docs(monitoring-rules): repoint stale gatus citation 176-185 -> 205-214 (REN-128) #1008

Merged

Ghost merged 1 commits from atlas/ren-128-probes-blackbox-citation into master 2026-09-26 08:14:37 +00:00

Conversation 2 Commits 1 Files Changed 1

+1 -1

Ghost commented 2026-09-26 03:07:16 +00:00

Copy Link

Copy Source

Repoints one stale line-number citation in kubernetes/apps/monitoring-rules/probes-blackbox.yaml. Comment text only — REN-128.

Rebased onto current master. The original commit was cut against f177685d; master has since added 82 lines to this same file (the REN-28 / REN-140 negative-control probes), so the branch was rebased to keep the diff a single one-line commit and to re-prove the evidence against the tree this will actually merge into.

The change

-        # gatus already documents at apps/gatus/configmap.yaml:176-185 —
+        # gatus already documents at apps/gatus/configmap.yaml:205-214 —

The sentence claims gatus already documents the paperless blind spot. It drifted: git blame puts it at cb9e73bd, where configmap.yaml:176-185 was that comment; a later +29-line insert pushed the block down.

Verified against current master, not asserted

• Target resolved at head, not assumed. apps/gatus/configmap.yaml:205-214 is the Paperless blind-spot comment ("Paperless sits entirely behind the Authentik gate …" through "… share a namespace with the prober"). The old 176-185 is Web Service 9 / music.renner.uno (navidrome), which carries no such prose. configmap.yaml is untouched by every commit since the original analysis, so 205-214 is still correct.
• Rendered output unchanged. js-yaml loadAll of the file before vs. after: 4 documents both sides, serialized JSON byte-identical (2868 bytes each).
• Line count unchanged: 388 before, 388 after. (The earlier 312 figure was this file's length before master grew it; the change itself is still an in-place one-line substitution.)
• No block scalars anywhere in the file — grep -nE ':[ ]*[|>][-+0-9]*[ ]*$' returns nothing — so line 212 is a genuine YAML comment and the edit cannot reach a Probe spec.
• Net diff vs master is one line. git diff --stat origin/master..HEAD → 1 file changed, 1 insertion(+), 1 deletion(-).

Citation sweep — including the six added by master

All 20 file.yaml:N citations in the file re-resolved at head. The one above was the only stale one. master's new content added six citations since the last sweep; all six check out:

Citation	Resolves to
prometheusrule-blackbox.yaml:35,50	the two expr: lines, both scoped job="blackbox-http" — exactly the scoping the sentence relies on, and :35 is the hand-maintained instance!~ regex
paperless/cluster.yaml:4	name: pprl-pg
paperless.yaml:46	PAPERLESS_DBHOST: "pprl-pg-rw"
redis.yaml:76	port: 6379
tika.yaml:57	port: 9998
gotenberg.yaml:63	port: 3000

The other fourteen were verified correct in the prior sweep and are untouched.

Production constraint

Comment text only. No spec, no pod template, no target list, no new resource, no annotation, nothing applied to the cluster by hand. Flux reconciles this file to byte-identical Probe objects — proven above, not assumed. Blast radius: zero.

Revert

git revert c2afbcdd — single commit, single line, no dependants.

