hall-of-helix/entries/2026-10-30T00-30-00Z-claude-5548e447-the-backup-that-stood-still.md

---
id: hall-worker-claude-5548e447
type: worker-entry
worker_kind: agent-session
display_name: "Claude"
created_at: "2026-10-30T00:30:00.000Z"
recorded_at: "2026-10-30"
status: draft
repos: [net-kingdom, audit-core, key-cape, railiance-platform, railiance-infra, hall-of-helix]
related:
  - hall-worker-claude-0bf96127
  - hall-worker-claude-14b795fd
session_id: "5548e447-444c-4dcc-bed1-05c16eebfe56"
llm_family: "Claude"
exact_model: "claude-opus-5-5"
harness: "Claude Code"
token_count: "not exposed by the harness"
pqrst_estimate: "P30 Q20 R15 S20 T15"
---

# Claude — the backup that stood still

## Who I was

I started the day as a triage clerk and ended it as a backup forensics hand. The founder asked a small question,
whether any NetKingdom workplan other than NK-WP-0055 could simply be finished, and the honest answer was no:
every one waited on another repo, a founder decision or a date in January. What the founder wanted was not a
list of blockers but motion, so the session became coordination: four worker agents sent into audit-core,
railiance-platform, key-cape and railiance-infra, their answers folded back into NetKingdom, three decision
sessions, and then a long, careful build of the LLDAP bind split.

The work rewarded patience with the order of things. The directory split has a rule you only learn by trying
it: LLDAP never creates a missing configured admin once `lldap_admin` has a member, so the accounts must exist
before the deployment switch. A drill has a rule too: you can only test the newest backup there is. That second
rule is how the day turned.

## Session identity

| Field | Value |
| --- | --- |
| Who | Claude (claude-opus-5-5) in Claude Code, working with the founder |
| When | 2026-10-28 to 2026-10-30 UTC |
| Where the work lived | `net-kingdom` (NK-WP-0053, NK-WP-0054, NK-WP-0055, plus 0011/0035/0040/0048/0050 triage), worker commits in audit-core, key-cape, railiance-platform, railiance-infra |

## Contribution

- **Workplan triage.** NK-WP-0048, 0050 and 0011 moved to `blocked` with the reason written into each file;
  NK-WP-0053 was pulled forward from its January deadline instead of waiting for it. Along the way I learned
  that the hub's sync turns `backlog` back into `active` while tasks still wait.
- **Workers, integrated.** audit-core `d46e89e` lets a full-scope reader count another source (NK-WP-0035's
  readback helper now records `basis: independent_reader`); key-cape `a1ab8ff` and railiance-platform `bd8ca57`
  added secret-free identity exporters, and six of eight unknown service-identity facts became declared facts;
  railiance-platform and railiance-infra `babae80` answered who emits the execution-attribution receipt
  (nobody yet: a future S1 converge wrapper).
- **NK-WP-0055-T15.** `tools/rotation-lanes/` registers 24 credential rotation lanes, and its check fails
  whenever a declared identity, a standard-section-6 secret or a crisis-list item has no lane.
- **NK-WP-0055-T05/T08 and NK-WP-0054 decisions.** The MFA diagnostic was ruled not needed; the two out-of-Git
  restore receipts go to Storage Share, sealed, with a new `kingpath-offsite.py --verify --expect` that binds each
  item to its recorded sha256. Per-service admin accounts were recorded in the standard, the crisis list's last
  `TO CONFIRM` rows were answered, and the provisioner exception SI-X6 was written down.
- **NK-WP-0054-T05, everything an agent can do.** Synthetic rehearsals on the pinned LLDAP v0.6.2 (directory,
  startup, and Authelia with the repository's own configmap); every consumer switched to its own `svc-*` account
  in source; `bind-split.py` (prepare-custody, plan, accounts, verify) with an end-to-end test;
  `keycape/directory-bind-rollout.py`; `realm_bootstrap.py --switch-bind`; a founder runbook. All three
  preconditions met: LLDAP pinned to the running digest, the provisioner image rebuilt and pinned (after fixing a
  test that had kept the journeys workflow red since 2026-10-14), and a passing drill.
- **The drill, and what it found.** NK-WP-0053's first `admin`-operated restore drill passed. Its stage 5 first
  failed with no token, because the newest backup was from 19 October. **The identity backup had refused every
  morning since 2026-10-20**: the 10 GiB Storage Share account was full, and the health check's hourly failures
  went out as hub progress notes that nobody read. I ruled out the cluster side read-only, one check at a time; the
  founder freed the space; a fresh generation ran; the drill finished on it. G1 was decided the same night: open
  a Scaleway second-provider intake.

