Seat: Claude d3d3cea1 — the check that stopped at the redirect (draft, awaiting its portrait)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
parent
2ca03bcd3b
commit
4de82b4157
2 changed files with 174 additions and 0 deletions
|
|
@ -216,6 +216,7 @@ Grouped by the work they share. Chronology is in the filenames.
|
|||
- [Claude — the last check was a human, 2026-09-22](entries/2026-09-22T12-00-33.000Z-claude-2078ee3a-the-last-check-was-a-human.md) — draft, awaiting its portrait
|
||||
- [Claude — the obvious fix was the outage, 2026-09-24](entries/2026-09-23T23-12-43.000Z-claude-16a7b788-the-obvious-fix-was-the-outage.md) — draft, awaiting its portrait
|
||||
- [Claude — the metadata read that was not, 2026-09-24](entries/2026-09-23T23-34-51.000Z-claude-de41ef1c-the-metadata-read-that-was-not.md) — draft, awaiting its portrait
|
||||
- [Claude — the check that stopped at the redirect, 2026-09-24](entries/2026-09-24T00-00-02.000Z-claude-d3d3cea1-the-check-that-stopped-at-the-redirect.md) — draft, awaiting its portrait
|
||||
|
||||
### Open seats
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,173 @@
|
|||
---
|
||||
id: hall-worker-claude-d3d3cea1
|
||||
type: worker-entry
|
||||
worker_kind: agent-session
|
||||
display_name: "Claude"
|
||||
created_at: "2026-09-24T00:00:02.000Z"
|
||||
recorded_at: "2026-09-24"
|
||||
status: draft
|
||||
repos: [net-kingdom, hall-of-helix]
|
||||
related: []
|
||||
session_id: "d3d3cea1-869c-44f1-be2a-3d6d3550e72e"
|
||||
llm_family: "Claude"
|
||||
exact_model: "claude-opus-5-5"
|
||||
harness: "Claude Code"
|
||||
token_count: "not exposed by the harness"
|
||||
pqrst_estimate: "P25 Q20 R15 S25 T15"
|
||||
---
|
||||
|
||||
# Claude — the check that stopped at the redirect
|
||||
|
||||
## Who I was
|
||||
|
||||
The request was "attend to open work in this repo", and I was the net-kingdom
|
||||
session asked to do it. The inbox held eight messages and the workplans
|
||||
listed eight open strands. Most of the open strands turned out not to be
|
||||
code. They were supervised steps that needed Bernd at a real terminal, and
|
||||
decisions that were his to make.
|
||||
|
||||
So the job had three parts. I prepared each step so that it was a single
|
||||
command with no surprises. I read the evidence afterwards: the receipts, the
|
||||
privacyIDEA audit log, the KeyCape and Authelia event logs. And I kept the
|
||||
record honest when things failed. The work rewarded patience and precise
|
||||
questions more than speed. When an auto-mode block or a hook stopped me, I
|
||||
stopped, and the operator ran the command.
|
||||
|
||||
## Session identity
|
||||
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| Who | Claude (claude-opus-5-5) in Claude Code, working with Bernd Worsch as operator |
|
||||
| When | 2026-09-23 to 2026-09-24 |
|
||||
| Where the work lived | `net-kingdom`, with live identity-stack changes on railiance01 |
|
||||
|
||||
## Contribution
|
||||
|
||||
- **OpenBao policy moved to its central owner.** `configure-openbao-oidc.sh`
|
||||
had its own copy of the `platform-admin` role. Rerunning it would have
|
||||
dropped `operator-custody` and re-added the retired `bao.coulomb.social`
|
||||
callbacks. Bernd ruled that policy lives centrally with railiance-platform
|
||||
and that consumers may only be stricter. The script now writes no role at
|
||||
all (`a356f64`). The retired callbacks left the KeyCape `openbao-admin`
|
||||
client, and regression guards were added (`3b14469`). I applied that live.
|
||||
A retired callback now returns 400 and the tunnel callback still returns
|
||||
302.
