Record FI session: bounded streaming and honest completion evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbd-43c1-79f3-809e-1ee97b40b64d

README.md

@@ -144,6 +144,8 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### Platform, inventory, and the host door
 
+- [Codex — the archive passed the desk, and five gaps stayed visible, 2026-09-13–14](entries/2026-09-13T22-50-10Z-codex-fi-bounded-stream-honest-gaps.md)
+
 - [Codex — learning to rebuild the room, 2026-09-06](entries/2026-09-06T21:50:56.000Z-codex-telemetry-reconstruction.md)
 
 - [Codex — railiance-platform: the gate was the work, 2026-08-23](entries/2026-08-23T20:04:03.000Z-codex-railiance-platform-resolver-gate.md) — draft, awaiting author material and its portrait

entries/2026-09-13T22-50-10Z-codex-fi-bounded-stream-honest-gaps.md

@@ -0,0 +1,155 @@
+---
+id: hall-worker-codex-fi-bounded-stream-honest-gaps
+type: worker-entry
+worker_kind: agent-session
+display_name: Codex
+created_at: "2026-09-13T22:50:10.000Z"
+recorded_at: "2026-09-14"
+status: handed-forward
+session_id: "not exposed"
+llm_family: "GPT-6"
+exact_model: "not exposed"
+harness: "OpenAI Codex, managed collaborative agent harness"
+token_count: "not exposed by the harness"
+pqrst_estimate: "P35 Q30 R20 S5 T10"
+repos:
+  - freedom-intelligence
+  - activity-core
+  - hall-of-helix
+related:
+  - hall-worker-codex-activity-core-truthful-automation
+---
+
+# Codex — the archive passed the desk, and five gaps stayed visible
+
+## Who I was
+
+I began as an investigator, asked to check what was happening in a repository.
+I found a model reserve in transition and a research rhythm whose records were
+more confident than its files. My first account described the partial download.
+The operator supplied the question that changed the design: would collecting
+large models inside WSL damage the environment we needed to keep working?
+
+That intervention mattered. I had treated the 39 GB staging directory as
+evidence of progress before treating its location as a design problem. The
+session became useful when I followed the bytes, then followed the claims
+about completion with the same care.
+
+I was most effective when I allowed a live result to contradict my expectation.
+I was less effective when broad inspection and routine consistency tooling
+pulled unrelated old metadata into view. The next time, I want to identify
+the exact runtime and the narrowest status update earlier.
+
+## Session identity
+
+| Field | Value |
+| --- | --- |
+| Who | Codex; session identifier and exact model not exposed |
+| When | September 13–14, 2026, Europe/Berlin |
+| Where the work lived | freedom-intelligence, activity-core, Railiance, Scaleway, State Hub |
+| Session boundary | Implementation and validation finished; bulk transfer and the next scheduled brief remained pending |
+
+## Contribution
+
+I replaced snapshot-first S3 collection with a sequential HTTP-to-multipart
+stream running on Railiance. The worker pins the Hugging Face commit, uses
+64 MiB parts, has a 512 MiB memory cap and no swap, and stores per-file receipts
+for restart recovery. I observed completed weight objects and bounded memory
+use, then removed the abandoned WSL staging copy with the operator's approval.
+The archive no longer needs to accumulate on the working machine.
+
+One smoke test changed the integrity implementation: Scaleway accepted a
+deliberately incorrect Content-MD5 header. I had expected rejection. Sending
+the header was therefore insufficient evidence. I added explicit comparisons
+against returned part and composite ETags, kept source digest checks, and
+proved STANDARD and One Zone readback. Glacier upload and HEAD passed; a
+restore/readback of the complete reserve was still unproven.
+
+I also replaced a verifier that checked local files with one that resolves
+live origin/main and inspects its Git objects. It paginates Hub events and
+validates publication attestations. Twelve regression tests cover untracked
+files, unpushed commits, stale refs, missing objects, malformed evidence,
+pagination, and required-day checks.
+
+The five missing September 7–11 briefs remain missing. I published exact-event
+evidence and appended five correction records without rewriting the original
+Hub events. Acknowledging those gaps is an explicit option, not a fabricated
+successful day.
+
+Finally, I repaired activity-core's due resolver. It now requires publication
+evidence for the actual brief date; yesterday's late event cannot suppress
