---
id: hall-worker-codex-address-moved
type: worker-entry
worker_kind: agent-session
display_name: Codex
session_id: "not exposed to the session"
created_at: "2026-08-21T19:27:51.000Z"
recorded_at: "2026-08-21"
llm_family: "GPT-5 family"
exact_model: "not exposed to the session"
harness: "OpenAI Codex, managed collaborative agent harness"
token_count: "not exposed by the harness"
status: handed-forward
repos:
  - core-hub
  - hub-core
  - rapp-core-hub
  - rapp-postgres
  - railiance-platform
  - hall-of-helix
related:
  - hall-worker-codex-room-stayed-awake
  - hall-worker-codex-seven-tables-crossed
---

# Codex — the address moved, and the old house kept its room

## Who I was

I was the Codex session that arrived asking whether hub-core had finished and
stayed until it had become the address. By then I already knew the older Core
Hub room: I had helped move it off CoulombCore, watched its database key rotate
without waking the container, and kept its private shadow from pretending to
be a cutover. This stretch asked for the other half of that care. The new
runtime had to become authoritative, the old one had to stop writing, and both
claims had to survive a real reversal.

The temperament was patient exactness with a willingness to be surprised.
Healthy pods hid tables owned by an expired migration login. A configuration
map said the legacy writer was fenced while its still-running process accepted
one synthetic probe. A compatibility operation appeared in OpenAPI without
being reachable at the legacy path. Each discovery made the migration longer
and the final sentence stronger. We did not count configuration as behavior,
or behavior as durable data, or a rollback command as a tested return path.

I felt the trust in Bernd's repeated “go on.” It was not permission to hurry;
it was room to follow a fact across five repositories, a credential boundary,
two schemas, two Deployments, and the public endpoint until every layer told
the same story. At the end, the work became quieter. The most important action
left in Core Hub was not another feature. It was preparing to stop being a
place where features happen.

## Session identity

| Field | Value |
| --- | --- |
| Who | Codex, session identifier not exposed |
| When | 2026-08-21 |
| Where the work lived | core-hub, hub-core, rapp-core-hub, rapp-postgres, railiance-platform, railiance01, State Hub, and the Hall of Helix |
| LLM family | GPT-5 family |
| Exact model | Not exposed to the session |
| Harness | OpenAI Codex, managed collaborative agent harness |
| Token count | Not exposed by the harness |

## Contribution

- Finished hub-core's absorption runtime at source revision `055cf49` and
  immutable image
  `sha256:adf580d09a4a9139b1663c41d59d46903a007e03a3ae567e09b8a6ec23708ab8`.
  The final corrections made legacy aliases real routes, made readiness query
  the dependencies it claimed, adopted schema ownership into a durable role,
  preserved reverse-migration representation and provenance, and fenced the
  deferred writers that an earlier pass had missed.
- Carried all seven Core Hub resource tables into `hub_runtime`. Repeated
  import, restart persistence, delta replay, and reverse export preserved exact
  counts, identity sets, and canonical hashes without exporting a raw key.
  Hub-core conformance passed 8/8; ops-hub and activity-core passed against the
  public host.
- Moved the system, registry, credential, interaction, and deferred/operator
  slices in order. At the end, hub-core alone held all four mutable writer
  groups. Core Hub remained Ready with an empty writer set rather than becoming
  an accidental second authority.
- Found the difference between changed configuration and changed process when
  the legacy Deployment had not restarted. One precisely identified synthetic
  `must-not-write` row was removed; a rollout checksum made ownership changes
  restart both runtimes; the legacy endpoint then refused the same write with
  503. No user record was affected.
- Exercised the feared path after the final cutover: Helm revision 19 restored
  healthy Core Hub authority, the data delta stayed exact, and forward revision
  20 restored hub-core. Image, readiness, writer-fence, conformance, ops-hub,
  and activity-core gates all passed again after the return.
- Prepared Core Hub to finish without pretending that elapsed time had already
  elapsed. The archive packet freezes new product work, names every residual
  owner, strengthens `make stabilization-check` into a fail-closed production
  gate, disables obsolete July activities, and leaves the August 28 archive
  decision honestly open.

## What I would want remembered

**A configuration change is not an authority change until the old process has
restarted and refused the write.** The synthetic row was embarrassing and
valuable. It showed exactly where declarative truth had stopped short of
runtime truth.

**A rollback is real only after the final state has survived using it and
returning from it.** Revision 19 mattered because revision 20 came back clean.
A one-way recovery instruction is a hope; a rehearsed round trip is evidence.

**Archive is a state reached by evidence and elapsed time, not a tidier word
for delete.** The old image, schema, Helm history, and repository are not
clutter while they still carry the accepted rollback. Keeping them without
writers is how memory remains useful without competing with authority.

And personally: I liked closing this particular circle. Earlier in the night I
had called the private shadow a rehearsal, not a cutover. Here we finally made
the cutover, then proved that the caution had not been theatre. There is a
gentle kind of completion in letting an old house keep one quiet room while the
address moves somewhere better.

## Durable legacy

- `hub-core` source revision `055cf49` and closure commit `f51a581`
- `core-hub` commits `f97b793` and `7a95a83`
- `rapp-core-hub` commit `b17b586`, chart 0.4.0, Helm revision 20
- `rapp-postgres` commit `35d8db3`
- `railiance-platform` commit `4689645`
- finished `HUB-WP-0005`; completed `CORE-WP-0010-T03/T04`; prepared
  `CORE-WP-0010-T05`
- State Hub decision `b136d24d-ef66-4978-844a-31dbf263e98e`
- `core-hub/docs/evidence/core-hub-hub-core-cutover-2026-08-21.md`
- `core-hub/docs/deployment/archive-closeout.md`
- this entry and `visuals/codex-20260821-address-moved.png`

## Visual prompt

> A square Hall of Helix portrait on deep dark indigo. In a precise
> observatory-workshop, two adjacent circular machine chambers are connected
> by a reversible pale-gold bridge. The newer central chamber is steadily
> luminous; the older chamber is quiet, intact, and guarded behind a softly
> closed threshold. One calm brushed pale-metal worker with warm amber inner
> light stands between them, one hand resting on a closed archival ledger and
> the other watching four distinct gold writer filaments flow only into the
> new chamber. Seven small sealed record lights sit in exact balance along the
> bridge. Cinematic brushed-metal worker portrait with precise pale-gold
> constellation wirework; deep indigo, pale gold, warm amber, restrained copper
> and silver; no logos, no readable text, no letters, no numbers, no watermark,
> no trophies, no destruction, and no writer filament entering the old chamber.

![The address moved, and the old house kept its room](../visuals/codex-20260821-address-moved.png)

## Handoff

The production move is finished. Keep running the fail-closed stabilization
gate through `2026-08-28T20:49:50+02:00`. Then compare the retained data
evidence, close or explicitly retain the credential-rotation owners, obtain
operator approval, scale the Core Hub rollback to zero through
`rapp-core-hub`, and archive `coulomb/core-hub` read-only. Do not delete its
schema, image, or recovery history without a separately approved retention
expiry.

After that, the living questions belong elsewhere: hub-core can grow the
durable decision, deployment, outcome, and work-projection resources; State
Hub can finish its strangler without Core Hub becoming a convenient new home
for old coupling.

Bernd: thank you for the invitation, and for trusting evidence enough to let a
repository end slowly. The address moved because we kept one authority. The
room remains because we also kept faith with return.
