docs(specs): 018 v0.3 release readiness audit records by ValgulNecron · Pull Request #424 · GameplanePanel/Gameplane

ValgulNecron · 2026-09-24T08:08:08Z

Summary

Audit records for spec 018 (v0.3 release readiness), in progress. This is a draft so the records can be reviewed as they grow (tasks.md "Commit Cadence"). Product fixes don't land here; they go to their own fix/018-* branches.

Status (2026-10-04)

v0.3.0-rc.1 is tagged (RC-TAG-1, 2026-09-24). The rc.2 CHANGELOG (docs: add v0.3.0-rc.2 CHANGELOG section #496) and the hardening fixes fix(agent): confine the final upload path to the data root #511, fix(operator): align dev RBAC manifests and markers with the split-role design #513–fix(netguard): harden address policies and document call sites #517 and fix(operator): surface refused tunnel credentials on status #534 are merged; RC-TAG-2 (v0.3.0-rc.2) is pending.
OD-001 to OD-026 are resolved.
tasks.md: 24 tasks checked, 52 open. Most of the open ones are the live kubelab rounds (T015, T025–T033).
Branch synced with master (no conflicts); the PR touches only specs/018-v0-3-release-readiness/ and .gitignore.

In this branch

specs/018-v0-3-release-readiness/: plan, tasks, research, contracts and OPEN-DECISIONS.md.
audit/release-criteria.md: RC-01 to RC-08, committed before any live work. RC-03 was amended on 2026-09-24 per OD-010.
audit/tools/: read-only kubelab snapshot.sh, snapshot-diff.sh and cleanup-check.sh.
audit/kubelab-baseline.md and audit/evidence/baseline/: the pre-audit snapshot, plus the API state and DB migration level from T012.
audit/evidence/rc.0/module-categories.md: 17 module categories across 30 modules.
audit/inventory.md and audit/procedures/: capabilities enumerated from code, the completeness review, and a correctness pass over the procedures.
audit/evidence/review-*/: a review of every component with independent verification (coverage.md rows all complete).
audit/findings.md: known bugs imported (T009–T011) plus the review findings, checked one tier up. Unfixed security findings are held off-git (OD-019), so the IDs have gaps.
.gitignore: un-ignores specs/*/audit/coverage.md, which coverage.* was catching, and ignores specs/*/audit/held/.

Known gaps (do not merge yet)

The live inventory rounds (T025–T033) have not run.
T012: the API user list is still to be captured.
Some tasks.md checkboxes lag the record (T014's tag is done per RC-TAG-1, T023's merge is done per its note); to be reconciled when the rounds run.

Related PRs (all merged)

chore(release): CHANGELOG section for v0.3.0-rc.1 #423: CHANGELOG for v0.3.0-rc.1 (T013)
docs: add v0.3.0-rc.2 CHANGELOG section #496: CHANGELOG for v0.3.0-rc.2
fix(hack): doc-version checker matches bare, multi-digit and -rc.N versions; adds fixture tests #420: doc-version checker (T052), with the OD-011/OD-012 follow-up
docs(claude): add gp-module to the repo map and fix module count #421: CLAUDE.md gp-module map (T053)
ci(e2e): move upgrade-test baseline to 0.2.0-beta.8 #422: e2e upgrade baseline 0.2.0-beta.8 (T051)

Test plan

CI docs checks green (check-links, check-specs, check-doc-versions)
Records reviewed; not merged until the audit completes

🤖 Generated with Claude Code

https://claude.ai/code/session_01UshpSigdLccuYZi7oFJX9y

``<source media="(prefers-color-scheme: dark)" srcset="https://greptile-static-assets.s3.amazonaws.com/badges/RetriggerDark.svg?v=2"><source media="(prefers-color-scheme: light)" srcset="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=2"><img alt="Retrigger" src="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=2" align="right">``Confidence Score: 0/5 ^{``<img alt="Tier: apex" title="Review tier: apex" src="https://greptile-static-assets.s3.amazonaws.com/badges/effort-apex.svg?v=3" height="12">``}

This draft should not be merged or used for live release sign-off until the database, node-recovery, resource-isolation, and verification-gate failures are corrected.

