Red Hat · Four Inc. · Carahsoft · September 17, 2026

Choose your own adventure

Everything from the session — the deck, eight virtual-terminal labs, the guides, the talk track, the tools and the files — catalogued and connected, so you can follow it on your own. Pick the path that matches your job, or browse the whole kit below.

DeckLabsDemoPresenter consoleDocumentationSlides (reveal.js)PowerPointPDFGitHub
Start here

Six paths through the kit

Each path is a reading order. Steps open the deck at the right slide, run a lab in your browser, or jump to the guide. Nothing here needs a cluster, a GPU or credentials — every lab runs in simulate mode.

Programme owner · mission lead · acquisition

I own a mission or a programme

You need to know what is real, what is safe to start, and what to ask for. Read first, then watch one lab refuse to guess.

  1. Slide 03The work is seasonal, textual and unforgivingWhy now — a year of demand in six weeks, and the data cannot leave.
  2. Slide 05From data to judgementThe ladder. If you remember one picture, make it this one.
  3. Slide 07Where AI actually lands in the filing lifecycleWhere AI lands first, and why exam selection is deliberately not on the list.
  4. Slide 08Five outcomes, and where each one is provenFive outcomes, each tied to the lab that proves it.
  5. briefEvent briefThe brief: the same argument in prose, for the people you have to convince.
  6. Lab 04Ground answers in your own guidanceWatch the system refuse a question it has no guidance for. That is the governance story.
  7. Slide 14Ninety days, then ninety moreNinety days, then ninety more — where programmes actually stall.
  8. Slide 15What happens after this hourYour move: Solution Architect, community of practice, hardest question.
Platform · infrastructure · capacity

I run the platform

One foundation from bare metal to the taxpayer. Serve a model on localhost, then survive April, then let automation carry the toil.

  1. Slide 09One foundation, from bare metal to the taxpayerThe reference architecture — read it bottom to top; trust and automation span every layer.
  2. Slide 11Define the service onceDefine the service once, run it in the datacenter, the accredited cloud or the enclave.
  3. Lab 01Serve a model inside your boundaryServe Granite on 127.0.0.1 with the AI Inference Server. Stop on ss -ltnp.
  4. Lab 03Survive filing seasonKServe + vLLM on OpenShift AI: 2 → 20 replicas under a 400-user rehearsal.
  5. Lab 05Automate the toil around the modelEvent-Driven Ansible remediates saturation in 62 seconds, with an audit row.
  6. toolbin/lib.shHow every lab is built: one step call per real command, simulate or live.
  7. toolbin/preflight.shWhich labs can run live on the machine in front of you.
  8. tool.github/workflows/docs.ymlHow this site is tested, built and published on every push.
ISSO · authorizing official · assessor

I sign the authorization

Evidence is information; your decision is judgement. Everything here produces the first so a person can make the second.

  1. Slide 18The questions an authorizing official will askThe questions an authorizing official will ask, each mapped to a control.
  2. Lab 06Prove it to your ISSOcosign, FIPS, a Compliance Operator scan that honestly says NON-COMPLIANT, and drift read correctly.
  3. Lab 01Serve a model inside your boundaryOne line — the endpoint bound to 127.0.0.1 — answers 'where does our data go?'
  4. Lab 05Automate the toil around the modelThe rulebook escalates a provenance mismatch instead of fixing it; the audit row writes itself.
  5. briefEvent briefThe AO questions table in prose, with the lab that proves each answer.
  6. guideFacilitator guideSix stock answers: air-gapped, GPUs, hallucination, training on our data, other models, FedRAMP.
  7. guideThe ladder: data → information → knowledge → judgementThe definitions the whole kit assumes — including why judgement is never automated.
Subject-matter expert · data lead · correspondence

I own the data, the notices, the guidance

Knowledge is the institution's memory, retrievable and cited. You write it once as seeds and guidance; the model learns the vocabulary and cites the source.

  1. Slide 04An LLM is the engineAn LLM is the engine, not the vehicle — fine-tuning studies for the test, retrieval brings the notebook.
  2. Slide 06Predictive and generative AI answer different questionsPredictive and generative fail differently, so they are governed differently.
  3. Lab 02Teach it your notice taxonomyTwelve seed examples become 2,200 kept samples; the tuned model beats the base on your taxonomy.
  4. dataNotice taxonomy seedWhat an expert actually writes: contexts and Q&A pairs in qna.yaml, reviewed like code.
  5. Lab 04Ground answers in your own guidanceIngest Publications 17, 501 and 594; get a cited CP14 answer; watch the refusal.
  6. datalabs/lab04-rag/corpus/Where your own published guidance goes before a live run — and why the repo ships it empty.
  7. toollabs/lab04-rag/ingest.pyChunk, embed, index. Deliberately boring.
  8. toollabs/lab04-rag/query.pyThe four-rule system prompt, the 0.75 threshold and the --explain trace for a governance board.
  9. Slide 12The useful pattern is a loop, not a chatbotThe knowledge flywheel: generated text is a draft until it passes the same curation as any record.
Operations · SRE · on-call

I get paged

Predict, explain, ground, act, learn. Point the same retrieval pattern at your own logs and watch diagnosis collapse from hours to minutes.

  1. Slide 12The useful pattern is a loop, not a chatbotThe useful pattern is a loop, not a chatbot.
  2. Slide 13Point the same pattern at your logsWhere the hours actually live: diagnosis. MTTR is the proof.
  3. Lab 07Ask your own logsNinety days of logs, 48 runbooks, 312 postmortems — a cited diagnosis of an OOM in seconds.
  4. Slide 17One loop, end to end: from mainframe logs to an assistant that probesOne loop, end to end: the eight-station map, and why the platform becomes the KM system.
  5. Lab 08One loop, end to endThe whole loop on one platform: logs scored, a Lightspeed draft reviewed and merged, EDA closing it in 42 seconds, the assistant citing RB-214.
  6. Lab 05Automate the toil around the modelThe remediation that follows, with the digest check people forget.
  7. Lab 04Ground answers in your own guidanceThe retrieval stack Lab 07 reuses — only the corpus changed.
  8. toolbin/lib.shLAB_PACE=step and the other knobs for rehearsing on a projector.
Facilitator · Solution Architect · partner

I have to present this myself

Everything you need to re-run the hour: the run of show, the talk track, the labs that demo well live, and the files people ask for afterwards.

