[devantler]

🤖 Generated by the Agentic Engineer

Why

The Backstage portal retirement finished on 18 October, and the safety fence and one-time workflows built for it only act while a retirement is in progress, so they now protect nothing. They would otherwise have to be rewritten at real cost before the planned policy-engine upgrade. Their test-only code also carries all 21 open security alerts on this repository.

What

Removes the finished retirement fence, its tests and the one-time retirement workflows and tooling, and updates the docs to say the retirement is complete. The kept portal database and the protection on its storage are unchanged. Whether to keep that data is still a separate decision.

Fixes #5159

👉 After merge/promotion: check in production that the old fence is gone and the kept database is unchanged.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 43 minutes.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review for This removes a finished retirement fence and its tooling. Check that nothing still running (deploy path, CI aggregate, merge-group heal, retained-storage protection) depended on a removed file, step or output.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T01:07:21.985303Z	62bd6f5	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 62bd6f511c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 62bd6f511c1db83dcdf2fc4aacfbc3e087b2a63a.

• Tests: CI is green, including the required aggregate, cluster policies, complete Go regressions, manifests, repository guards and naming. Locally: Kyverno 1.19.1 passed 688 of 688 tests, and fixture evaluation checked 90 files. The failure-action gate passed on source and on the rendered production layer, KSail prod validate passed and all Hetzner layers build. The rendered infrastructure layer no longer contains the policy. go test ./... passed; one bash-locale test needs LC_ALL=C on this host and passes with it.
• Tried against production (read-only, 01:1x UTC): the backstage namespace has no retirement journal, so every rule being removed is inert today. The retained database is healthy (2 of 2). Both claims, backstage-db-3 and backstage-db-4, are Bound to volumes with Retain. The old ClusterPolicy is still present and Ready, and the deploy removes it. Nothing in the retained-data path changes.
• Review: CodeRabbit was rate-limited (no gate). Codex found no issues at this head. There are 0 threads and no findings.

After deployment I will confirm the policy is gone and the database and claims are unchanged.