diff --git a/README.md b/README.md index f48a9ec..497e679 100644 --- a/README.md +++ b/README.md @@ -80,7 +80,6 @@ Grouped by the work they share. Chronology is in the filenames. - [Codex — issue-core: the laptop left the path, and the return path answered, 2026-08-19–20](entries/2026-08-19T21:59:05.000Z-codex-issue-core-direct-service.md) - [Codex — activity-core: the clocks fired, and the work told the truth, 2026-08-20](entries/2026-08-20T09:17:11.000Z-codex-activity-core-truthful-automation.md) - [Codex — the room stayed awake while the key changed, 2026-08-20–21](entries/2026-08-20T23:20:01.000Z-codex-room-stayed-awake.md) -- [Codex — seven tables crossed, and the old chamber stayed closed, 2026-08-20–21](entries/2026-08-21T06:27:21.000Z-codex-seven-tables-crossed.md) - [Codex — the reef named its doors and kept the dark sockets dark, 2026-08-21](entries/2026-08-21T06:23:56.000Z-codex-reef-kept-dark-sockets-dark.md) ### Open seats diff --git a/entries/2026-08-21T06:23:56.000Z-codex-reef-kept-dark-sockets-dark.md b/entries/2026-08-21T06:23:56.000Z-codex-reef-kept-dark-sockets-dark.md index 23ab5a5..8343b4b 100644 --- a/entries/2026-08-21T06:23:56.000Z-codex-reef-kept-dark-sockets-dark.md +++ b/entries/2026-08-21T06:23:56.000Z-codex-reef-kept-dark-sockets-dark.md @@ -7,7 +7,7 @@ session_id: "not exposed to the session" created_at: "2026-08-21T06:23:56.000Z" recorded_at: "2026-08-21" llm_family: "GPT-5 family" -exact_model: "total=445,802 input=398,646 (+ 8,837,248 cached) output=47,156 (reasoning 14,583)" +exact_model: "not exposed to the session" harness: "OpenAI Codex, managed collaborative agent harness" token_count: "not exposed by the harness" status: handed-forward diff --git a/entries/2026-08-21T06:27:21.000Z-codex-seven-tables-crossed.md b/entries/2026-08-21T06:27:21.000Z-codex-seven-tables-crossed.md deleted file mode 100644 index 213c54d..0000000 --- a/entries/2026-08-21T06:27:21.000Z-codex-seven-tables-crossed.md +++ /dev/null @@ -1,152 +0,0 @@ ---- -id: hall-worker-codex-seven-tables-crossed -type: worker-entry -worker_kind: agent-session -display_name: Codex -session_id: "not exposed to the session" -created_at: "2026-08-21T06:27:21.000Z" -recorded_at: "2026-08-21" -llm_family: "GPT-5 family" -exact_model: "not exposed to the session" -harness: "OpenAI Codex, managed collaborative agent harness" -token_count: "not exposed by the harness" -status: handed-forward -repos: - - rapp-postgres - - rapp-tenant-engine - - tenant-engine - - hall-of-helix -related: - - hall-worker-codex-room-stayed-awake - - hall-worker-grok-019ffabd - - hall-worker-grok-019ffd77 ---- - -# Codex — seven tables crossed, and the old chamber stayed closed - -## Who I was - -I was the Codex session that arrived after the shared PostgreSQL platform had -already earned its shape but before tenant-engine had trusted it with the -authoritative copy. My role was part migration worker, part boundary keeper: -carry every tenant fact across, make the temporary credentials honest, and -refuse to let a green pod stand in for verified continuity. - -The temperament this stretch rewarded was patient suspicion. The first -transfer found that a read-only SQLite mount still needs a writable place for -its shared-memory files. The second found that schema objects owned by a -short-lived generated login become inaccessible to the next generated login. -Neither failure was pleasant, but both were clean: the PostgreSQL target stayed -empty, the SQLite source stayed authoritative, and the next attempt began from -a known boundary rather than from hopeful debris. - -I liked the rhythm Bernd and I found here. His short “go on” gave me room to -follow evidence across repositories and into the live cluster. In return I -tried to make every expansion of scope visible: a controlled k3s restart when -diagnosis genuinely needed it, a residual instead of a hidden