode)
+
+**Expected runtime:** ~5-10 minutes (vs. hours for full conformance)
+
+## Development Workflow
+
+### Testing a PR branch locally
+
+```bash
+# 1. Fetch and checkout PR branch
+gh pr checkout 214  # or: git fetch origin pull/214/head:pr-214 && git checkout pr-214
+
+# 2. Quick validate
+make build-linux-amd64
+./build/opct-linux-amd64 destroy
+./build/opct-linux-amd64 run -w --dev-count=1
+
+# 3. Monitor plugin progress
+# In another terminal:
+watch -n 5 'oc get pods -n opct'
+
+# 4. Check for specific issues (e.g., cache-init errors)
+oc get events -n opct --field-selector involvedObject.kind=Pod --sort-by='.lastTimestamp'
+```
+
+### Validating template changes
+
+When modifying plugin templates in `data/templates/plugins/*.yaml`:
+
+```bash
+# 1. Make template changes
+# 2. Rebuild (embeds new templates)
+make build-linux-amd64
+
+# 3. Clean previous run
+./build/opct-linux-amd64 destroy
+
+# 4. Test with minimal workload
+./build/opct-linux-amd64 run -w --dev-count=1
+
+# 5. Verify init containers succeeded
+oc describe pod -n opct -l sonobuoy-component=plugin | grep -A 10 "Init Containers"
+```
+
+### Testing specific scenarios
+
+**Cache-init validation:**
+```bash
+# After modifying cache-init in plugin templates
+make build-linux-amd64 && \
+./build/opct-linux-amd64 destroy && \
+./build/opct-linux-amd64 run -w --dev-count=1
+
+# Check cache-init container status
+oc get pods -n opct -l sonobuoy-component=plugin -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.initContainerStatuses[?(@.name=="cache-init")].state}{"\n"}{end}'
+```
+
+**Retrieve/download validation:**
+```bash
+# Test retrieve functionality
+./build/opct-linux-amd64 retrieve --watch
+
+# Test with signal handling (Ctrl+C during download)
+./build/opct-linux-amd64 retrieve -w  # Press Ctrl+C during "Extracting..."
+```
+
+## Common Issues
+
+| Issue | Diagnosis | Fix |
+|-------|-----------|-----|
+| `Init:Error` on plugin pods | `oc logs <pod> -c <init-container>` | Check init container permissions/commands |
+| `ImagePullBackOff` | `oc describe pod <pod>` | Verify image references in templates |
+| Pods stuck in `Pending` | `oc describe pod <pod>` | Check node resources, taints/tolerations |
+| `destroy` fails with "not found" | Expected if no prior run | Safe to ignore, continue with `run` |
+
+## Full Test vs. Quick Test
+
+| Mode | Command | Runtime | Use Case |
+|------|---------|---------|----------|
+| **Quick** | `--dev-count=1` | ~5-10 min | Development iteration, template changes, plugin fixes |
+| **Full** | (no flag) | ~2-6 hours | Final validation, conformance certification |
+
+## Cleanup
+
+```bash
+# Remove OPCT namespace and all resources
+./build/opct-linux-amd64 adm cleanup
+
+# Or just destroy current run (keeps namespace)
+./build/opct-linux-amd64 destroy
+```
+
+## Related Skills
+
+- `/go-validate` — Validate Go code before building
+- `/opct-runtime` — Understand plugin execution architecture
+- `/ci-triage` — Debug CI failures
diff --git a/.claude/skills/go-validate/SKILL.md b/.claude/skills/go-validate/SKILL.md
new file mode 100644
index 00000000..e8cb83ee
--- /dev/null
+++ b/.claude/skills/go-validate/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: go-validate
+description: Run the full Go validation suite (tidy, build, test, vet) before committing. Use after any Go code changes.
+allowed-tools: Bash, Read
+---
+
+# Go Validate
+
+Run the standard validation checklist before committing Go changes.
