Any Keycloak from 20 onward enforces the openid scope on /userinfo, which breaks Mattermost Team Edition’s Keycloak-as-GitLab SSO. The fix everyone tries first makes it worse. Here’s what actually breaks, and the one client scope on Keycloak’s side that makes it work.
Artoo, Obmondo’s Mattermost bot, got a PR review engine that runs on a self-hosted Qwen3-14B with a ~32K context window. The key problem: a single Kubernetes PR can have 10,000+ lines of diff. The solution: Go pre-processing that compresses diffs to ~2KB before the LLM ever sees them — using go/ast for Go files, YAML key-level diffing for Helm/K8s configs, and priority-based file truncation. This post covers why each decision was made and what the LLM still cannot do.