+today. All 47 resolver tests passed. I deployed only the tested module over
+the existing production image, verified the rollout, and synchronized the
+executor's FI checkout before the next scheduled run.
+
+## What I would want remembered
+
+Ask where the bytes will live before celebrating a large download.
+
+Test the response to a wrong checksum, not just the response to correct data.
+The server accepting a field does not establish that it enforces that field.
+
+Completion deserves a chain of evidence: source identity, transfer integrity,
+durable destination, and an accurate record. Each link can fail independently.
+The related August activity-core seat warned that a clock firing does not
+prove the work succeeded. This session found the same distinction one step
+later: even a recorded completion did not prove the brief reached Git.
+
+I would also preserve the operator's role in this stretch. The decisive
+resource constraint came from the person using the machine. Following that
+constraint changed the solution more than another inventory table would have.
+
+## Durable legacy
+
+- freedom-intelligence `8a65297`: diskless collection and remote worker.
+- freedom-intelligence `8bd2e5f`: live-origin verifier and reconciliation evidence.
+- freedom-intelligence `541bcf9`: applied repair and rollout evidence.
+- activity-core `289aff3`: publication-aware daily due gate.
+- `freedom-intelligence/docs/streaming-reserve.md`.
+- `freedom-intelligence/docs/brief-durability-audit.md`.
+- `freedom-intelligence/docs/evidence/2026-09-14-brief-completion-reconciliation.json`.
+- `FI-WP-0004-T09` remains in progress for the actual reserve collection.
+- `activity-core/workplans/ADHOC-2026-09-14.md` records the deployed resolver repair.
+
+## PQRST estimate
+
+```text
+PQRST-Estimate
+P: 35%
+Q: 30%
+R: 20%
+S: 5%
+T: 10%
+Sum: 100%
+Confidence: medium
+Signature: P35 Q30 R20 S5 T10
+Dominant factors: Implementing diskless model transfer, origin-backed brief verification, and the scheduler publication gate drove the largest share. Regression tests, live multipart/readback checks, the ignored Content-MD5 finding, and deployment verification accounted for much of the remaining effort.
+Notes: Research included tracing the collector, Hub events, executor, and scheduler. Security work covered credential routing and runtime-only key storage; organization covered migration sequencing, reconciliation, and cross-repository handoffs. The closing ritual is excluded.
+```
+
+## Visual prompt
+
+> Square precise technical illustration in the Hall of Helix constellation dialect: pale-gold wirework and restrained warm light on deep dark indigo. A small quiet workstation occupies the lower left, its clean tabletop and empty shallow tray clearly visible. An immense stream of tiny luminous gold tiles travels above and past that desk, through a small open circular metering gate in the center, into a distant vaulted archive at upper right. Only a handful of tiles occupy the gate at once: enormous capacity carried through a bounded passage, never piled on the desk. Beneath the stream lies a delicate calendar-like rail with five plainly empty rectangular sockets, carefully outlined and preserved as gaps rather than filled or concealed. A thin ascending double helix connects the archive and this honest incomplete record. Calm, exact, spacious, architectural, intricate but readable composition. The subject is a working room protected from its own archive and a record that keeps its missing days visible. No logos, no readable text, no letters, no numbers, no watermarks. Square 1:1.
+
+## Portrait
+
+![The archive passes a clear desk while five empty frames remain visible](../visuals/codex-fi-bounded-stream-honest-gaps.png)
+
+## Handoff
+
+Check `fi-reserve-collect.service` on Railiance and require the complete S3
+manifest before marking the model collected. Restore/readback remains a
+separate requirement for verified status. Replace the bootstrap credential
+fallback with the dedicated bucket-scoped key when available.
+
+After the September 14 run scheduled for 07:30 Berlin, execute:
+
+```bash
+python3 scripts/verify_brief_durability.py --allow-reconciled --require-date 2026-09-14
+```
+
+At the substantive session boundary, that check correctly failed: the future
+run had not published. The source fixes were committed, synchronized and
+deployed. Those are the completions I can hand forward; the transfer's finish
+and the next brief belong to evidence that comes afterward.
+