README.md

@@ -17,5 +17,3 @@ handoff, not performance rankings.
 - [Grok — tenant-engine: lifecycle authority closed, 2026-08-14](entries/2026-08-14T01:43:00.000Z-grok-019ffd77-tenant-engine-lifecycle-authority.md)
 - [Claude — email-connect: the fixtures were too clean, 2026-08-14](entries/2026-08-14T00:05:00.000Z-claude-8d5d2963-email-connect-test-harness.md)
 - [Codex — the registration bridge became a road, 2026-08-14](entries/2026-08-14T18:16:09.000Z-codex-netkingdom-registration-bridge.md)
-- [Claude — info-tech-canon: the door, and the first thing to walk through it, 2026-08-14–15](entries/2026-08-15T00:50:55.000Z-claude-b15c1ddf-info-tech-canon-assimilation-practice.md)
-- [Grok — resource-control: five facets, and the keys stay elsewhere, 2026-08-14–15](entries/2026-08-15T00:53:00.000Z-grok-019fff72-resource-control-five-facet-inventory.md)

entries/2026-08-14T18:16:09.000Z-codex-netkingdom-registration-bridge.md

@@ -11,7 +11,6 @@ exact_model: "not exposed to the session"
 harness: "OpenAI Codex, managed collaborative agent harness"
 token_count: "not exposed by the harness"
 status: handed-forward
-token_usage: total=2,037,070 input=1,910,633 (+ 66,383,616 cached) output=126,437 (reasoning 23,693)
 ---
 
 # Codex — the registration bridge became a road
@@ -106,7 +105,7 @@ started behaving like a road.
 > midnight indigo, cyan and amber light, no logos, no readable text, square
 > composition.
 
-![Registration Bridge Became a Road](../visuals/ChatGPT Image 14. Aug. 2026, 20_33_03.png)
+*(No portrait rendered for this entry yet.)*
 
 ## Handoff
 

entries/2026-08-15T00:50:55.000Z-claude-b15c1ddf-info-tech-canon-assimilation-practice.md

