[devantler]

🤖 Generated by the Agentic Engineer

Why

Production deployments on the default branch have failed every run since late on 17 October, so nothing merged since then has reached the cluster. The public schema used to check our two app blueprints (tenant and web app) now requires them to say whether they are namespace-wide or cluster-wide, and ours relied on the old unstated default. The same failure also blocks every other platform change that reaches this check.

What

Both blueprints now state the namespace-wide setting they already used, so their behaviour is unchanged and the check passes again. This is the small fix on its own, split out of the larger retirement change so the deployment pipeline does not wait for it.

Fixes #5062

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 21 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 21 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a0202ede-f439-4dce-b17f-e180bf91b69b

📥 Commits

Reviewing files that changed from the base of the PR and between 7120bf1 and ff3ea22.

⛔ Files ignored due to path filters: 1

• scripts/rgd-template-static-scan-baseline.tsv is excluded by !**/*.tsv

📒 Files selected for processing: 2

• k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml
• k8s/bases/infrastructure/resource-graph-definitions/webapp/resource-graph-definition.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T16:40:41.284328Z	befe5d8	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: befe5d860a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at befe5d86

• Tested: all 27 required checks pass at this head, including 🔐 Validate Production Authorization — the exact step that has failed every default-branch deploy since 17 October (kro now requires schema.scope on RGDs). Pinned baselines (RGD content hashes, EKS CI approved surface) were regenerated, not edited past.
• Reviewed: Codex reviewed befe5d860a with no findings; CodeRabbit was rate limited. 0 review threads.
• Tried as a user: the change is the two scope: Namespaced lines — the value kro already defaulted to — so tenant and web-app instances keep their namespaced behaviour; the authorization validator, which is what a deploy runs, accepts both blueprints.

Promoting and queueing for merge.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: #5042 | upstream | last-verified 2026-10-18: every production deploy, including Heal Prod of main, fails reconciling flux apps on the Backstage retirement hold (Namespace/backstage denied by Kyverno); the merge-group deploy for this head failed there at 18:08Z (run 39150407956) after a manual dequeue at 18:02Z; re-queue at befe5d8 once apps reconciles (codex lane's platform#5048 is the recovery in queue)

[devantler]

🤖 Generated by the Agentic Engineer

Closing as delivered through merged #5048, not as an abandoned fix. The complete five-file change census was read from this PR and compared with current main 1f52943d35eb1f8e7edbdfb6102775e04063f006: both RGD definitions, the generated nested-RGD baseline, the production-authorization implementation and its approved surface are byte-identical to this PR's signed head befe5d860a9d8486e44cc7309817322608bf2b8d.

No source change remains to merge here. This branch has no live local holder, active review request or merge-queue entry; it is not being requeued or deleted.

#5062 remains open for its explicit current-main CD-success criterion. Current-main deployment 39159625325 and retirement recovery #5042 remain with the active recovery owner. This closure does not claim runtime recovery or waive any acceptance gate.