[devantler]

🤖 Generated by the Daily AI Engineer

Why

The reviewed Coroot and OpenCost-retirement profile existed only as test fixture wiring. Operators could not select it without copying that wiring into template-owned files, where template sync would overwrite the change.

What

• promote the staged composition into stable Docker and Hetzner controller, infrastructure, and apps profiles
• add alternate local and production cluster paths selected through the instance-owned KSail config
• remove OpenCost resources, cross-layer references, and Headlamp's stale OpenCost plugin from both profiles
• scope Coroot's required host-security policy exceptions to the explicit profiles while keeping default enforcement unchanged
• preserve every default cluster/provider render and the Hetzner-only audit forwarder boundary
• document the profile as transitional: Coroot is enabled, OpenCost is absent, and the remaining legacy metrics/log stack stays until later Sync observability stack to Coroot (+ audit-log-forwarder) like the reference platform #65 slices

This does not introduce an OpenCost-to-Coroot Prometheus handoff while devantler-tech/platform#2689 remains unresolved.

Fixes #88
Part of #65
Part of #24

[devantler]

🤖 Generated by the Daily AI Engineer

Readiness evidence for df14390a3c939f3b72b63f4a1c24038a55ede9d5:

• ./scripts/validate-observability-option.sh passes the default-off and selectable Coroot render contract.
• ./scripts/validate-naming.sh, the shared Helm remediation-policy validator, bash -n, ShellCheck, and git diff --check pass.
• Direct KSail validation succeeds for both unchanged default provider configs (257 rendered files each).
• Byte-for-byte comparison confirms the six default cluster/provider entrypoints are unchanged from origin/main.
• Four semantic negative controls fail closed: a stale apps selector, omitted apps component, Docker audit-forwarder leakage, and omitted controller cleanup.
• User trial: following the documented one-line kustomizationFile change, both clusters/local-coroot and clusters/prod-coroot validate successfully through KSail (257 rendered files each), without creating or mutating a cluster.
• Independent static re-review found no remaining P0/P1 issue; both combined profiles contain zero OpenCost references, including Headlamp plugin configuration.

The PR remains draft pending a supported green review at this exact head and CodeRabbit pre-merge evidence.

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df14390a3c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

Updated readiness evidence for bfd62e9f7d5a7db84d9a704b663d559276309c55:

• The current-head CI rollup is green and the branch is CLEAN.
• The prior P1 is fixed and its thread resolved: all seven relevant Kyverno rules now exempt observability only in the explicit Docker/Hetzner Coroot profiles; the default profiles keep enforcement.
• The focused validator demonstrated the regression before the component existed and now passes for both profiles and both unchanged defaults.
• Naming, shared-policy, ShellCheck, syntax, and diff checks pass.
• User trial at this head: selecting clusters/local-coroot and clusters/prod-coroot through the documented KSail field validates both complete 257-file payloads without creating or mutating a cluster; the original config files were restored byte-for-byte.
• Independent P0/P1 security re-review found no remaining blocker or other enforcing policy that would reject the workloads.

The PR remains draft pending a fresh supported green review at this exact head.

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bfd62e9f7d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Daily AI Engineer

Updated readiness evidence for 1e7956c0ff703afd031657f8d42342ceb9ac6e97:

• Current-head CI is green, merge state is CLEAN, and all review threads are resolved.
• Coroot's Kyverno and Kubescape exceptions are profile-only across both providers; defaults remain enforced, health-probe controls remain enforced, and the focused validator checks every relevant rule/exception count.
• The operator guide now requires the safe selection and revert sequence for each config: workload push → cluster update → workload reconcile; an ordered executable assertion prevents omissions or reordering.
• Focused observability, naming, shared-policy, Bash syntax, ShellCheck, and diff checks pass.
• User trial at this head: both documented Coroot selections validate their complete 257-file payloads through KSail without creating, updating, or reconciling a cluster; the original configs are restored byte-for-byte. The write-bearing command sequence was verified against the pinned KSail command surface and repository deployment flow, not executed against infrastructure.
• Independent P0/P1 re-review of the final render and command ordering is clean.

The PR remains draft pending a fresh supported green review at this exact head.

[devantler]

🤖 Generated by the Daily AI Engineer

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 1e7956c0ff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".