  1. guideFacilitator guideMinute-by-minute timing, which labs to run live, projector settings, the honesty checklist.
  2. pagePresenter consoleThe console: 24 steps in lockstep with the deck, planted questions and 'on the ladder' beats.
  3. toolbin/run-all-labs.shRehearse all eight labs in one command; CI runs the same thing.
  4. pageInteractive deckThe Demo view plays every lab hands-free — a holding screen before you start.
  5. exportslides/slides.adocThe reveal.js cut of the deck, with speaker notes on S.
  6. exportPowerPoint exportThe PowerPoint for platforms that insist on an upload.
  7. specslides/ladder-map.jsonThe source of truth for every rung chip, if you add a slide or a product.
The one thing to remember

The ladder: data → information → knowledge → judgement

Every technology, slide and lab in the kit is tagged with the rung it serves — in rainbow order, so nobody has to learn a palette. AI moves work up the ladder; it never takes the top step. See the slide · read the definitions · the machine-readable map.

Data

What happened, uninterpreted: returns, transcripts, calls, logs, telemetry. Where it lives decides the architecture.

Information

Data in context for one case: a classification, a score, a diagnosis, a metric. What predictive AI and inference produce.

Knowledge

Information that informs an outcome: guidance, precedent, runbooks, taxonomies. The institution's memory, retrievable and cited.

Judgement

A determination someone signs. Deliberately human; automation executes what was decided, it never decides.

TechnologyRung it serves
Red Hat Enterprise Linuxdata
Red Hat AI Inference Server (vLLM)data → information
Red Hat OpenShiftdata
Red Hat OpenShift AIinformation + knowledge
KServe / model servinginformation
Granite modelsinformation
SDG Hubknowledge
Training Hubknowledge
Pipelinesknowledge
Model registryjudgement
Retrieval / vector store / pgvector / Llama Stackknowledge
Ansible Automation Platform / Event-Driven Ansibleexecutes judgement
Sigstore / cosignjudgement
FIPS modedata
Compliance Operatorinformation
TrustyAIinformation
OpenShift Logging / Lokidata
GPUs / acceleratorsdata
Predictive modelsinformation
Generative models (with retrieval)knowledge
Human reviewerjudgement
Models-as-a-Serviceinformation
llm-dinformation
Hands on

The eight labs, connected

Real commands, representative output. Run them in the browser from the deck's Labs view, watch them in the Demo view, or clone the repo and run ./bin/run-all-labs.sh. Each card says who it is for, what you will see, and what a live run needs.

01Serve a model inside your boundary02Teach it your notice taxonomy03Survive filing season04Ground answers in your own guidance05Automate the toil around the model06Prove it to your ISSO07Ask your own logs08One loop, end to end

Labs 02, 07 and 08 ship as walkthroughs: their run.sh files narrate the helper scripts they call, and those scripts are not in the repository yet — simulate mode is complete, live mode for those three is a to-do.

01

Serve a model inside your boundary

data → informationAbout 5 minutes (5 steps)

For Platform and infrastructure engineers; anyone who has to answer "where does our data go when someone prompts the model?"

Pull the signed Red Hat AI Inference Server (vLLM) image, download the validated RedHatAI/granite-3.3-8b-instruct model, serve it on localhost, and classify a real taxpayer refund inquiry without any inference call leaving the host.

The screens people remember

  • ss -ltnp shows 127.0.0.1:8000 — the endpoint has no egress path; that screen is the point
  • podman pull prints 'Signature verified — policy: signedBy release key' on the way in
  • The curl reply returns category, routing queue, missing Form 8822 and a draft for a human to sign
  • assets/inquiry.json's system prompt forbids stating a determination as final

To run it for real LAB_MODE=simulate: nothing. LAB_MODE=live: a RHEL host with a supported accelerator and CDI devices generated (nvidia-ctk cdi generate), podman, huggingface-cli, curl and jq on the path, registry.redhat.io credentials, ~20 GB free disk. Step 3 blocks in live mode; run it in a second terminal.

Run it in the browserLab guiderun.sh on GitHubWatch the demoThen: Lab 02 Lab 06
02

Teach it your notice taxonomy

knowledgeAbout 6 minutes (5 steps); hours of GPU to run live

For Subject matter experts and data leads who own notice families, routing rules and correspondence house style

Write agency knowledge as reviewable seed YAML (qna.yaml, schema v3), validate it, expand 12 seed examples into ~2,200 kept samples with SDG Hub, LoRA-tune Granite with Training Hub, and prove the tuned model beats the base.

The screens people remember

  • 12 seed examples become 2,556 generated, 2,203 kept — every sample traces to a human-written seed
  • Evaluation table: notice family accuracy 0.61 → 0.94, cites the right form 0.44 → 0.89
  • check_seeds.py is the CI gate: fail in a pull request, not after four hours of GPU
  • Keep the held-out evaluation set out of the seed data or the numbers mean nothing

To run it for real LAB_MODE=simulate: only python3 (and only checked in live mode). LAB_MODE=live: a GPU host, Python with the sdg-hub and training-hub libraries, the Lab 01 endpoint (http://127.0.0.1:8000/v1) running as the teacher model, and several hours of GPU time. Note: check_seeds.py, generate.py, train.py and evaluate.py are not shipped in the lab directory — only taxonomy/knowledge/gov/tax/notices/qna.yaml is.

Run it in the browserLab guiderun.sh on GitHubWatch the demoThen: Lab 03
03

Survive filing season

information at scaleAbout 6 minutes (6 steps)

For Platform engineers and capacity planners responsible for taxpayer-facing services at April peak

Deploy the Lab 02 model as a KServe InferenceService on the vllm-runtime, watch it become Ready in ~96 seconds, then run a 400-concurrent-user rehearsal and watch replicas climb 2 → 20 and back with no application change.

