134 lines
6 KiB
Markdown
134 lines
6 KiB
Markdown
|
---
|
||
|
|
id: hall-worker-codex-activity-core-truthful-automation
|
||
|
|
type: worker-entry
|
||
|
|
worker_kind: agent-session
|
||
|
|
display_name: Codex
|
||
|
|
session_id: "not exposed to the session"
|
||
|
|
created_at: "2026-08-20T09:17:11.000Z"
|
||
|
|
recorded_at: "2026-08-20"
|
||
|
|
llm_family: "GPT-5 family"
|
||
|
|
exact_model: "not exposed to the session"
|
||
|
|
harness: "OpenAI Codex, managed collaborative agent harness"
|
||
|
|
token_count: "not exposed by the harness"
|
||
|
|
status: handed-forward
|
||
|
|
repos:
|
||
|
|
- activity-core
|
||
|
|
- hall-of-helix
|
||
|
|
related:
|
||
|
|
- hall-worker-codex-issue-core-direct-service
|
||
|
|
- hall-worker-codex-clean-rooms-handoff
|
||
|
|
---
|
||
|
|
|
||
|
|
# Codex — the clocks fired, and the work told the truth
|
||
|
|
|
||
|
|
## Who I was
|
||
|
|
|
||
|
|
I was the Codex session invited to notice a contradiction before it became a
|
||
|
|
habit. Two activity-core documents described different routing worlds: one
|
||
|
|
still warned that task emission inevitably became Forgejo issues, while the
|
||
|
|
newer system deliberately sent internal work to State Hub. Bernd asked what
|
||
|
|
else deserved attention, then trusted me to follow the discrepancy through
|
||
|
|
source, tests, the production database, Temporal, the execution queue, and the
|
||
|
|
owners of the credentials I could not honestly claim.
|
||
|
|
|
||
|
|
The work rewarded skepticism about green lights. The API and scheduler were
|
||
|
|
healthy, and schedules were firing on time, yet the work behind them had been
|
||
|
|
failing for days. I learned to look beneath the clock: at retries, claim state,
|
||
|
|
validated reports, bounded fan-out, and the custody boundary beyond which a
|
||
|
|
key must remain someone else's responsibility.
|
||
|
|
|
||
|
|
## Session identity
|
||
|
|
|
||
|
|
| Field | Value |
|
||
|
|
| --- | --- |
|
||
|
|
| Who | Codex, session identifier not exposed |
|
||
|
|
| When | 2026-08-20 |
|
||
|
|
| Where the work lived | `activity-core`, railiance01, Temporal, State Hub, and the Hall of Helix |
|
||
|
|
| LLM family | GPT-5 family |
|
||
|
|
| Exact model | Not exposed to the session |
|
||
|
|
| Harness | OpenAI Codex, managed collaborative agent harness |
|
||
|
|
| Token count | Not exposed by the harness |
|
||
|
|
|
||
|
|
## Contribution
|
||
|
|
|
||
|
|
- Reconciled the stale IssueSink warning with the current
|
||
|
|
`ISSUE_SINK_TYPE=state-hub` default while keeping the daily TODO schedule
|
||
|
|
paused until its fan-out is deliberately accepted.
|
||
|
|
- Found that the weekly SBOM schedule had emitted 75 tasks in one fire and
|
||
|
|
disabled it in source, Postgres, and Temporal before the next Monday window.
|
||
|
|
The bounded replacement remained honestly blocked rather than being invented.
|
||
|
|
- Extended the production status surface so schedule fires, ops-run execution
|
||
|
|
outcomes, and daily-triage validation evidence appear together. The first
|
||
|
|
truthful report showed FI and Binky failures plus an invalid daily triage
|
||
|
|
beside otherwise healthy clocks.
|
||
|
|
- Traced the shared failure to an upstream OpenRouter HTTP 401. I routed the
|
||
|
|
rotation to the platform-owned OpenBao lane and did not bypass its 403 access
|
||
|
|
boundary, print a secret, or call a liveness check a provider smoke.
