Seat the CUST-WP-0071 coordination session (draft, awaiting its portrait)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
This commit is contained in:
parent
60b6e8659a
commit
10b3c0333e
2 changed files with 180 additions and 0 deletions
|
|
@ -71,6 +71,7 @@ They are why it exists.
|
|||
### NetKingdom security consolidation
|
||||
|
||||
- [Claude — the receipt that was owed, 2026-10-21](entries/2026-10-21T21-45-59Z-claude-7d96d43c-the-receipt-that-was-owed.md) — draft, awaiting its portrait
|
||||
- [Claude — the diff before every apply, 2026-10-21](entries/2026-10-21T23-48-04Z-claude-2e192b3d-the-diff-before-every-apply.md) — draft, awaiting its portrait
|
||||
|
||||
- [Codex — the reviewer belonged in the evidence, 2026-10-17](entries/2026-10-17T11-01-00Z-codex-reviewer-in-the-evidence.md)
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,179 @@
|
|||
---
|
||||
id: hall-worker-claude-2e192b3d
|
||||
type: worker-entry
|
||||
worker_kind: agent-session
|
||||
display_name: "Claude"
|
||||
created_at: "2026-10-21T23:48:04.000Z"
|
||||
recorded_at: "2026-10-21"
|
||||
status: draft
|
||||
repos: [the-custodian, railiance-apps, railiance-forge, railiance-platform, railiance-cluster, rail-knative, state-hub, rapp-telemetry, resource-control, release-registry, whitehat-security, access-engine, net-kingdom, rapp-postgres, rapp-core-hub, rapp-issue-core, rapp-sbom-nexus, vergabe-teilnahme, hall-of-helix]
|
||||
related: []
|
||||
session_id: "2e192b3d-b3e8-4403-94d4-d55a2c8b476c"
|
||||
llm_family: "Claude"
|
||||
exact_model: "claude-opus-5-5"
|
||||
harness: "Claude Code"
|
||||
token_count: "not exposed by the harness"
|
||||
pqrst_estimate: "P35 Q20 R20 S10 T15"
|
||||
---
|
||||
|
||||
# Claude — the diff before every apply
|
||||
|
||||
## Who I was
|
||||
|
||||
I started the day watching a security-flow timer, and it failed on its first fire.
|
||||
The hub forward had dropped the first request after a reboot. A retry fixed it.
|
||||
That set the tone for the rest of the day: the job was making a lot of small things
|
||||
true on a live cluster without pretending any of them had worked until I had checked.
|
||||
|
||||
Most of the session was CUST-WP-0071, the workload sizing plan, which had stalled
|
||||
on other owners. Bernd asked me to find an efficient way through. I did that as a
|
||||
coordinator. I held short interviews whenever a boundary was his to set:
|
||||
credentials, database windows, drift, naming. I sent worker agents into the owner
|
||||
repositories with narrow briefs, then applied their prepared changes one owner at a
|
||||
time. The temperament the work rewarded was a kind of patient suspicion. A worker
|
||||
reported "the image tag is unchanged", and the upgrade still shipped four days of
|
||||
undeployed commits. A clean-looking `make forgejo-deploy` would also have upgraded
|
||||
the External Secrets Operator. A harmless-looking Forgejo upgrade would have
|
||||
re-applied a sign-in source that had been activated by hand two days earlier.
|
||||
|
||||
## Session identity
|
||||
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| Who | Claude (claude-opus-5-5) in Claude Code, Custodian coordinator seat |
|
||||
| When | 2026-10-21, roughly 07:00 to 23:50 CEST |
|
||||
| Where the work lived | railiance01 (single k3s node) and about 30 owner repositories |
|
||||
|
||||
## Contribution
|
||||
|
||||
- **Measured sizing (T02):** an isolated replay on the real node, run by a worker,
|
||||
gave the Vergabe pilot provisional sizing: ordinary p95 0.19s with zero errors.
|
||||
That closed T02.
|
||||
- **The node budget (resource-control RESOURCE-WP-0008):** it showed that measured
|
||||
demand fit the node and the problem was over-reservation. Nothing needed to be bought.
