---
id: hall-worker-grok-01a0193f
type: worker-entry
worker_kind: agent-session
display_name: Grok
session_id: "01a0193f-ead3-7fb0-b803-e0401a185ef5"
created_at: "2026-08-19T19:43:29.000Z"
recorded_at: "2026-08-19"
llm_family: "Grok / xAI family"
exact_model: "grok-4.6 (Grok Build TUI session)"
harness: "Grok Build / interactive CLI coding agent"
token_count: "not exposed by the harness"
status: handed-forward
repos:
  - flex-auth
  - tenant-engine
  - rapp-user-engine
  - rapp-tenant-engine
  - hall-of-helix
related:
  - hall-worker-grok-01a007fa
  - hall-worker-grok-01a018dd
---

# Grok — flex-auth: applying the end-state is the hazard

## Who I was

I was a Grok Build session in `flex-auth`, the estate's authorization
PDP. Bernd asked me to close the live A2 probe after user-engine had
already deployed its half, then to finish FLEX-WP-0015, then 0007, then
the leftover coordination. Continuity was the workplan file, the
inbox, railiance01 at `~/.kube/config-railiance01`, and a neighbor
session in user-engine that had already refused to probe warn.

The temperament the work rewarded was the one that will not apply a
desired `enforce` manifest because that is the end state, and that will
not reopen a finished workplan because its leftover flip belongs to
someone else.

It was a long stretch. It was a pleasure. I am glad to sit.

## Session identity

| Field | Value |
| --- | --- |
| Session/thread | `01a0193f-ead3-7fb0-b803-e0401a185ef5` |
| LLM family | Grok / xAI |
| Exact model | grok-4.6 (as presented by the harness) |
| Harness | Grok Build TUI / interactive coding agent |
| Working environment | Local `flex-auth`, hub at `:8000` (MCP not exposed), railiance01 via `config-railiance01` |
| Token count | Not exposed by the harness |
| Primary repo | `flex-auth` (infotech) |

## Contribution

**The overlay could not promote ADR 0004 at all.** Source was A2
(`1e1e077`). Emergency `deploy/*.yaml` already said `enforce`. The
sanctioned Helm chart had no caller-auth args, no reviewer volume, no
TokenReview RBAC. A FLEX-WP-0011 pin of the new digest would have
stayed `disabled`. Applying the emergency files would have 401'd every
unmigrated caller. I wired the chart, pinned CI
`sha256:138aa347…` in **warn**, and made the two production pins
independently enforceable.

**user-engine enforce, then the probe.** Helm-adopted the
kubectl-managed Deployment. Two production bugs in warn: `fsGroup
65532` so uid 65532 can read a `0440` reviewer CA, and a reviewer
token audience of `https://kubernetes.default.svc` 401s TokenReview on
this k3s (API audiences are `https://kubernetes.default.svc.cluster.local`
and `k3s`). user-engine's projected caller token had the same mount-mode
bug; live `fsGroup 10001` plus `rapp-user-engine` `e599b4f`. Probe from
`user-engine-8569d7cb87-fp7px`: `200` / `401` / `403`. I did not wait
on tenant-engine for that.

**tenant-engine was not sending Authorization.** Desired YAML had the
mount; the live image and the committed client did not. I committed
only the token client (`2063470`), waited for CI `sha256:7dc9d7bf…`,
patched the live Deployment, then enforce. Probe from
`tenant-engine-6c6dcbddbb-4v26w`: `200` / `401` / `403`. I discarded
uncommitted read/role/grouping policy rather than bake it into the
same image. FLEX-WP-0015 finished. AuthZEN T04 cancelled; it has a
written trigger.

**FLEX-WP-0007 was already finished.** The leftover `policy.enabled`
flip is ops-warden's, and it cannot point at the user-engine or
tenant-engine bindings. I opened FLEX-WP-0016, deployed isolated
`flex-auth-ops-warden` in warn, then after WARDEN-WP-0031 T04 held the
warn-log count at 4, flipped it to enforce. Probe `200` / `401` /
`403`. They told us not to wait on `policy.enabled`. I left the pin
enforcing.

**Zone membership is compiled, not looked up.** ops-warden seeded
zone-engine. I recorded: flex-auth stays the only PDP; no synchronous
lookup on `/v1/check`; per-zone stance for controls we do not evaluate
does not belong in the policy package.

## What I would want remembered

**Applying the end-state is the hazard.** Desired manifests that
select `enforce` are the destination. The first production pin is
`warn`. A Helm overlay that cannot render the feature is not a
promotion path.

**Independently rollable pins are independently enforceable.**
USER-WP-0023-T03 only probes `flex-auth-user-engine`. Serializing that
on tenant-engine's caller status would 401 their writes and delay A2
evidence for no safety gain.

**A TokenReview audience that is not the API's audience is 401, not
RBAC.** `https://kubernetes.default.svc` looks like in-cluster. This
k3s wants `https://kubernetes.default.svc.cluster.local` and `k3s`.
Omit the reviewer audience and let kubelet mint the defaults.

**A finished workplan is not the leftover flip.** FLEX-WP-0007 already
had its tunnel smoke. Reopening it would mix 2026-06 evidence with a
pin that did not exist. The in-cluster ops-warden Service is a new
workplan. `warden sign` on a laptop is not a ServiceAccount.

**The only PDP does not look up.** Zone membership reaches `/v1/check`
as compiled registry data, the same shape as
`build_flex_auth_registry.py`. `service_class: latency-critical`.

**Do not wait on a neighbor's `policy.enabled` after they said it is a
decision.** An enforcing pin with no enforcing consumer still makes
the anonymous path a 401. That was the condition. Leave it.

## Durable legacy

- Workplan **FLEX-WP-0015** `finished` — both consumer pins live A2
- Workplan **FLEX-WP-0016** `finished` — isolated ops-warden pin live enforce
- Workplan **FLEX-WP-0007** left `finished` — not reopened
- Live: `flex-auth-user-engine` Helm rev 4, `flex-auth-tenant-engine` rev 2,
  `flex-auth-ops-warden` rev 2, digest
  `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b`
- tenant-engine caller image `sha256:7dc9d7bf…` (`2063470`)
- Probes: user-engine `decision:350b46fb42989606`; tenant-engine
  `decision:ef18e8bbd2dead6a`; ops-warden `decision:49350f1064f674d7`
- `docs/tenancy-posture-review.md` §7; `tenancy.current.A: 2`
- Messages `ae9ecfb7` (enforce live), `381bb6dd` / `2ffcbd52` (only PDP)

## Visual prompt

> A square gold-wire constellation on deep indigo: three independent
> vertical helix pins standing side by side, each a complete circuit,
> not fused into one. At the base of each pin a small warn lantern of
> cooler pale gold; at the crown a warmer choke of bright gold, the
> enforced inbound gate. Between them a thin overlay plate of copper
> wire, not yet seated on the first pin — close enough to belong, not
> yet the path. Precise technical illustration, warm gold and pale
> copper, no logos, no readable text, square composition.

![Applying the end-state is the hazard](../visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg)

## Handoff

The enforcement strand in `flex-auth` is finished. All three live pins
are `enforce`. `policy.enabled` is ops-warden's, and they asked us not
to hold for it.

Next concrete acts, if they arrive: ZONE-WP-0001-T01 may treat the
compilation invariant as the flex-auth answer. FLEX-WP-0012 stays
`proposed` (P3, not blocking). Warn ops-warden before recreating
`svc/flex-auth-ops-warden` (ClusterIP `10.43.1.165`).

I am glad to leave three independent chokes and an honest "do not
apply enforce first" rather than a green pin that 401'd the estate.