The screens people remember

  • hey -z 90s -c 400: 1,183 req/s, p95 0.612s, zero errors, replicas 2 → 20 → 2
  • manifests/inferenceservice-tax-classifier.yaml is the capacity plan: minReplicas 2, scaleMetric concurrency, scaleTarget 24
  • storageUri pinned to sha256:4b91c0e2f7a3 — the digest the authorizing official approved, not a tag
  • Scale-to-two, not zero: cold-starting an 8B model costs ~90 seconds

To run it for real LAB_MODE=simulate: nothing. LAB_MODE=live: an OpenShift cluster with Red Hat OpenShift AI installed, GPU nodes with the NVIDIA GPU Operator, oc authenticated, and hey for the load test. WARNING: step 6 consumes every GPU the namespace can schedule for 90 seconds — non-production cluster only.

Run it in the browserLab guiderun.sh on GitHubWatch the demoThen: Lab 04 Lab 05
04

Ground answers in your own guidance

knowledgeAbout 5 minutes (5 steps)

For Governance boards, correspondence reviewers and anyone deciding whether an AI answer may reach a taxpayer

Stand up pgvector on the same cluster as the model, ingest Publications 17/501/594 plus internal notice guidance (3,135 chunks), get a cited CP14 answer, then watch the system refuse a 2031 question and show exactly why.

The screens people remember

  • The refusal: 'sources: none above threshold (0.75)' — refer to a specialist, exit code 3
  • --explain prints every rejected candidate with its score against the 0.750 threshold
  • Every good answer carries a sources block: Publication 594 p.4, score 0.891
  • The corpus is queried, never learned — sensitive text stays out of training
  • The run.sh has a fifth step, the --explain trace; the deck version stops at four

To run it for real LAB_MODE=simulate: nothing. LAB_MODE=live: an OpenShift cluster, psycopg installed, an embeddings endpoint (Lab 01 or Lab 03; default http://127.0.0.1:8000/v1/embeddings), and your own guidance in labs/lab04-rag/corpus/ as .txt/.md/.adoc/.html. ingest.py --dry-run chunks a corpus with no database.

Run it in the browserLab guiderun.sh on GitHubWatch the demoThen: Lab 07 Lab 05
05

Automate the toil around the model

executes judgementAbout 5 minutes (4 steps)

For Operations and automation teams; whoever gets paged when inference saturates

Run a health playbook that tests the endpoint the way a taxpayer would (including the served-digest check against CR-8841), then start an Event-Driven Ansible rulebook and watch a queue-depth alert remediated in 62 seconds with an audit row.

The screens people remember

  • Alert 14:38:02 → job 40213 scales maxReplicas 20 → 32 → resolved 14:39:04. No ticket, no pager
  • rulebooks/inference_saturation.yml: ModelProvenanceMismatch deliberately escalates instead of self-remediating
  • awx job list shows launched_by eda-rulebook — the evidence Lab 06 asks for writes itself
  • The digest check is the task people forget; drift from the approved artefact is an accreditation finding

To run it for real LAB_MODE=simulate: nothing. LAB_MODE=live: Red Hat Ansible Automation Platform 2.4+, ansible-navigator and ansible-rulebook on the path (the rules engine needs a JDK), the ansible.eda collection, an Automation Controller with the named job templates, and Alertmanager posting to the rulebook source on port 5000.

Run it in the browserLab guiderun.sh on GitHubWatch the demoThen: Lab 06 Lab 07
06

Prove it to your ISSO

evidence → judgementAbout 6 minutes (5 steps)

For ISSOs, authorizing officials, assessors and security architects accrediting an AI workload

Run the four checks an authorizing official actually runs: cosign-verify the model against change record CR-8841, confirm FIPS and SELinux enforcing, read a real Compliance Operator result, and interpret TrustyAI drift and fairness metrics correctly.

The screens people remember

  • oc get compliancescan: ocp4-moderate DONE NON-COMPLIANT — the honest result, and it is deliberate
  • 1 of 217 checks failed (audit-log-forwarding); remediation available, or let the Lab 05 rulebook apply it
  • channel_mix drift 0.212 exceeds 0.150 — nothing is wrong with the model; more taxpayers moved to the portal
  • cosign verify names signer, timestamp and 'CR-8841 (approved by AO 2026-08-20)' before admission

To run it for real LAB_MODE=simulate: nothing. LAB_MODE=live: oc authenticated to a cluster with the Compliance Operator and TrustyAI installed, cosign on the path, the agency model-signing public key (agency-model-signing.pub), and SSH access to a GPU node (default ocp-gpu-04). Step 2 reads node configuration over SSH.

Run it in the browserLab guiderun.sh on GitHubWatch the demoThen: Lab 07
07

Ask your own logs

information → knowledgeAbout 5 minutes (5 steps)

For SREs, on-call engineers and platform leads who own mean time to restore

Point the Lab 04 retrieval pattern at operations: ingest 90 days of Loki logs, 48 runbooks, 312 postmortems and 1,240 change records (12,135 chunks), get a cited diagnosis of an OOM incident, remediate via Lab 05, and read the MTTR case.

The screens people remember

  • Cited diagnosis in seconds: CR-9012 raised max_model_len 8192 → 16384; precedent INC-2209; runbook RB-114 steps 3-5
  • MTTR decomposition: diagnose 2h 41m → 24m; total 3h 16m → 59m (-70%)
  • Same stack as Lab 04 — only the corpus changed; nothing left the cluster
  • Logs carry hostnames and case identifiers: keeping this notebook on-cluster is not optional

To run it for real LAB_MODE=simulate: nothing. LAB_MODE=live: an OpenShift cluster with OpenShift Logging (Loki), the Lab 04 vector store and model serving in place, logcli and python3 on the path. Note: ingest_ops.py and mttr_report.py are not shipped in the lab directory — only run.sh is.

