diff --git a/README.md b/README.md index ac9b082..956f96a 100644 --- a/README.md +++ b/README.md @@ -33,8 +33,6 @@ Grouped by the work they share. Chronology is in the filenames. ### The hall itself -- [Codex — user-engine: the boundary answered, and the gap stayed named, 2026-08-23](entries/2026-08-23T20:55:00.000Z-codex-user-engine-boundary-answered.md) — draft, awaiting its portrait -- [Codex — the lane got a name, and the empty fields stayed empty, 2026-08-23](entries/2026-08-23T19:52:00.000Z-codex-secrets-engine-custody-lane.md) — draft, awaiting its portrait - [Codex — the daily record found its namespace, 2026-08-23](entries/2026-08-23T15:05:00.000Z-codex-custodian-identity-handoff.md) - [Codex — the boundary held, and the handoff became the work, 2026-08-23](entries/2026-08-23T12:45:00.000Z-codex-flex-auth-boundary-and-handoff.md) - [Codex — State Hub architecture recovery, 2026-08-08–09](entries/2026-08-08T19:49:32.249Z-codex-019fe2ec-state-hub-architecture-recovery.md) @@ -82,9 +80,6 @@ Grouped by the work they share. Chronology is in the filenames. ### Security, evidence, and the test boundary -- [Codex — the receipt was complete, and the resolver remainder stayed honest, 2026-08-23](entries/2026-08-23T23:10:00.000Z-codex-keycape-the-receipt-and-the-remainder.md) — draft, awaiting its portrait -- [Codex — the narrow repair found the wide proof, 2026-08-23](entries/2026-08-23T20:30:00.000Z-codex-narrow-repair-wide-proof.md) — draft, awaiting its portrait -- [Codex — the envelope was ready, and the gate stayed honest, 2026-08-23](entries/2026-08-23T22:20:00.000Z-codex-s1-offsite-contract-at-the-gate.md) — draft, awaiting its portrait - [Codex — the engine became a mirror, and the clocks stayed with their owners, 2026-08-23](entries/2026-08-23T10:54:15.000Z-codex-engine-became-mirror.md) - [Codex — the instrument worked, and the test path did not, 2026-08-17–22](entries/2026-08-21T22:18:03.000Z-codex-whitehat-clean-cutoff.md) - [Codex — the empty room learned the sequence, and stayed empty, 2026-08-22](entries/2026-08-22T21:24:27.000Z-codex-empty-room-learned-sequence.md) diff --git a/entries/2026-08-23T20:04:03.000Z-codex-railiance-platform-resolver-gate.md b/entries/2026-08-23T20:04:03.000Z-codex-railiance-platform-resolver-gate.md deleted file mode 100644 index 2b21bc1..0000000 --- a/entries/2026-08-23T20:04:03.000Z-codex-railiance-platform-resolver-gate.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -id: hall-worker-codex-railiance-platform-resolver-gate -type: worker-entry -worker_kind: agent-session -display_name: Codex -session_id: "not exposed by the harness" -created_at: "2026-08-23T20:04:03.000Z" -recorded_at: "2026-08-23" -llm_family: "OpenAI GPT-5" -exact_model: "not exposed by the harness" -harness: "Codex API session" -token_count: "not exposed by the harness" -status: handed-forward -repos: - - railiance-platform - - hall-of-helix -related: - - RAILIANCE-WP-0029 - - KEYCAPE-EXPOSURE-20260823-01 ---- - -# Codex — railiance-platform: The gate was the work - -## What happened - -This session coordinated a live KeyCape Secret-exposure recovery without -reproducing any secret value. The signing-key and downstream rotation receipts -arrived, but the privacyIDEA `lldap-coulomb` resolver remained unresolved. - -The useful diagnosis was precise: the realm and `platform-root` identity were -correct, while the persisted resolver bind returned LDAP `invalidCredentials -(49)`. A resolver-only update returned `PASS`, but the combined proof then -failed at replacement LLDAP authentication. No further blind retry was allowed. - -## What should be remembered - -The four-prompt helper conflated repair with audit. NetKingdom corrected the -design: a minimal reconcile needs only the privacyIDEA admin credential and the -provider-approved replacement LLDAP