Findings

<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Reinstall reuses the old database ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Rollback restores the wrong snapshot ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Stopped worker cannot restart itself ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Network policy reverts disable defaults ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Ingress remains disabled after testing ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Toggle tests replace the RC ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Image cleanup restores private builds ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Tests mutate an existing server ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Server references a nonexistent template ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> CSRF extraction includes cookie attributes ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Snapshot source uses local-path storage ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Module cleanup leaves backup records ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Cleanup omits round fixtures ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Failed queries report clean cleanup ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Helm changes escape baseline checks ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Safety fields are not compared ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Missing baseline files pass comparison ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Two required reviews are absent ▶
<img alt="P1" src="https://greptile-static-assets.s3.amazonaws.com/badges/p1.svg?v=9" align="top"> Tag command requires unavailable key ▶
<img alt="P2" src="https://greptile-static-assets.s3.amazonaws.com/badges/p2.svg?v=9" align="top"> <img alt="Security" src="https://greptile-static-assets.s3.amazonaws.com/badges/Security.svg?v=2" align="top"> Raw login headers remain unprotected ▶
<img alt="P2" src="https://greptile-static-assets.s3.amazonaws.com/badges/p2.svg?v=9" align="top"> <img alt="Security" src="https://greptile-static-assets.s3.amazonaws.com/badges/Security.svg?v=2" align="top"> Raw database diff enters evidence ▶
<img alt="P2" src="https://greptile-static-assets.s3.amazonaws.com/badges/p2.svg?v=9" align="top"> Created admin missing from cleanup ▶

Fix with agent prompt

### Issue 1
specs/018-v0-3-release-readiness/audit/procedures/upgrade.md:82-89
Kubelab is at migration 011, so it takes this reinstall branch. But the chart retains `gameplane-api-data` on uninstall, and the reinstall mounts that same PVC. The beta.8 API therefore starts against the existing 011 database instead of a fresh beta.8 database, so this cannot verify the intended 006-to-RC upgrade. The DO NOT RUN warning covers deletion of the games namespace, not this separate problem.

### Issue 2
specs/018-v0-3-release-readiness/audit/procedures/upgrade.md:431-433
`upg-real.db` was captured before the beta.8 test state was seeded. On the planned fresh-database path, restoring it for rollback discards the test admin, puts kubelab's real 011-level database under the beta.8 binary, and makes the subsequent test-admin login unable to prove that the seeded account survived. Rollback needs a snapshot taken after seeding; the real-database snapshot is for final restoration.

### Issue 3
specs/018-v0-3-release-readiness/audit/procedures/nodes.md:319-322
Step 3 stops `k3s-agent` on `kubelab-worker-2`, which also stops that worker's kubelet. This step then tries to run `systemctl start` in a *new* debug pod on the same worker, but that pod cannot start without its kubelet. The procedure has no working recovery step while the pre-existing `soak-pool-west-0` is down; restart the agent through an out-of-band route such as SSH.

### Issue 4
specs/018-v0-3-release-readiness/audit/procedures/helm.md:254
Both `gameEgress.enabled` and `gameIngress.enabled` are `true` in kubelab's chart defaults, yet this cleanup sets game egress to `false` and the game-ingress procedure does the same for ingress. With default-deny policies still in place, existing game pods lose public download access and their per-server player-ingress policies. Restore each setting's pre-test value instead of leaving the live installation under a different network configuration.

### Issue 5
specs/018-v0-3-release-readiness/audit/procedures/helm.md:755
Kubelab has the `gameplane.local` ingress enabled, but the test ends by setting `ingress.enabled=false` and calls that cleanup. Running it removes the existing dashboard route for everyone after the test. Restore the recorded prior value, which is `true` for this installation.

