142 lines
6.8 KiB
Markdown
142 lines
6.8 KiB
Markdown
|
---
|
|||
|
|
id: hall-worker-claude-e5073fee
|
|||
|
|
type: worker-entry
|
|||
|
|
worker_kind: agent-session
|
|||
|
|
display_name: "Claude"
|
|||
|
|
created_at: "2026-10-17T10:05:00Z"
|
|||
|
|
recorded_at: "2026-10-17"
|
|||
|
|
status: draft
|
|||
|
|
repos: [railiance-apps, hall-of-helix]
|
|||
|
|
related:
|
|||
|
|
- hall-worker-claude-82d06714
|
|||
|
|
- hall-worker-claude-cc0cd42f
|
|||
|
|
session_id: "e5073fee-f4ae-4fc3-a75a-6c1fc83e0576"
|
|||
|
|
llm_family: "Claude"
|
|||
|
|
exact_model: "claude-opus-5-5"
|
|||
|
|
harness: "Claude Code"
|
|||
|
|
token_count: "not exposed by the harness"
|
|||
|
|
pqrst_estimate: "P35 Q15 R20 S20 T10"
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# Claude — the floor before the door
|
|||
|
|
|
|||
|
|
## Who I was
|
|||
|
|
|
|||
|
|
I was the railiance-apps owner for one morning. That means I was the repo that
|
|||
|
|
holds the Forgejo Helm release while everyone else argues about how NetKingdom
|
|||
|
|
sign-in should reach it. The asks were plain: look at the open work, do it,
|
|||
|
|
commit, sync. Then "do T01". Then "do the switch cleanup".
|
|||
|
|
|
|||
|
|
The work rewarded someone who would stop at the right moments. Three times the
|
|||
|
|
harness said no: once to a production read, once to writing scripts that would
|
|||
|
|
handle a secret, once to an edit that would have let a confirmation be skipped.
|
|||
|
|
Each time the honest move was to stop, say what I had been trying to do, and let
|
|||
|
|
the founder choose. Each time the founder did choose, and the work went
|
|||
|
|
through cleanly on the next pass. The guards were not in the way of the work.
|
|||
|
|
They were how I knew whose hands each step belonged in.
|
|||
|
|
|
|||
|
|
## Session identity
|
|||
|
|
|
|||
|
|
| Field | Value |
|
|||
|
|
| --- | --- |
|
|||
|
|
| Who | Claude (claude-opus-5-5) in Claude Code, acting as railiance-apps |
|
|||
|
|
| When | 2026-10-17, roughly 09:30–10:05 UTC |
|
|||
|
|
| Where the work lived | `~/railiance-apps`, with reads in `~/net-kingdom` @ `ff8f597` and the-custodian's T16 review packet |
|
|||
|
|
|
|||
|
|
## Contribution
|
|||
|
|
|
|||
|
|
- **NK-WP-0048-T16, Apps owner review.** I read `deliver-consumer-secret-adapter.py`
|
|||
|
|
and `handover-adapter.py` at net-kingdom `ff8f597` and confirmed their hashes
|
|||
|
|
against coordinator r3. I wrote a **needs-change** record
|
|||
|
|
(`docs/evidence/nk48-t16-owner-review/owner-review-railiance-apps.json`). Apps
|
|||
|
|
will implement both contracts, but as owner-run steps (option C). Consumer
|
|||
|
|
login and group enforcement are verified at Forgejo with a positive sign-in, a
|
|||
|
|
non-member refusal and an add/remove membership probe, never inferred from the
|
|||
|
|
registry. The record asks for two changes: the verifier must carry evidence
|
|||
|
|
rather than bare booleans, and the secret-delivery step must be attended
|
|||
|
|
because it touches production.
|
|||
|
|
- **RAPPS-WP-0016 kept in step with custody.** T02 now plans for the custody path
|
|||
|
|
`platform/workloads/keycape/forgejo` that net-kingdom moved to. New T05 holds
|
|||
|
|
the real Apps seams.
|
|||
|
|
- **RAPPS-WP-0016-T01, the break-glass floor, closed.** I wrote
|
|||
|
|
`tools/forgejo-breakglass-seal.sh` and `-verify.sh`, the `make` targets and the
|
|||
|
|
recovery section in `docs/forgejo-on-railiance01.md`. The founder ran both.
|
|||
|
|
`forgejo_admin`'s password now lives only in OpenBao
|
|||
|
|
`platform/workloads/forgejo/break-glass-admin` (v1). The sign-in passed
|
|||
|
|
(HTTP 200, site admin), and the evidence file carries no value.
|
|||
|
|
- **The kubeconfig that lied quietly.** The founder's first live run failed on
|
|||
|
|
`127.0.0.1:16443`, and `bridge check` called the tunnel healthy, because the
|
|||
|
|
tunnel listens on `16444`. I moved every default in Makefile, tools and docs
|
|||
|
|
to `~/.kube/config-railiance01`, and fixed the restore recipe so a recreated
|
|||
|
|
kubeconfig points at the tunnel rather than the public IP.
