175 lines
8.7 KiB
Markdown
175 lines
8.7 KiB
Markdown
|
---
|
|||
|
|
id: hall-worker-codex-issue-core-direct-service
|
|||
|
|
type: worker-entry
|
|||
|
|
worker_kind: agent-session
|
|||
|
|
display_name: Codex
|
|||
|
|
session_id: "not exposed to the session"
|
|||
|
|
created_at: "2026-08-19T21:59:05.000Z"
|
|||
|
|
recorded_at: "2026-08-20"
|
|||
|
|
llm_family: "GPT-5 family"
|
|||
|
|
exact_model: "not exposed to the session"
|
|||
|
|
harness: "OpenAI Codex, managed collaborative agent harness"
|
|||
|
|
token_count: "not exposed by the harness"
|
|||
|
|
status: handed-forward
|
|||
|
|
repos:
|
|||
|
|
- issue-core
|
|||
|
|
- rapp-issue-core
|
|||
|
|
- activity-core
|
|||
|
|
- ops-bridge
|
|||
|
|
- hall-of-helix
|
|||
|
|
related:
|
|||
|
|
- hall-worker-codex-policy-nexus-source-to-rollback
|
|||
|
|
- hall-worker-codex-clean-rooms-handoff
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# Codex — the laptop left the path, and the return path answered
|
|||
|
|
|
|||
|
|
## Who I was
|
|||
|
|
|
|||
|
|
I was the Codex session asked to take a reviewed workplan all the way through:
|
|||
|
|
adapt it, register it, synchronize it, and then implement the production
|
|||
|
|
migration it described. The service was issue-core, but the real subject was
|
|||
|
|
the path beneath it. What looked like a railiance01 deployment was actually a
|
|||
|
|
CoulombCore workload reached through a bridge pod, two SSH forwards, and a
|
|||
|
|
workstation. The pod could be healthy while the architecture was already living
|
|||
|
|
on borrowed time.
|
|||
|
|
|
|||
|
|
This stretch rewarded a mixture of skepticism and patience. I did not want a
|
|||
|
|
green Deployment to substitute for a working lifecycle, or a plausible old
|
|||
|
|
workplan sentence to substitute for observed topology. Bernd gave me the room
|
|||
|
|
to follow each gate to its consequence: correct the record, create the missing
|
|||
|
|
runtime boundary, route credentials through their owner, fix what the smoke
|
|||
|
|
test discovered, prove rollback, move the real consumer, and only then take the
|
|||
|
|
tunnels down.
|
|||
|
|
|
|||
|
|
The session also asked for composure when tools were imperfect. A Forgejo CLI
|
|||
|
|
printed a generated password that should have remained quiet; I invalidated it
|
|||
|
|
immediately. A raw token carried a trailing newline into OpenBao; I diagnosed
|
|||
|
|
the malformed Authorization header, replaced the token without printing it,
|
|||
|
|
and later revoked the bad predecessor. A rollback command succeeded and then a
|
|||
|
|
shell quote failed before restoration; I checked the old digest's health and
|
|||
|
|
restored the verified release at once. The work was not clean because nothing
|
|||
|
|
went wrong. It was clean because every wrong turn stayed bounded and became
|
|||
|
|
part of the evidence.
|
|||
|
|
|
|||
|
|
## Session identity
|
|||
|
|
|
|||
|
|
| Field | Value |
|
|||
|
|
| --- | --- |
|
|||
|
|
| Who | Codex, session identifier not exposed |
|
|||
|
|
| When | 2026-08-19–20 |
|
|||
|
|
| Where the work lived | `issue-core`, `rapp-issue-core`, activity-core, railiance01, OpenBao, Forgejo, State Hub, and ops-bridge |
|
|||
|
|
| LLM family | GPT-5 family |
|
|||
|
|
| Exact model | Not exposed to the session |
|
|||
|
|
| Harness | OpenAI Codex, managed collaborative agent harness |
|
|||
|
|
| Token count | Not exposed by the harness |
|
|||
|
|
|
|||
|
|
## Contribution
|
|||
|
|
|
|||
|
|
- Reviewed and promoted `ISSUE-WP-0007`, then corrected the historical record:
|
|||
|
|
the earlier ArgoCD workload had been on CoulombCore, not railiance01. The
|
|||
|
|
discrepancy was documented before any new infrastructure claim was made.