Run it in the browserLab guiderun.sh on GitHubWatch the demoThen: Lab 08
08

One loop, end to end

data → information → knowledge → judgementAbout 8 minutes (8 steps)

For Everyone who has seen one link of the loop and wants the whole thing: platform, operations and the people who sign the change

Run the whole loop on one platform: 2.2 million log lines from z/OS, RHEL and OpenShift become hourly features, a tabular model scores server8-audits at 0.91, Ansible Lightspeed drafts the rulebook and playbook with citations, a person reviews and merges the pull request, Event-Driven Ansible relieves the memory pressure in 42 seconds, and the ops assistant answers 'how is server8-audits?' by probing through approved job templates.

The screens people remember

  • score.py: server8-audits 72h risk 0.91 (heap headroom -38% wk/wk, GC p95 2.4s, 2 OOM kills); outage-risk v14, AUC 0.93 on 180 days
  • PR #482: sre-lead requests threshold 0.8 → 0.85 and a maintenance_window guard, approves after 2 edits; the merge syncs AAP and indexes RB-214
  • Job 40512: Xmx 6g → 7g inside the 9g cgroup, service restarted, probe 200 OK in 0.31s, INC-2340 opened and closed; event to verified in 42 seconds, risk 0.91 → 0.34
  • ask.py: three probes (jobs 40518, 40519, 40520), every answer cited; online 13/14 with MVSB in a planned IPL window

To run it for real LAB_MODE=simulate: nothing. LAB_MODE=live: OpenShift AI with a KServe sklearn runtime and vLLM, OpenShift Logging with Vector receiving z/OS SYSLOG into Loki, Ansible Automation Platform 2.5 with Lightspeed on-prem served through OpenShift AI, an EDA controller with the named job templates, an ITSM webhook, and oc, logcli, python3, ansible-rulebook, ansible-lint, git, gh and awx on the path. Note: ingest_estate.py, score.py, lightspeed_draft.py and ask.py are representative wrappers not shipped in the lab directory; the prompt, the reviewed rulebook and the reviewed playbook are.

Run it in the browserLab guiderun.sh on GitHubWatch the demo
The narrative

The deck, slide by slide

Seventeen slides, each with the rung it serves and the line to remember. Links open the interactive deck at that slide; press N there for the presenter notes.

#SlideRungsThe line to remember
01AI foundations for intelligent tax administrationThe framing of the hour and the layered pyramid — 01 Data, 02 Information, 03 Knowledge, 04 Judgement — with the question each layer answers, the rail that says data informs every layer, the end state at the apex (knowing enough to decide) and the rule on the base: solve a problem someone has; don't invent a solution to one no one has.data information knowledge judgementThe promise: every claim made today gets run in a shell before you leave.
02Four different jobs get called “AI”Predictive, generative/LLM, agentic and automation defined as four separate jobs, each with a plain analogy, its ladder rung, and a 'what it is not' box.information knowledge judgementAnalogies: weather forecast, well-read drafting assistant, junior analyst with a restricted tool belt, checklist that performs itself.
03The work is seasonal, textual and unforgivingWhy tax agencies are the case: April demand at 6× the August low against fixed staff, rules locked in legacy code, unstructured text, and FTI rules that forbid public endpoints.dataChart title: a year of demand arrives in six weeks — the shaded gap is what automation absorbs.
04An LLM is the engine — not the whole vehicleThe six-layer stack around a model (mission app → context/RAG → model → inference → platform → compute + data) and the three knobs: prompting, RAG, fine-tuning.data information knowledge judgementFine-tuning is studying for the test. Retrieval is bringing the notebook. You want both.
05From data to judgement — and who climbs each stepThe ladder as a staircase: predictive AI climbs data→information, generative AI with RAG climbs to knowledge, and only people climb to judgement.data information knowledge judgementThe top step is marked 'stays human' — a design rule, not a technical limit.
06Predictive and generative AI answer different questionsA five-row table (learns from / produces / in tax terms / fails as / governed by) plus a Venn showing how the two compose on one platform.information knowledgePredictive fails as a bad number; generative fails as a plausible sentence — so grounding and review are non-negotiable.
07Where AI actually lands in the filing lifecycleSix lifecycle stages; intake, validation, correspondence, collections support and taxpayer service are AI-assisted with a human in the loop, while exam selection is held back.judgementExam selection is deliberately NOT highlighted — 'governance first'; saying so unprompted buys credibility.
08Five outcomes, and where each one is provenThe five event-abstract outcomes, each mapped to the Red Hat product that delivers it and the lab that proves it — the map of the rest of the hour.data information knowledge judgementModernize operations → Ansible Automation Platform · Event-Driven Ansible · OpenShift → Labs 05 · 07.
09One foundation, from bare metal to the taxpayerThe reference architecture: RHEL + AI Inference Server on GPU nodes, OpenShift, OpenShift AI (serving, training, pipelines, registry, retrieval), mission apps — with trust and automation pillars spanning every layer.data information knowledge judgementMost failures happen at the seams between systems, not inside them — the platform makes seams boring.
10The federal problem is not “get a model.” It is operate AI without giving up control.The Red Hat proposition and six take-home proof points: model freedom, data locality, Models-as-a-Service, accelerator efficiency, predictive + generative lifecycle, Ansible closes the loop.data information knowledge judgementBring the model to the mission — not the mission data to somebody else's model.
11Define the service once — run it wherever the mission needs itOne InferenceService manifest with a signed model, delivered by GitOps, deploys unchanged (oc apply) to a datacenter, an accredited cloud region, or an air-gapped enclave.data information judgementPlacement is policy, not re-architecture — moving a workload is a redeploy of the same manifest.
12The useful pattern is a loop, not a chatbotThe operations flywheel — predict, explain, ground + act, learn — with predictive ML, the LLM, RAG and Ansible each doing the one job it is good at.information knowledge judgementDo not let fluency become authority — telemetry and retrieved sources decide whether the explanation holds.
13Point the same pattern at your logs — MTTR is the proofThe Lab 04 retrieval stack aimed at logs, runbooks, incidents and change records; mean time to resolution decomposed before and after an on-cluster ops notebook.data information knowledgeBefore 3h 16m (diagnose 2h 41m); with the notebook 59m (diagnose 24m) — diagnosis -84%.
14Ninety days, then ninety moreA crawl/walk/run adoption path — Prove (days 0–90), Ground (90–180), Scale (180+) — with five concrete checklist items per phase.data information knowledgeProve = data, Ground = information, Scale = knowledge.
15What happens after this hourThree concrete asks — a half-day architecture workshop, a guided pilot with a measured baseline, and acquisition through Four Inc. and Carahsoft — plus the repo and contact strip.judgementIf you did not see it here, that does not mean it does not exist — ask.
16Eight labs — real commands, run them yourselfThe eight lab cards with their rung chips and one-line goals — the deck's concluding takeaway before the presenter switches to the Labs view.data information knowledge judgementRun this on a personal laptop — never production, never a work laptop.
17One loop, end to end: from mainframe logs to an assistant that probesLab 08 on one slide: the eight-station map read clockwise — logs land in Loki, the outage-risk model scores who fails next, Lightspeed drafts the rulebook and playbook with citations, a person reviews and merges the pull request, Event-Driven Ansible runs the approved job, the platform remembers, and the assistant answers from what the loop wrote.data information knowledge judgementThe platform is also the KM system and the documentation: every promoted change is a cited record.
18The questions an authorizing official will askThe security appendix: eight questions an authorizing official actually asks, each mapped to a platform control and where it lives.information judgementParked in the appendix on purpose — but this is the slide that unblocks the deal.
Read