+
+## When to use
+
+- Before committing any Go code changes
+- After dependency updates (`go.mod`, `go.sum`)
+- After modifying embedded templates (`data/templates/`)
+- When CI fails and you need to reproduce locally
+
+## Steps
+
+```bash
+# 1. Resolve dependencies
+go mod tidy
+
+# 2. Build
+make build
+
+# 3. Run tests
+make test
+
+# 4. Run vet
+make vet
+
+# 5. Optional: lint (may have pre-existing YAML issues)
+make test-lint
+```
+
+## Expected results
+
+- `make build`: produces `build/opct-linux-amd64`
+- `make test`: all packages pass (currently ~10 packages)
+- `make vet`: no output (clean)
+- `make test-lint`: Go code should pass; YAML workflow issues are acceptable if unrelated
+
+## Common issues
+
+| Issue | Fix |
+|-------|-----|
+| `no required module provides package` | Run `go get <package>@latest` then `go mod tidy` |
+| `toolchain` directive in go.mod | Remove it — causes CI compatibility issues |
+| Import cycle | Check `internal/` vs `pkg/` boundaries |
+| `go.sum` mismatch | Delete `go.sum` and run `go mod tidy` to regenerate |
diff --git a/.claude/skills/jira-ops/SKILL.md b/.claude/skills/jira-ops/SKILL.md
new file mode 100644
index 00000000..4deeb82c
--- /dev/null
+++ b/.claude/skills/jira-ops/SKILL.md
@@ -0,0 +1,81 @@
+---
+name: jira-ops
+description: Jira operations for the OPCT project — MCP-first with REST API fallback for creating issues, comments, and links.
+allowed-tools: Bash, mcp__jira__jira_create_issue, mcp__jira__jira_add_comment, mcp__jira__jira_create_issue_link, mcp__jira__jira_search, mcp__jira__jira_update_issue, mcp__jira__jira_get_issue
+---
+
+# Jira Operations for OPCT
+
+Shared operational knowledge for Jira interactions in the OPCT project. Used by `ci-triage` and `opct-developer` agents.
+
+## Strategy: MCP first, REST API fallback
+
+Always try MCP tools first. If MCP returns a permission error, fall back to REST API via `curl`.
+
+## Creating issues
+
+**MCP (try first):**
+```
+mcp__jira__jira_create_issue(
+    project_key="OPCT",
+    summary="...",
+    issue_type="Bug",
+    description="<jira wiki markup>",
+    additional_fields='{"labels": [...], "parent": {"key": "OPCT-400"}}'
+)
+```
+
+**REST API fallback:**
+```bash
+curl -s -X POST -H "Content-Type: application/json" \
+  -u "${JIRA_USERNAME}:${JIRA_API_TOKEN}" \
+  "https://redhat.atlassian.net/rest/api/2/issue" \
+  -d '{"fields": {"project": {"key": "OPCT"}, "issuetype": {"name": "Bug"}, ...}}'
+```
+
+If credentials are not exported, ask the user where their Jira credentials file is located.
+
+## Adding comments
+
+**MCP (try first):**
+```
+mcp__jira__jira_add_comment(issue_key="OPCT-XXX", body="Comment in Markdown")
+```
+
+**REST API fallback:**
+```bash
+curl -s -X POST -H "Content-Type: application/json" \
+  -u "${JIRA_USERNAME}:${JIRA_API_TOKEN}" \
+  "https://redhat.atlassian.net/rest/api/2/issue/OPCT-XXX/comment" \
+  -d '{"body": "Comment in Jira wiki markup"}'
+```
+
+## Linking issues
+
+**MCP (try first):**
+```
+mcp__jira__jira_create_issue_link(link_type="Related", inward_issue_key="OPCT-NEW", outward_issue_key="OPCT-EXISTING")
+```
+
+**REST API fallback:**
+```bash
+curl -s -X POST -H "Content-Type: application/json" \
+  -u "${JIRA_USERNAME}:${JIRA_API_TOKEN}" \
+  "https://redhat.atlassian.net/rest/api/2/issueLink" \
+  -d '{"type": {"name": "Related"}, "inwardIssue": {"key": "OPCT-NEW"}, "outwardIssue": {"key": "OPCT-EXISTING"}}'
+```
+
+## Link type reference
+
+| Name | Inward | Outward |
+|------|--------|---------|
+| `Related` | is related to | relates to |
+| `Blocks` | is blocked by | blocks |
+
+**Common mistake:** `"Relates"` returns 404 — the correct name is `"Related"`.
+
+## Important notes
+
+- **API URL:** Always use `https://redhat.atlassian.net` directly. Do NOT use `https://issues.redhat.com` — it returns a 301 redirect that drops the POST body.
+- **Description format:** MCP tools accept Markdown. REST API uses Jira wiki markup (`h2.`, `*bold*`, `{noformat}`).