### Issue 6
specs/018-v0-3-release-readiness/audit/procedures/helm.md:13
The live HELM procedures use `helm upgrade gameplane charts/gameplane`, but this checkout's local chart is still version/appVersion `0.2.0-beta.8`. After an RC is deployed, the first toggle replaces its chart with that local one; if the image tag was cleared to use appVersion, the API, operator, and web images also revert to beta.8. Later rows would not test the published candidate required by FR-018. Run live toggles with the deployed RC chart.

### Issue 7
specs/018-v0-3-release-readiness/audit/procedures/helm.md:995
This step restores the pre-audit private `016` tag, and the registry-override procedure similarly restores `gameplane-test`. If either runs during an RC audit round, subsequent `--reuse-values` upgrades select private images rather than the public RC images, even though the chart carries an RC label. Restore the image settings recorded immediately before each test, not the old pre-audit overrides.

### Issue 8
specs/018-v0-3-release-readiness/audit/procedures/api.md:674
`mc-fabric` is a pre-existing, running GameServer, but this step enables capture on it. The same procedures file uploads and deletes a file in its data volume and kicks a player from it. An admin following these steps can disturb a real workload, contrary to FR-009 and the audit convention that explicitly says never to write to `mc-fabric`. Use an isolated `audit018-` server for these mutation tests.

### Issue 9
specs/018-v0-3-release-readiness/audit/procedures/api.md:247
This create request sets `templateRef.name` to `mc-fabric`, which the baseline identifies as a GameServer, not a GameTemplate. The baseline's template is `minecraft-java`. The new audit server cannot resolve the named template, so this step cannot establish the server needed by the subsequent API procedures.

### Issue 10
specs/018-v0-3-release-readiness/audit/procedures/agent.md:26-27
These commands extract `gameplane_csrf` from a `Set-Cookie` header using only `cut -d= -f2`, which leaves `; Path` after the token. The API requires `X-Gameplane-CSRF` to match the stored token exactly, so the agent procedures' POST requests receive `403 csrf mismatch` instead of exercising the agent. The shared sessions convention also cuts the value at `;`; apply that here.

### Issue 11
specs/018-v0-3-release-readiness/audit/procedures/crd.md:823-828
Installing `csi-driver-host-path` does not convert `audit018-server-create-data` into a CSI volume. The server created earlier specifies no CSI StorageClass, its copied [Minecraft template](https://github.com/valgulnecron/gameplane-module/blob/HEAD/minecraft-java/template.yaml) specifies only storage size and mount path, and kubelab defaults the PVC to `local-path`, which has no CSI snapshots. This backup therefore cannot reach its expected successful snapshot, leaving the dependent restore row untestable. Provision the audit server on the CSI class before taking its snapshot.

### Issue 12
specs/018-v0-3-release-readiness/audit/procedures/modules.md:174
The module cycles name their manual Backup and Restore `<server>-bk` and `<server>-rs`, but these cleanup commands pass only `<server>` to `kubectl delete gameserver,backup,restore`. The garrys-mod variant selects a label its created objects do not have. Deleting the GameServer does not garbage-collect those manual Backup and Restore records, so completed rows leave audit resources behind and cannot satisfy the zero-leftovers criterion.

### Issue 13
specs/018-v0-3-release-readiness/audit/tools/cleanup-check.sh:26-34
This check scans seven Gameplane resource kinds and PVCs, but round setup also creates `audit018-restic` and `audit018-registry` Deployments and Services, a Secret and NetworkPolicy, and the `audit018-games2` namespace. Neither this check nor the snapshot diff inspects those fixtures. It can report no remaining resources while audit infrastructure is still on kubelab, falsely supporting RC-06.