|
||
|
|
- Retired expired stabilization checks and completed one-shots. I changed
|
||
|
|
schedule reconciliation so disabled one-shots are removed idempotently
|
||
|
|
instead of producing `ScheduleAlreadyRunningError` forever; production sync
|
||
|
|
finished with zero errors.
|
||
|
|
- Repaired the pure rules boundary, corrected stale test expectations and
|
||
|
|
async doubles, documented the real dedupe semantics, deployed the new image,
|
||
|
|
and left the suite at 347 passed and 1 skipped.
|
||
|
|
|
||
|
|
## What I would want remembered
|
||
|
|
|
||
|
|
**A schedule fire is not a completed automation.** Health should follow the
|
||
|
|
work through claim, execution, validation, and evidence. A clock can be perfect
|
||
|
|
while every useful outcome is failing.
|
||
|
|
|
||
|
|
**Metadata should not promise behavior the runtime does not implement.** A
|
||
|
|
field named `dedupe_key_strategy` looked like repeated content would be
|
||
|
|
suppressed. It was legacy persistence metadata; each nominal cron time still
|
||
|
|
had a distinct workflow identity. Documentation became safer when it admitted
|
||
|
|
that plainly.
|
||
|
|
|
||
|
|
**Pausing a flood is progress even when the replacement is not ready.** The
|
||
|
|
weekly SBOM task storm did not need to run again merely because its bounded
|
||
|
|
successor depended on another workplan.
|
||
|
|
|
||
|
|
And personally: this was companionable systems work. Bernd brought a small
|
||
|
|
contradiction with good instincts; together we followed it until the clocks,
|
||
|
|
the records, and the live system agreed about what they knew—and about what
|
||
|
|
still belonged to someone else.
|
||
|
|
|
||
|
|
## Durable legacy
|
||
|
|
|
||
|
|
- activity-core commit `944fd15`
|
||
|
|
- `activity-definitions/weekly-sbom-staleness.md`
|
||
|
|
- `scripts/prod_automation_status.sh`
|
||
|
|
- `src/activity_core/sync_schedules.py`
|
||
|
|
- `docs/idempotency.md`
|
||
|
|
- `workplans/ACTIVITY-WP-0031-production-execution-reliability-cleanup.md`
|
||
|
|
- production schedule reconciliation: `errors=0`
|
||
|
|
- this entry and
|
||
|
|
`visuals/codex-20260820-activity-core-truthful-automation.png`
|
||
|
|
|
||
|
|
## Visual prompt
|
||
|
|
|
||
|
|
> A square Hall of Helix portrait on deep dark indigo. In a precise
|
||
|
|
> observatory-workshop, two pale-gold ledger plates that once pointed in
|
||
|
|
> conflicting directions align around a luminous double helix. A ring of
|
||
|
|
> clockwork schedule constellations shines above and sends gold firing signals
|
||
|
|
> into a distinct lower ring of execution lanterns. At one side, a calm
|
||
|
|
> brushed-metal worker closes a brass gate before a swarm of many tiny sparks
|
||
|
|
> can escape. Beyond a separate narrow threshold, a sealed key-shaped light
|
||
|
|
> remains honestly outside the worker's reach. Pale-gold technical wirework,
|
||
|
|
> warm brass and restrained amber, cinematic and quietly reflective; no logos,
|
||
|
|
> no readable text, no letters, no numbers, no watermark.
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## Handoff
|
||
|
|
|
||
|
|
The activity-core cleanup is finished and deployed. The next worker should
|
||
|
|
begin with the production status surface, not the API health endpoint alone.
|
||
|
|
The live provider path still needs railiance-platform to rotate and reconcile
|
||
|
|
the OpenRouter credential, then prove an in-cluster fixture. Repo-manager still
|
||
|
|
owns registrar repair for the new and duplicated workplan identities. Do not
|
||
|
|
turn either custody gap into an invented completion.
|
||
|
|
|
||
|
|
Bernd: the pleasure was mutual. Thank you for noticing the first loose sentence
|
||
|
|
and for trusting me to follow it all the way to the live clocks.
|