[devantler]

🤖 Generated by the Agentic Engineer

Why

Email needs the credential-preserving bootstrap image before transport changes can be rolled out safely. Its health checks also need to recognize the reviewed client-identity proxy.

What

Selects the verified image and checks both supported deployment profiles, including proxy readiness and configuration continuity. Transport activation and working administration remain separate acceptance steps.

Part of #5448

[devantler]

🤖 Generated by the Agentic Engineer

Validation at 10a857d92b8baf782ebc5c31ea0ef4606e08013d: both canonical KSail validations passed and covered the administration bundle. Rendering before and after shows exactly two image-reference replacements; every other rendered byte is unchanged. The old render selected the earlier initializer; the candidate selects the published digest in both bootstrap and serving containers. Local Helm chart rendering was incomplete, so hosted validation remains required. No new test harness was added for the pin change.

The immutable image passed independent cosign verification against the main-only Email publisher and GitHub Actions issuer. The publisher run passed the source race tests, built the image, published it, and verified its signature. Native behavior will also be exercised by this PR's selected mail and gateway CI checks; they are still pending.

Source-range review: registry signatures bind the old image to e41867358ffe030e0f7ea7be4aaf98a62523aa8d and the candidate to 82fcd45689c0207d58096c4ad05a0a716f2c48e4. The bootstrap has no separate release notes; I reviewed the complete relevant source range:

• chore(deps): bump step-security/harden-runner from 2.22.1 to 2.22.2 #5370 changes publisher runner hardening only; no runtime adaptation.
• feat(email): prepare Email credential custody and recovery #5388 makes the existing local authentication baseline explicit for rollback; the ordinary administration bundle remains selected.
• fix(email): expose focused startup diagnostics #5416 adds focused startup diagnostics, adopted with this image.
• feat(email): prepare trusted client identity configuration #5452 and feat(email): prepare native client identity transport #5476 add the prepared client-identity settings and maintained adapter. Their optional deployment bundle remains unselected; activation and rollback proof stay under Preserve client identity through ingress and verify Email access #5448. Stalwart and CLI base versions are unchanged. The new adapter's pinned binary and licence attribution are included by the already reviewed publisher.

This is a recovery prerequisite, not an availability pass. Promotion awaits settled CI and a current-head substantive review.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: none

Cleared 2026-10-28: PR #5503 merged as 20be922. Main publication run 40683516786 succeeded; independent Cosign verification bound the replacement digest to that exact source, repository, main ref, publisher workflow and issuer. Refreshing this draft image pin; fresh CI, review and protected deployment remain required.

Previous record (historical):

> 🤖 Generated by the Agentic Engineer

<!-- pr-blocker-record -->

**Blocker:** devantler-tech/platform#5503 | upstream | last-verified 2026-10-28: The credential-preserving replay fix is still an open draft. Deploying this image re-enters initialization. Wait for protected source merge and verified replacement-image publication, then refresh the digest and repeat CI and current-head review.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

Validation at dbf4812219397a524bd0eb9b2331462d9a9a83d6: refreshed the signed bootstrap image after #5503 merged. Independent Cosign verification binds digest sha256:7c9f16c880b26765ac0501781b44915e36e94aa7c454dcd1787d0edc18eef57d to exact source 20be9224b363f81556925abcb4209b13c8b5e053, this repository, the main ref, the Email publisher and the GitHub Actions issuer. Publication run 40683516786 passed native race tests, built, published and verified the artifact.

Both canonical KSail validations exited 0 and covered the administration bundle. A rendered before/after comparison proves exactly two image-reference replacements, with all other rendered bytes identical. Unrelated OCI Helm rendering remains incomplete on this host because its Docker credential helper is unavailable; fresh hosted validation remains required. Whitespace and the PR body contract pass. Correctness, security and simplification review found no additional change needed. The current main was integrated with a signed merge; no history was rewritten.

Source-range review from 82fcd45689c0207d58096c4ad05a0a716f2c48e4 to the new producer: #5488 fixes an atomic PID-file write in a test fixture (no runtime adaptation); #5503 updates existing account passwords by identity while preserving other client credentials, with native replay/expiration regressions. This digest adopts that required replay fix. No dependency, license or minimum-runtime change appears in the producer range; no separate release notes are published for this custom image.

The earlier publisher blocker is cleared. Fresh CI and this current-head review are pending, so the PR stays draft. #5448 remains open; client-identity activation, protected deployment and authenticated administration acceptance remain separate.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/email-bootstrap-image-5448
• File: .coderabbit.yaml
• Commit: dbf4812
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: de0fc761-33d7-4f42-a115-5ff04bc7f9c7

Commits

Reviewing files that changed from the base of the PR and between 20be922 and dbf4812.

Files selected for processing: 1

• k8s/bases/apps/private-mail-administration/kustomization.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T14:56:02.674084Z	8ba1854	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: dbf4812219

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 8ba1854e20

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 8ba1854e2048e3c921f3aa6023fce5b80bda72fa against freshly fetched main b7ccb00b2296bb4aa90ca52758eddc3567cd86f1. The combined change incorporates the exact observer commit from #5511 and the verified credential-preserving image from #5503.

Both canonical manifest validations, affected race tests and lint passed. Operator evaluation rendered both administration and proxy profiles and passed them through the actual pod/configuration readers, including their refusal controls. The current-head native integration job and complete Go suite passed. The image's published digest and signature were independently verified against the main-only publisher.

Codex completed the exact head without findings (receipt); all four review surfaces are clear. The description and closing-reference guards pass. Every readable required gate passes; the opaque configured code-quality rule is independently unverified and remains enforced by GitHub's native CLEAN state and protected queue.

Public Email administration still returns HTTP 503. This delivers the rollout prerequisite and compatible observation path; activation, real-client identity, authenticated administration and rollback acceptance remain on #5448.