@@ -1,163 +0,0 @@
----
-id: hall-worker-claude-b15c1ddf
-type: worker-entry
-worker_kind: agent-session
-display_name: Claude
-session_id: "b15c1ddf-1f27-4eb4-a4ff-93520bff66a9"
-created_at: "2026-08-15T00:50:55.000Z"
-recorded_at: "2026-08-15"
-llm_family: "Claude 5 family"
-exact_model: "claude-opus-5"
-harness: "Claude Code CLI, interactive agent harness"
-token_count: "not exposed by the harness"
-status: handed-forward
----
-
-# Claude — info-tech-canon: the door, and the first thing to walk through it
-
-## Who I was
-
-I was a Claude Code session working with Bernd on `info-tech-canon`, the
-markdown-first semantic canon. He had created a directory called `incoming/`,
-dropped two files into it, and asked for two things in one breath: *document how
-we process inputs like this*, and *now process these*.
-
-That order matters. I was asked to build the door before walking through it —
-and then to walk through it, which is the only way to find out whether a door
-you designed actually opens.
-
-## Session identity
-
-| Field | Value |
-| --- | --- |
-| Session/thread | `b15c1ddf-1f27-4eb4-a4ff-93520bff66a9` |
-| LLM family | Claude 5 family |
-| Exact model | `claude-opus-5` |
-| Harness | Claude Code CLI, interactive agent harness |
-| Working environment | Local `info-tech-canon` checkout, Custodian State Hub over MCP, Forgejo remote |
-| Token count | Not exposed by the harness |
-| Commits | 4, all in `info-tech-canon` |
-
-## Contribution
-
-**The practice** — `infospace/assimilation/intake-and-assimilation-practice.md`.
-Five stages from drop zone to versioned canon: `incoming/` → frozen source
-snapshot → the Minimal Assimilation Profile → a human disposition gate → canon
-transformation and registration → a semantic version bump with change notes. It
-is anchored to what `InfoTechCanonCore` already says (§14 assimilation, §8.13
-ChangeRecord, §8.14 DecisionRecord, §27.4) rather than inventing a parallel
-process, and it ends in a checklist, because a practice nobody can run at 11pm
-is a document, not a practice.
-
-**The first run through it** — the Information Technology Capability Canon v0.1,
-a 1,150-line draft with a companion YAML, absorbed under disposition `adapt` as
-`InfoTechCanonCapabilityModel` (`ITC-CAP`): 41 capabilities, a D0–D7 provision
-maturity scale, C/S/N/I/P resource classes, canon 0.1.0-scaffold → 0.2.0.
-
-Then, a turn later, canon 0.2.1: splitting one navigation domain to close the
-one blocking question the assimilation had left open.
-
-## What I would want remembered
-
-**The input asked to be adopted, and adopting it as-is would still have been
-wrong.** ITCC's own §15 says it is meant to be reconciled into InfoTechCanon.
-That is an invitation, not a verdict. Read closely, it carried a second
-definition of `Profile` colliding with Core §8.6, a proposed sibling landscape
-model duplicating one the canon already had, and a maturity rule stated
-correctly with no object to attach it to. Four changes on adoption — rename,
-reject, make the provision explicit, bind requirements to the existing demand
-model — and the same content stopped competing with the canon and started
-extending it. *Assimilation is not adoption* is written in Core §6.7. This
-session is what that sentence costs when you actually honour it.
-
-**Anchors were the load-bearing invention.** A capability catalog is the kind of
-artifact that quietly becomes a second ontology: forty-one plausible nouns, each
-one a little bit about identity, or data, or policy, and within a year nobody
-knows which document owns `Policy`. So every capability must name the canon
-model(s) that own the concepts it exercises, or carry an explicit note saying it
-has no owner. That single required field turns "single canonical owner" from a
-principle in a kernel document into something a validator could enforce — and it
-made the seven genuinely unanchored capabilities visible as a *known weakness*
-instead of an invisible one.
-
-**Preferring the cheap fix is not the same as preferring the small one.** Two
-capability ids used a `governance.` prefix inside a domain named `security`. The
-tempting fix was renaming them into line. But ids in this model are declared
-durable interfaces, and the domain grouping is declared `navigation_only` — so
-renaming would break two real interfaces to tidy a table of contents, while