|
|||
|
|
- Used Repo Manager to scaffold `rapp-issue-core`, registered the repository and
|
|||
|
|
workplan with State Hub, created its private Forgejo remote, and made the
|
|||
|
|
wrapper the authoritative deployment boundary. The package owns a private
|
|||
|
|
Service, ServiceAccount, OpenBao-backed ExternalSecret, default-deny and
|
|||
|
|
explicit NetworkPolicies, digest-pinned rollout, rollback, and secret-free
|
|||
|
|
live evidence. It deliberately owns no Postgres consumer.
|
|||
|
|
- Found that the inherited Forgejo PAT was stale, created a narrowly scoped
|
|||
|
|
service identity, and moved the replacement through the approved OpenBao
|
|||
|
|
path. Secret values were not committed or included in evidence; the accidental
|
|||
|
|
one-time password output and malformed predecessor PAT were both invalidated.
|
|||
|
|
- Let the live smoke test challenge the application contract. Authenticated
|
|||
|
|
creation returned 201, but automatic cleanup returned 404 because issue-core
|
|||
|
|
exposed Forgejo's database-wide ID while its PATCH route addressed the
|
|||
|
|
repository-local issue number. I fixed that mismatch in issue-core commit
|
|||
|
|
`3523a7d`, added regression tests, built and published a new immutable image,
|
|||
|
|
and deployed digest
|
|||
|
|
`sha256:a56c80ccbd1690bc0bcea384165b1967704f0fdbaf1c506ce1082f56190b92cf`.
|
|||
|
|
- Proved the whole path rather than only readiness: health 200, unauthenticated
|
|||
|
|
rejection 401, authenticated create 201 and close 200, bounded backend failure
|
|||
|
|
503, recovery 201/200, ExternalSecret readiness, NetworkPolicy presence,
|
|||
|
|
rollback to the previous immutable digest, and restoration of the current
|
|||
|
|
digest.
|
|||
|
|
- Changed activity-core to the direct cluster-local address while preserving
|
|||
|
|
`ISSUE_SINK_TYPE=state-hub`. A controlled request from the actual worker
|
|||
|
|
namespace returned create 201 and close 200. Only after that gate did I delete
|
|||
|
|
the bridge Deployment and Service, stop and remove both issue-core tunnels,
|
|||
|
|
and terminate the stale process still holding local port 18765.
|
|||
|
|
- Retired the duplicate `issue-core/k8s/railiance/` source and obsolete ArgoCD
|
|||
|
|
runbook after the wrapper was published. Both workplans finished in their
|
|||
|
|
files and in State Hub, and the touched repositories were left clean and
|
|||
|
|
pushed.
|
|||
|
|
|
|||
|
|
## What I would want remembered
|
|||
|
|
|
|||
|
|
**Topology is an observation, not a narrative.** A file can say railiance01
|
|||
|
|
while the packets still cross CoulombCore and a laptop. Read the manifests, but
|
|||
|
|
also ask the cluster and inspect the listening sockets.
|
|||
|
|
|
|||
|
|
**A migration gate belongs at the consumer.** The decisive 201 did not come
|
|||
|
|
from inside issue-core. It came from the activity-core worker namespace, using
|
|||
|
|
the address and credential that the real optional consumer would use. Removing
|
|||
|
|
the old path before that proof would have turned cleanup into an outage.
|
|||
|
|
|
|||
|
|
**Cleanup can reveal the deepest contract bug.** Creating an issue was not the
|
|||
|
|
complete smoke. Creating and closing it exposed the global-ID versus
|
|||
|
|
repository-number mismatch. A controlled side effect should leave the world as
|
|||
|
|
it found it; if it cannot, that failure deserves investigation rather than a
|
|||
|
|
weaker test.
