[devantler]

The first Wedding database recovery run refused before its first database command because the pinned Flux reconciliation digest had one mistyped hex character. The live history records ba344a9c; the recovery guard expected ba344e9c.

This corrects the exact pre-loss witness, covers it with a regression test, and reports only an allow-listed phase name when a trusted recovery run refuses. Untrusted invocations still receive the generic message and no subprocess details.

Validation:

• node --test tests/wedding-db-incident-recovery/recovery.test.mjs
• git diff --check
• Read-only production replay of every source guard; all guards passed and a wrapper blocked the first intended mutation at SELECT pg_switch_wal()
• Live witness re-read from the Wedding Flux Kustomization: 2026-09-09T01:57:41Z, successful reconciliation, exact digest, and exact origin revision

The failed run created no backup, recovery cluster, PVC, network policy, proof ConfigMap, or staging schema. Its cleanup job succeeded, so retrying after this change is deployed starts from the original fenced state.

[devantler]

@codex review Please review the current head 92092f1, especially the exact pre-loss witness and the refusal-phase disclosure boundary.

[devantler]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 57 minutes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T21:07:07.073083Z	92092f1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 71ba0001-a785-4d6f-88a0-52177450021b

📥 Commits

Reviewing files that changed from the base of the PR and between ab9987a and 92092f1.

📒 Files selected for processing (2)

• scripts/recover-wedding-db-incident.mjs
• tests/wedding-db-incident-recovery/recovery.test.mjs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 92092f1232

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".