[devantler]

🤖 Generated by the Agentic Engineer

Why

Idle databases can trigger repeated warnings and make real database incidents harder to spot.

What

Rolls out the validated monitoring repair together with its matching collector. The existing warning remains when database progress cannot be confirmed.

Part of #5446

⚠️ Merge order: land #5507 first so deployment checks can verify the additional images safely.

[devantler]

🤖 Generated by the Agentic Engineer

Validation at e88b8041670c11c60ad7eb903f36e3ccbc2b2b3e:

• The only production-resource changes are the server and collector image references. A semantic comparison preserves every other field. The production render contains both exact published digests and the existing server replica setting.
• Fresh anonymous OCI reads verified both image indexes and their provenance layers by digest. Both signatures pass the declared dedicated main-only publisher rules. Read-only fleet comparison matched all declared verification decisions and running trust roots; fix(talos): preserve verifier resource IDs in live observations #5507 must merge before delivery uses its corrected observer.
• Both local and production KSail validations included the changed Coroot resource and returned zero. Some unchanged charts were unavailable to the local tool, and namespace-dependent policy evaluation retains its documented offline limits. The production authorization validator, API-key/egress contract, dashboard regression package, ShellCheck and workflow lint pass. The API-key contract failed before its explicit compatibility-image update.
• The native dashboard workflow is now pinned to this exact candidate, including its real compiled startup version. The upstream API/browser source audit remains valid for the checkpoint-only patch; hosted persisted-dashboard, panel, browser and refusal controls must pass before review or promotion.

Production image activation, natural database progress and actual Coroot warning recovery remain unverified. This PR stays a draft behind #5507; #5446 remains open.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: none

Cleared 2026-10-28: Prerequisite #5507 merged. Read-only production run 40729701009 at reviewed main cea0633 passed native policy/trust-root comparison and running-image signatures. Current-head CI/review and both exact compatibility-image signatures were reverified.

Previous record (historical):

> 🤖 Generated by the Agentic Engineer

<!-- pr-blocker-record -->

**Blocker:** devantler-tech/platform#5507 | upstream | last-verified 2026-10-28: The verifier observer must merge before the paired monitoring images can be delivered.

[devantler]

🤖 Generated by the Agentic Engineer

CI classification and correction at 7522f05b08fd2242fb6ac9bac06a41e6155cd027:

• The repository and complete-Go jobs failed the same dependency-discovery guard, which still looked for upstream component images in the Coroot resource. Those upstream runtime dependencies remain present in the compatibility Dockerfiles. The guard now checks their actual built-in Dockerfile extraction, including disabled/omitted managers, excluded files, exact dependency names, datasource and unresolved-version refusal controls. The ordinary-update release-age and review settings are unchanged; a normalized comparison confirms only Renovate descriptions changed.
• The affected package passes with the race detector. The complete local Go suite passes for the correction; after refreshing main, the dependency guard, production-authorization and backup-recovery packages pass again. The unresolved-version control is independent of the current base-version value, so a later legitimate version update does not break the control itself.
• The separate tenant job failed before its tests while downloading a public Go module with an HTTP/2 transport error. The old workflow was not rerun; the corrected head requires a new complete hosted result.
• The exact proposed Coroot image passed the native persisted-dashboard, API, browser and refusal controls in run 40691525256. I inspected all three captured dashboard pages: the charts render, failing/unknown/unproven results remain visible, and the declared one-day-history gap remains separate. These are synthetic compatibility checks, not production recovery. The manifest, native fixture and immutable images exercised there are unchanged by the guard correction and main refresh.

Fresh hosted checks and current-head review remain required. Keep this draft behind the actual merge of #5507 and keep #5446 open for production acceptance.

[devantler]

🤖 Generated by the Agentic Engineer

The remaining failed check at 7522f05b08fd2242fb6ac9bac06a41e6155cd027 was the existing hosted WebApp fixture: its public CI evidence read hit GitHub's API quota before the real application trial. The required aggregate failed as a consequence; the other checks completed without a reported failure.

The same hosted fixture has since passed in a newer queue check. After rebinding this PR and completed run to the unchanged head, I requested one retry of only the failed jobs. No check, credential, timeout or source input was changed for the retry. The draft still requires current-head green CI/review and the actual merge of #5507.

[devantler]

🤖 Generated by the Agentic Engineer

Current-head hosted checks are green after the bounded retry. CodeRabbit's freshly re-read repository reply reports an active included-review limit through approximately 14:58 UTC. The exact-head guard found no delivered CodeRabbit review here. Codex has just completed another current-head review in this repository, so I am using that next serving lane without requesting usage-based review. This records provider availability, not a review result or production clearance.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T14:55:44.073144Z	7522f05	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 7522f05b08

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 7522f05: hosted CI is green, GitHub reports CLEAN, and the complete review/thread census has no open findings. Codex's current-head review is clear. Both exact compatibility-image signatures have been freshly verified against the dedicated main-branch publisher identity.

Operator evaluation used the actual proposed images in native trial 40691525256: persisted dashboard, API and browser behavior, with failure/unknown refusal controls. The three captured views were inspected. Those runtime inputs are unchanged at this head. The local Coroot-resource and PodMetrics reads remain denied and were not treated as evidence or bypassed; the hosted image trial provides the compatibility proof.

The actual #5507 prerequisite has merged. Production observation 40729701009 passed native declared-policy/trust-root comparison and running-image signature inventory. Ownership and absence of conflicting claims were rechecked. The change is ready for protected delivery; live image adoption, rollout and Coroot user-path/health acceptance remain due after deployment under #5446.