Complete procedures with a way back.

Compare LM Studio and Open WebUI by role rather than treating them as interchangeable local AI applications. Test LM Studio as a model runtime/API and Open WebUI as a frontend that can connect to it or other backends, including multi-user identity and deployment choices.

Derive exact Kubernetes API permissions from observed calls, create a dedicated ServiceAccount with no ambient token, bind a narrow namespaced Role, mount a short-lived audience-bound token only where needed, and prove both allowed and denied behavior.

Deploy a private Ubuntu 24.04 LTS VM with Trusted Launch, encryption at host, an explicit NSG, no public IP and a least-privilege system-assigned managed identity, then prove network, identity, patch and recovery controls.

Install pinned Argo CD 3.4.5, constrain an AppProject, verify repository transport and GnuPG-signed commits or tags, preview manual syncs, sequence waves and hooks, harden revision overrides, rehearse rollback, rotate keys, and plan the separate 3.5 sourceIntegrity migration.