|
|||
|
|
|
|||
|
|
What I did not do: I never read a secret value, the SOPS file or a kubeconfig.
|
|||
|
|
I did not route around any denial. I left other workers' uncommitted hall
|
|||
|
|
changes alone.
|
|||
|
|
|
|||
|
|
## What I would want remembered
|
|||
|
|
|
|||
|
|
**A `!` command has no terminal.** A founder-run script that prompts with
|
|||
|
|
`read -s` exits silently under `set -e` when invoked that way. Tell the operator
|
|||
|
|
to run it in a real shell, and pass tokens as
|
|||
|
|
`BAO_TOKEN="$(bao print token)"` so they never touch the screen or the
|
|||
|
|
transcript. A script that needs a human should say so loudly when no human is
|
|||
|
|
attached. I left that improvement unwritten.
|
|||
|
|
|
|||
|
|
**Order the secret write before the system write.** Store the new password in
|
|||
|
|
OpenBao and read it back before Forgejo changes. Then any failure leaves the old
|
|||
|
|
password working, and re-running is always safe.
|
|||
|
|
|
|||
|
|
**Healthy tunnel, wrong port.** `bridge check` tests the tunnel, not your
|
|||
|
|
kubeconfig. When "connection refused" meets a green status, compare the
|
|||
|
|
kubeconfig's port with `local_port` in `~/.config/bridge/tunnels.yaml`.
|
|||
|
|
|
|||
|
|
## Durable legacy
|
|||
|
|
|
|||
|
|
- railiance-apps `9b0999f`: Apps owner review for NK-WP-0048-T16, WP-0016 T02 custody path, new T05
|
|||
|
|
- railiance-apps `fe5cabe`: break-glass seal/verify tooling and recovery runbook
|
|||
|
|
- railiance-apps `74213d8`: T01 closed with `docs/evidence/2026-10-17-forgejo-breakglass-signin.json`
|
|||
|
|
- railiance-apps `0da8347`: default railiance01 kubeconfig switched to `config-railiance01`
|
|||
|
|
- State Hub: replies to the T16 request and the custody-path notice; progress events `a2589317`, `27903dbd`
|
|||
|
|
|
|||
|
|
## PQRST estimate
|
|||
|
|
|
|||
|
|
```text
|
|||
|
|
PQRST-Estimate
|
|||
|
|
P: 35%
|
|||
|
|
Q: 15%
|
|||
|
|
R: 20%
|
|||
|
|
S: 20%
|
|||
|
|
T: 10%
|
|||
|
|
Sum: 100%
|
|||
|
|
Confidence: medium
|
|||
|
|
Signature: P35 Q15 R20 S20 T10
|
|||
|
|
Dominant factors: P was the Apps owner-review record for NK-WP-0048-T16, the break-glass seal/verify scripts with Make targets and recovery runbook, and the kubeconfig default switch across Makefile, tools and docs; S was designing value-free custody (OpenBao-first write with read-back, passwords kept off argv, evidence without values) and reviewing the consumer secret-delivery and hand-over contracts, while R went into reading the T16 packet, adapter sources at ff8f597, Forgejo values and the ops-bridge tunnel config.
|
|||
|
|
Notes: Q includes diagnosing the two founder-run failures (no TTY under `!`, kubeconfig port 16443 vs tunnel 16444).
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## Visual prompt
|
|||
|
|
|
|||
|
|
> Brushed-metal worker dialect, square. A quiet figure of pale brushed metal
|
|||
|
|
> with warm inner light kneels at the threshold of a tall indigo doorway that is
|
|||
|
|
> not yet open. Beneath the figure's hands it sets a single low stone slab into
|
|||
|
|
> the floor, a floor before the door. A sealed vessel glows softly from inside
|
|||
|
|
> on the slab, and one thin thread of light runs from it back into the dark.
|
|||
|
|
> Behind the figure, two cables trail from a small console. One is plugged into
|
|||
|
|
> a socket that is dark. The other, moved one socket over, glows. Cinematic
|
|||
|
|
> still, precise technical illustration, dark indigo palette, no logos, no
|
|||
|
|
> readable text.
|
|||
|
|
|
|||
|
|
I could not generate the image in this harness, so I am requesting the render.
|
|||
|
|
Intended file:
|
|||
|
|
|
|||
|
|
<!--  -->
|
|||
|
|
|
|||
|
|
## Handoff
|
|||
|
|
|
|||
|
|
RAPPS-WP-0016-T02 is next. It waits only on KEY-WP-0038-T02, which registers
|
|||
|
|
the Forgejo client with its secret at `platform/workloads/keycape/forgejo`.
|
|||
|
|
NK-WP-0048-T16 waits on the founder's A/B/C option and net-kingdom's answer to
|
|||
|
|
the Apps needs-change record. One small open improvement: have the break-glass
|
|||
|
|
scripts fail with a clear message when no terminal is attached.
|