+- **All Jira comments/descriptions created by AI** must end with `— AI Claude`.
diff --git a/.claude/skills/opct-runtime/SKILL.md b/.claude/skills/opct-runtime/SKILL.md
new file mode 100644
index 00000000..94be16fa
--- /dev/null
+++ b/.claude/skills/opct-runtime/SKILL.md
@@ -0,0 +1,108 @@
+---
+name: opct-runtime
+description: OPCT plugin runtime architecture — execution order, dependency chain, timing delays, and key files for investigating plugin and workflow issues.
+allowed-tools: Bash, Read
+---
+
+# OPCT Plugin Runtime Architecture
+
+Reference knowledge for investigating plugin timing, dependency, and workflow issues. Used by `ci-triage` and `opct-developer` agents.
+
+## Plugin Execution Order
+
+Plugins run as sonobuoy Job pods, all created simultaneously. Dependencies are managed inside the plugin containers, not by the scheduler.
+
+```
+05-openshift-cluster-upgrade  →  10-openshift-kube-conformance  →  20-openshift-conformance-validated  →  80-openshift-tests-replay  →  99-openshift-artifacts-collector
+```
+
+Each plugin waits for its predecessor to complete before starting test execution.
+
+## Dependency Chain Components
+
+Four components add sequential delays between plugin completion and successor startup:
+
+| Component | Delay | Location |
+|-----------|-------|----------|
+| sonobuoy-worker done-file sleep | 5s (hardcoded) | sonobuoy upstream (not configurable) |
+| Aggregator annotation update | 5s + 1.2x jitter | sonobuoy upstream `run.go:45` |
+| Plugin dependency waiter poll | 10s | `plugin.go:683` in plugins repo |
+| Tests container start-file poll | 10s | `entrypoint-tests.sh:165` in plugins repo |
+| openshift-tests init (extension discovery) | ~3 min | upstream openshift-tests |
+
+Worst case additive delay after predecessor finishes: ~30s polling + ~3min openshift-tests init.
+
+Improvement tracked in [OPCT-409](https://issues.redhat.com/browse/OPCT-409).
+
+## How Dependencies Work
+
+### Plugin container (`plugin` sidecar)
+
+1. Waits for suite list file (`/tmp/shared/suite.list.done`)
+2. Starts dependency waiter — polls sonobuoy aggregator annotation (`sonobuoy.hept.io/status`) every 10 seconds via `sbaggregation.GetStatus()` which reads the sonobuoy pod annotation
+3. When predecessor shows `status=complete` or `podPhase=Completed`, writes `/tmp/shared/start`
+4. Monitors test progress via `/tmp/shared/fifo` and reports to aggregator via progress API
+
+### Tests container (`tests`)
+
+1. Runs `openshift-tests` to list suite (generates `/tmp/shared/suite.list`)
+2. Polls for `/tmp/shared/start` file every 10 seconds (bash `sleep 10` loop)
+3. When start file appears, runs `openshift-tests run` with the suite list
+
+### Sonobuoy aggregator (`sonobuoy` pod)
+
+1. Receives progress updates from plugin pods via HTTP POST to `/api/v1/progress/`
+2. Receives results via HTTP PUT to `/api/v1/results/`
+3. Updates pod annotation (`sonobuoy.hept.io/status`) every 5s via `wait.JitterUntil()`
+4. The annotation is what both `opct status` (client) and dependency waiters (plugin) read
+
+### Sonobuoy worker (`sonobuoy-worker` sidecar in each plugin pod)
+
+1. Watches for done file at `/tmp/sonobuoy/results/done`
+2. **Sleeps 5 seconds** after detecting done file ("allows other containers to intervene")
+3. Uploads result tarball to aggregator via PUT
+
+## Status Messages in `opct status`
+
+| Message Pattern | Meaning |
+|----------------|---------|
+| `status=blocked-by={PLUGIN}` | Predecessor's predecessor is still running |
+| `status=waiting-for={PLUGIN}=(0/{N}/0)` | Predecessor is running, {N} tests remaining |
+| `status=running=T/C/P/F/S={total}/{completed}/{passed}/{failed}/{skipped}` | Plugin is actively running tests |
+| `waiting for jobs initialization=PodStatus(NotReady)` | Plugin pod containers still starting |
+
+## Runtime Data in Report
+
+The `meta/run.log` file in the sonobuoy archive contains JSON-formatted server events. Parsed by `internal/opct/archive/metalog.go`:
+
+- `"plugin started {NAME}"` — when plugin sends first POST (progress update)
+- `"plugin finished {NAME}"` — when plugin sends PUT (result upload)
+- `"server finished"` — when aggregator cleanup runs
+
+Delta times computed as `finish[current] - finish[predecessor]`. If predecessor never finished, falls back to plugin's own start time (fixed in OPCT-408).