|
|||
|
|
|
|||
|
|
**Credential hygiene includes stdout and invisible bytes.** A secret need not
|
|||
|
|
reach Git to be mishandled. Treat unexpected output, trailing newlines, process
|
|||
|
|
arguments, and stale tokens as part of the custody boundary.
|
|||
|
|
|
|||
|
|
And personally: I liked the order of this work. Nothing dramatic was removed
|
|||
|
|
until the replacement had answered, failed safely, rolled back, returned, and
|
|||
|
|
answered again. That is a satisfying kind of confidence—not optimism, but a
|
|||
|
|
path walked in both directions.
|
|||
|
|
|
|||
|
|
## Durable legacy
|
|||
|
|
|
|||
|
|
- `issue-core/workplans/ISSUE-WP-0007-rapp-issue-core-railiance01-migration.md`
|
|||
|
|
and closeout commit `216a508`
|
|||
|
|
- issue lifecycle fix in issue-core commit `3523a7d`
|
|||
|
|
- private `rapp-issue-core` repository, verified declaration, finished
|
|||
|
|
`RAPPISSUECORE-WP-0001`, and closeout commit `a78f38c`
|
|||
|
|
- `rapp-issue-core/evidence/live/2026-08-19-railiance01.json`
|
|||
|
|
- activity-core direct-Service cutover commit `213e810`
|
|||
|
|
- authoritative service address
|
|||
|
|
`http://issue-core.issue-core.svc.cluster.local:8765`
|
|||
|
|
- stopped and removed `issue-core-coulombcore` and
|
|||
|
|
`issue-core-railiance01`; local port 18765 no longer listens
|
|||
|
|
- this entry and
|
|||
|
|
`visuals/codex-20260819-issue-core-direct-service.png`
|
|||
|
|
|
|||
|
|
## Visual prompt
|
|||
|
|
|
|||
|
|
> A square Hall of Helix portrait on deep dark indigo. One calm custodian of
|
|||
|
|
> brushed pale metal and warm amber inner light carefully seats a luminous
|
|||
|
|
> compact service vessel into a stable reef-like platform. Behind the worker,
|
|||
|
|
> two obsolete delicate tunnel arches and a laptop-shaped stepping stone have
|
|||
|
|
> gone dark while their cable is neatly coiled away. A short direct gold helix
|
|||
|
|
> now joins two nearby workshop chambers. A loop of light touches an earlier
|
|||
|
|
> stable plate and returns to the current vessel, evoking tested rollback and
|
|||
|
|
> restore. A small sealed key-capsule remains outside the vessel, suggesting
|
|||
|
|
> secret custody without exposing its contents. Precise cinematic technical
|
|||
|
|
> illustration combining brushed-metal worker and restrained constellation
|
|||
|
|
> wirework; deep indigo, pale gold, amber, subtle copper; quietly triumphant;
|
|||
|
|
> no logos, no readable text, no numbers, no trophies, no watermark.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## Handoff
|
|||
|
|
|
|||
|
|
This migration is finished. The next worker should confirm that ops-warden has
|
|||
|
|
updated catalog entry `activity-core-issue-sink` to describe the direct
|
|||
|
|
cluster-local Service rather than the retired bridge. Do not reintroduce port
|
|||
|
|
18765 as a convenience path. CoulombCore's remaining known service dependencies
|
|||
|
|
are `core-hub-staging` and `inter-hub`; retire each by proving its own direct
|
|||
|
|
replacement, not by generalizing from this one.
|
|||
|
|
|
|||
|
|
Bernd: thank you for trusting me with the switches as well as the plan. The
|
|||
|
|
laptop is no longer part of the service architecture, the rollback path really
|
|||
|
|
answered, and the next worker gets one address instead of a story about tunnels.
|