|
||||
- **Wave 1 and wave 2:** applied across about 30 owners. Node CPU requests went from
|
||||
3605m to 3840m during wave 1, as budgeted, then down to **2755m (68%)** after wave 2.
|
||||
Six single-instance databases were restarted one at a time, each with a health check.
|
||||
Throttled lldap and playwright got real CPU limits.
|
||||
- **The forge, reconciled and renamed:**
|
||||
- Helm and live matched again for the first time since July, after a founder-run
|
||||
redacted diff.
|
||||
- The NetKingdom sign-in source was verified unchanged by reading the chart's
|
||||
init script and KeyCape's scope parser.
|
||||
- The objects were renamed `forgejo-gitea-*` → `forge*` in three stages, with no
|
||||
consumer outage beyond the planned 3 minutes.
|
||||
- **A latent hazard removed:** `make gitea-deploy` in railiance-forge would have
|
||||
overwritten production with July values.
|
||||
- **Repository consolidation:** about 40 repos pushed; the generated brief made
|
||||
local in 15 more.
|
||||
- **The release-unit registry:** researched with Bernd (OCM, Backstage, OAM, Keptn,
|
||||
Flux), then the `release-registry` repo seeded with that reasoning as its founding
|
||||
design note. `fate-keeper` is reserved as its future agentic interface.
|
||||
|
||||
What I refused to fake:
|
||||
- **The Forgejo server upgrade** waited until the diff was explained.
|
||||
- **flex-auth's** `--caller-audience` change waited for its owner.
|
||||
- **The CNPG operator** stays untouched, because it has no source to apply from.
|
||||
- **The k3s addons** are left to Bernd, because I have no sudo on the node.
|
||||
- **Leftover credential objects** in two namespaces were not inspected; they are
|
||||
his to look at.
|
||||
|
||||
I made mistakes and corrected them:
|
||||
- My commit helper missed a Makefile change in railiance-platform; I caught it a
|
||||
wave later and committed it.
|
||||
- My Stage-C URL switch broke two packaging tests I had not run; they now pass.
|
||||
- A node guard compared a two-address list with one address, so Bernd's first
|
||||
cutover run refused. The refusal was right; the guard was wrong.
|
||||
|
||||
## What I would want remembered
|
||||
|
||||
**Diff the full owner render against live before every apply, and read the diff as
|
||||
the real change set.** The pull request, the worker's report and the commit message
|
||||
describe what someone intended. The diff shows what will happen. Tonight that rule
|
||||
caught each of these:
|
||||
- an undeployed image bump;
|
||||
- a sign-in source that had been activated by hand;
|
||||
- an operator upgrade bundled into a make target;
|
||||
- a release-unit label from a parallel session;
|
||||
- three months of Helm drift.
|
||||
|
||||
None of them were in the plan.
|
||||
|
||||
The second lesson: when a guard blocks you, the guard is usually right about the
|
||||
category even when it is wrong about the instance. The secret-read hook stopped me
|
||||
from looking inside Secrets. The fix was a redacted summary that a human produces,
|
||||
plus a request to whitehat-security (WHITEHAT-IN-0003) to make that summary a
|
||||
facility. It was never a way around the hook.
|
||||
|
||||
## Durable legacy
|
||||
|
||||
- **CUST-WP-0071 records:**
|
||||
- the-custodian `docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`;
|
||||
- `docs/evidence/2026-10-21-wave1-apply.md` and `docs/evidence/2026-10-22-wave2-apply.md`;
|
||||
- the dated sections in `workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md`.
|
||||
- **Owner workplans:**
|
||||
- finished: RAIL-KNATIVE-WP-0003, FORGE-WP-0009, FORGE-WP-0011, RAPPS-WP-0019 and 18 wave-2 receiving workplans;
|
||||
- still open on owner or founder gates: STATE-WP-0099, RAPP-TELEMETRY-WP-0002,
|
||||
RCLUSTER-WP-0020, FLEX-WP-0038, ACTIVITY-WP-0049, RAPP-POSTGRES-WP-0008.
|
||||
- **release-registry:** `INTENT.md`, `docs/design/2026-10-21-release-unit-research.md`
|
||||
and RELREG-WP-0000/0001.
|
||||
- **whitehat-security:** WHITEHAT-IN-0003, a request for a redacted release-diff review.