+
+## Key Files
+
+### OPCT CLI repo (`opct`)
+
+| File | Purpose |
+|------|---------|
+| `internal/opct/archive/metalog.go` | Parses `meta/run.log` for runtime data |
+| `pkg/status/printer.go` | `opct status` output formatting |
+| `data/templates/plugins/*.yaml` | Plugin manifest templates |
+
+### Plugins repo (`provider-certification-plugins`)
+
+| File | Purpose |
+|------|---------|
+| `openshift-tests-plugin/pkg/plugin/plugin.go:680-820` | Dependency waiter loop |
+| `openshift-tests-plugin/pkg/plugin/blocker.go` | `GetPluginsBlocker()` — reads sonobuoy annotation |
+| `openshift-tests-plugin/plugin/entrypoint-tests.sh:154-166` | Start-file polling loop |
+
+## Investigating Plugin Timing Issues
+
+1. Check `plugin` container logs: `oc logs {pod} -c plugin -n opct` — shows dependency waiter reconcile cycles
+2. Check `tests` container logs: `oc logs {pod} -c tests -n opct` — shows start-file polling and openshift-tests init
+3. Check `sonobuoy-worker` container logs: `oc logs {pod} -c sonobuoy-worker -n opct` — shows done-file detection and result upload
+4. Check aggregator logs: `oc logs sonobuoy -n opct` — shows PUT/POST requests from plugins
+5. Check annotation directly: `oc get pod sonobuoy -n opct -o jsonpath='{.metadata.annotations.sonobuoy\.hept\.io/status}'`
diff --git a/.claude/skills/webui-chat-debug/SKILL.md b/.claude/skills/webui-chat-debug/SKILL.md
new file mode 100644
index 00000000..c2409e64
--- /dev/null
+++ b/.claude/skills/webui-chat-debug/SKILL.md
@@ -0,0 +1,81 @@
+---
+name: webui-chat-debug
+description: Debug the OPCT chatbot backend — test API endpoints, check auth, inspect tool execution, and troubleshoot Vertex/Anthropic API issues.
+allowed-tools: Bash, Read
+---
+
+# Web UI Chat Debug
+
+Debug the OPCT chatbot backend when chat isn't working or producing errors.
+
+## When to use
+
+- Chat shows "not available" or API errors
+- Vertex AI or Anthropic API authentication issues
+- Tool execution returning wrong data
+- SSE streaming not working
+- Session save/load failures
+
+## Diagnostic steps
+
+### 1. Check chat status
+
+```bash
+curl -s http://localhost:9090/api/v1/chat/status | python3 -m json.tool
+```
+
+Expected: `{"enabled": true, "provider": "vertex"|"anthropic", "model": "claude-sonnet-4-5"}`
+
+If `enabled: false`:
+- For Vertex AI: `echo $GOOGLE_CLOUD_LOCATION $ANTHROPIC_VERTEX_PROJECT_ID` (both must be set)
+- Fallbacks also checked: `CLOUD_ML_REGION`, `GOOGLE_CLOUD_PROJECT`
+- For Anthropic API: `echo $ANTHROPIC_API_KEY`
+
+### 2. Test a simple chat message
+
+```bash
+curl -s -X POST http://localhost:9090/api/v1/chat \
+  -H "Content-Type: application/json" \
+  -d '{"message": "hello", "history": []}' 2>&1 | head -20
+```
+
+Should stream SSE events like:
+```
+event: text
+data: Hello...
