[devantler]

🤖 Generated by the Agentic Engineer

Why

Kyverno's reports controller is still producing misleading fatal events in Coroot. The earlier logging repair covered admission only, leaving the other controllers exposed to the same severity misclassification.

What

Use structured logging across every controller while preserving verbosity, complete notices and genuine warning, error and fatal reporting. Extend the existing regression to cover all producers and the observed deprecation-notice failure, using the deployed consumer version.

Part of #4919

[devantler]

🤖 Generated by the Agentic Engineer

Validation at signed 04daacb0c762aaff8db942e7165df84e45fcd055, including current main c25cb3c45e8d5afe87659c5e228168f2e77a0c8f:

• RED/GREEN: the native chart regression failed for background, reports and cleanup controllers before the shared formatter was added; admission already passed. All four now pass with every argument except text-to-JSON formatting unchanged, including verbosity. The runtime manifest delta is four lines and does not change admission scope, failure actions, resource filters, security configuration, replicas or image versions.
• The actual CRI consumer reproduces the colored informational Alert deprecation notice as critical. Its structured counterpart retains the original informational level, complete notice and logger attribute. Trace/debug/info/warning/error/fatal controls preserve their actual severities and attributes. Required native Helm 4.2.0 race tests pass; no native coverage was skipped in that run.
• Dependency provenance was corrected before review: the immutable deployed custom node-agent is built from upstream ee62018e73b90b1549f5b81ba0d3d6e28851a1df, which uses logparser 1.4.0. The only import here is this test. Its prior 1.4.2 pin was not deployment proof; the tests now use 1.4.0, and the production image is untouched. Module tidiness, targeted vet and lint pass.
• The full root-module suite initially rejected the expected authorization-ledger movement. The pinned native kubectl 1.36.2/Kustomize 5.8.1 validator confirmed exactly one changed HelmRelease and no added/removed authorization entries. The explicit formatter-only approval and rationale are recorded; the native validator and authorization/consumer race suites pass. The final complete go test ./... run passes after that repair and main integration.
• Both configured KSail validation commands exit zero and explicitly include the affected Kyverno files, 127 kustomizations and 736 files. They still report unrelated OCI-chart render skips because the host's Docker credential helper is absent; a clean per-command registry configuration did not remove those warnings. Those renders remain UNVERIFIED, not blanket validation coverage. The affected Kyverno chart is independently rendered by the required native regression. The post-renderer inventory guard passes; Kyverno has no selected post-renderer, so a targeted probe correctly reported nothing checked rather than furnishing coverage. The complete PDB guard passes across two clusters and 29 rendered charts.

User evaluation exercised the real chart boundary and CRI parser with the observed message shape, not a substitute parser. Fresh OIDC readback confirms admission already uses JSON while the other three deployed controller types use text; all eight controller pods are Ready. Correctness, simplicity and security self-review found no additional issue: use the existing shared formatter, retain all original severity controls, and change no authority or production credentials.

Hosted current-head CI 38754654939 and substantive exact-head review remain required before promotion/merge. Actual rollout and separated producer/Coroot acceptance remain open under #4919; neither historical log entries nor thresholds were changed.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T15:48:34.316662Z	04daacb	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 04daacb0c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at signed 04daacb0c762aaff8db942e7165df84e45fcd055: the complete hosted CI run 38754654939 is successful, with the required aggregate check and all readable required workflow gates present and green. GitHub's configured code-quality rule has no head-specific readable verdict; its native merge policy remains authoritative, not assumed complete from the visible rollup.

Codex's completed exact-head review reports no major issues; the full conversation, review objects and thread census contain no outstanding finding. All four source commits have valid signatures and the branch is mergeable. The native chart and actual CRI-consumer evaluation, RED/GREEN proof and validation limits are recorded in the earlier validation comment. The change retains informational notices and genuine warning/error/fatal levels; it does not silence messages or weaken checks.

This is ready for the ordinary merge queue, not evidence of rollout or alert clearance. #4919 stays open for deployment readback and separated live producer/Coroot samples.