[devantler]

🤖 Generated by the Agentic Engineer

Why

Public staging needs a delivery hold in place before its application is enabled, so checks can finish before visitors reach it. Installing the hold separately avoids a brief exposure during the first rollout.

What

Prepare a production-only hold for the business staging service, with boundary checks in CI. Application reconciliation stays disabled; verifying the running service, private input delivery and recovery remains part of the staging rollout.

Part of #5247

[devantler]

🤖 Generated by the Agentic Engineer

At signed head bc41abd0e37ade4bfb57c58c201032845aa7f691, the real production render contains one namespaced hold selecting only the business-site workload and denying Gateway ingress to its application port. The public application remains disabled and the local overlay has no such hold. The check was RED without the hold, then GREEN with all seven missing/widened/wrong-direction/port mutations refused. ShellCheck, diff checks and the existing CI routing/result controls pass; inspection of the actual workflow finds exactly one mandatory invocation.

Both schema-aware local and production validations exit 0. Their output explicitly validates the changed hold and Tenant files. Some unrelated Helm expansions are skipped because the host's configured Docker credential helper is absent; those warnings are retained, not reported as complete chart coverage. Hosted CI remains required.

The design follows Cilium's documented Gateway ingress identity and deny precedence. These are design evidence, not a measured datapath result. No workload is enabled by this increment. Before any later exposure, #5247 must still verify realized policy/endpoints, protect the Platform-owned hold from tenant changes, validate private-input projection and restricted health, and prove hold → public service → isolation → recovery. Runtime acceptance and portal activation are not claimed here.

[devantler]

🤖 Generated by the Agentic Engineer

Signed correction 569351f07e4f0c10a852d18cd964ce87cc405842 changes only the new test's tracked mode from 100644 to 100755. The actual CI failure was repository-guard job 121855495617 in run 40403584249, not a successful run or an infrastructure retry.

The exact test-entry guard reproduced RED before the mode change and passes afterward. Both execute-bit guards and their maintained regression controls pass, as do the rendered staging hold and seven refusal controls. The policy and application flags are unchanged. Fresh hosted CI and substantive exact-head review remain required.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/business-staging-held-5247-01a1783e
• File: .coderabbit.yaml
• Commit: 569351f
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 91aaf856-2fc9-4b53-8a08-67d3c68c3276

Commits

Reviewing files that changed from the base of the PR and between e85d946 and 569351f.

Files selected for processing: 4

• .github/workflows/ci.yaml
• k8s/providers/hetzner/apps/business-site/cilium-network-policy-staging-hold.yaml
• k8s/providers/hetzner/apps/business-site/kustomization.yaml
• scripts/tests/test-business-staging-hold.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

cr:no-gate@569351f07e4f0c10a852d18cd964ce87cc405842 — reason=rate-limit. CodeRabbit's authenticated current-head response, published 21:57:42 UTC, explicitly refuses this four-file request because its included OSS allowance is exhausted and reports a 29-minute recovery. The response is not a review or a permanent provider outage. The fresh no-gate guard returns ADMIT and finds no substantive CodeRabbit review of this head.

Proceeding to the next ordered lane, Codex, without a duplicate CodeRabbit request or paid credits. No green review or promotion is claimed.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T22:01:57.476454Z	569351f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 569351f07e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 569351f07e4f0c10a852d18cd964ce87cc405842, with the actual current main ref separately rebound to 735cd49d6bb022c886307e1f0256b8f42f7fcf6b:

• All six exact-head workflows and 46 native checks are settled without failures; CI 40405960750 succeeds. The earlier failed mode-check run remains failed. GitHub reports CLEAN, with zero review threads or inline findings. Native code-quality analysis remains independently UNVERIFIED, not waived or relabeled complete.
• Codex's substantive clean receipt binds this head after the applicable included-review limit prevented CodeRabbit from serving it. No further provider request is needed for this unchanged head.
• The actual production/local renders, both schema-aware validations, seven security-boundary refusal controls and actual CI invocation were inspected. The exact executable-mode guard was RED and then GREEN. A scoped live baseline confirms source-only staging, a restricted namespace and zero application Deployments. This configuration increment enables no workload; realized datapath, projection, exposure and recovery proof remain Register the public-only business-site staging tenant #5247. Its eventual installation will be observed through the normal deployment path.

The current base change updates the maintained KSail pin. Its main workflows succeeded. A peer merge-group is active, and current reads show the protected core layers suspended. Their ownership remains with the deployment pipeline. The health helper exits 0 and the sibling watch is OK. Promotion is separable from that peer deployment; any queue entry and deployment still require fresh checks and the ordinary protected queue.