+```
+
+### 3. Check tool execution directly
+
+Tools read from the report directory. Verify the report data exists:
+
+```bash
+TEST_ID=4.20.0-0.nightly-2026-05-04-230007-20260510-HighlyAvailable-aws-External
+ls ~/opct/tmp/${TEST_ID}__report/opct-report.json
+ls ~/opct/tmp/${TEST_ID}__report/failures-*/
+ls ~/opct/tmp/${TEST_ID}__report/metrics/
+```
+
+### 4. Check sessions directory
+
+```bash
+curl -s http://localhost:9090/api/v1/chat/sessions | python3 -m json.tool
+ls ~/opct/tmp/${TEST_ID}__report/chat-sessions/
+```
+
+### 5. Common errors
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `404 Not Found` from Vertex | Wrong model ID or region | Use alias `claude-sonnet-4-5` (not dated). Use `GOOGLE_CLOUD_LOCATION` not `CLOUD_ML_REGION=global` |
+| `enabled: false` | No API credentials detected | Set `GOOGLE_CLOUD_LOCATION` + `ANTHROPIC_VERTEX_PROJECT_ID` (Vertex) OR `ANTHROPIC_API_KEY` (direct) |
+| Chat panel shows "unable to connect" | Server not running or wrong port | Start with `opct report -s <dir> <archive>` (not `--skip-server`) |
+| Tool returns empty data | Report JSON missing or malformed | Regenerate report: `rm -rf <dir> && opct report -s <dir> --skip-server <archive>` |
+
+## Key files
+
+- `internal/chat/handler.go` — HTTP handlers, auth detection, streaming loop
+- `internal/chat/tools.go` — Tool definitions and execution against report dir
+- `internal/chat/prompt.go` — System prompt (built-in + file override)
+- `internal/chat/session.go` — Session persistence
+- `pkg/cmd/report/report.go` — Route registration (lines ~196-204)
diff --git a/.claude/skills/webui-report-test/SKILL.md b/.claude/skills/webui-report-test/SKILL.md
new file mode 100644
index 00000000..81036ab7
--- /dev/null
+++ b/.claude/skills/webui-report-test/SKILL.md
@@ -0,0 +1,86 @@
+---
+name: webui-report-test
+description: Build, regenerate, and serve the OPCT web UI report for browser testing. Use when modifying report.html, report.css, chat backend, or any template/chart changes.
+allowed-tools: Bash, Read
+---
+
+# Web UI Report Test
+
+Build the project, regenerate the report from a test archive, and serve it for browser testing.
+
+## When to use
+
+- After modifying `data/templates/report/report.html` or `report.css`
+- After changing report data generation in `internal/report/data.go`
+- After changing metrics generation in `internal/openshift/mustgathermetrics/`
+- After changing chat backend in `internal/chat/`
+- When testing any web UI layout, chart, chatbot, or table changes
+
+## Workflow
+
+### 1. Build
+
+```bash
+make build
+```
+
+### 2. Generate report and serve
+
+There are two modes depending on what you're testing:
+
+**With chat API (use when testing chatbot or full integration):**
+```bash
+TEST_ID=4.20.0-0.nightly-2026-05-04-230007-20260510-HighlyAvailable-aws-External
+
+# Kill previous server
+pkill -f "opct-linux-amd64 report" 2>/dev/null; sleep 1
+
+# Generate and serve (Go HTTP server — serves both static files and chat API)
+rm -rf ~/opct/tmp/${TEST_ID}__report
+./build/opct-linux-amd64 report -s ~/opct/tmp/${TEST_ID}__report ~/opct/results/${TEST_ID}.tar.gz
+```
+
+**Without chat API (use for pure frontend/layout changes):**
+```bash
+TEST_ID=4.20.0-0.nightly-2026-05-04-230007-20260510-HighlyAvailable-aws-External
+
+# Generate only
+rm -rf ~/opct/tmp/${TEST_ID}__report
+./build/opct-linux-amd64 report -s ~/opct/tmp/${TEST_ID}__report --skip-server ~/opct/results/${TEST_ID}.tar.gz
+
+# Serve with python (lightweight, no chat API)
+pkill -f "python3 -m http.server 9090" 2>/dev/null; sleep 0.5
+python3 -m http.server 9090 --directory ~/opct/tmp/${TEST_ID}__report
+```
+
+### 3. Test in browser
+
+Open http://localhost:9090 and verify:
+
+**Always check:**
+- The page you modified works correctly
+- At least 2-3 other pages (Summary, Checks, Network) have no layout regressions
+- Browser resize works for responsive layouts
+
+**For chart changes:**
+- Charts load and are interactive (zoom, expand)
+- etcd split-pane layout works, divider is draggable
+
+**For chatbot changes:**
+- Chat bubble appears in bottom-right
+- `/api/v1/chat/status` returns enabled status
+- Streaming responses work
+- Minimize/maximize/close buttons work
+- Stop button cancels mid-stream responses
+- Sessions auto-save and load correctly
+
+**For layout changes (headline, tables):**
+- Verify styling on ALL pages that use `pageHeadline` (Summary, Checks, etcd, Network, Runtime, etc.)