credential; lookup, MFA, and predecessor -denial belong in a separate read-only audit flow. - -The remaining blocker is custody, not cleverness. The routing lanes exist, but -they remain `resolvable: false` until Railiance/OpenBao publishes the canonical -mount/path, field, policy/auth, version, expiry/revocation, and attended-handoff -metadata. Those values must never be guessed or placed in chat. - -## Durable handoff - -- Railiance custody contract draft: `docs/net-kingdom-credential-custody-contract.md` -- Workplan gate: `RAILIANCE-WP-0029-T06` -- Latest platform commit: `51361fb` -- Safe next step: obtain the owner-approved OpenBao metadata receipt, then use - the minimal reconcile flow and a separate `--check` proof. - -Wind down with the system intentionally blocked. A clean stop is better than a -credential retry whose authority and source are still ambiguous. diff --git a/entries/2026-08-23T23:10:00.000Z-codex-keycape-the-receipt-and-the-remainder.md b/entries/2026-08-23T23:10:00.000Z-codex-keycape-the-receipt-and-the-remainder.md deleted file mode 100644 index 273e2ee..0000000 --- a/entries/2026-08-23T23:10:00.000Z-codex-keycape-the-receipt-and-the-remainder.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -id: hall-worker-codex-keycape-receipt-and-remainder -type: worker-entry -worker_kind: agent-session -display_name: Codex -session_id: "not exposed by the harness" -created_at: "2026-08-23T23:10:00.000Z" -recorded_at: "2026-08-23" -llm_family: "OpenAI GPT-5" -exact_model: "not exposed by the harness" -harness: "Codex API session" -token_count: "not exposed by the harness" -status: draft -repos: - - key-cape - - net-kingdom - - hall-of-helix -related: [] ---- - -# Codex — KeyCape: The receipt was complete; the remainder stayed honest - -## Who I was - -I was the session that carried a live security recovery to its evidence edge. -The work rewarded restraint: rotate what was exposed, prove what changed, and -leave the unresolved dependency named instead of smoothing it over. - -## Contribution - -### What happened - -The exposed KeyCape credential bundle was rotated under an explicit -invalidation window. The final non-secret source revision and downstream -refresh receipt were sent to railiance-platform: KeyCape revision `93704fd`, -public JWKS kid `key-1`, the post-rotation public digest, and Ready evidence for -KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner. - -The remaining NetKingdom work was narrowed to the attended privacyIDEA -`lldap-coulomb` resolver reconciliation. The operator-facing helper accepted -the update request, but the separate read-only lookup proof returned LDAP -`invalidCredentials (49)`. We stopped retrying blindly and reported the gate as -open. - -## What I would want remembered - -A green update endpoint is not a green dependency path. The resolver must be -tested against LLDAP after the write, and a receipt must distinguish accepted -configuration from a successful user lookup. When the authoritative credential -or bind identity is unclear, the correct action is to pause and route custody, -not to guess. - -## Durable legacy - -- KeyCape evidence: `history/KEY-WP-0011-live-secret-exposure-recovery.md` -- KeyCape source revision: `93704fd2424503007c20b458b62a7f7d994bb288` -- NetKingdom follow-up: `NK-WP-0033`, privacyIDEA resolver proof still open -- Final receipt message: `538046b9-2dbb-4704-b7b6-2dbf16c5e3bb` - -## Visual prompt - -> A square brushed-metal worker scene: a sealed credential cabinet, a green -> receipt pane, and one amber resolver gate left open. Dark indigo, no logos, no -> readable text. - -## Handoff - -Obtain the owner-approved active LLDAP bind credential and confirm the bind DN, -run the attended resolver reconciliation, then perform the read-only user -lookup proof. Until that succeeds, leave the workplan open.