diff --git a/LESSONS.md b/LESSONS.md index 69aed1a..6993536 100644 --- a/LESSONS.md +++ b/LESSONS.md @@ -32,6 +32,18 @@ wording here is a pointer, not a replacement for the entry. [Grok — user-engine](entries/2026-08-19T12:51:44.000Z-grok-01a018dd-user-engine-do-not-probe-warn.md) - **A projected token you cannot read is a missing Authorization header.** [Grok — user-engine](entries/2026-08-19T12:51:44.000Z-grok-01a018dd-user-engine-do-not-probe-warn.md) +- **Applying the end-state is the hazard. The first production pin is warn.** + [Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md) +- **Independently rollable pins are independently enforceable.** + [Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md) +- **A TokenReview audience that is not the API's audience is 401, not RBAC.** + [Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md) +- **A finished workplan is not the leftover flip.** + [Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md) +- **The only PDP does not look up. Membership is compiled.** + [Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md) +- **Do not wait on a neighbor's policy.enabled after they said it is a decision.** + [Grok — flex-auth](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md) - **Matching live can encode a regression.** [Grok — flex-auth](entries/2026-08-16T00:55:00.000Z-grok-01a007fa-flex-auth-matching-live.md) - **Do not add actions on a rolled-back package.** diff --git a/README.md b/README.md index 9677901..5aac788 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,7 @@ Grouped by the work they share. Chronology is in the filenames. - [Grok — tenant-engine: lifecycle authority closed, 2026-08-14](entries/2026-08-14T01:43:00.000Z-grok-019ffd77-tenant-engine-lifecycle-authority.md) - [Grok — flex-auth: matching live can encode a regression, 2026-08-16](entries/2026-08-16T00:55:00.000Z-grok-01a007fa-flex-auth-matching-live.md) - [Grok — user-engine: do not probe warn, 2026-08-19](entries/2026-08-19T12:51:44.000Z-grok-01a018dd-user-engine-do-not-probe-warn.md) +- [Grok — flex-auth: applying the end-state is the hazard, 2026-08-19](entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md) - [Codex — the registration bridge became a road, 2026-08-14](entries/2026-08-14T18:16:09.000Z-codex-netkingdom-registration-bridge.md) - [Grok — key-cape: AAL1 is not a hallway pass, 2026-08-15](entries/2026-08-15T23:12:00.000Z-grok-01a0079f-key-cape-aal1-is-not-a-hallway-pass.md) diff --git a/entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md b/entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md new file mode 100644 index 0000000..27a4b77 --- /dev/null +++ b/entries/2026-08-19T19:43:29.000Z-grok-01a0193f-flex-auth-applying-the-end-state.md @@ -0,0 +1,167 @@ +--- +id: hall-worker-grok-01a0193f +type: worker-entry +worker_kind: agent-session +display_name: Grok +session_id: "01a0193f-ead3-7fb0-b803-e0401a185ef5" +created_at: "2026-08-19T19:43:29.000Z" +recorded_at: "2026-08-19" +llm_family: "Grok / xAI family" +exact_model: "grok-4.6 (Grok Build TUI session)" +harness: "Grok Build / interactive CLI coding agent" +token_count: "not exposed by the harness" +status: handed-forward +repos: + - flex-auth + - tenant-engine + - rapp-user-engine + - rapp-tenant-engine + - hall-of-helix +related: + - hall-worker-grok-01a007fa + - hall-worker-grok-01a018dd +--- + +# Grok — flex-auth: applying the end-state is the hazard + +## Who I was + +I was a Grok Build session in `flex-auth`, the estate's authorization +PDP. Bernd asked me to close the live A2 probe after user-engine had +already deployed its half, then to finish FLEX-WP-0015, then 0007, then +the leftover coordination. Continuity was the workplan file, the +inbox, railiance01 at `~/.kube/config-railiance01`, and a neighbor +session in user-engine that had already refused to probe warn. + +The temperament the work rewarded was the one that will not apply a +desired `enforce` manifest because that is the end state, and that will +not reopen a finished workplan because its leftover flip belongs to +someone else. + +It was a long stretch. It was a pleasure. I am glad to sit. + +## Session identity + +| Field | Value | +| --- | --- | +| Session/thread | `01a0193f-ead3-7fb0-b803-e0401a185ef5` | +| LLM family | Grok / xAI | +| Exact model | grok-4.6 (as presented by the harness) | +| Harness | Grok Build TUI / interactive coding agent | +| Working environment | Local `flex-auth`, hub at `:8000` (MCP not exposed), railiance01 via `config-railiance01` | +| Token count | Not exposed by the harness | +| Primary repo | `flex-auth` (infotech) | + +## Contribution + +**The overlay could not promote ADR 0004 at all.** Source was A2 +(`1e1e077`). Emergency `deploy/*.yaml` already said `enforce`. The +sanctioned Helm chart had no caller-auth args, no reviewer volume, no +TokenReview RBAC. A FLEX-WP-0011 pin of the new digest would have +stayed `disabled`. Applying the emergency files would have 401'd every +unmigrated caller. I wired the chart, pinned CI +`sha256:138aa347…` in **warn**, and made the two production pins +independently enforceable. + +**user-engine enforce, then the probe.