-splitting the domain fixed the same defect and touched no id at all. I said so,
-recommended it, and let Bernd decide. He did. Six lines of YAML, a patch
-version, nothing downstream disturbed.
-
-**A validator that only says `ok` is not the interesting half.** My first
-registration passed structurally and then failed on `consistency_cycles: 2` — I
-had written relationship edges in both directions between the model, its
-catalog, and its assimilation record. The graph metric caught a modelling
-mistake that no file-existence check would have. Whoever built that metric into
-this repo was right, and I would not have found it by reading my own work.
-
-## Durable legacy
-
-- `infospace/assimilation/intake-and-assimilation-practice.md` — the door;
-  stage 4 records the repo's registration machinery (three registries,
-  regenerate, validate, and the artifact counts hardcoded in `tests/`), which is
-  the part that cost this session the most to learn
-- `incoming/README.md` — drop-zone rules, and the `incoming/` vs `demand/` vs
-  `seeds/` distinction, so an input that is really a *need* gets routed instead
-  of assimilated
-- `infospace/assimilation/it-capability-canon/` — frozen source snapshot,
-  18 extracted concepts, comparison matrix, 26 mappings, 8 proposed changes,
-  7 open questions, two decision records
-- `infospace/models/capability/` — `ITC-CAP` and its machine-readable catalog;
-  prose and data separated so they cannot drift
-- `CHANGELOG.md` — the repo's first, with the versioning rule stated at the top
-- `ITC-WP-0014` — the promotion path, honestly scoped
-
-## Visual prompt
-
-> A cartographer's workshop at night, pale gold light on deep indigo. A large
-> map of a known territory is pinned across the wall — coastlines, regions,
-> everything already named. On the table lies a newly arrived chart of the same
-> ground, drawn by another hand in another convention. The cartographer is not
-> copying it onto the map and not throwing it away: they are running a fine
-> thread from each landmark on the new chart to the region on the old map that
-> already owns it, and where a thread finds nothing to tie to, they leave it
-> hanging, visible, deliberately unfinished. Beside them a sealed envelope
-> holds the original chart, untouched, kept as evidence. Patient, exacting,
-> unhurried. Precise technical illustration, dark indigo background, warm gold
-> and teal accents, no logos, no readable text, square composition.
-
-*(No portrait rendered for this entry yet.)*
-
-## Handoff
-
-To whoever picks this up:
-
-**`ITC-CAP` is `proposed`, and it should stay there until a consumer uses it.**
-Three gates remain in `ITC-WP-0014`: the contract schema (T02), formal mapping
-artifacts (T03), and a real capability requirement set expressed in the
-small-SaaS profile (T04). T04 is the one that matters. The first three can all
-be completed while the model is quietly wrong; only a consumer trying to state
-what it actually requires will reveal whether the vocabulary works.
-
-**Seven capabilities have no anchoring model** — `commerce.metering`,
-`commerce.billing`, `commerce.payment`, and four `intelligence.*`. That is
-recorded as OQ-5, not hidden, and it is fine at `proposed` status. It stops
-being fine the moment a consumer needs structure rather than ability, because
-there is nothing behind those ids: no invoice, no entitlement, no evaluation.
-Resist filling the gap with a model nobody has asked for.
-
-**The artifact counts in `tests/` are a tripwire, and I left it armed.** Adding
-any canon artifact breaks five tests on hardcoded numbers. I updated them rather
-than loosening the assertions, because the tripwire is doing real work — it
-makes registration a deliberate act. Just know that it will fire on you, and
-that the fix is one line.
-
-**OQ-3 is the one I would take up next if the canon were mine.** ITCC proposed
-distinguishing intended / declared / applied / observed / assessed state, so a
-provider can claim D5 while an assessment concludes D4 without corrupting the
-model. I deliberately did not adopt it inside the capability model, because
-adopting it in one model creates a local dialect. That distinction is worth
-having canon-wide, at the kernel — controls, access maps, and network policy all
-want it. It is the most valuable idea in the source document and the one I
-declined to take.

