[devantler]

🤖 Generated by the Agentic Engineer

Why

The verified storage repair is published, but the platform still uses the older build. Adoption is needed to preserve newer scan metadata and use the corrected dependencies.

What

Adopt the signed, verified storage release while retaining the current data format. Deployment and complete security-result readback remain required; the scanner upgrade stays separately blocked.

Part of #5553

[devantler]

🤖 Generated by the Agentic Engineer

Validation and authorization-ledger evidence for c36164c5d45e22103a4e5d43e21a826966aa7800:

• The image was published by the merged producer workflow. Independent tag resolution and keyless signature verification bind the immutable index to the expected main-only publisher identity. Both executables extracted from that exact image pass the official released Go vulnerability auditor; no experimental auditor or suppression was used.
• The existing immutable-image guard fails on the old declaration and passes on the proposed declaration. ShellCheck, both local and production KSail validations, and ten Kustomize builds pass. Offline namespace-selector limitations remain unexecuted runtime coverage.
• The initial CI authorization failure correctly detected the changed complete-object fingerprint. Only helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape moves from 6a352e2f5cb05f56d3558dcb9a11b1a56275b70c62b508f67e9c5366c79ce390 to 67654a0c106caeec0ab230eaf8a845cb4f103e95d4daafd9b1b340859f1073f0. Complete normalized rendered objects are identical after removing the storage image tag. No permissions or other authorization entries change.
• The full authorization Go package and standalone authorization check pass with CI's approved renderer. The host's newer renderer was correctly refused; its guard remains unchanged.

This remains a draft pending current-head hosted validation and independent review. Protected deployment, runtime image readback and complete current-image scan results are still required. The scanner upgrade and #5553 remain open.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/adopt-storage-codec-5553-d20babd4fb28
• File: .coderabbit.yaml
• Commit: c36164c
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8790f5bb-d654-4daa-82f1-e2efad8141b3

Commits

Reviewing files that changed from the base of the PR and between ee02c6f and c36164c.

Files selected for processing: 3

• k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
• scripts/tests/test-kubescape-storage-hotfix.sh
• scripts/validate-eks-ci-role-policy/approved-surface.txt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T07:33:57.745139Z	c36164c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: c36164c5d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at signed head c36164c5d45e22103a4e5d43e21a826966aa7800.

All 53 reported contexts are settled without failures. The effective readable required check and three required workflows pass. The native Code Quality run also succeeded at this exact head. The completeness helper still reports the configured code_quality rule as UNVERIFIED; that API limitation is retained for GitHub's ordinary protected merge decision, not counted as a passed per-head verdict.

Codex completed a clean review of this head. Both the completed full-head summary and receipt agree, and the complete thread and non-thread surfaces contain no unresolved findings. CodeRabbit explicitly declined on its included review limit before the ordered fallback. GitHub reports the head mergeable and CLEAN.

Local validation, the one-entry authorization approval and its unchanged negative controls are recorded above. As operator, I independently verified the actual published immutable image and its signature/provenance, inspected both extracted executables and their passing official audits, and exercised the production render with the exact pin. The full rendered HelmRelease is unchanged apart from that pin. This evaluates adoption preparation; protected deployment, runtime digest adoption and complete current-image result coverage remain separate acceptance gates. The scanner upgrade and #5553 remain open.

Deployment readback, 3 November: this PR merged as c5a1a40fdc3088cf19d02daeb186ac38e6c5a537. The protected production deployment completed successfully. The running storage container matches the reviewed immutable image digest sha256:cf539713a84613e00cd3cf9fa4c8c4f68eeb0719299fbb6ac91bca1d215e005b; its rollout generation is observed, its replica is ready and it has zero restarts.

The real result API is populated and accepting newer summaries. Complete coverage remains failed: 49/82 current vulnerability results, 33 missing, and incomplete runtime coverage. One LIST/GET version mismatch in the capture was followed by identity-bound GET/LIST/GET reads agreeing on the same UID and version, so that capture alone does not establish persistent corruption. These observations verify adoption, not complete scanner or platform recovery. #3156, #5553 and the held scanner adoption remain open.