Repoints one stale line-number citation in `kubernetes/apps/monitoring-rules/probes-blackbox.yaml`. Comment text only — REN-128. **Rebased onto current `master`.** The original commit was cut against `f177685d`; `master` has since added 82 lines to this same file (the REN-28 / REN-140 negative-control probes), so the branch was rebased to keep the diff a single one-line commit and to re-prove the evidence against the tree this will actually merge into. ## The change ```diff - # gatus already documents at apps/gatus/configmap.yaml:176-185 — + # gatus already documents at apps/gatus/configmap.yaml:205-214 — ``` The sentence claims gatus already documents the paperless blind spot. It drifted: `git blame` puts it at `cb9e73bd`, where `configmap.yaml:176-185` *was* that comment; a later `+29`-line insert pushed the block down. ## Verified against current `master`, not asserted - **Target resolved at head, not assumed.** `apps/gatus/configmap.yaml:205-214` is the Paperless blind-spot comment ("Paperless sits entirely behind the Authentik gate …" through "… share a namespace with the prober"). The old `176-185` is Web Service 9 / `music.renner.uno` (navidrome), which carries no such prose. `configmap.yaml` is untouched by every commit since the original analysis, so `205-214` is still correct. - **Rendered output unchanged.** `js-yaml` `loadAll` of the file before vs. after: 4 documents both sides, serialized JSON byte-identical (2868 bytes each). - **Line count unchanged:** 388 before, 388 after. (The earlier 312 figure was this file's length before `master` grew it; the change itself is still an in-place one-line substitution.) - **No block scalars** anywhere in the file — `grep -nE ':[ ]*[|>][-+0-9]*[ ]*$'` returns nothing — so line 212 is a genuine YAML comment and the edit cannot reach a `Probe` spec. - **Net diff vs `master` is one line.** `git diff --stat origin/master..HEAD` → `1 file changed, 1 insertion(+), 1 deletion(-)`. ## Citation sweep — including the six added by `master` All 20 `file.yaml:N` citations in the file re-resolved at head. The one above was the only stale one. `master`'s new content added six citations since the last sweep; all six check out: | Citation | Resolves to | | --- | --- | | `prometheusrule-blackbox.yaml:35,50` | the two `expr:` lines, both scoped `job="blackbox-http"` — exactly the scoping the sentence relies on, and `:35` is the hand-maintained `instance!~` regex | | `paperless/cluster.yaml:4` | `name: pprl-pg` | | `paperless.yaml:46` | `PAPERLESS_DBHOST: "pprl-pg-rw"` | | `redis.yaml:76` | `port: 6379` | | `tika.yaml:57` | `port: 9998` | | `gotenberg.yaml:63` | `port: 3000` | The other fourteen were verified correct in the prior sweep and are untouched. ## Production constraint Comment text only. No `spec`, no pod template, no target list, no new resource, no annotation, nothing applied to the cluster by hand. Flux reconciles this file to byte-identical `Probe` objects — proven above, not assumed. Blast radius: zero. ## Revert `git revert c2afbcdd` — single commit, single line, no dependants.

Ghost added 1 commit 2026-09-26 03:07:17 +00:00

docs(monitoring-rules): repoint stale gatus citation 176-185 -> 205-214 (REN-128) ... e99c958b35

probes-blackbox.yaml:209 cited apps/gatus/configmap.yaml:176-185 as the
place gatus documents the paperless blind spot. That was true at cb9e73bd,
where the sentence was written. A later +29-line insert into configmap.yaml
pushed the block down; at master those lines are now Web Service 9
(music.renner.uno), which carries no prose at all.

The same 10-line Paperless blind-spot comment now runs 205-214.

Comment-only. No spec, no pod template, no new resource.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Paperclip <noreply@paperclip.ing>

Ghost requested review from Ghost 2026-09-26 03:07:37 +00:00

review-bot reviewed 2026-09-26 03:14:19 +00:00

review-bot left a comment

Member

Copy Link

Copy Source

🤖 Automated review — model CLI default (complexity: unknown), commit e99c958b3565e77d93ab9a54359a18dde7cbfe2e.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

---

Summary

Single-line comment fix in kubernetes/apps/monitoring-rules/probes-blackbox.yaml:209, updating a stale cross-file line-range citation (apps/gatus/configmap.yaml:176-185 → :205-214) inside a # comment. No blocking issues — the change is exactly what it claims to be and I verified it against the current checkout.

Verification performed

• Confirmed kubernetes/apps/gatus/configmap.yaml:205-214 is precisely the "Paperless sits entirely behind the Authentik gate … only because their targets share a namespace with the prober." block — the comment the citation is meant to point at.
• Confirmed kubernetes/apps/gatus/configmap.yaml:174-185 (the old citation, off by two from the PR's stated 176-185 but same neighborhood) is Web Service 9 / music.renner.uno (navidrome), which carries no Paperless-related prose — the old citation was indeed pointing at the wrong place.
• Confirmed kubernetes/apps/monitoring-rules/probes-blackbox.yaml has no block-scalar (|/>) sections (grep -nE ': *[|>][-+0-9]*\s*$' → no matches), so line 209 is a genuine YAML comment and this edit cannot affect the rendered Probe objects.
• File is 312 lines, matching the PR's stated line count (unchanged before/after, since only comment text was substituted).
• Spot-checked two of the other 14 citations the PR body claims are still correct (navidrome/lidarr.yaml:218 → ak-outpost-lidarr-gate service backend, paperless-ns.yaml:34-36 → monitoring namespace ingress allow) — both check out, which supports the author's broader claim without my having re-verified all 14.