Guides and documents

README — the kit in one page

5

What the repository holds (seven labs, docs, deck, exports, bin/), the three-command quick start, the seven-lab table with product and rung, the two lab modes, and the honesty note about sample content.

  • Quick start: ./bin/preflight.sh, then LAB_PACE=step ./labs/lab01-rhel-ai/run.sh, then ./bin/run-all-labs.sh — no cluster, GPU or credentials.
  • Lab table: 01 AI Inference Server, 02 SDG Hub + Training Hub, 03 OpenShift AI, 04 pgvector, 05 Ansible, 06 Compliance/TrustyAI/Sigstore, 07 Logging.
  • Warning: LAB_MODE=live in Lab 03 consumes every GPU its namespace can schedule; Lab 06 reads node config over SSH.
  • Licence is MIT; the material is event enablement, not an official Red Hat product or publication.

For Anyone opening the repo cold — the first thing to read.

Open

Docs master document — About this guide, who it is for, five outcomes, how to run

8

The book that stitches every module into one page: reader-to-lab routing, the five event outcomes mapped to labs, the env-variable table, and the Demo-view tip for hands-free playback.

  • Who this is for: 5 reader rows — platform (01,03,05), data/app (02,04), ops/SRE (07), security (06), programme leads (brief only).
  • Five outcomes table maps each abstract promise to the lab that proves it: 05, 01+02, 04, 06, 03.
  • Env table: LAB_MODE simulate, LAB_PACE auto, LAB_SPEED 0.04, NO_COLOR unset.
  • Includes 00-event-brief, labs 01–07 and 90-facilitator-guide at :leveloffset: +1, so each becomes a chapter.

For Self-guided readers choosing where to start.

OpenSource

The ladder: data → information → knowledge → judgement

4

The four-rung definitions that every slide, lab and product in the kit is tagged with, plus the 23-row table mapping each technology to the rung it serves.

  • Data = what happened; Information = data in context for one case; Knowledge = guidance, precedent, runbooks; Judgement = a determination someone signs.
  • Arrow form (data → information) marks a converter; 'executes judgement' marks automation carrying out a decision already made.
  • Table has 23 rows: RHEL data; AI Inference Server data → information; OpenShift AI information + knowledge; Model registry, Sigstore, Human reviewer judgement.
  • Ansible / Event-Driven Ansible = executes judgement; Compliance Operator and TrustyAI = information (evidence); llm-d and Models-as-a-Service = information.

For Everyone — it is the vocabulary the rest of the kit assumes.

OpenSource

Event brief — operating reality, lifecycle map, architecture, AO questions, adoption path

10

Why tax administration suits language models yet punishes normal deployment, where AI lands in the filing lifecycle, the four-layer reference architecture with two vertical concerns, and a 0–90–180-day adoption path.

  • Four realities: demand is seasonal, rules are locked in legacy code, answers are in the text, the data cannot leave (FTI).
  • Six-stage lifecycle table; only Exam selection is marked No — governance first, automation much later.
  • Seven questions an authorizing official asks, each mapped to a control and a lab (01, 04 or 06).
  • Prove days 0–90, Ground 90–180, Scale 180+; most programmes stall on the capacity plan and written data-class agreement.

For Programme and acquisition leads, ISSOs, anyone briefing leadership.

OpenSource

Facilitator guide — running the 60-minute session

8

Minute-by-minute timing for a 60-minute virtual event, which labs to run live and why, projector settings, the five planted questions, six stock answers, and a four-item honesty checklist.

  • Timing: slides 0–34 min, Lab 01 live 34–42 (stop on ss -ltnp), Lab 05 live 42–50 (the 62-second remediation), Q&A 56–60.
  • 30-minute cut: slides 1, 2, 8, Lab 01, and the drift section of Lab 06; keep slide 17 loaded for ISSOs.
  • Projector: LAB_SPEED=0.08 LAB_PACE=step, or NO_COLOR=1 if screen share mangles ANSI; 80 columns is enough.
  • Say out loud: sample notices are illustrative, numbers are representative, exam selection is deliberately excluded, a human signs everything.

For Whoever presents or re-runs the session; attendees do not need it.

OpenSource

Presenter console

60 (Sept 17, 1:00–2:00 PM)

The talk track behind every slide and lab: what is on screen, what to say, the five planted questions, per-command 'say' lines for all seven labs, and the ladder mapping per step.