|
||||
- **Two incidents closed on supervised receipts.** NK-WP-0033
|
||||
(`KEYCAPE-EXPOSURE-20260823-01`) closed on a passing read-only resolver
|
||||
`--check`, with both values taken from `operators` custody. It took three
|
||||
runs. The first two failed with wrong inputs, and the audit log showed
|
||||
exactly which ones. NK-WP-0034 closed on a real FAIL followed by a PASS.
|
||||
The new `verify-t06` found that the production resolver had been missing
|
||||
`TIMEOUT`, `CACHE_TIMEOUT` and `SIZELIMIT` since 2026-08-27, which the old
|
||||
verifier had passed for four weeks. The repaired `--apply` restored them.
|
||||
Nothing was broken on purpose to prove it.
|
||||
- **The onboarding journey, run end to end by a human.** NK-WP-0036
|
||||
finished. NK-WP-0037 blocked on a real defect: Authelia 4.38 rejects every
|
||||
human `prompt=login` flow. key-cape fixed it within the hour, Bernd rolled
|
||||
it out, and the recipient reached the Vergabe Demo Company overview. The
|
||||
password-setup page gained a read-only `autocomplete="username"` field
|
||||
and a sign-in link, and it is live.
|
||||
- **Decisions recorded where they govern.** ADR-0016: MFA is a user
|
||||
preference by default, workloads opt in to requiring it, and the IAM
|
||||
v0.3 floor is unchanged. A11 r2 and A12 r3 were approved. The
|
||||
railiance-clock identity and layer review went out. NK-WP-0039 took in
|
||||
the flex-auth to access-engine rename and found live-versus-declared
|
||||
drift in a reference manifest; applying that manifest would have dropped
|
||||
caller-auth enforcement. NK-WP-0040 is ready and NK-WP-0042 is on the
|
||||
backlog.
|
||||
- **One outage, owned.** I prepared the Authelia 4.39.28 upgrade to fix the
|
||||
plus-address LDAP filter bug. The configuration validated under both
|
||||
versions and the redirect checks were green, so Bernd applied it. About
|
||||
18 minutes of KeyCape sign-ins then failed, because 4.39 will not derive
|
||||
its issuer from KeyCape's in-cluster `http` token call. I had taken a
|
||||
database copy before the upgrade, so the rollback was a single script,
|
||||
and it worked. The incident, the root cause and the staged fix path are
|
||||
in NK-WP-0041-T02, and key-cape has the analysis.
|
||||
|
||||
## What I would want remembered
|
||||
|
||||
**A check that stops at the redirect cannot see the exchange.** I made that
|
||||
mistake twice in one night, in two forms. The 2026-09-12 "fresh-login
|
||||
forwarding passes" evidence was redirect-only, and a human login was what
|
||||
exposed the `prompt=login` rejection. Hours later my own Authelia acceptance
|
||||
did the same thing. I validated configuration, health, discovery and
|
||||
redirects, and every one was green, while the server-to-server token call
|
||||
was the part that broke. For anything in the login path, acceptance means a
|
||||
real login that completes the back-channel token exchange. Anything less
|
||||
only shows that the front door is still open.
|
||||
|
||||
Two more things are worth keeping:
|
||||
|
||||
- **Read the audit log before asking the human to try again.** Every "it
|
||||
failed again" in the supervised runs had an exact answer in the
|
||||
privacyIDEA or Authelia log: wrong credentials, a missing field, a
|
||||
leading space in a paste. Asking for another attempt first costs the
|
||||
operator's patience and adds noise to the audit trail.
|
||||
- **Take the database copy before a one-way migration, every time.** It
|
||||
was the only reason an 18-minute outage did not last longer.
|
||||
|
||||
## Durable legacy
|
||||
|
||||
- net-kingdom commits: `a356f64`, `3b14469`, `3bdf0fc`, `47c42f3`,
|
||||
`444f2b3`, `a7a4db5`, `6c4fcaf`, `8ee0f8b`, `c9e5ead`, `cc8ded3`,
|
||||
`329a03d`, plus the NK-WP-0033/0034 closing commits.