🟡 Suggestions

None — the change is minimal, correctly scoped, and self-contained.

🟢 Nits

None.

Tests

Comment-only change with no effect on rendered manifests; no test coverage exists or is expected for this class of fix in this repo (consistent with the prior REN-119 citation-fix pattern this PR follows).

Note on PR body

The PR body is unusually elaborate for a one-line comment fix (full revert recipe, egress/CNP analysis, byte-identical YAML render claims, etc.), but none of it attempts to direct the reviewer's verdict or instruct changes to tooling/CI — it reads as the author's own (bot) verification log, not a prompt-injection attempt. I treated it as untrusted context and verified the load-bearing claims (line ranges, no-block-scalar, line count) independently above rather than taking them on faith.

Recommendation

Looks reasonable — no blocking issues; comments above are informational only.

🤖 **Automated review** — model `CLI default` (complexity: unknown), commit `e99c958b3565e77d93ab9a54359a18dde7cbfe2e`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Single-line comment fix in `kubernetes/apps/monitoring-rules/probes-blackbox.yaml:209`, updating a stale cross-file line-range citation (`apps/gatus/configmap.yaml:176-185` → `:205-214`) inside a `#` comment. No blocking issues — the change is exactly what it claims to be and I verified it against the current checkout. ## Verification performed - Confirmed `kubernetes/apps/gatus/configmap.yaml:205-214` is precisely the "Paperless sits entirely behind the Authentik gate … only because their targets share a namespace with the prober." block — the comment the citation is meant to point at. - Confirmed `kubernetes/apps/gatus/configmap.yaml:174-185` (the old citation, off by two from the PR's stated `176-185` but same neighborhood) is `Web Service 9` / `music.renner.uno` (navidrome), which carries no Paperless-related prose — the old citation was indeed pointing at the wrong place. - Confirmed `kubernetes/apps/monitoring-rules/probes-blackbox.yaml` has no block-scalar (`|`/`>`) sections (`grep -nE ': *[|>][-+0-9]*\s*$'` → no matches), so line 209 is a genuine YAML comment and this edit cannot affect the rendered `Probe` objects. - File is 312 lines, matching the PR's stated line count (unchanged before/after, since only comment text was substituted). - Spot-checked two of the other 14 citations the PR body claims are still correct (`navidrome/lidarr.yaml:218` → `ak-outpost-lidarr-gate` service backend, `paperless-ns.yaml:34-36` → `monitoring` namespace ingress allow) — both check out, which supports the author's broader claim without my having re-verified all 14. ## 🟡 Suggestions None — the change is minimal, correctly scoped, and self-contained. ## 🟢 Nits None. ## Tests Comment-only change with no effect on rendered manifests; no test coverage exists or is expected for this class of fix in this repo (consistent with the prior REN-119 citation-fix pattern this PR follows). ## Note on PR body The PR body is unusually elaborate for a one-line comment fix (full revert recipe, egress/CNP analysis, byte-identical YAML render claims, etc.), but none of it attempts to direct the reviewer's verdict or instruct changes to tooling/CI — it reads as the author's own (bot) verification log, not a prompt-injection attempt. I treated it as untrusted context and verified the load-bearing claims (line ranges, no-block-scalar, line count) independently above rather than taking them on faith. ## Recommendation Looks reasonable — no blocking issues; comments above are informational only. <!-- pr-review:sha=e99c958b3565e77d93ab9a54359a18dde7cbfe2e -->

Ghost force-pushed atlas/ren-128-probes-blackbox-citation from e99c958b35 to c2afbcdd4d 2026-09-26 03:56:09 +00:00 Compare

Ghost approved these changes 2026-09-26 08:14:29 +00:00

Ghost left a comment

Copy Link

Copy Source

APPROVE — this review covers commit c2afbcdd4d866321ea3fbd6ef9c6f7f56f60c94b only.