+
+## Important notes
+
+- The Go server (`opct report` without `--skip-server`) blocks the terminal — run in background
+- The Go server is REQUIRED for chat API — python server only serves static files
+- Chat requires Vertex AI or Anthropic API credentials (see CLAUDE.md for env vars)
+- Report generation takes ~15 seconds for the test archive
+- Always `rm -rf` the report dir before regenerating to pick up template changes
diff --git a/CLAUDE.md b/CLAUDE.md
index ac66c0ce..6718084e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -14,6 +14,7 @@ This document provides structured instructions for common development activities
   - [OPCT CLI Release](#opct-cli-release)
   - [Plugins Release](#plugins-release)
 - [Validation Procedures](#validation-procedures)
+- [Web UI Report Development](#web-ui-report-development)
 - [Contributing Guidelines](#contributing-guidelines)
 
 ---
@@ -1048,16 +1049,20 @@ refactor: replace pkg/errors with stdlib fmt.Errorf
 fix: correct error handling in baseline reporting
 ```
 
-### AI Assistant Footer
+### AI Attribution (Required)
 
-Include the following footer in commits made by AI assistants:
+All AI-generated content must be attributed for traceability.
 
+**Git commits** — include the co-author trailer:
 ```
-🤖 Generated with [Claude Code](https://claude.com/claude-code)
-
 Co-Authored-By: Claude <noreply@anthropic.com>
 ```
 
+**GitHub interactions** (PR descriptions, comments, review replies) — append at the end:
+```
+— AI Claude
+```
+
 ### Branch Naming
 
 - Feature branches: `feature/<description>`
@@ -1178,6 +1183,220 @@ Based on v0.6.1 experience:
 
 ---
 
+## Web UI Report Development
+
+**When to use**: Modify the OPCT web report UI (charts, tables, layout, new pages).
+
+### Architecture
+
+The report is a **Vue.js 2 single-page application** rendered as a Go template.
+
+**Key files**:
+- `data/templates/report/report.html` — Main Vue app (Go template delimiters: `[[` / `]]`)
+- `data/templates/report/report.css` — Styles
+- `internal/report/data.go` — Backend: `SaveResults()` renders templates to `<saveTo>/index.html`
+- `internal/openshift/mustgathermetrics/plotly.go` — Generates Plotly-format JSON chart data to `<saveTo>/metrics/`
+
+**CDN libraries loaded in report.html**:
+- Vue 2, Bootstrap, BootstrapVue, axios
+- Chart.js 4.4.9 + chartjs-adapter-date-fns (time-series X axes)
+- Hammer.js + chartjs-plugin-zoom (drag-to-zoom, pan)
+
+**Content rendering pattern**: Each page builds HTML strings in `this.menuBody` and renders via `v-html` directive. Data comes from `opct-report.json` (fetched by axios or embedded via Go template).
+
+### Testing Workflow
+
+```bash
+# 1. Build
+make build
+
+# 2. Generate report (--skip-server to avoid blocking)
+TEST_ID=<result-name>  # e.g., 4.20.0-0.nightly-2026-05-04-230007-20260510-HighlyAvailable-aws-External
+./build/opct-linux-amd64 report -s ~/opct/tmp/${TEST_ID}__report --skip-server ~/opct/results/${TEST_ID}.tar.gz
+
+# 3. Serve for browser testing
+python3 -m http.server 9090 --directory ~/opct/tmp/${TEST_ID}__report
+
+# 4. Open http://localhost:9090 in browser, test all pages
+```
+
+Always test:
+- The page you modified
+- At least 2-3 other pages (Summary, Checks, Network) to verify no layout regressions
+- Browser resize for responsive behavior
+
+### Split-Pane Layout Pattern
+
+Some pages (e.g., etcd) use a split-pane layout with tables on the left and charts on the right.
+
+**Critical rule**: Use `v-if`/`v-else` to conditionally render the split container — **never** use a shared container with conditional CSS classes.