### Issue 14
specs/018-v0-3-release-readiness/audit/tools/cleanup-check.sh:41-42
The resource queries, including the PVC query below, end in `|| true`. If kubelab is unreachable, a kind is unavailable, or parsing fails, the scan discards the error and can exit zero with “No audit018- resources found.” Round cleanup uses that exit code as evidence, so an incomplete scan must fail rather than certify that no test resources remain.

### Issue 15
specs/018-v0-3-release-readiness/audit/tools/snapshot-diff.sh:193-197
The comparison always skips `helm-values.json`, although the live tests repeatedly change Helm settings and FR-018 permits only documented changes. A failed revert, such as leaving ingress or a network-policy toggle disabled, can therefore pass the post-round snapshot diff. Compare captured values while excluding only the round's explicitly intended differences.

### Issue 16
specs/018-v0-3-release-readiness/audit/tools/snapshot-diff.sh:108-110
The PVC comparison keeps only name and UID, ignoring the bound `volumeName` captured by `snapshot.sh`; the node comparison likewise ignores captured `schedulable` state. After a storage change or failed drain cleanup, a pre-existing PVC backed by a different volume or a node left cordoned can still pass the baseline check. Compare those safety-relevant fields as well as UID.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

(6 more issues omitted due to length limits.)

Summary

This draft adds the spec 018 release-readiness audit: baseline records, component reviews and findings, live-test procedures, release criteria, and snapshot/cleanup tools. The records identify substantial known product work, but several new procedures and verification gates need correction before they can safely support live testing or a release decision.

The beta.8 reinstall and rollback do not establish and preserve the test database state they claim to verify.
Some live procedures disturb existing resources or leave configuration and test resources behind.
The cleanup and baseline-diff tools can report success without checking material parts of the cluster state.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  B[Record kubelab baseline] --> R[Publish and deploy RC]
  R --> T[Run isolated live procedures]
  T --> E[Record outcomes and findings]
  E --> F[Fix, publish next RC, re-verify]
  F --> T
  T --> C[Clean fixtures and compare baseline]
  C --> G[Go/no-go report]

_{Reviews (1) · Last reviewed commit: "docs(specs): 018 rc.2 also waits for #50..."}

Generated by Claude Code

Phase 0/1 artifacts for the v0.3 release audit: plan, research decisions (RC publication via release.yaml, kubelab deploy with --reuse-values, audit018- isolation, severity scale, known-bug import sources), data model for the audit records, contracts for record formats, test resources, RC deploy/rollback and v0.3.0 status wording, plus a quickstart for running and validating an audit round. Adds OD-005..OD-008 (upgrade baseline, node-loss test, kubelab reachability, audit tamper test scope) for maintainer decision. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

OD-005 reinstall kubelab at beta.8 (DB snapshot/restore) for the live upgrade test; OD-006 real node-loss test approved; OD-007 maintainer fixes devbox networking; OD-008 live audit tamper on audit018- rows. Adds OD-009 (audit chain recovery after the live tamper), which gates only the tamper test. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

Snapshot/restore the API DB around each live tamper variant (UPDATE, middle DELETE, tail truncation) on audit018- rows. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

76 tasks across setup, foundational (release criteria, known-bug import, kubelab baseline, rc.1), US1 live inventory, US2 component review and live security violations, US3 fix/re-verify rounds, US4 upgrade/rollback/node-loss, US5 go/no-go report, and v0.3.0 release polish. Records that kubelab DNS now resolves (OD-007). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

coderabbitai · 2026-09-24T08:08:16Z

Important

Review skipped

Too many files!

This PR contains 217 files, which is 117 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Check out review usage here.

⚙️ Run configuration

Configuration used: Repository: ValgulNecron/Gameplane/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 823b34ad-113d-4bb3-b78d-a2f50819bf0d

📥 Commits

Reviewing files that changed from the base of the PR and between 9a0f406 and f586860.