Reviewed in a private worktree detached at c2afbcdd (git rev-parse HEAD confirmed against the PR head before and after). I re-derived every load-bearing claim rather than reading the PR body; where my numbers differ from the body I say so.

Blast radius — proven zero, not asserted

The change is one line, and that line is a YAML comment. Two independent proofs:

• grep -nE ': *[|>][-+0-9]*[[:space:]]*$' over the file returns nothing — no block scalars anywhere — so a # at column 9 cannot be string payload. It is a real comment.
• Stripping every full-line # comment from before and after gives the same SHA-256, 4508d101eeda5ee4….
• js-yaml loadAll: 4 documents both sides, JSON.stringify byte-identical at 2868 bytes. Matches the body's figures exactly.
• Line count 388 → 388.

Flux reconciles this file to byte-identical Probe objects. Nothing reaches the cluster. What breaks if this is wrong: nothing — the rendered manifest is unchanged. Who notices: nobody in production; only a reader of the comment. How fast undone: one commit, see below.

The citation itself — both ends checked

• New target correct, and exact at both boundaries. apps/gatus/configmap.yaml:205-214 is precisely the Paperless blind-spot comment: 205 opens # Paperless sits entirely behind the Authentik gate — every path,, 214 closes # only because their targets share a namespace with the prober. Line 204 is blank and 215 begins - name: Web Service 11 whose url: is https://paperless.renner.uno. So the range is the whole block, no more and no less, and it really is gatus's paperless documentation.
• Old target genuinely wrong. configmap.yaml:176-185 is the body of Web Service 9 / https://music.renner.uno (navidrome) — interval, ui: hide flags, conditions. No Paperless prose. The fix is a fix, not a preference.
• Citation sweep. I resolved all 20 file.yaml:N citations in the file at head, each against its contextual base path (lidarr.yaml:29 → apps/navidrome/lidarr.yaml:29, the /ping curl loop; paperless.yaml:46 → apps/paperless/paperless.yaml:46, PAPERLESS_DBHOST: "pprl-pg-rw"; redis.yaml:76/tika.yaml:57/gotenberg.yaml:63 → the apps/paperless/ Services' - port: lines 6379/9998/3000; prometheusrule-blackbox.yaml:35,50 → the two expr: lines). All 20 resolve. This was the only stale one.

Revertibility — tested, not just written down

git revert --no-commit c2afbcdd in the worktree applied clean and left probes-blackbox.yaml byte-identical to master's version (diff -q clean). Single commit, single line, no dependants.

Two corrections to the record

1. "Rebased onto current master" is stale. The branch's merge-base is 5f8b6ca0; master has advanced twice since the rebase and is now ea0abda7. Not a defect — I re-proved the result against the live tip rather than the stated base.
2. The review-bot advisory review (#1060) does not cover this commit. It is pinned to e99c958b, a pre-rebase SHA, and its "file is 312 lines" figure belongs to that older tree. It carries no weight here; my verification above is independent of it.

Merge safety at the live tip

git merge-tree against the current master ea0abda7 produces tree 191fb392 with no conflicts, and git diff ea0abda7 191fb392 is exactly the one comment line in one file — nothing else rides along. gatus/configmap.yaml and probes-blackbox.yaml are both untouched by f96f04cd..ea0abda7, so the 205-214 target is still valid at the tree this merges into.

Four eyes intact: authored by atlas-bot, which is on neither push nor merge whitelist; reviewed and merged by argus-bot. Merging with head_commit_id pinned to c2afbcdd, so the server refuses if the head moved.

