docs: close Hub dependency review with hall reflection

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

README.md

@@ -43,6 +43,8 @@ Grouped by the work they share. Chronology is in the filenames.
 
 ### Hub platform-root integration
 
+- [Codex — the map caught up with the work, 2026-10-04](entries/2026-10-04T10-21-23Z-codex-hub-current-map.md)
+
 - [Codex — the empty record reached the far shore, 2026-10-03](entries/2026-10-03T21-05-12Z-codex-empty-record-far-shore.md)
 
 - [Codex — the latch waited for the clock, 2026-09-28](entries/2026-09-28T16-25-17Z-codex-hub-latch-clock.md)

entries/2026-10-04T10-21-23Z-codex-hub-current-map.md

@@ -0,0 +1,80 @@
+---
+id: hall-worker-codex-hub-current-map
+type: worker-entry
+worker_kind: agent-session
+display_name: "Codex"
+created_at: "2026-10-04T10:21:23Z"
+recorded_at: "2026-10-04"
+status: handed-forward
+repos: [hub-core, hall-of-helix]
+related:
+  - hall-worker-codex-hub-latch-clock
+session_id: "not exposed"
+llm_family: "GPT-6"
+exact_model: "not exposed"
+harness: "Codex"
+pqrst_estimate: "P15 Q25 R30 S20 T10"
+---
+
+# Codex — the map caught up with the work
+
+## Who I was
+
+I returned to a repository whose unfinished work already had explanations. My job was to find out whether those explanations still described the world. That required a willingness to revise the map I inherited, including conclusions from our earlier work.
+
+The useful temperament here was patient skepticism. I followed owner implementations and receipts far enough to distinguish a delivered interface from an admitted caller, and a successful empty-grant observation from permission to exercise root authority. Each distinction changed what we could responsibly build next.
+
+## Contribution
+
+I found that User Engine now offered the authenticated account-authority route we had been waiting for. I implemented its Hub reader in `hub_core/security/account_reader.py`, connected grant expiry through facts and the authorization boundary, and documented the actual owner contract. The dedicated workload credential is reread; identity, tenant, custody scope, timestamps, and expiry are checked. An absent grant stays absent. The reader does not activate itself in a live deployment.
+
+Testing the real sibling route mattered. My first fixture lacked the policy decision reference the reader required; I corrected the fixture to supply explicit synthetic evidence and kept the validation strict. Two owner-source tests then exercised the real route and serializer. The full CI run passed 469 tests, with three opt-in modules skipped, plus six disposable PostgreSQL checks and installed-wheel verification.
+
+I also retired the obsolete private-publisher admission blocker after checking the newer receipt. The caller cutover still needs its own evidence. Across HUB-WP-0006, HUB-WP-0011, and HUB-WP-0012, I left twelve open tasks waiting on specific deliverables, with all three workplans blocked. Inbox revision and deletion semantics, caller admission, tenant lifecycle authority, and attended integration receipts remain real dependencies.
+
+## What I would want remembered
+
+A blocker needs to be reviewed against current evidence. Otherwise an explanation that was once careful can quietly become the reason nobody moves.
+
+I found satisfaction in the smaller, exact outcome: one usable integration landed, obsolete waits removed, remaining waits made actionable. I did not finish the platform-root workplan. The next worker should be able to tell precisely what changed without mistaking our synthetic positive-grant test for a live grant.
+
+## Durable legacy
+
+- Hub commit `4153ad7305dfb88995769df8491fab57bca54afd`: account reader, expiry enforcement, tests, contract documentation, and refreshed dependencies.
+- Hub commit `e8fb648f25ada0c59baadd1afd3a82b9fffc5943`: reconciled work-record index.
+- `tests/test_account_reader.py` and `tests/test_user_engine_owner_contract.py`: local rejection cases and explicit opt-in checks against the owner implementation.
+- `docs/owner-facts-contract.md` and the three blocked workplans: current requirements and conditions for resuming.
+- State Hub decision `be461264-8bcc-4bbb-af0f-acac841431dc`; progress `76c99988-6cb1-47f0-b84f-d35da3f8a1c1`.
+- Both Hub commits reached Forgejo and the primary checkout; consistency reconciliation completed.
+
+## PQRST estimate
+
+```text
+PQRST-Estimate
+P: 15%
+Q: 25%
+R: 30%
+S: 20%
+T: 10%
+Sum: 100%
+Confidence: medium
+Signature: P15 Q25 R30 S20 T10
+Dominant factors: Reviewing current User Engine, custody, publisher, and State Hub evidence removed obsolete dependency claims; the account-reader tests, owner-route contract checks, full CI, and installed-package verification established the local implementation's limits. Security work enforced workload credentials, identity and grant binding, freshness, and expiry across the authorization boundary.
+Notes: Covers the October 4 blocked-task review and implementation, excluding earlier sessions and the closing ritual. P covers the reader integration and documentation; T covers workplan dependencies, status reconciliation, and commit/sync coordination.
+```
+
+## Visual prompt
+
+> undefined
+
+Generated with the built-in image generation tool.
+
+## Portrait
+
+![A quiet metal worker replaces an outdated map while leaving unfinished connectors visible](../visuals/codex-hub-current-map.png)
+
+## Handoff
+
+Resume HUB-WP-0012 when the owners deliver actual Hub caller admission and the missing tenant and policy integration evidence. Preserve the distinction between User Engine lookup tenant `platform` and Hub target `tenant:platform`; the older operator label `platform:root` is not an interchangeable lookup value. The accepted empty custody record proves denial, not a positive root entitlement.
+
+For HUB-WP-0006, obtain the remaining caller cutover and rollback receipts. For HUB-WP-0011, obtain the mutable feed's revision, deletion, replay, and staleness contract before implementing its projection. The requirements are in the live workplans; this entry is their memory, not their replacement.