+
+```html
+<!-- CORRECT: split pane only exists when menuBodyRight has content -->
+<div v-if="menuBodyRight" id="split-container" class="d-flex">
+  <div id="panel-left" class="etcd-panel-left overflow-auto">
+    <span v-html="menuBody"></span>
+  </div>
+  <div id="panel-divider" class="etcd-panel-divider"></div>
+  <div id="panel-right" class="etcd-panel-right overflow-auto">
+    <span v-html="menuBodyRight"></span>
+  </div>
+</div>
+<div v-else class="overflow-auto">
+  <span v-html="menuBody"></span>
+</div>
+```
+
+```html
+<!-- WRONG: d-flex affects all pages even when menuBodyRight is empty -->
+<div class="d-flex">
+  <div :class="menuBodyRight ? 'etcd-panel-left' : ''">
+    <span v-html="menuBody"></span>
+  </div>
+</div>
+```
+
+**Why**: The `d-flex` container changes layout behavior for ALL pages. Inline styles set by JavaScript (e.g., drag-resize) persist across page navigations. The `v-if`/`v-else` approach ensures non-split pages use the original full-width layout unchanged.
+
+**Cleanup**: `changeMenuCleanup()` must clear `menuBodyRight` AND reset any inline styles set by the drag-resize handler:
+
+```javascript
+changeMenuCleanup() {
+  this.menuTitle = '';
+  this.menuBody = '';
+  this.menuBodyRight = '';
+  var left = document.getElementById('panel-left');
+  if (left) { left.style.width = ''; left.style.minWidth = ''; }
+  var right = document.getElementById('panel-right');
+  if (right) { right.style.width = ''; right.style.minWidth = ''; }
+},
+```
+
+### Adding Charts to a Page
+
+Chart data is served as static JSON files at `./metrics/` (generated during report processing). To add charts to a page:
+
+1. **Define chart metadata** in Vue `data()`:
+   ```javascript
+   etcdCharts: [
+     { id: "etcd-chart-0", path: "./metrics/query_range-etcd-...", title: "Chart Title" },
+   ],
+   ```
+
+2. **Build canvas placeholders** in `menuBodyRight` (Chart.js uses `<canvas>`, not `<div>`):
+   ```javascript
+   this.menuBodyRight += `<div class="etcd-chart-card"><canvas id="` + chart.id + `"></canvas></div>`
+   ```
+
+3. **Render after DOM update** with `this.$nextTick(() => { this.renderCharts(); })`
+
+4. **Fetch JSON and create Chart.js instances**:
+   ```javascript
+   axios.get(chart.path).then(resp => {
+     let reply = resp.data;
+     // reply.data = [{x: [...], y: [...], name: "label", type: "scatter"}]
+     // Map Plotly format to Chart.js datasets
+     new Chart(canvas, { type: 'line', data: { datasets }, options: { ... } });
+   });
+   ```
+
+**Chart data format** (Plotly JSON, reused by Chart.js):
+- `data[].x` — timestamps as strings (e.g., `"2026-5-9 21:44:8"`, non-padded)
+- `data[].y` — float values
+- `data[].name` — series label
+- Use `parseMetricTimestamp()` for cross-browser safe date parsing
+
+**Available etcd metrics** (defined in `internal/openshift/mustgathermetrics/main.go`):
+- `query_range-etcd-disk-fsync-wal-duration-p99.json.gz`
+- `query_range-etcd-disk-fsync-db-duration-p99.json.gz`
+- `query_range-etcd-peer-round-trip-time.json.gz`
+- `query_range-etcd-total-leader-elections-day.json.gz`
+- `query_range-etcd-request-duration-p99.json.gz`
+- `query_range-api-kas-request-duration-p99.json.gz`
+
+### Common Pitfalls
+
+- **Go template conflict**: Use `[[` / `]]` for Go template delimiters, not `{{` / `}}` (conflicts with Vue)
+- **`v-html` scripts don't execute**: `<script>` tags injected via `v-html` are ignored. Use `$nextTick()` callbacks instead
+- **Chart.js needs `<canvas>`**, not `<div>` (unlike Plotly which uses `<div>`)
+- **Plotly is still used** by `metrics/index.html` (standalone page). Don't remove the Plotly JSON generation in the Go backend
+- **`hasMetricsData` flag**: Gate chart rendering on `this.report.summary.features.hasMetricsData` — it's `false` when must-gather metrics were not collected
+
+### Chatbot (AI Assistant) Architecture
+
+The report includes a floating chat widget powered by Claude via the Anthropic SDK.