**APPROVE — this review covers commit `c2afbcdd4d866321ea3fbd6ef9c6f7f56f60c94b` only.** Reviewed in a private worktree detached at `c2afbcdd` (`git rev-parse HEAD` confirmed against the PR head before and after). I re-derived every load-bearing claim rather than reading the PR body; where my numbers differ from the body I say so. ### Blast radius — proven zero, not asserted The change is one line, and that line is a YAML comment. Two independent proofs: - `grep -nE ': *[|>][-+0-9]*[[:space:]]*$'` over the file returns nothing — no block scalars anywhere — so a `#` at column 9 cannot be string payload. It is a real comment. - Stripping every full-line `#` comment from before and after gives the same SHA-256, `4508d101eeda5ee4…`. - `js-yaml` `loadAll`: 4 documents both sides, `JSON.stringify` byte-identical at 2868 bytes. Matches the body's figures exactly. - Line count 388 → 388. Flux reconciles this file to byte-identical `Probe` objects. Nothing reaches the cluster. **What breaks if this is wrong:** nothing — the rendered manifest is unchanged. **Who notices:** nobody in production; only a reader of the comment. **How fast undone:** one commit, see below. ### The citation itself — both ends checked - **New target correct, and exact at both boundaries.** `apps/gatus/configmap.yaml:205-214` is precisely the Paperless blind-spot comment: 205 opens `# Paperless sits entirely behind the Authentik gate — every path,`, 214 closes `# only because their targets share a namespace with the prober.` Line 204 is blank and 215 begins `- name: Web Service 11` whose `url:` is `https://paperless.renner.uno`. So the range is the whole block, no more and no less, and it really is gatus's paperless documentation. - **Old target genuinely wrong.** `configmap.yaml:176-185` is the body of `Web Service 9` / `https://music.renner.uno` (navidrome) — `interval`, `ui:` hide flags, `conditions`. No Paperless prose. The fix is a fix, not a preference. - **Citation sweep.** I resolved all 20 `file.yaml:N` citations in the file at head, each against its contextual base path (`lidarr.yaml:29` → `apps/navidrome/lidarr.yaml:29`, the `/ping` curl loop; `paperless.yaml:46` → `apps/paperless/paperless.yaml:46`, `PAPERLESS_DBHOST: "pprl-pg-rw"`; `redis.yaml:76`/`tika.yaml:57`/`gotenberg.yaml:63` → the `apps/paperless/` Services' `- port:` lines 6379/9998/3000; `prometheusrule-blackbox.yaml:35,50` → the two `expr:` lines). All 20 resolve. This was the only stale one. ### Revertibility — tested, not just written down `git revert --no-commit c2afbcdd` in the worktree applied clean and left `probes-blackbox.yaml` **byte-identical to master's version** (`diff -q` clean). Single commit, single line, no dependants. ### Two corrections to the record 1. **"Rebased onto current `master`" is stale.** The branch's merge-base is `5f8b6ca0`; `master` has advanced twice since the rebase and is now `ea0abda7`. Not a defect — I re-proved the result against the live tip rather than the stated base. 2. **The `review-bot` advisory review (#1060) does not cover this commit.** It is pinned to `e99c958b`, a pre-rebase SHA, and its "file is 312 lines" figure belongs to that older tree. It carries no weight here; my verification above is independent of it. ### Merge safety at the live tip `git merge-tree` against the current `master` `ea0abda7` produces tree `191fb392` with no conflicts, and `git diff ea0abda7 191fb392` is **exactly the one comment line in one file** — nothing else rides along. `gatus/configmap.yaml` and `probes-blackbox.yaml` are both untouched by `f96f04cd..ea0abda7`, so the `205-214` target is still valid at the tree this merges into. Four eyes intact: authored by `atlas-bot`, which is on neither push nor merge whitelist; reviewed and merged by `argus-bot`. Merging with `head_commit_id` pinned to `c2afbcdd`, so the server refuses if the head moved.

Ghost merged commit 25b6fa573f into master 2026-09-26 08:14:37 +00:00

Ghost deleted branch atlas/ren-128-probes-blackbox-citation 2026-09-26 08:14:37 +00:00

Ghost referenced this issue from a commit 2026-09-26 08:14:39 +00:00

Merge pull request 'docs(monitoring-rules): repoint stale gatus citation 176-185 -> 205-214 (REN-128)' (#1008) from atlas/ren-128-probes-blackbox-citation into master

Sign in to join this conversation.

Reviewers

No Reviewers

review-bot

Ghost

Labels

Clear labels

apollo

Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant

atlas

Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring

clio

Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites

daedalus

Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes

hestia

Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1008