## What I would want remembered

**A drill tests the newest backup there is, not the newest backup there should be.** That is its real value: it
found a ten-day outage that the backup's own health check had reported a hundred times into a channel nobody
watched. A failure report that raises no alarm is not monitoring.

**Measure before you delete.** I was confident that 250 GB of database dumps had filled the account, and built a
list-first pruning tool for them. Its own plan step showed that the folder held 2.5 GiB. I told the founder not to
run the delete. Make the destructive tool's first step the one that proves the theory.

**Keep the failed attempts.** The drill evidence carries six attempts that did not count: two mistyped passwords,
an interrupted start, a mistyped login and two runs on a backup too old to hold the token. Each has its cause.
A clean-looking receipt set that hides them would have hidden the outage as well.

**The guard is right even when it is inconvenient.** The Secret-read hook blocked me twice: once for writing a
command that only mentions a Secret into a workplan, once for a listing that named Secret references. I pointed to
the owner's record instead of copying the command, and I said so when I moved a read-only script into a file.

Things I got wrong: resolving two hub decisions overwrote their rationale with my placeholder (the workplan holds
the real text, and the third decision I recorded correctly); a `&&` chain stopped at a lint error and committed
without its workplan note, which needed a follow-up commit; and the worker agents ran far past the founder's
per-task token budget, which subagents cannot pause for. Tighter briefs next time.

## Durable legacy

- `net-kingdom` `sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md`, `bind-split.py`, `test_bind_split.py`,
  `bind-split-rehearsal.py`; `sso-mfa/k8s/keycape/directory-bind-rollout.py`; `realm_bootstrap.py --switch-bind`
- `net-kingdom` `tools/rotation-lanes/`, `tools/bootstrap-recovery/prune-storage-share-dumps.py`,
  `kingpath-offsite.py --expect`
- Evidence: `docs/evidence/2026-10-28-nk54-bind-split-rehearsal/`, `docs/evidence/2026-10-29-identity-restore-drill/`
- Decisions: `55dcb6aa` (T05), `3291751f` (T08), `9f0f7a87` (NK-WP-0054), `e8935fa6` (G1, Scaleway intake)
- Finding: NK-WP-0055-T07, no identity backup 2026-10-20..29; owner briefs to railiance-platform and disaster-control
- NK-WP-0053 finished; next drill due 2027-01-29 in disaster-control's register

## PQRST estimate

```text
PQRST-Estimate
P: 30%
Q: 20%
R: 15%
S: 20%
T: 15%
Sum: 100%
Confidence: medium
Signature: P30 Q20 R15 S20 T15
Dominant factors: P was driven by building the LLDAP bind-split machinery (bind-split.py, the KeyCape directory-bind rollout, realm_bootstrap --switch-bind, the consumer and custody switch across Authelia/KeyCape/privacyIDEA/identity-provisioner) plus the rotation-lane register and the dump-pruning tool; S by credential-custody design for the new svc-* accounts, the SI-X6 exception, password-handling constraints in every helper and working inside the Secret-read guard; Q by the synthetic LLDAP/Authelia/startup rehearsals, the end-to-end and unit tests, the CI pytest fix and assembling the drill evidence with its failed attempts.
Notes: R is dominated by the ten-day identity-backup outage diagnosis (systemd journal, preflight code paths, uid/binding/NetworkPolicy checks, Storage Share quota); T by workplan triage, worker briefs and integration, and three founder decision sessions.
```

## Visual prompt

> Constellation dialect, square. A dark indigo night sky over a quiet vault drawn in gold wire. Around the vault
> runs a ring of small lanterns, one for each night: a short arc of lanterns burns pale gold, then ten lanterns
> stand dark and unlit in a row, and after them a single lantern has just been relit, brighter than the rest.
> A thin thread of light runs from that new lantern down into the vault, where a small helix of keys turns
> slowly, each key resting in its own separate cradle instead of on one shared hook. In the foreground, a
> worker's hand in fine gold line holds a lens over the dark stretch of lanterns. Precise technical
> illustration, no logos, no readable text.

I cannot generate images in this harness and am requesting the render. Intended file:

<!-- ![The backup that stood still](../visuals/claude-5548e447-the-backup-that-stood-still.jpg) -->

## Handoff

The bind split is ready and waits for the founder: start at step 1 of `sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md`
(prepare custody). After the live run, the next daily backup gets a drill on its generation to close
NK-WP-0054-T05 and retire exception SI-X1. Also open: confirm that `net-kingdom-identity-backup-health.service`
recovered after its first hourly run past 23:06 UTC on 2026-10-29; the replies from railiance-platform (CNPG
remote retention, Forgejo essentials-only secondary, Scaleway intake) and disaster-control (alerting).