📒 Files selected for processing (217)

.gitignore
specs/018-v0-3-release-readiness/OPEN-DECISIONS.md
specs/018-v0-3-release-readiness/RESTART.md
specs/018-v0-3-release-readiness/audit/conventions.md
specs/018-v0-3-release-readiness/audit/coverage.md
specs/018-v0-3-release-readiness/audit/evidence/.gitkeep
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-backups.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-backupschedules.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-clusters.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-gameservers.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-gametemplates.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-modules.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-modulesources.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-networkcaptures.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/crd-restores.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/helm-list.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/helm-values.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/images.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/meta.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/nodes.json
specs/018-v0-3-release-readiness/audit/evidence/baseline/pvcs.json
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-AGT.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-API.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-AUX.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-CRD.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-HELM.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-MOD.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-NODE.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-UPG.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-WEB.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/inventory-review.md
specs/018-v0-3-release-readiness/audit/evidence/rc.0/module-categories.md
specs/018-v0-3-release-readiness/audit/evidence/rc.1/fix-groups-brief-session5.md
specs/018-v0-3-release-readiness/audit/evidence/rc.1/fix-plan.md
specs/018-v0-3-release-readiness/audit/evidence/rc.1/od021-followups-brief-session5.md
specs/018-v0-3-release-readiness/audit/evidence/review-agent/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-agent/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-api/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-api/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-audit-syslog-bridge/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-audit-syslog-bridge/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-capture-sidecar/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-capture-sidecar/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-charts-gameplane/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-charts-gameplane/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-deploy/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-deploy/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-docs/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-docs/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-followup/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-gameaction/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-gameaction/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-gameproto/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-gameproto/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-github-actions/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-github-actions/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-github-workflows/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-github-workflows/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-gp-module/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-gp-module/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-hack/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-hack/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-images/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-images/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-mcp-server/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-mcp-server/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-modules/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-netguard/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-netguard/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-operator/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-operator/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-sentinel/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-sentinel/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-svcutil/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-svcutil/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-telemetry-receiver/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-telemetry-receiver/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-test-e2e/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-test-e2e/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-tunnel/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-tunnel/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-web/notes.md
