[devantler]

🤖 Generated by the Agentic Engineer

Why

Runtime monitoring needs a small, verifiable detection baseline before broader rules can be enabled safely.

What

Enables the initial port-forward detection with stable matching and validation that follows the vendor's supported format.

Deferred: #4968 — broader runtime detection coverage.
Deferred: #4264 — end-to-end runtime alert delivery.

Part of #4968

[devantler]

🤖 Generated by the Agentic Engineer

Validation at 787c934b066780e0155fb6b3940972f7fd6f56bc:

• The original enabled-detector-without-rules control failed before the repair. The pinned chart now passes install and upgrade tests in both switch states, retaining only the vendor R2001 definition and its stable-ID binding. The other rendered objects and namespace scope are preserved.
• The generated Rules schema adds only the vendor-owned profileDataRequired property to the unchanged catalog. Valid and invalid resource controls pass; no existing constraint or skipped-kind list changes.
• Both KSail validation commands pass with CI's 7.206.14 binary. Local coverage still has unavailable OCI credential-helper and offline namespace-label limitations; the changed chart is independently exercised by the audited controller renderer. Hosted validation remains required.
• The production authorization gate initially refused the changed release fingerprint. With kubectl 1.36.2 / Kustomize 5.8.1, its 575 controls and executable contract now pass. The proposed ledger moves only the existing Kubescape release entry from 6a352e2f5cb05f56d3558dcb9a11b1a56275b70c62b508f67e9c5366c79ce390 to d173c38693c99ad1683f4408829c54293fef90f92b1d2a7d855590e692b65667; no authorization object is added or removed. The immutable approval history and refusal controls are preserved. The chart comparison establishes no RBAC, workload or CRD change.
• ShellCheck, CI routing controls and diff checks pass. The correctness and simplification passes are complete; the commit signature is verified by GitHub.

This remains a draft: current-head hosted checks and review must complete, and live rule loading plus a controlled detector event and observed alert delivery remain named acceptance gates. Rendering and object presence do not establish delivery or full runtime coverage.

[devantler]

🤖 Generated by the Agentic Engineer

Refreshed head 2dbc3436e06f8201cd19cef8790fc27909c44e36 integrates reviewed main, including the CI repairs in #5739 and #5748. The push preserves the signed branch history and starts a fresh CI evaluation.

The bounded runtime-rule render regression, generated-schema checks, authorization race suite, and local/production KSail validation pass. The changed Kubescape chart was rendered independently; broader validation retains its reported OCI credential-helper and offline namespace-label limitations.

This remains draft pending current-head CI and review. The controlled detection and alert-destination acceptance for #4968 and #4264 still need deployment evidence.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T19:57:09.496104Z	2dbc343	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 2dbc3436e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness for 2dbc3436e06f8201cd19cef8790fc27909c44e36: all 46 reported checks pass, ten conditional checks are skipped, and there are no pending checks or unresolved review threads. Codex's current-head review is green: #5750 (comment).

Operator evaluation follows the product's manifest-evaluation contract: actual Helm install and upgrade renders exercise both switch states, verify the exact R2001 definition and binding, and preserve unrelated rendered resources. The generated-schema and rejection controls, authorization race suite, and local/production KSail validation pass. Broader validation retains its reported OCI and offline namespace-label limitations; the changed chart was independently rendered.

This establishes the intended declarative installation. Live rule loading, controlled detection, and alert-destination acceptance remain post-deployment work under #4968 and #4264. Those runtime gates are unverified and the parent work remains open. The fresh general live-health check exits zero. Native GitHub reports CLEAN; the completeness helper's unreadable code-quality analysis state remains UNVERIFIED under the consumer's ordinary CLEAN rule.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: #5805 | upstream | last-verified 2026-11-03: Production public-contract timeout incident remains open. Mitigation PR #5807 is still OPEN and queued at reviewed head fc4b22c. Preserve this PR at 2dbc343 outside the queue. Resume only after #5807 merges and its native deployment receipt proves the public contract passed; re-read this PR's complete current-head gates and ownership before enqueueing. This repairs the record's date syntax without changing its resume conditions.