Repository navigation
feat(tenants): prepare verified source upgrades - #5364
Conversation
Signed published head 76af10d implements the bounded #5361 staging increment. The missing preparation operation was RED before implementation. A later real constructor-change race was also RED: preparation incorrectly accepted a constructor changed during observation. Final declaration, constructor, admission and complete-discovery checks now reject it. The real preparation/discovery/regeneration test passes positive upgrades from bootstrap and observed bindings, preserves the prior observation until replacement verification, and exercises 23 explicit refusal cases. Existing canonical admission, raw/rendered attribution, output-race, publication-binding and both legacy publisher-family regressions remain green. ShellCheck and actionlint pass; the workflow's path selection and native invocation include the new regression. The actual evidence-only publication verifier and read-only production source observation generated the proposed v2.0.0 files. The final invocation used data exported from actual Platform main ac76568; it independently verified source 2eca5f823676adde374556848cf8bf86eb139804, manifest sha256:2f43bf60c87e373ab99f9fc08f187287d9526b3f1b3212b6234e2ae80b9c5e82 and the already approved publisher 467f07582436a26b62cf4aa756423512f85ba0c0, then reobserved the unchanged existing generation-1 source. Only generated admission/Tenant files were copied into this checkout. The old applied digest remains sha256:fa22e5796a39872feb8c75b5d56e2c6d68ff289230e2c5762f0bbfa0b30d6744; the new digest is proposed, not applied. No cluster or private-value write occurred. Both KSail provider validations exit zero and explicitly cover the changed business-site Tenant. Their output includes skipped Helm rendering for an unavailable credential helper and offline namespace-policy warnings; those are retained limitations, not claims of full Helm/runtime coverage. The candidate keeps webApp, source.reconcileApplication, externalDns and sops false. Fresh complete hosted CI, substantive exact-head review, normal protected merge and actual Flux source/signature acceptance remain required. This PR does not activate the portal. |
Exact-head repair evaluation: 6433a5f. The initial CI failure is preserved as failure. The unchanged validators were reproduced locally with their exact supported kubectl 1.36.2 and Trivy 0.74.0. Their independently observed deltas contain only the business-site Tenant: one authorization fingerprint and one instance-content fingerprint. The Tenant diff changes only the immutable source digest; its publisher, constructor and all application/DNS/SOPS capability switches remain unchanged and disabled. The repair records those two intended fingerprints. No finding count, severity, graph fingerprint, authorization rule, threshold or scanner behavior changed. The complete authorization package passes, including all seven source-removal/capability/publisher/artifact refusal controls; the actual production authorization CLI passes. The unchanged Trivy scan passes over 17 templates from two graphs and three committed instances. The pinned KRO/API-server compiler fixture passes, including source-only activation and all invalid-source/transition controls. This is still a reviewed proposal. No cluster resource was changed, and no new source application, customer login, worker or payment flow is claimed active. Fresh CI and substantive current-head review remain required before promotion. |
@coderabbitai review |
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 27 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
cr:no-gate@6433a5f. The single ordered CodeRabbit request was explicitly refused: authenticated reply 6411972979 and summary #5364 (comment). The summary's 08:50:47Z event states a 16-minute recovery, ending 09:06:47Z; the primary was reread while that window remained active. Scope is this public repository/head and its included OSS allowance. This is not a code finding or green review. The no-gate guard admits progression; no paid review, credit reset or duplicate request is used. |
@codex review for correctness and security of source-only upgrades, including all fourteen changed files and the two fingerprint records |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6433a5f7e8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@coderabbitai full review |
|
@codex review |
For cb35f74, CodeRabbit's authenticated response reports the included review limit, with a 48-minute recovery from its 10:40:11 UTC event: #5364 (comment) . The edited summary binds this exact head and independently states the same active limit. No usage-based billing or credits were used. The complete current-head read contains no substantive CodeRabbit review; review-no-gate-guard returns ADMIT. Recorded progression: cr:no-gate@cb35f74. The ordered Codex request is #5364 (comment) . An acknowledgement is not a verdict; promotion remains held for a substantive current-head result and the other gates. |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness at GitHub-verified signed head cb35f74: all six exact-head workflows and all 39 native check runs are successful or skipped; the complete comment/review/inline/thread read has no unresolved finding. Codex's clean receipt is #5364 (comment) and its updated summary reports no findings at this same head. CodeRabbit's explicit current included-review limit is recorded separately, not treated as green. Configured native code_quality remains UNVERIFIED because its head analysis is unreadable; no COMPLETE result or waiver is claimed. I exercised the current preparation command against a fresh data export of actual current Platform main, real read-only production source observations and the unchanged authenticated publication verifier. It generated a new v2.0.0 proposal, independently binding business-site source 2eca5f823676adde374556848cf8bf86eb139804, manifest digest sha256:2f43bf60c87e373ab99f9fc08f187287d9526b3f1b3212b6234e2ae80b9c5e82 and the approved publisher 467f07582436a26b62cf4aa756423512f85ba0c0. The command reobserved the existing source before producing its new private output. webApp, source.reconcileApplication, externalDns and sops remain false. No cluster mutation occurred. The real preparation/generation regression families pass against the integrated base, including all eight independently demonstrated unsafe replacement-policy/observation cases. Readable required gates pass, the PR is conflict-free/CLEAN and the worktree holder is this invocation. The only subsequently merged base change is an aggregate-action pin; the protected merge queue will validate the combined tree. Promotion-triggered checks must settle before queue entry. Issue #5361 stays open until the actual replacement source is verified/applied; this proposal does not activate the portal. |
The merge queue removed this PR at 12:12 UTC after newer main revisions introduced a conflict in the source-binding registry. The preceding queue build passed; this was not a failed test or a reason to bypass protection. Signed head The PR is draft again while fresh CI and substantive current-head review run. Old review green does not apply to this changed head. No production reconciliation, application activation, forced merge or queue override occurred. |
The fresh pre-review read found a conflict with subsequently merged main #5366, which moved the existing publication-generator regressions into their own required job. No review request was spent on the conflicting head. Signed head The proposed source binding, signed-publication tuple, constructor and disabled application settings did not change. The PR remains draft for fresh hosted CI and substantive exact-head review; neither earlier green applies to the changed head. No merge-queue override or production mutation occurred. |
@coderabbitai full review |
|
CodeRabbit explicitly refused the requested review because its included quota is exhausted (authenticated reply 6417287072). The fresh no-gate guard reports ADMIT for this exact head: no substantive CodeRabbit review was delivered. Proceeding to the next included lane; no paid review or quota reset is requested. |
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Ready at signed head I exercised the real operator command at this head against freshly fetched main The independent CI registration control was RED without the new regression command and GREEN when registered in the required generator partition; race tests, the partition controls and actionlint pass. The existing PR body passes the current template contract. Fresh process/claim checks show only this session. GitHub reports MERGEABLE/CLEAN. Configured native code_quality remains UNVERIFIED/UNKNOWN; it is neither declared complete nor waived. A normal protected, exact-head queue operation remains required, followed by actual source-acceptance verification; proposal generation is not deployment or portal activation. |
Why
The portal's staging registration cannot safely replace its already verified website package. Treating the replacement as already applied would hide whether deployment succeeded.
What
Adds a reviewed upgrade path and proposes the verified replacement while keeping the application disabled. The existing verified version remains recorded until the replacement is actually accepted.
Part of #5361