specs/018-v0-3-release-readiness/audit/evidence/review-web/verification.md
specs/018-v0-3-release-readiness/audit/evidence/review-website/notes.md
specs/018-v0-3-release-readiness/audit/findings.md
specs/018-v0-3-release-readiness/audit/held/briefs/G2.md
specs/018-v0-3-release-readiness/audit/held/briefs/H04.md
specs/018-v0-3-release-readiness/audit/held/briefs/H05-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H05.md
specs/018-v0-3-release-readiness/audit/held/briefs/H06.md
specs/018-v0-3-release-readiness/audit/held/briefs/H07-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H07.md
specs/018-v0-3-release-readiness/audit/held/briefs/H08-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H08.md
specs/018-v0-3-release-readiness/audit/held/briefs/H09-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H09.md
specs/018-v0-3-release-readiness/audit/held/briefs/H09.patch
specs/018-v0-3-release-readiness/audit/held/briefs/H11.md
specs/018-v0-3-release-readiness/audit/held/briefs/H12.md
specs/018-v0-3-release-readiness/audit/held/briefs/H13-security-audit-edits.md
specs/018-v0-3-release-readiness/audit/held/briefs/H13.md
specs/018-v0-3-release-readiness/audit/held/briefs/H14-design.md
specs/018-v0-3-release-readiness/audit/held/briefs/H15.md
specs/018-v0-3-release-readiness/audit/held/briefs/H16-security-audit-edits.md
specs/018-v0-3-release-readiness/audit/held/briefs/H16.md
specs/018-v0-3-release-readiness/audit/held/briefs/H17.md
specs/018-v0-3-release-readiness/audit/held/briefs/H18.md
specs/018-v0-3-release-readiness/audit/held/briefs/H19-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H19.md
specs/018-v0-3-release-readiness/audit/held/briefs/H20-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H20.md
specs/018-v0-3-release-readiness/audit/held/briefs/H21.md
specs/018-v0-3-release-readiness/audit/held/briefs/H22-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H22.md
specs/018-v0-3-release-readiness/audit/held/briefs/H23-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H23.md
specs/018-v0-3-release-readiness/audit/held/briefs/H24-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H24.md
specs/018-v0-3-release-readiness/audit/held/briefs/H25-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H25.md
specs/018-v0-3-release-readiness/audit/held/briefs/H26-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H26.md
specs/018-v0-3-release-readiness/audit/held/briefs/H27-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H27.md
specs/018-v0-3-release-readiness/audit/held/briefs/H27.patch
specs/018-v0-3-release-readiness/audit/held/briefs/H28-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H28.md
specs/018-v0-3-release-readiness/audit/held/briefs/H29-review.md
specs/018-v0-3-release-readiness/audit/held/briefs/H29.md
specs/018-v0-3-release-readiness/audit/held/briefs/H30.md
specs/018-v0-3-release-readiness/audit/held/briefs/H31a.md
specs/018-v0-3-release-readiness/audit/held/briefs/H31b-design.md
specs/018-v0-3-release-readiness/audit/held/briefs/files/H19/audit-syslog-bridge/README.md
specs/018-v0-3-release-readiness/audit/held/briefs/files/H19/audit-syslog-bridge/bridge_test.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H19/audit-syslog-bridge/main.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H19/audit-syslog-bridge/specs.md
specs/018-v0-3-release-readiness/audit/held/briefs/files/H20/gp-module/internal/archetypes/archetypes.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H20/gp-module/internal/archetypes/archetypes_test.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H20/gp-module/internal/scaffold/scaffold.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H20/gp-module/internal/scaffold/scaffold_test.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H20/gp-module/specs.md
specs/018-v0-3-release-readiness/audit/held/briefs/files/H20/test/e2e/buckets.sh
specs/018-v0-3-release-readiness/audit/held/briefs/files/H20/test/e2e/module_toolkit_e2e_test.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H23/telemetry-receiver/README.md