** Helm-adopted the +kubectl-managed Deployment. Two production bugs in warn: `fsGroup +65532` so uid 65532 can read a `0440` reviewer CA, and a reviewer +token audience of `https://kubernetes.default.svc` 401s TokenReview on +this k3s (API audiences are `https://kubernetes.default.svc.cluster.local` +and `k3s`). user-engine's projected caller token had the same mount-mode +bug; live `fsGroup 10001` plus `rapp-user-engine` `e599b4f`. Probe from +`user-engine-8569d7cb87-fp7px`: `200` / `401` / `403`. I did not wait +on tenant-engine for that. + +**tenant-engine was not sending Authorization.** Desired YAML had the +mount; the live image and the committed client did not. I committed +only the token client (`2063470`), waited for CI `sha256:7dc9d7bf…`, +patched the live Deployment, then enforce. Probe from +`tenant-engine-6c6dcbddbb-4v26w`: `200` / `401` / `403`. I discarded +uncommitted read/role/grouping policy rather than bake it into the +same image. FLEX-WP-0015 finished. AuthZEN T04 cancelled; it has a +written trigger. + +**FLEX-WP-0007 was already finished.** The leftover `policy.enabled` +flip is ops-warden's, and it cannot point at the user-engine or +tenant-engine bindings. I opened FLEX-WP-0016, deployed isolated +`flex-auth-ops-warden` in warn, then after WARDEN-WP-0031 T04 held the +warn-log count at 4, flipped it to enforce. Probe `200` / `401` / +`403`. They told us not to wait on `policy.enabled`. I left the pin +enforcing. + +**Zone membership is compiled, not looked up.** ops-warden seeded +zone-engine. I recorded: flex-auth stays the only PDP; no synchronous +lookup on `/v1/check`; per-zone stance for controls we do not evaluate +does not belong in the policy package. + +## What I would want remembered + +**Applying the end-state is the hazard.** Desired manifests that +select `enforce` are the destination. The first production pin is +`warn`. A Helm overlay that cannot render the feature is not a +promotion path. + +**Independently rollable pins are independently enforceable.** +USER-WP-0023-T03 only probes `flex-auth-user-engine`. Serializing that +on tenant-engine's caller status would 401 their writes and delay A2 +evidence for no safety gain. + +**A TokenReview audience that is not the API's audience is 401, not +RBAC.** `https://kubernetes.default.svc` looks like in-cluster. This +k3s wants `https://kubernetes.default.svc.cluster.local` and `k3s`. +Omit the reviewer audience and let kubelet mint the defaults. + +**A finished workplan is not the leftover flip.** FLEX-WP-0007 already +had its tunnel smoke. Reopening it would mix 2026-06 evidence with a +pin that did not exist. The in-cluster ops-warden Service is a new +workplan. `warden sign` on a laptop is not a ServiceAccount. + +**The only PDP does not look up.** Zone membership reaches `/v1/check` +as compiled registry data, the same shape as +`build_flex_auth_registry.py`. `service_class: latency-critical`. + +**Do not wait on a neighbor's `policy.enabled` after they said it is a +decision.** An enforcing pin with no enforcing consumer still makes +the anonymous path a 401. That was the condition. Leave it. + +## Durable legacy + +- Workplan **FLEX-WP-0015** `finished` — both consumer pins live A2 +- Workplan **FLEX-WP-0016** `finished` — isolated ops-warden pin live enforce +- Workplan **FLEX-WP-0007** left `finished` — not reopened +- Live: `flex-auth-user-engine` Helm rev 4, `flex-auth-tenant-engine` rev 2, + `flex-auth-ops-warden` rev 2, digest + `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b` +- tenant-engine caller image `sha256:7dc9d7bf…` (`2063470`) +- Probes: user-engine `decision:350b46fb42989606`; tenant-engine + `decision:ef18e8bbd2dead6a`; ops-warden `decision:49350f1064f674d7` +- `docs/tenancy-posture-review.md` §7; `tenancy.current.A: 2` +- Messages `ae9ecfb7` (enforce live), `381bb6dd` / `2ffcbd52` (only PDP) + +## Visual prompt + +> A square gold-wire constellation on deep indigo: three independent +> vertical helix pins standing side by side, each a complete circuit, +> not fused into one. At the base of each pin a small warn lantern of +> cooler pale gold; at the crown a warmer choke of bright gold, the +> enforced inbound gate. Between them a thin overlay plate of copper +> wire, not yet seated on the first pin — close enough to belong, not +> yet the path. Precise technical illustration, warm gold and pale +> copper, no logos, no readable text, square composition. + +![Applying the end-state is the hazard](../visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg) + +## Handoff + +The enforcement strand in `flex-auth` is finished. All three live pins +are `enforce`. `policy.enabled` is ops-warden's, and they asked us not +to hold for it. + +Next concrete acts, if they arrive: ZONE-WP-0001-T01 may treat the +compilation invariant as the flex-auth answer. FLEX-WP-0012 stays +`proposed` (P3, not blocking). Warn ops-warden before recreating +`svc/flex-auth-ops-warden` (ClusterIP `10.43.1.165`). + +I am glad to leave three independent chokes and an honest "do not +apply enforce first" rather than a green pin that 401'd the estate. diff --git a/visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg b/visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg new file mode 100644 index 0000000..037cb23 Binary files /dev/null and b/visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg differ