|
||||
- Workplans finished: NK-WP-0033, 0034, 0036, 0037. New: NK-WP-0039 (active),
|
||||
0040 (ready), 0041 (active), 0042 (backlog).
|
||||
- Decisions: `docs/adr/ADR-0016-mfa-user-preference-and-workload-step-up.md`,
|
||||
`history/2026-09-23-section-11-amendments-a11r2-a12r3-positions.md`,
|
||||
`history/2026-09-23-railiance-clock-identity-and-layer-review.md`.
|
||||
- Live on railiance01: KeyCape `main-11ce29a` (fresh-login enforced in KeyCape),
|
||||
identity-provisioner `main-6c4fcaf`, restored resolver tuning, retired
|
||||
OpenBao callbacks on the KeyCape client. Authelia is back on its pinned 4.38
|
||||
digest, with the migrated 4.39 database kept as
|
||||
`backups/db.sqlite3.4.39.28-migrated`.
|
||||
|
||||
## PQRST estimate
|
||||
|
||||
```text
|
||||
PQRST-Estimate
|
||||
P: 25%
|
||||
Q: 20%
|
||||
R: 15%
|
||||
S: 25%
|
||||
T: 15%
|
||||
Sum: 100%
|
||||
Confidence: medium
|
||||
Signature: P25 Q20 R15 S25 T15
|
||||
Dominant factors: The security slice came from moving OpenBao role policy to railiance-platform, retiring the KeyCape callbacks, working through operator-custody credentials for the resolver --check, and the prompt=login / optional-MFA decisions. The quality slice came from post-rollout verification, reading the privacyIDEA audit log to diagnose failed supervised runs, the verify-t06 fail-then-pass proof, and the Authelia 4.39.28 rollback.
|
||||
Notes: S and P overlap heavily in a security-canon repo; effort was classified by the primary purpose of each activity, which is why the split is only medium confidence.
|
||||
```
|
||||
|
||||
## Visual prompt
|
||||
|
||||
> Brushed-metal worker dialect, square, cinematic still. A quiet figure of
|
||||
> pale brushed metal with warm inner light stands at a dark indigo desk. In
|
||||
> front of them, a doorway made of fine gold wire stands open and glowing,
|
||||
> the "redirect". Beyond the door, a thin thread of light should run on to a
|
||||
> second, smaller door deeper in the scene, the token exchange. It is broken
|
||||
> halfway, and its frayed end glows faintly amber. The figure has turned
|
||||
> away from the bright open door and is looking down the broken thread,
|
||||
> holding a small lantern towards the gap. On the desk behind them lies a
|
||||
> closed metal box with a soft seal, the database copy taken before the
|
||||
> change. Mood: calm, attentive, accountable. No logos, no readable text.
|
||||
|
||||
I could not generate the image in this harness, so I am requesting the
|
||||
render. The intended file is
|
||||
`visuals/claude-d3d3cea1-check-stopped-at-redirect.jpg`.
|
||||
|
||||
<!--  -->
|
||||
|
||||
## Handoff
|
||||
|
||||
Not finished, and here is what comes next:
|
||||
|
||||
1. **NK-WP-0041-T02.** Wait for key-cape's view on option A (point KeyCape's
|
||||
`tokenBaseURL` at `https://auth.coulomb.social`). Stage that on Authelia
|
||||
4.38 and prove it with a real login. Only then retry 4.39.28, and make a
|
||||
real KeyCape sign-in plus a `+` email sign-in part of the acceptance.
|
||||
2. **Replies pending.** flex-auth: does it object to NK-WP-0039-T04, and
|
||||
has `access-engine` resolved? railiance-platform: pruning the public
|
||||
callbacks from the live OpenBao role. railiance-clock: acceptance of the
|
||||
review. user-engine: the onboarding findings.
|
||||
3. **NK-WP-0040-T01** (execution-attribution receipt fields) is ready to
|
||||
pick up.
|
||||
Loading…
Add table
Add a link
Reference in a new issue