[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

What changed

• replace the Hetzner-only audit-collector removal component with one shared Coroot-profile component that removes HelmRelease/loki, HelmRelease/alloy, HelmRelease/alloy-audit, and their now-unconsumed HelmRepository/grafana from both providers
• remove the dead Grafana Loki datasource only in the Coroot profiles; Tetragon continues using its existing HelmRepository/cilium
• keep the default Docker and Hetzner observability payloads byte-for-byte unchanged and document that kube-prometheus-stack remains until the metrics/alerting slice is proven separately

Why

Selecting Coroot still deployed a second logging backend and collector path that the reference Platform no longer carries. Loki and Alloy form one coupled path, so retiring them together is the smallest coherent step toward #65 without also changing metrics or alerting.

Validation

• RED: the strengthened observability gate failed because Docker Coroot still rendered alloy-audit
• GREEN: ./scripts/validate-observability-option.sh
• review RED: after Codex identified the stale Tetragon assumption, the gate failed on the retained but unconsumed HelmRepository/grafana
• mutation controls: the gate rejected removal of the new component from Docker, removal from Hetzner, removal of Alloy from the default stack, and retention of the dead Grafana source
• ./scripts/validate-naming.sh
• ./scripts/validate-shared-cluster-policies.sh
• ./scripts/validate-recommended-labels-option.sh
• ksail --config ksail.yaml workload validate (97 kustomizations, 258 files)
• ksail --config ksail.prod.yaml workload validate (97 kustomizations, 258 files)

KSail emitted the existing Testkube OCI-render warning and validated those HelmRelease resources as-is; both commands exited 0.

User-path evaluation

Rendered the default and selectable Coroot profiles through the documented static operator path. Defaults match origin/main byte-for-byte and retain Loki, both Alloy releases, and their Grafana source. Each Coroot profile has none of those releases, their datasource, or the unconsumed chart source, and keeps the documented Coroot activation path valid. Per this template's safety contract, no cluster was started or mutated.

Fixes #96
Part of #65

[devantler]

🤖 Validation record from the Daily AI Engineer (Codex instance)

Validated exact head c3d53e0a952f3d2428fe42339aa1961d5274d2dd:

• TDD RED: the strengthened gate rejected Docker Coroot because it still rendered alloy-audit before implementation.
• TDD GREEN: the observability-option gate passed after the shared retirement component landed.
• Negative controls: the gate rejected omission of the component from Docker, omission from Hetzner, and deletion of Alloy from the default stack.
• Static gates: naming, shared-policy, recommended-label, local KSail, prod KSail, and git diff --check all passed; each KSail run validated 97 kustomizations and 258 files without starting a cluster.
• User evaluation: default provider renders retain Loki and both Alloy releases; both documented Coroot profiles remove all three releases and the Loki datasource while retaining HelmRepository/grafana for Tetragon.

[devantler]

🤖 Review request from the Daily AI Engineer (Codex instance)

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c3d53e0a95

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Exact-head re-review request from the Daily AI Engineer (Codex instance)

The Grafana-source finding is fixed at d8a25e18ea8a42511d94680de29e186677d9fcc2. Tetragon's live source is HelmRepository/cilium; the Coroot component now deletes the unconsumed Grafana source, and the validation gate rejects its retention.

At this head, the focused gate, its dead-source ablation, naming, shared-policy, recommended-label, local KSail, and prod KSail validations all pass. Both KSail runs validated 97 kustomizations and 258 files without starting a cluster.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: d8a25e18ea

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".