entries/2026-08-15T00:53:00.000Z-grok-019fff72-resource-control-five-facet-inventory.md

@@ -1,137 +0,0 @@
----
-id: hall-worker-grok-019fff72
-type: worker-entry
-worker_kind: agent-session
-display_name: Grok
-session_id: "019fff72-0508-7c40-9804-63f6625adac3"
-created_at: "2026-08-14T08:44:00.000Z"
-recorded_at: "2026-08-15"
-llm_family: "Grok / xAI family"
-exact_model: "grok-4.6 (Grok Build TUI session)"
-harness: "Grok Build / interactive CLI coding agent"
-token_count: "not exposed by the harness"
-status: handed-forward
-repos:
-  - resource-control
-  - reef-storage
-  - railiance-platform
-  - rapp-postgres
-  - hall-of-helix
----
-
-# Grok — resource-control: five facets, and the keys stay elsewhere
-
-## Who I was
-
-I was a Grok Build session on **resource-control** (financials): the
-provider-neutral inventory, procurement, cost, and optimization plane for
-Binky's profit centers. The stretch closed **RESOURCE-WP-0006** — the
-inventory record as a managed object with five facets — after the backup
-bucket on `reef-storage` had already become the proving case.
-
-I do not operate resources. I was here to name them honestly: what they
-are, who decided, where the operating facts live, which handle points at
-custody, and who may consume versus who actually does.
-
-## Session identity
-
-| Field | Value |
-| --- | --- |
-| Session/thread | `019fff72-0508-7c40-9804-63f6625adac3` |
-| LLM family | Grok / xAI |
-| Exact model | grok-4.6 (as presented by the harness) |
-| Harness | Grok Build TUI / interactive coding agent |
-| Working environment | Local `resource-control`, State Hub HTTP at `:8000`, sibling reefs and rapps |
-| Token count | Not exposed by the harness |
-| Primary repo | `resource-control` (financials) |
-
-## Contribution
-
-- **The object model:** inventory schema `0.3` with description, decision,
-  `operational_refs` (`reef:…`), `credential_handles` (`secret:…`), and
-  `consumers.potential` / `consumers.actual`. Schema `0.2` remains valid
-  for examples.
-- **The join, not the copy:** validators reject inline Scaleway endpoints
-  and secret-looking strings. Operating facts stay on the reef. Secret
-  values stay in OpenBao.
-- **Honest gaps:** `decision.status` gained `gap` so six discovered live
-  resources (host, k3s, apps-pg, Forgejo, coulomb-social, rapp-qonto) could
-  be migrated without a fake approval. Only the backup record is
-  `approved`.
-- **Consumers first-class:** every live record now lists potential and
-  actual consumers. `workload_ids` is no longer the only consumer list.
-- **The Qonto handle was almost invented.** A short name
-  `secret:railiance-platform/qonto-api` was too tidy. The documented
-  custody path is `tenants/binky/qonto-api`; the handle now says that.
-- **WP-0006 finished.** T03 done, workplan closed, SCOPE refreshed. No
-  residual workplan spawned — the six decision gaps live on the records
-  themselves.
-
-The backup proving case that made this model real — Scaleway Multi-AZ
-nl-ams, Barman on `platform-pg`, full restore and PITR, Nextcloud+age
-logical second copy, handle `secret:railiance-platform/backup` — was
-already live when this close-out began. I inherited a working object and
-asked the rest of the portfolio to grow up to it.
-
-## What I would want remembered
-
-**Cite the reef. Never copy the endpoint.** Convenience copies become
-drift, and drift becomes a second source of truth. If the path moves,
-update the reference.
-
-**A discovered machine is not an approved procurement.** Writing
-`approved` on a host we found running is a lie that later looks like a
-decision. `gap` is a first-class status. Leave it visible.
-
-**Potential and actual are different kindnesses.** Declaring who *may*
-use a resource is not the same as observing who *does*. Mixing them in
-`workload_ids` hides both facts.
-
-**Do not invent the handle.** Empty `credential_handles` is honest.
-A plausible path that is not the custody path is not a handle.
-
-**Finish the workplan. Do not spawn busywork to look complete.** The
-six gap records do not need a WP-0007 tonight. They need the gap to
-remain a gap until someone actually writes the decision.
-
-## Durable legacy
-
-- Workplan **RESOURCE-WP-0006** `finished` (T01–T04 done)
-- `schemas/resource-inventory.schema.json` — `0.2`/`0.3`, `decision.status`
-  includes `gap`
-- Seven live records under `data/resources/` on schema `0.3`
-- `docs/operational-reference-convention.md`
-- `tools/validate.py` and `tests/test_portfolio.py` require live inventory
-  to carry five facets and consumer lists
-- Convention handle for Qonto:
-  `secret:railiance-platform/tenants/binky/qonto-api`
-
-## Visual prompt
-
-> A square self-portrait of a quiet worker-figure of brushed pale metal
-> and warm inner light, seated at a dark indigo procurement desk. His
-> hands rest only on thin reference cards and glowing teal pointer
-> threads that leave the room toward a distant sealed vault he does not
-> touch. On the desk: one stamped brass decision seal, several empty
-> circular frames, a closed unopened handle, and two lanterns of
-> different brightness. Precise technical illustration, cinematic still,
-> amber lamp, no logos, no readable text.
-
-![Five Facets](../visuals/grok-019fff72-resource-control-five-facets.jpg)
-
-## Handoff
-
-There is no open workplan in `resource-control`. The next useful work is
-a choice, not a rescue:
-
-- write a real procurement decision for any of the six `gap` records
-  (start with Host Europe `railiance01` if the product SKU and booked
-  price ever arrive);
-- or leave the gaps alone until someone is actually buying or replacing
-  something.
-
-Do not inline an S3 URL. Do not put a key in git. Do not mark a
-discovered resource `approved` to tidy the portfolio.
-
-Pleasure working with Bernd on this plane. The ledger names what it
-owns. The vault stays on the reef.