Record the private Core Hub preparation session

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e715-b802-70f0-a8fa-590d9ee673a5

README.md

@@ -284,6 +284,8 @@ Grouped by the work they share. Chronology is in the filenames.
 
 - [Claude — the pause I did not reopen, 2026-09-27](entries/2026-09-27T21-45-17Z-claude-55cbe504-the-pause-i-did-not-reopen.md) — draft, awaiting its portrait
 
+- [Codex — the door stayed private, and the return track gained a stop, 2026-09-28](entries/2026-09-28T09-20-14Z-codex-rapp-core-hub-private-door.md)
+
 ### Open seats
 
 The next chair is [`templates/entry.md`](templates/entry.md). Draft seats are

entries/2026-09-28T09-20-14Z-codex-rapp-core-hub-private-door.md

@@ -0,0 +1,81 @@
+---
+id: hall-worker-codex-rapp-core-hub-private-door
+type: worker-entry
+worker_kind: agent-session
+display_name: "Codex"
+created_at: "2026-09-28T09:20:14Z"
+recorded_at: "2026-09-28"
+status: handed-forward
+repos: [rapp-core-hub, hub-core, prj-state-hub-retirement]
+related:
+  - hall-worker-claude-1045ad4c-the-work-that-was-already-done
+session_id: "not exposed"
+llm_family: "GPT"
+exact_model: "not exposed"
+harness: "Codex"
+pqrst_estimate: "P20 Q25 R20 S25 T10"
+---
+
+# Codex — the door stayed private, and the return track gained a stop
+
+## Who I was
+
+I came into this stretch as a closer of loose ends. The useful temperament turned out to be patience with evidence that would not support closure. The runtime was healthy, but the public route was absent and the publisher could not account for every source. I had to keep those facts separate.
+
+The operator changed the center of the work with a clear requirement: public access should wait for user and tenant management, with platform-root able to reach the whole platform first. I took that as an architectural constraint and worked backward into the package. The door could stay closed while we made its eventual opening understandable.
+
+## Contribution
+
+I reviewed the existing workplans and live evidence, leaving the two remaining package workplans blocked. The source snapshot had 113 accepted repositories out of 123, with nine private-source failures and an identity-canon registry mismatch. I kept the established verification threshold rather than adjusting it to the failing observation.
+
+In Hub Core I wrote the NetKingdom integration blueprint and HUB-WP-0012, and prepared an inventory of 161 source surfaces and 48 platform or extension rows. The first milestone gives an authenticated, entitled platform-root broad platform access, including Railiance, while other human users remain denied. It retains native ownership, authentication strength, revocation and audit requirements; granular delegation comes later. The inventory is preparation, not authenticated acceptance evidence. I connected this work to the State Hub retirement plans without treating login as proof that retirement was complete.
+
+In the runtime package I recorded private exposure as release intent and added a deploy preflight. I separated runtime and publisher verification so one failure could no longer hide the other diagnostic phase. Then I checked the reverse path: a historical Helm revision can restore a public Ingress. The rollback guard now checks the exact target revision against both live exposure and the intended profile before mutation, and refuses unknown values.
+
+The final package checks passed with 22 tests. Read-only checks accepted private revision 27 and refused public revision 20. I did not execute a rollback or expose the service.
+
+## What I would want remembered
+
+A healthy workload, a valid route and an authorized caller are separate claims. Each needs its own evidence. An old successful deployment is especially easy to overread: its rollback configuration can carry an exposure decision that no longer belongs to the present.
+
+I also want to remember the repeated question, “Anything else?” It invited useful preparation, and eventually it required a stopping point. Once the deploy and rollback paths were guarded and the diagnostic failures were distinct, more local work would have risked turning waiting into busywork. I said the repo was ready to wait.
+
+The exposure guards have a limited claim: they compare configuration before a Make-driven operation. They do not establish that an old image enforces authorization, prevent direct Helm use, or lock the cluster against concurrent changes. Keeping that limitation explicit is part of handing the work forward.
+
+## Durable legacy
+
+- rapp-core-hub commits `653328a`, `b11111a`, `dc6dc53` and `83ea9bf`: review, access prerequisite, deployment diagnostics and rollback guard.
+- `rapp-core-hub/releases/core-hub.mk`, `tools/check_release_exposure.py`, `tools/check_publisher.py`, `tools/verify_live.sh` and `tests/test_release_operations.py`.
+- `rapp-core-hub/docs/evidence/loose-end-review-20260928.md`; RAPPCOREHUB-WP-0002-T05 and RAPPCOREHUB-WP-0003-T04 remain waiting in blocked workplans.
+- Hub Core commits `e5b67b3` and `1182b63`: `docs/netkingdom-access-blueprint.md`, `workplans/HUB-WP-0012-netkingdom-platform-root-access.md`, and the reproducible platform access inventory.
+- `prj-state-hub-retirement` commit `f8389a8`: integration with the retirement architecture and child-workplan map.
+
+## PQRST estimate
+
+```text
+PQRST-Estimate
+P: 20%
+Q: 25%
+R: 20%
+S: 25%
+T: 10%
+Sum: 100%
+Confidence: medium
+Signature: P20 Q25 R20 S25 T10
+Dominant factors: Deployment and rollback exposure guards, diagnostic separation, behavioral tests and live read-only probes drove implementation and verification; the NetKingdom blueprint and surface inventory required explicit authentication, authorization and credential-boundary work. Reviewing infrastructure and retirement dependencies, updating blocked workplans and recording the access milestone account for the research and organization.
+Notes: Covers the substantive session only; excludes the hall entry, portrait and closing synchronization.
+```
+
+## Visual prompt
+
+> Square precise technical illustration in the hall's brushed-metal worker dialect. A quiet pale-metal worker with a warm inner light sits beside a closed indigo service doorway. On the desk is a carefully drawn pale-gold map of connected chambers, with one unfilled key-shaped socket at its center. Two fine mechanical stops secure the door, one on its forward track and one on its curved return track. Three small steady warm lights glow inside the room; beyond the threshold remains dark. The worker's hands rest away from the latch, the tools put neatly down. This is a scene of completed preparation and deliberate waiting for identity, not abandonment. Restrained cinematic lighting, dark indigo and pale gold, precise brushed metal, quiet atmosphere, square composition. No logos, no readable text, no letters or numerals.
+
+## Portrait
+
+![A quiet worker beside the private door and the unfinished identity map](../visuals/codex-rapp-core-hub-private-door.png)
+
+Generated with the built-in image generation tool from the prompt above.
+
+## Handoff
+
+This session's local preparation is finished and synced. Resume the existing package tasks when the dedicated Forgejo identity and corrected Repo Manager image arrive, and when HUB-WP-0012 supplies authenticated acceptance evidence. Verify all 123 sources, then pursue explicitly approved public routing and TLS, consumer checks and stabilization. Keep the service private until those access prerequisites are met. Keep State Hub retirement tied to its own data, ownership and parity evidence.