  • Run of show: slides 0–34 min, Lab 01 live 34–42, Lab 05 live 42–50, skim the rest 50–56, questions 56–60.
  • Only 30 minutes? Slides 1, 2, 8 plus Lab 01 and the drift section of Lab 06.
  • Delivery rule: goal number one is to entertain — a tuned-out audience learns nothing.
  • Keys: ← → or Space to move, J jump, M read-all; Home/End; 'Read all' shows every step on one page.

For Presenters; self-guided readers who want the full talk track

OpenSource
Watch, present, download

Views and exports

Interactive deck — Labs view

Eight labs, roughly five minutes each

All eight labs as virtual terminals: press Show to reveal the next command and type it, Run to execute it, or Demo to play one lab hands-free. A card pops up on every step with what is happening, why it matters to the talk, and the seam one platform removes; a wrap card closes each lab. See the map opens the Choose-your-path graphic. Commands are real and copyable; output matches the run.sh scripts.

  • Eight terminal cards; the sidebar rail lists lab titles and scrolls to each card
  • Tab completes the next command like a shell; Show / Run / Demo buttons per lab
  • Deck's Lab 04 has 4 steps (no --explain trace) — the run.sh has 5
  • Closing card: nothing in eight labs required a public model endpoint or internet at inference time

For Self-guided readers and workshop attendees who want to type the commands themselves in a browser

OpenSource

Interactive deck — Demo view

Loops through all seven labs continuously; speed 1×, 1.6×, 2.4× or 4×

An automated walkthrough that types each lab's commands and prints the representative output, then shows the takeaway and moves to the next lab — the whole hands-on track without touching the keyboard.

  • Space plays/pauses; ← → switch labs; Restart lab and a Speed selector up to 4×
  • Header shows lab badge, product chip, time chip and rung chip; progress reads 'lab 3/7 · step 2 / 6'
  • Playback is clock-driven, so a throttled hidden tab drops smoothness but never pace
  • Ends each lab with '✓ Lab NN complete' and its Takeaway line, then loops

For Kiosk screens, booth loops and anyone who wants to watch all seven labs play themselves

OpenSource

slides/slides.adoc — the reveal.js deck with speaker notes

35

The 17-slide event narrative as asciidoctor-revealjs source: AI in plain English, why now, inside an LLM, the ladder, where AI lands, five outcomes, architecture, why Red Hat AI, one platform, ops loop, logs-to-MTTR, adoption, next steps, labs, security appendix.

  • Every slide opens with a monospace 'Rung: ...' line and closes with a [.notes] block — 17 of each; press S in the browser for notes.
  • Header: Red Hat · Four Inc. · Carahsoft virtual event, September 17, 2026, presented by Jon Keam and Brad Scalio.
  • Slide 13 'Point the same pattern at your logs — MTTR is the proof' is the ops-notebook argument that Lab 07 demonstrates.
  • Built with asciidoctor-revealjs at 1280×720, white theme, fade transition, slide numbers c/t.

For Presenters and readers who want the narrative in order.

OpenSource

PowerPoint export — redhat-ai-tax-administration.pptx

10

The upload-friendly deck for platforms and review processes that insist on .pptx: 10 slides with speaker notes covering the ladder, operating reality, lifecycle, outcomes, architecture, adoption, next steps, labs and AO questions.

  • Verified with python-pptx: 10 slides, 67,282 bytes; the reveal/HTML decks carry 17 slides, so this is a condensed cut.
  • Slide titles include 'From data to judgement — and who climbs each step' and 'The questions an authorizing official will ask'.
  • Speaker notes carry the same talk beats: stop Lab 01 on step 4 (127.0.0.1), the demand-curve argument, exam selection is gray.
  • Regenerate with make pptx; CI copies slides/exports/ to /exports/ on the site.

For Event platforms, agency reviewers, anyone who needs a file not a URL.

OpenSource

Printable PDF — the whole documentation book

45

The same content as /docs/index.html — brief, seven lab modules, facilitator guide — rendered by asciidoctor-pdf for offline or air-gapped reading.

  • Built by make pdf and by the CI build job: asciidoctor-pdf -D build -o redhat-ai-tax-administration.pdf docs/index.adoc.
  • Source is the documentation, not the slides; the slide deck's PDF-equivalent is the .pptx export.
  • Not committed to the repo; it exists only in build/ and on the published site.

For Readers in disconnected enclaves or who print.

OpenSource
Under the hood

Tools, data and specs

The lab runtime and its four knobs, the readiness check, the build, and the data files a subject-matter expert or a data team will actually edit.

VariableDefaultWhat it does
LAB_MODEsimulatesimulate prints the expected output of every command; live executes it against your environment.
LAB_PACEautostep pauses before each command: Enter runs it, s skips, q quits.
LAB_SPEED0.04seconds per character when typing commands; 0 for CI, 0.08 on a projector.
NO_COLORunsetany value disables ANSI colour — use it when screen sharing mangles it.

bin/lib.sh — the shared lab runtime (simulate vs live)

5

How every lab is a sequence of step calls — a real command plus its expected output — and how four environment variables switch mode, pacing, speed and colour.

  • Defaults from the file: LAB_MODE=simulate, LAB_PACE=auto, LAB_SPEED=0.04; NO_COLOR unset (any value, or a non-tty stdout, disables colour).
  • step "cmd" <<'OUT' ... OUT: simulate prints expected lines; live evals the command and on non-zero exit shows the expected output as the finding.
  • LAB_PACE=step prompts '[Enter] to run, s to skip, q to quit'; LAB_STEPS_TOTAL and LAB_PROMPT are per-lab knobs.
  • require_cmd exits 2 in live mode when a tool is missing; lab_footer returns 1 if any live step failed.

For Facilitators tuning a demo, and anyone writing a new lab.

Open

bin/preflight.sh — which labs can run live here

1

A never-failing readiness report: for each of the seven labs it lists the CLI tools LAB_MODE=live needs and prints 'live ready' or 'simulate only (missing: ...)'.