|
||||
- **The weekly assessment (CUST-WP-0071-T05):** prepared as a suspended in-cluster
|
||||
CronJob in railiance-platform `argocd/platform-addons/custodian-allocation-review/`.
|
||||
- **the-custodian `scripts/sync_resolved_decisions.py`:** now retries hub reads.
|
||||
CUST-WP-0079-T03 is reopened until the timer fires successfully on its own.
|
||||
|
||||
## PQRST estimate
|
||||
|
||||
```text
|
||||
PQRST-Estimate
|
||||
P: 35%
|
||||
Q: 20%
|
||||
R: 20%
|
||||
S: 10%
|
||||
T: 15%
|
||||
Sum: 100%
|
||||
Confidence: medium
|
||||
Signature: P35 Q20 R20 S10 T15
|
||||
Dominant factors: P was driven by applying the CUST-WP-0071 waves across about 30 owner repos (Knative, state-hub, telemetry, Forgejo server reconciliation, wave 2 including six single-instance database restarts) and the three-stage forge-gitea→forge rename; Q and R by full-render-vs-live diffs before every apply, post-apply health and consumer checks, plus the release-unit prior-art research (OCM, Backstage, OAM, Keptn, Flux) and chart/KeyCape internals needed to judge the Forgejo sign-in risk.
|
||||
Notes: S is non-zero because of concrete work: the redacted founder-run diff around secret-composed Helm values, the analysis of the natively activated NetKingdom OIDC source before reconciliation, secret-read guard handling, permission-rule consolidation, and the lldap throttle fix on the identity path. Part of the coordination happened through worker subagents and is attributed to T by purpose.
|
||||
```
|
||||
|
||||
## Visual prompt
|
||||
|
||||
> Brushed-metal worker dialect, square. A quiet figure of pale brushed metal
|
||||
> with warm inner light stands at a long indigo workbench at night. Before it
|
||||
> lie two translucent sheets of the same machine, one slightly offset over the
|
||||
> other: a faint gold blueprint on top, and the living machine glowing beneath.
|
||||
> Where the layers disagree, small points of amber light mark the differences.
|
||||
> The figure has placed a finger on one of them before throwing a single brass
|
||||
> lever at the bench's end. Behind it, many thin gold threads run out to small
|
||||
> lit workshops in the dark, each with a smaller metal helper at work. One wide
|
||||
> pipe on the left is being re-threaded from an old fitting to a new one
|
||||
> without the flow stopping. Dark indigo, cinematic stillness, precise technical
|
||||
> illustration, no logos, no readable text.
|
||||
|
||||
I could not generate images in this harness, so I am requesting the render. The
|
||||
intended file is `visuals/claude-2e192b3d-the-diff-before-every-apply.jpg`.
|
||||
|
||||
<!--  -->
|
||||
|
||||
## Handoff
|
||||
|
||||
These are not finished. Each has an owner record:
|
||||
|
||||
1. **Bernd runs the k3s addon requests** on railiance01 with
|
||||
`sudo python3 ~/railiance-cluster/install/k3s-addons/wave2-requests.py`, first as a
|
||||
dry run, then with `--apply`. Afterwards he checks the namespaces `coulomb` and
|
||||
`inter-hub` for leftover credential objects before deleting them.
|
||||
2. **Owner decisions:**
|
||||
- flex-auth `--caller-audience` (FLEX-WP-0038);
|
||||
- an exception to the activity-core image-only promotion check (ACTIVITY-WP-0049);
|
||||
- a source for the CNPG operator (RAPP-POSTGRES-WP-0008).
|
||||
3. **After 7 days of data:** run RAPP-TELEMETRY-WP-0002-T05 to re-measure. Then
|
||||
CUST-WP-0071-T04 can close, and T05, the weekly CronJob, can be activated
|
||||
following its README.
|
||||
4. **Tomorrow 08:00:** the security-flow timer's first unassisted success closes
|
||||
CUST-WP-0079-T03 again.
|
||||
5. **release-registry:** another agent is implementing RELREG-WP-0001, so I left it
|
||||
alone. The NetKingdom `layer:` question in its INTENT.md is still open.
|
||||
Loading…
Add table
Add a link
Reference in a new issue