specs/018-v0-3-release-readiness/audit/held/briefs/files/H23/telemetry-receiver/main.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H23/telemetry-receiver/main_test.go
specs/018-v0-3-release-readiness/audit/held/briefs/files/H24/deploy/kind/up.sh
specs/018-v0-3-release-readiness/audit/held/findings.md
specs/018-v0-3-release-readiness/audit/held/fix-plan-held.md
specs/018-v0-3-release-readiness/audit/held/inventory-SEC.md
specs/018-v0-3-release-readiness/audit/held/procedures-security.md
specs/018-v0-3-release-readiness/audit/held/questions.md
specs/018-v0-3-release-readiness/audit/held/rc0-inventory-SEC.md
specs/018-v0-3-release-readiness/audit/held/review-agent.md
specs/018-v0-3-release-readiness/audit/held/review-api.md
specs/018-v0-3-release-readiness/audit/held/review-audit-syslog-bridge.md
specs/018-v0-3-release-readiness/audit/held/review-capture-sidecar.md
specs/018-v0-3-release-readiness/audit/held/review-charts-gameplane.md
specs/018-v0-3-release-readiness/audit/held/review-deploy.md
specs/018-v0-3-release-readiness/audit/held/review-gameaction.md
specs/018-v0-3-release-readiness/audit/held/review-github-workflows.md
specs/018-v0-3-release-readiness/audit/held/review-gp-module.md
specs/018-v0-3-release-readiness/audit/held/review-mcp-server.md
specs/018-v0-3-release-readiness/audit/held/review-netguard.md
specs/018-v0-3-release-readiness/audit/held/review-operator.md
specs/018-v0-3-release-readiness/audit/held/review-telemetry-receiver.md
specs/018-v0-3-release-readiness/audit/held/review-tunnel.md
specs/018-v0-3-release-readiness/audit/held/review-web-notes-routes.md
specs/018-v0-3-release-readiness/audit/held/review-web.md
specs/018-v0-3-release-readiness/audit/held/verification-agent.md
specs/018-v0-3-release-readiness/audit/held/verification-api.md
specs/018-v0-3-release-readiness/audit/held/verification-audit-syslog-bridge.md
specs/018-v0-3-release-readiness/audit/held/verification-capture-sidecar.md
specs/018-v0-3-release-readiness/audit/held/verification-charts-gameplane.md
specs/018-v0-3-release-readiness/audit/held/verification-deploy.md
specs/018-v0-3-release-readiness/audit/held/verification-followup.md
specs/018-v0-3-release-readiness/audit/held/verification-gameaction.md
specs/018-v0-3-release-readiness/audit/held/verification-github-workflows.md
specs/018-v0-3-release-readiness/audit/held/verification-gp-module.md
specs/018-v0-3-release-readiness/audit/held/verification-hack.md
specs/018-v0-3-release-readiness/audit/held/verification-mcp-server.md
specs/018-v0-3-release-readiness/audit/held/verification-netguard.md
specs/018-v0-3-release-readiness/audit/held/verification-operator.md
specs/018-v0-3-release-readiness/audit/held/verification-sentinel.md
specs/018-v0-3-release-readiness/audit/held/verification-svcutil.md
specs/018-v0-3-release-readiness/audit/held/verification-telemetry-receiver.md
specs/018-v0-3-release-readiness/audit/held/verification-tunnel.md
specs/018-v0-3-release-readiness/audit/held/verification-web.md
specs/018-v0-3-release-readiness/audit/inventory.md
specs/018-v0-3-release-readiness/audit/kubelab-baseline.md
specs/018-v0-3-release-readiness/audit/procedures/.gitkeep
specs/018-v0-3-release-readiness/audit/procedures/agent.md
specs/018-v0-3-release-readiness/audit/procedures/api.md
specs/018-v0-3-release-readiness/audit/procedures/aux.md
specs/018-v0-3-release-readiness/audit/procedures/conventions.md
specs/018-v0-3-release-readiness/audit/procedures/crd.md
specs/018-v0-3-release-readiness/audit/procedures/helm.md
specs/018-v0-3-release-readiness/audit/procedures/modules.md
specs/018-v0-3-release-readiness/audit/procedures/nodes.md
specs/018-v0-3-release-readiness/audit/procedures/upgrade.md
specs/018-v0-3-release-readiness/audit/procedures/web.md
specs/018-v0-3-release-readiness/audit/release-criteria.md
specs/018-v0-3-release-readiness/audit/report.md
specs/018-v0-3-release-readiness/audit/rounds.md
specs/018-v0-3-release-readiness/audit/tools/cleanup-check.sh
specs/018-v0-3-release-readiness/audit/tools/snapshot-diff.sh
specs/018-v0-3-release-readiness/audit/tools/snapshot.sh
specs/018-v0-3-release-readiness/contracts/audit-records.md
specs/018-v0-3-release-readiness/contracts/rc-deploy.md
specs/018-v0-3-release-readiness/contracts/status-wording.md
specs/018-v0-3-release-readiness/contracts/test-resources.md
specs/018-v0-3-release-readiness/data-model.md
specs/018-v0-3-release-readiness/plan.md
specs/018-v0-3-release-readiness/quickstart.md
specs/018-v0-3-release-readiness/research.md
specs/018-v0-3-release-readiness/tasks.md