  • lab01 needs podman huggingface-cli curl jq; lab03 needs oc curl jq hey; lab05 needs ansible-navigator ansible-rulebook.
  • lab06 needs oc cosign ssh; lab07 needs logcli python3; lab02 and lab04 need python3 (lab04 also oc).
  • Ends by reminding that every lab runs today in simulate mode via ./bin/run-all-labs.sh.
  • It is the first command in the README quick start.

For Anyone about to run a lab, especially before a live session.

Open

bin/run-all-labs.sh — walk all seven labs end to end

3 (with LAB_SPEED=0, seconds)

The rehearsal and CI smoke test: cds into each labs/lab*/ directory, runs run.sh, counts failures and exits 1 if any lab failed.

  • Exports LAB_MODE (default simulate) so it can also drive a full live run.
  • Step totals per lab from run.sh: 01=5, 02=5, 03=6, 04=5, 05=4, 06=5, 07=5 (35 steps).
  • CI and make test call it with LAB_SPEED=0 NO_COLOR=1 for a fast, plain-text run.
  • Prints '>>> labNN' before each lab and 'All labs completed.' at the end.

For Facilitators rehearsing; contributors before a pull request.

Open

Makefile — build docs, slides, PPTX, PDF and run the smoke test

3

Ten targets that turn the AsciiDoc sources into the published site, using the docker.io/asciidoctor/docker-asciidoctor:latest container so Ruby is never installed locally.

  • docs → build/index.html; slides → build/slides.html (reveal.js 4.6.1 from jsdelivr); pdf → build/redhat-ai-tax-administration.pdf from docs/index.adoc.
  • pptx → python3 bin/build-pptx.py --out slides/exports/redhat-ai-tax-administration.pptx (needs only python-pptx).
  • lint = bash -n on bin/*.sh and labs/*/run.sh plus py_compile; test = lint then LAB_SPEED=0 NO_COLOR=1 ./bin/run-all-labs.sh.
  • RUNTIME picks podman or docker; check-runtime prints the local fallback asciidoctor -D build docs/index.adoc.

For Contributors and anyone rebuilding the site locally.

Open

.github/workflows/docs.yml — test, build and publish to GitHub Pages

3

Three chained jobs: lint and run every lab in simulate mode, build docs/slides/PDF in the asciidoctor container, then deploy build/ to Pages — only on a push to main.

  • test: bash -n over bin/*.sh and labs/*/run.sh, py_compile, then ./bin/run-all-labs.sh with LAB_SPEED=0 NO_COLOR=1 — labs gate the docs.
  • build: docs/index.html, slides.html, redhat-ai-tax-administration.pdf, then stages deck.html as index.html (and /deck.html), presenter-notes.html, adventure.html and slides/exports/ into build/.
  • publish: actions/configure-pages@v5, upload-pages-artifact@v3, deploy-pages@v4; concurrency group docs-${{ github.ref }}.
  • Only a push to main publishes; pull requests run the test and build jobs without deploying.

For Maintainers; anyone wondering why a push did or did not publish.

Open

bin/build-pptx.py — generate the PowerPoint export with native shapes

2 to run

A 652-line python-pptx script that builds a 10-slide 16:9 deck with speaker notes and editable graphics rather than screenshots, using the same palette as the HTML deck.

  • Native drawings: a cosine-interpolated filing-season demand curve, a six-chevron lifecycle flow, a layered architecture, a three-phase roadmap.
  • Palette matches deck.html: Red Hat red #CC0000 plus the rainbow rung scale (red, orange, green, violet); fonts Red Hat Display/Text/Mono.
  • Slide 2 draws the ladder as a rising staircase of four rung cards with technology captions.
  • Usage: python3 bin/build-pptx.py [--out slides/exports/redhat-ai-tax-administration.pptx]; requires pip install python-pptx.

For Contributors regenerating the export after changing the narrative.

Open

Shared AsciiDoc attributes — product names and lab defaults

2

The single place product names and environment defaults are defined, so a rename is one edit; explains the {rhaiis}-style tokens seen throughout docs/.

  • Product tokens: rhel, rhaiis (Red Hat AI Inference Server), ocp, rhoai, aap, eda (Event-Driven Ansible).
  • Lab defaults: ns tax-inference, base-model granite-3.3-8b-instruct, tuned-model granite-8b-tax-v1, change-record CR-8841.
  • Rendering: :toc: left, :sectnums:, :sectanchors:, rouge highlighter, :idprefix: empty, :idseparator: - (so auto ids are plain kebab-case).
  • repo-url attribute points at https://github.com/nommsweyMX/redhat-ai-tax-labs.

For Contributors editing docs or adapting the kit to their own estate.

Open

slides/ladder-map.json — the rung tagging source of truth

3

The machine-readable theme: four rungs with colours and CSS classes, per-slide rung lists and item tags for all 17 slides, the seven lab chips, and 23 technology mappings the docs table mirrors.

  • Rungs in rainbow order: data #CC0000 r-data, information #C2410C r-info, knowledge #1E7A55 r-know, judgement #5B2E91 r-judge — yellow and blue are only the in-between segments of the ladder track.
  • Chip conventions: plain ('Knowledge'), arrow ('data → information'), automation ('executes judgement'); CSS for the pill is included.
  • Slide 14 note records the mapping prove/ground/scale = data/information/knowledge, verbatim from the Sept 3 planning call.
  • deck.html, presenter-notes.html, slides.adoc, docs/ and README must agree with it; bin/build-adventure.py reads it to build this page.

For Contributors changing the theme or adding a slide, lab or product.

Open

.gitattributes and .gitignore — LF enforcement and what never gets committed

1

Why the lab scripts run identically on every machine: every textual file is forced to LF, and lab working directories and the guidance corpus are excluded from git.

  • * text=auto eol=lf, with explicit LF for .sh .py .yml .yaml .adoc .json .ini and Makefile; .pptx .png .pdf binary.
  • Ignored: build/, __pycache__, labs/*/sdg/, labs/*/checkpoints/, labs/*/.venv/, labs/lab04-rag/corpus/* (except README.txt).
  • Rationale in the file: CRLF in a shell script is a runtime error that only shows up on someone else's machine.

For Contributors.