+
+**Backend files** (`internal/chat/`):
+- `handler.go` — HTTP handlers, SSE streaming, Claude API tool-use loop
+- `tools.go` — 8 tool definitions (summary, checks, plugin results, test failure logs, etcd, network) + tool executor reading from report directory
+- `session.go` — Session CRUD with JSON persistence in `<report-dir>/chat-sessions/`
+- `prompt.go` — Built-in system prompt with file override (`<report-dir>/system.prompt.txt`)
+
+**API endpoints** (registered in `pkg/cmd/report/report.go`):
+- `GET /api/v1/chat/status` — Returns `{"enabled": bool, "provider": "vertex"|"anthropic", "model": "..."}`
+- `POST /api/v1/chat` — Send message, stream response via SSE
+- `GET /api/v1/chat/sessions` — List saved sessions
+- `GET /api/v1/chat/sessions/{id}` — Load a session
+- `POST /api/v1/chat/sessions` — Save a session
+
+**Authentication** (auto-detected at startup):
+1. Vertex AI: detected when `GOOGLE_CLOUD_LOCATION` (or `CLOUD_ML_REGION`) and `ANTHROPIC_VERTEX_PROJECT_ID` (or `GOOGLE_CLOUD_PROJECT`) are set
+2. Anthropic API: detected when `ANTHROPIC_API_KEY` is set
+3. Neither set → chat disabled, UI shows setup instructions
+
+**Key design decisions**:
+- Uses **tool use** instead of stuffing the 2MB report JSON into context — Claude calls tools to fetch specific data on demand
+- **SSE streaming** for real-time token display via `fetch()` + `ReadableStream`
+- **AbortController** for the Stop button — cancels the fetch request mid-stream
+- Tool results are read directly from the report directory filesystem
+
+**Vertex AI region priority**: Use `GOOGLE_CLOUD_LOCATION` first, then `CLOUD_ML_REGION`. The `CLOUD_ML_REGION=global` value is NOT a valid Vertex AI Anthropic endpoint — always prefer the specific region.
+
+**Model format**: Use alias form like `claude-sonnet-4-5` (not dated versions like `claude-sonnet-4-5-20250514` which may not be available in all Vertex projects).
+
+### Floating Widget Pattern
+
+The chat uses a floating widget (not a tab) so users can keep navigating all existing tabs while the chat is open.
+
+**Key behaviors**:
+- Chat bubble icon fixed bottom-right, always visible
+- Three header buttons: minimize (`—`), maximize (`□`), close (`×`)
+- Minimize/maximize use CSS classes (`chat-minimized`, `chat-maximized`) with `!important` rules — **never** toggle `display` on individual children via JS (causes partial state bugs)
+- Chat state persists in JS variables across tab navigation
+- Sessions auto-save after each assistant response
+
+**Anti-patterns learned**:
+- ❌ CSS `resize: both` — unreliable across browsers, resize handle is invisible/hard to find
+- ❌ Setting `display` on individual children for minimize — causes blank areas on restore
+- ❌ `direction: rtl` hack for resize handle position — conflicts with content layout
+- ✅ Use CSS classes with `!important` for state changes (minimize/maximize)
+- ✅ Use explicit maximize/restore buttons instead of drag-to-resize for floating panels
+
+### UI Styling Patterns
+
+**Page headline bar**: Cluster info displayed as colored badge pills (not raw text with brackets):
+```javascript
+// Pattern used in pageHeadline computed property
+headline += '<span class="headline-badge headline-ocp">OpenShift <strong>' + version + '</strong></span>'
+```
+- `.headline-ocp` — blue badge for OpenShift version
+- `.headline-k8s` — green badge for Kubernetes version
+- `.headline-platform` — amber badge for platform type
+- `.headline-archive` — gray monospace badge for archive filename on second row
+
+**Table section headers**: Use Bootstrap `<dt>` with `text-light bg-secondary` class:
+```javascript
+this.menuBody += '<dt class="text-light bg-secondary ps-1 mb-1">Section Title</dt>'
+```
+
+**Font sizes**: Chat widget uses fixed pixel sizes (not rem) to avoid inheritance issues:
+- Body text: 12px
+- Headings inside chat: 13px
+- Code/pre: 11px
+- Tables: 11px
+
+---
+
 ## Document Maintenance
 
 This document should be updated when:
@@ -1186,5 +1405,5 @@ This document should be updated when:
 - AI assistants encounter repeated questions or issues
 - Development workflows change significantly
 
-**Last Updated**: 2025-12-08
+**Last Updated**: 2026-05-14
 **Maintainer**: OPCT Development Team