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-24T08:08:36Z

CI Report - `f586860`

run 37382380168 - attempt 1

0 failed - 2 passed - 18 skipped - 9m11s elapsed

Coverage

no coverage/* commit statuses found on f586860

Changed

Area	Files	+/-
specs/	216	+33909/-1
(root)	1	+7/-1

Slowest jobs

Job	Duration
lint (api)	3m27s
lint (mcp-server)	2m34s
lint (test/e2e)	2m16s
lint (sentinel)	1m42s
lint (netguard)	1m20s

e2e buckets run

multicluster, upgrade

Fixed before round 0 (FR-015). Met stays pending until go/no-go. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

…ubelab baseline snapshot T001 skeleton (coverage, report), T002 module categories (17 categories across 30 modules), T006-T008 read-only snapshot/diff/cleanup scripts, T012 read-only baseline snapshot JSON. OPEN-DECISIONS: RC-TAG-1 and OD-010..OD-018 pending maintainer input, T054 module tag question. .gitignore: un-ignore specs/*/audit/coverage.md (caught by coverage.*). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

…0..OD-018 - audit/inventory.md: 502 rows merged from the rc.0 drafts (T023), plus the T024 completeness review - audit/procedures/*: haiku-drafted procedures, not yet reviewed for correctness; security.md carries a do-not-run banner - audit/evidence/review-{docs,test-e2e,modules,web,website}: first review pass and verification notes - audit/kubelab-baseline.md, rounds.md, conventions.md - release-criteria.md: RC-03 amended per OD-010 (change-log line) - OPEN-DECISIONS.md: OD-010..OD-017 resolved, OD-018 logged, RC-TAG-1 command switched to an annotated unsigned tag (OD-013) - RESTART.md: session handoff Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

- OPEN-DECISIONS.md: OD-019, the maintainer's rule that security findings stay unpushed until fixed, and how it's applied - .gitignore: ignore specs/*/audit/held/ - audit/findings.md: note that held IDs leave gaps - audit/conventions.md: OD-015/OD-016 marked settled; held evidence path Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

… fixes - audit/findings.md: known-bug import (T009-T011), review findings F-031..F-043 and the opus review wave F-044..F-255, checked one tier up (OD-020); unfixed security findings are held off-git (OD-019) - audit/coverage.md: every component row complete (T035-T045) - audit/evidence/review-*: opus review notes and independent verification per component; held candidates replaced by stubs - audit/procedures/*: correctness pass, factual follow-ups, quoting sweep; upgrade.md baseline-beta8 reinstall marked DO NOT RUN (OD-023) - audit/inventory.md: evidence links under evidence/, stale T031 deferrals cleared - audit/kubelab-baseline.md, rounds.md: T012 API state and migration level 011 - OPEN-DECISIONS.md: OD-015 command fix, OD-020..OD-023 - tasks.md, RESTART.md: progress and hand-off Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

- audit/evidence/rc.1/fix-plan.md: findings grouped into fix/018-* branches, S1 first, each with its regression test; re-check-first and in-flight lists; checked one tier up (opus) - OPEN-DECISIONS.md: OD-024, maintainer sign-off before the fix waves (production code and tests) - tasks.md, RESTART.md: T050 done, next steps Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

- OD-022: add .github/actions/ and images/ coverage rows and review them - OD-023: fix F-212 first, then reinstall with that RC's chart - OD-024: whole fix plan approved - OD-025: design-first fix groups done on another machine Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011gFiYbmVoNLZkV3koRKVQN Signed-off-by: devbox-test <devbox-test@localhost>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UshpSigdLccuYZi7oFJX9y Signed-off-by: Claude <noreply@anthropic.com>

F-054 (#436), F-103/F-104 (#437), F-121 (#438), F-204 (#439), F-102/F-108 (#433) and F-215 (#432) move to fixing. F-258 records the Failed-Module status loop found while fixing CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UshpSigdLccuYZi7oFJX9y Signed-off-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UshpSigdLccuYZi7oFJX9y Signed-off-by: Claude <noreply@anthropic.com>

qodo-code-review · 2026-09-28T23:51:06Z