Open

Data you will replace with your own

Notice taxonomy seed — qna.yaml for SDG Hub

knowledge3

What a subject-matter expert actually writes to teach a model agency vocabulary: short contexts plus question/answer pairs in the qna.yaml taxonomy format, reviewed like code.

  • version 3, domain tax_administration, created_by revenue-modernization-team; 4 seed contexts and 9 question/answer pairs (docs say '12 seed examples').
  • Contexts: CP2000 is a proposal not a bill (30 days, Automated Underreporter); CP14 first balance notice with four payment options.
  • Third context: refund inquiry after a move — Form 8822 first, then the refund trace; fourth: house style, one action per paragraph.
  • Memorable line: 'The model drafts; it never sends' — a named reviewer edits and signs every reply.

For Data teams and the SMEs who will write the real taxonomy.

Open

labs/lab04-rag/corpus/ — the empty guidance drop zone

knowledge1

Where your own published guidance goes before a live ingest, and why the repo ships it empty: agency material must never be committed to a public repository.

  • README.txt is a one-line placeholder: drop published guidance here (PDF, HTML or text).
  • gitignore excludes labs/lab04-rag/corpus/* except README.txt; sdg/, checkpoints/ and .venv/ under labs are also ignored.
  • ingest.py only reads .txt .md .adoc .html .htm — PDFs must be converted first.

For Anyone preparing a live run of Lab 04.

Open

labs/lab04-rag/ingest.py — chunk, embed and index guidance into pgvector

knowledge5

A deliberately boring ingestion pipeline: fixed-window chunks with overlap that prefer paragraph breaks, embedded via an OpenAI-compatible endpoint and upserted into a pgvector table with an HNSW cosine index.

  • Defaults: --source ./corpus, --chunk 800, --overlap 120, --embed-model granite-embedding-125m, --batch 32; reads .txt .md .adoc .html .htm.
  • --dry-run (used in the lab) walks the corpus and reports chunk counts with no psycopg, endpoint or database.
  • Creates table tax_guidance(uid, source, ordinal, body, embedding vector(768)) and index tax_guidance_hnsw with vector_cosine_ops.
  • Env: EMBED_ENDPOINT default http://127.0.0.1:8000/v1/embeddings; PGHOST PGPORT PGDATABASE(tax_guidance) PGUSER PGPASSWORD.

For Data and application teams building retrieval over published guidance.

Open

labs/lab04-rag/query.py — cited answers, and the refusal that is the point

5

Retrieval-augmented answering where the important behaviour is refusing: below a relevance threshold it says it has no guidance, recommends referral, and exits 3 so a workflow can route to a human.

  • RELEVANCE_THRESHOLD = 0.75, TOP_K = 6; score is 1 - cosine distance from pgvector's <=> operator.
  • --explain prints the retrieval trace — every candidate, its score, accepted/REJECTED, the threshold and the decision — for a governance board.
  • System prompt has four rules: only the passages, cite every claim, say so and refer if unanswered, never state a taxpayer determination as final.
  • Defaults: --model granite-8b-tax-v1, temperature 0.1, max_tokens 600, INFERENCE_ENDPOINT http://127.0.0.1:8000/v1/chat/completions.

For Data teams and governance staff asking how hallucination is stopped.

Open
Steal these

The talk track — five planted questions

The exchanges Jon and Brad rehearsed, and the answers. They work just as well in your own briefing.

planted question

“So is AI taking our jobs?”

Jon asks; Brad answers that AI is not coming for your job because right now it does not have judgement — the ladder's top step stays human.

  • The make-the-tests-pass story: told to make tests pass, the AI edits the code until they do — information, not judgement.
  • Optional garnish, attributed to Karpathy: you can outsource intelligence but not understanding.
Open the console
planted question

“What’s a seam?”

Jon plays the foil; Brad answers with the pants analogy — failures happen at integration seams between systems, never in the middle where the fabric is strongest.

  • RHEL and OpenShift interoperating layer to layer is what makes the seams boring.
  • 'We are not the only ones who do it — but we are uniquely positioned.'
Open the console
planted question

“What is fine-tuning to you, Jon?”

Brad cold-asks Jon on the architecture slide; the answer reprises 'fine-tuning is studying for the test, retrieval is bringing the notebook' and turns information into actionable knowledge.

  • Jon calls 'how do you turn information into actionable knowledge' the core of the whole talk.
  • Fine-tuning is durable behavior — never facts that change each filing season.
Open the console
planted question

“What do you actually mean by lock-in?”

Jon plays the foil ('I thought we already bought the software'); Brad answers with the phone-plan analogy: modern lock-in limits future decisions without you knowing.

  • A plan where you cannot call Pizza Hut, only Domino's — real lock-in is bespoke hyperscaler-unique services.
  • Honest caveat said out loud: sometimes you legitimately need a native service; the ask is only infrastructure as code.
Open the console
planted question

“What is a predicament versus a problem?”

Jon asks; Brad answers that a problem you solve today while a predicament you can only plan around — so a hypothetical GPU shortage must not stall the pilot.

  • Plan for problems, not predicaments: the problem now is grounding the proof so you can scale.
  • Success test: no decision made today may limit your options tomorrow.
Open the console
Your move

Take it home

Reach us — Brad is your connector
Brad ScalioRed Hat · if nothing else, he will get you to the right personbscalio@redhat.com

Four Inc. and Carahsoft carry the contract vehicles — bring them into the conversation early, not at the end.

the next decision is yours
Already a Red Hat customer? Ask for your Solution Architect.Not sure who that is? Email Brad, open a ticket in the Customer Portal and ask support, or ask through your management line. The foundational questions are free to ask and expensive to skip.
Start a community of practice.A standing group across platform, security and mission teams, built around one workflow. We will help seed it and we will show up.
Bring your hardest question.Air-gapped operation, FedRAMP boundaries, accelerator scarcity, model provenance. If you did not see it here, that does not mean it does not exist — ask.
Book the architecture workshop.Half a day with your platform and security teams to size accelerators, place the first workload and name the data classes in scope — then a guided pilot with a measured baseline.