fix(kubescape): adopt verified storage codec repair - #5808

🤖 Generated by the Agentic Engineer

Validation and authorization-ledger evidence for c36164c5d45e22103a4e5d43e21a826966aa7800:

• The image was published by the merged producer workflow. Independent tag resolution and keyless signature verification bind the immutable index to the expected main-only publisher identity. Both executables extracted from that exact image pass the official released Go vulnerability auditor; no experimental auditor or suppression was used.
• The existing immutable-image guard fails on the old declaration and passes on the proposed declaration. ShellCheck, both local and production KSail validations, and ten Kustomize builds pass. Offline namespace-selector limitations remain unexecuted runtime coverage.
• The initial CI authorization failure correctly detected the changed complete-object fingerprint. Only helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape moves from 6a352e2f5cb05f56d3558dcb9a11b1a56275b70c62b508f67e9c5366c79ce390 to 67654a0c106caeec0ab230eaf8a845cb4f103e95d4daafd9b1b340859f1073f0. Complete normalized rendered objects are identical after removing the storage image tag. No permissions or other authorization entries change.
• The full authorization Go package and standalone authorization check pass with CI's approved renderer. The host's newer renderer was correctly refused; its guard remains unchanged.

This remains a draft pending current-head hosted validation and independent review. Protected deployment, runtime image readback and complete current-image scan results are still required. The scanner upgrade and #5553 remain open.

🤖 Generated by the Agentic Engineer

@coderabbitai review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

🤖 Generated by the Agentic Engineer

@codex review

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: c36164c5d4

🤖 Generated by the Agentic Engineer

Ready at signed head c36164c5d45e22103a4e5d43e21a826966aa7800.

All 53 reported contexts are settled without failures. The effective readable required check and three required workflows pass. The native Code Quality run also succeeded at this exact head. The completeness helper still reports the configured code_quality rule as UNVERIFIED; that API limitation is retained for GitHub's ordinary protected merge decision, not counted as a passed per-head verdict.

Codex completed a clean review of this head. Both the completed full-head summary and receipt agree, and the complete thread and non-thread surfaces contain no unresolved findings. CodeRabbit explicitly declined on its included review limit before the ordered fallback. GitHub reports the head mergeable and CLEAN.

Local validation, the one-entry authorization approval and its unchanged negative controls are recorded above. As operator, I independently verified the actual published immutable image and its signature/provenance, inspected both extracted executables and their passing official audits, and exercised the production render with the exact pin. The full rendered HelmRelease is unchanged apart from that pin. This evaluates adoption preparation; protected deployment, runtime digest adoption and complete current-image result coverage remain separate acceptance gates. The scanner upgrade and #5553 remain open.

Deployment readback, 3 November: this PR merged as c5a1a40fdc3088cf19d02daeb186ac38e6c5a537. The protected production deployment completed successfully. The running storage container matches the reviewed immutable image digest sha256:cf539713a84613e00cd3cf9fa4c8c4f68eeb0719299fbb6ac91bca1d215e005b; its rollout generation is observed, its replica is ready and it has zero restarts.

The real result API is populated and accepting newer summaries. Complete coverage remains failed: 49/82 current vulnerability results, 33 missing, and incomplete runtime coverage. One LIST/GET version mismatch in the capture was followed by identity-bound GET/LIST/GET reads agreeing on the same UID and version, so that capture alone does not establish persistent corruption. These observations verify adoption, not complete scanner or platform recovery. #3156, #5553 and the held scanner adoption remain open.