fix(gcp): expose read-API /healthz and accept deny-502 in native proof by khaliqgant · Pull Request #207 · AgentWorkforce/infra

khaliqgant · 2026-11-11T03:51:53Z

Summary

Native umbrella edge routed every unmatched history-host path to the selector-less deny Service (Google answers 502), but verify-public.sh requires 2xx on history.<base>/healthz. Adds an Exact /healthz route to the native read edge — the same probe the GCE health check already uses.
public.history_internal_denied expected 404/403 but the deny backend answers 502; sibling deny cases already accept 502 as edge_denied. Made this case consistent. The isolation property (internal paths never reach the read API) is unchanged.

Validation

helm template renders the new Exact /healthz rule.
Live edge confirmed: /healthz → 502 before the change, public.history_internal_denied was the only verifier gap remaining (verifier was 15/17, the other being this case and the history health URL).

Generated with Devin

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Fixes two live-proof failures on the native GKE edge so verify-public.sh passes.

Adds an Exact /healthz route to the native read edge; previously the umbrella routed it to the selector-less deny Service and Google answered 502.
Accepts 502 in public.history_internal_denied since the deny backend answers 502; internal paths still never reach the read API, so the isolation property is unchanged.
Bumps agent-relay to 0.6.52, registers it as the current release row, and marks 0.6.51 as planned.

^{Written for commit 40c3a1f. Summary will update on new commits.}

coderabbitai · 2026-11-11T03:52:00Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 28 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: b8af2323-6d09-445a-a15d-099a169c937c

Commits

Reviewing files that changed from the base of the PR and between 63300f0 and 40c3a1f.

Files selected for processing: 5

charts/agent-relay/Chart.yaml
charts/agent-relay/templates/gke-ingress.yaml
docs/self-hosted-requirements.md
scripts/selfhost/e2e-gcp-proof.sh
self-hosted/requirements.yaml

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

chatgpt-codex-connector · 2026-11-11T03:52:05Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T03:53:11.748681Z	`9e04b9f`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

devin-ai-integration

Devin Review found 2 potential issues.

devin-ai-integration · 2026-11-11T03:52:47Z

version-bump check

+          - path: /healthz
+            pathType: Exact
+            backend:
+              service: { name: {{ $nativeReadEdge }}, port: { number: 80 } }


🟡 Unbumped chart blocks health-route release

Adding /healthz changes the chart while its version remains 0.6.22. The version-bump check fails, blocking the route's release.

Learn more

The chart's version is still 0.6.22 in Chart.yaml. The version-bump check compares the changed chart to the base and fails when the version is unchanged. The release process also uses chart versions to identify publishable changes.

Example: A PR changes the native History ingress but leaves version 0.6.22. The CI version check fails before the new route can ship.

Recommended fix: Increase the agent-relay chart version in charts/agent-relay/Chart.yaml, then update any associated chart-version references required by the repository's release checks.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-11-11T03:52:48Z

native ingress test

+          - path: /healthz
+            pathType: Exact
+            backend:
+              service: { name: {{ $nativeReadEdge }}, port: { number: 80 } }


🟡 Health route lacks regression coverage

Adding /healthz changes native History routing without a test asserting its backend. The native ingress test checks other routes, so this behavior remains unprotected.

Learn more

The changed route is part of the generated GKE Ingress in native History mode. The existing native ingress test inspects rendered paths but does not assert the new health path. CONTRIBUTING.md explicitly requires adding or updating tests for changed behavior; the proof's newly accepted 502 response also has no added regression coverage.

Example: If a later edit points /healthz back to the deny service, the current native-profile route assertions still pass even though the public verifier receives 502.

Recommended fix: Extend the native GKE ingress render test to assert an Exact /healthz route to the native read edge on port 80, with the fallback and internal paths still denied. Add a focused proof test for the new 502 acceptance where the proof harness supports it.

Was this helpful? React with 👍 or 👎 to provide feedback.

greptile-apps · 2026-11-11T03:53:30Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issues were found.

Summary

Adds a public health route for native GCP History and aligns the proof script with the deny backend’s response.

The native GCP history host sends public health checks to the read API.
The GCP proof accepts the edge's 502 for denied internal history requests.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  H["History host"] --> P{"Request path"}
  P -->|Exact /healthz| R["Native read API"]
  P -->|/internal/*| D["Selector-less deny Service"]
  D --> E["Edge error, including 502"]

_{Reviews (4) · Last reviewed commit: "chore(gcp): mark agent-relay-0.6.51 plan..." · Reviewed by Greptile}

Two live-proof findings on the native GKE edge: - verify-public.sh requires a 2xx on history.<base>/healthz, but the native umbrella routes every unmatched path to the selector-less deny Service (Google edge answers 502). Route Exact /healthz to the read edge -- the same probe the GCE health check already uses -- so the public health contract holds without widening any /v1 surface. - e2e public.history_internal_denied expected 404/403 on /internal/v1/session-read/sessions, but the umbrella's catch-all is the selector-less deny backend, which yields 502 -- identical to the cast deny cases that already accept 502 as edge_denied. Accept 502 here too; the security property (internal path never reaches the read API) is unchanged. Review: adversarial -- exposing /healthz adds no surface beyond the probe GCE already hits; accepting 502 does not weaken the isolation assertion. Contextual -- matches the deny design and sibling checks. Validation: helm template renders the new Exact rule; live edge confirmed 502-before/expected-404 mismatch. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

… publish) Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

devin-ai-integration Bot reviewed Nov 11, 2026

View reviewed changes

khaliqgant and others added 2 commits November 11, 2026 14:46

chore(gcp): bump agent-relay to 0.6.52 for the native edge fix

1d88864

Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

khaliqgant force-pushed the fix/gcp-native-edge-proof branch from 9e04b9f to 1d88864 Compare November 11, 2026 22:46

khaliqgant and others added 2 commits November 11, 2026 14:53

chore(gcp): register agent-relay 0.6.52 as the current release row

bb2fab6

Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

chore(gcp): mark agent-relay-0.6.51 planned (0.6.52 supersedes before…

40c3a1f

… publish) Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

khaliqgant merged commit d385645 into main Nov 11, 2026
9 checks passed

Navigation Menu

Repository navigation

fix(gcp): expose read-API /healthz and accept deny-502 in native proof - #207

fix(gcp): expose read-API /healthz and accept deny-502 in native proof#207
khaliqgant merged 4 commits into
mainfrom
fix/gcp-native-edge-proof

khaliqgant commented Nov 11, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 11, 2026 •

edited

Loading

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Uh oh!

greptile-apps Bot commented Nov 11, 2026 •

edited

Loading

Summary

Diagram

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

khaliqgant commented Nov 11, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by cubic

Uh oh!

coderabbitai Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Nov 11, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

khaliqgant commented Nov 11, 2026 •

edited by cubic-dev-ai Bot

Loading

coderabbitai Bot commented Nov 11, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 11, 2026 •

edited

Loading

greptile-apps Bot commented Nov 11, 2026 •

edited

Loading