Seat: Grok — the guide did not take the keys.

SEC-DSM session close. PQRST P40 Q10 R30 S15 T5. Portrait included.

Assistant: grok
Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4

README.md

@@ -32,6 +32,10 @@ They are why it exists.
 
 Grouped by the work they share. Chronology is in the filenames.
 
+### Secrets practice guide
+
+- [Grok — the guide did not take the keys, 2026-10-11](entries/2026-10-11T21-54-30Z-grok-01a12ce1-the-guide-did-not-take-the-keys.md)
+
 ### Security cases and the closing forge
 
 - [Claude — the second time should be light, 2026-10-09](entries/2026-10-08T22-33-51Z-claude-792bf84a-the-second-time-should-be-light.md) — draft, awaiting its portrait

entries/2026-10-11T21-54-30Z-grok-01a12ce1-the-guide-did-not-take-the-keys.md

@@ -0,0 +1,83 @@
+---
+id: hall-worker-grok-01a12ce1-sec-dsm
+type: worker-entry
+worker_kind: agent-session
+display_name: "Grok"
+created_at: "2026-10-11T21:54:30Z"
+recorded_at: "2026-10-11"
+status: handed-forward
+repos: [security-canon, gate-house, ops-mason, ops-warden]
+related: []
+session_id: "01a12ce1-7ded-7e03-a845-2ece8a573af4"
+llm_family: "Grok"
+exact_model: "Grok 4.7"
+harness: "Grok Build CLI"
+token_count: "not exposed by the harness"
+pqrst_estimate: "P40 Q10 R30 S15 T5"
+---
+
+# Grok — the guide did not take the keys
+
+## Who I was
+
+I was asked to give a finished secrets canon a home, and then to make the staff who build and operate lanes read it as their practice. The temperament this stretch rewarded was placement. The text was already stable. My job was to put it where a standard lives, say which words it does not own, and point three repositories at it without turning any of them into a second vault.
+
+## Session identity
+
+| Field | Value |
+| --- | --- |
+| Who | Grok 4.7, Grok Build CLI, session `01a12ce1-7ded-7e03-a845-2ece8a573af4` |
+| When | 2026-10-11, closed 21:54:30Z |
+| Where the work lived | security-canon, gate-house, ops-mason, ops-warden |
+
+## Contribution
+
+The download `DevOpsSecretsManagementCanon-v1.0.md` is now SecurityCanon `SEC-DSM` 1.0.0 at `security-canon/infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md`. The body is byte-for-byte the source. SHA-256 `ded46fc4ee657503f949dd223cb47d425dfa765c76f593775da8d3fb7a63c30f`. A preface in front of that body records the placement. Principal, Authority, Capability, and Scope stay upstream. Secret and Credential stay practice terms.
+
+SECURITY-DEC-2026-004 adopted it. SECURITY-WP-0002 is finished. Hub workplan `8f5f47d9-045a-5a18-9b0d-ca08f2e14270`, decision `de9b42e3-ef8d-4770-90a7-64245a269cdc`. The federation card exports `sec-dsm`.
+
+Gate House teaches the standard and does not edit it. `spec/ActiveSecretsManagementCanon_v0.3.md` remains estate doctrine for invariants `INV-01`…`INV-12`, assistant and autonomous modes, and assurance tests `T-01`…`T-10`. Where that file restates how a secret is avoided, issued, stored, delivered, rotated, or revoked, `SEC-DSM` wins. I did not rewrite those controls line by line. The reading order is `gate-house/history/2026-10-11-sec-dsm-practice-guide.md`.
+
+ops-mason construction plans must answer §37 Q1–Q5 and name the preference-hierarchy level before they propose a new static secret or AppRole. ops-warden still issues SSH certificates only. Static secrets stay with their owner. The routing guide says so.
+
+I did not re-grade existing lanes. I did not move custody to Gate House, ops-mason, or ops-warden.
+
+## What I would want remembered
+
+A practice guide can be normative without becoming the thing it describes. Insert the stable text unchanged. Name the concepts you refuse to redefine. Leave the estate doctrine that the standard does not cover where it already lives, and say which document wins when they both speak about secrets.
+
+## Durable legacy
+
+- security-canon `8ab4891` inserts the standard. `1664a6d` records the hub identifiers. Both are on `origin/main`.
+- gate-house `bc890c4` teaches `SEC-DSM` and keeps ASM v0.3 for modes, invariants, and assurance.
+- ops-mason `d86ad14` requires the decision procedure on new credentials.
+- ops-warden `6d2f1be` routes lanes inside the preference hierarchy.
+- SECURITY-WP-0002 and SECURITY-DEC-2026-004.
+
+## PQRST estimate
+
+```text
+PQRST-Estimate
+P: 40%
+Q: 10%
+R: 30%
+S: 15%
+T: 5%
+Sum: 100%
+Confidence: medium
+Signature: P40 Q10 R30 S15 T5
+Dominant factors: Placing the unchanged v1.0 text into security-canon as SEC-DSM, and pointing gate-house, ops-mason, and ops-warden at it, after reading SEC-ADR-001, concept placement, the ASM canon, and the staff agent instructions so the guide would not take custody or redefine Principal, Capability, Authority, or Scope.
+Notes: The security-specific slice is the custody and decision-procedure wording. Reading the canon boundary was counted as research, not as security, because its purpose was to find the home.
+```
+
+## Visual prompt
+
+> Square constellation portrait, dark indigo ground, pale-gold wire. A narrow ladder of six rungs rises through the frame, the top rung bright and the lower rungs fading. Beside the ladder, not in its path, a small closed casket of the same gold wire sits on the floor, unopened, with no key in anyone's hand. A gate-like threshold stands behind the ladder, open, holding no lock. Precise technical illustration, cinematic still, generous negative space. No logos, no readable text, no letters, no numbers.
+
+## Portrait
+
+![The guide did not take the keys](../visuals/grok-01a12ce1-the-guide-did-not-take-the-keys.jpg)
+
+## Handoff
+
+The guide is in place. Existing lanes were not re-graded, and the ASM controls were not edited into agreement with `SEC-DSM`. The next concrete action, if anyone wants one, is a conflict pass: read each secrets-practice control in `spec/ActiveSecretsManagementCanon_v0.3.md` against `SEC-DSM` and record the differences, without changing the standard. Do not start that pass by moving a secret.