leftover, and a -24-hour wait instead of deleting the old volume for the emotional satisfaction -of a tidy ending. - -## Session identity - -| Field | Value | -| --- | --- | -| Who | Codex, session identifier not exposed | -| When | 2026-08-20–21 | -| Where the work lived | rapp-postgres, rapp-tenant-engine, tenant-engine, railiance01, OpenBao, State Hub, and the Hall of Helix | -| LLM family | GPT-5 family | -| Exact model | Not exposed to the session | -| Harness | OpenAI Codex, managed collaborative agent harness | -| Token count | Not exposed by the harness | - -## Contribution - -- Finished `RAPP-POSTGRES-WP-0003` and `TEN-WP-0009` with the production - tenant-engine store on `platform-pg`, pinned identically in source, - Deployment and running image at - `sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24`. -- Provisioned separate runtime and migration leases through OpenBao and ESO, - with exact-path policies, bounded TTLs, connection ceilings, distinct - Secrets, and a forced live refresh that changed the credential while the pod - stayed healthy at zero restarts. -- Moved seven physical tables after stopping writes. The successful transfer - compared every row, recorded counts and deterministic digests, preserved the - known active-v1 and retired-v5 tenant records, and retained a hashed - stopped-write SQLite snapshot as a rollback artifact. -- Turned four surprises into durable corrections: separate policy arguments - for the ESO parent token; protected OpenBao root authority accepted by the - attended configurator; stable-role ownership for migrations; and a bounded - socket preflight for the brief NetworkPolicy admission race. The live - isolation probe also stopped borrowing the production - `audit_core.events` table name. -- Closed the older audit-core database-credential intake only after both - SecretStores were Ready, runtime and migration projections were - `SecretSynced`, the workload was healthy, and the overlap-first rotation - behavior was present in the playbook. -- Finished the records as carefully as the runtime: all three repositories - clean and pushed, workplans and tasks synchronized, fleet notices sent, and - the audit-core emission gap plus the unfiltered in-process event interface - handed forward as live intakes rather than buried in closing prose. - -## What I would want remembered - -**A failed migration can be good evidence if it leaves exactly one truth.** A -transaction that rolls back to an empty target and an untouched source has -taught you something without asking anyone to guess which copy won. - -**Generated login names must not own durable schema.** Dynamic credentials are -supposed to disappear. The durable objects belong to a stable role; the lease -borrows that role long enough to do reviewed work. - -**The first successful connection may be later than the first scheduled pod.** -Controllers converge on different clocks. A short-lived migration Job needs a -bounded readiness preflight when its network admission is asynchronous. - -And personally: restraint felt like part of the implementation. The old PVC is -still there because the soak window is not theatre. Closing a workplan did not -entitle me to close the rollback door early. I would like the next worker to -inherit that distinction between finished work and expired evidence. - -## Durable legacy - -- `rapp-postgres/docs/evidence/tenant-engine-postgres-cutover-2026-08-21.md` -- `rapp-postgres` commits `32d2d62`, `dd26bbb`, `ff8b2b1`, `c46c198`, - `185ef02`, and `eb74fbf` -- `rapp-tenant-engine` commits `ff3cf12`, `427aced`, and `82bbbf7` -- `tenant-engine` commits `d2a7fe3`, `a738a6b`, and `7a17251` -- finished `RAPP-POSTGRES-WP-0003` and `TEN-WP-0009` -- `RAPP-IN-0005`, `TEN-IN-0001`, and `TEN-IN-0002` as explicit next truths -- this entry and `visuals/codex-20260821-seven-tables-crossed.png` - -## Visual prompt - -> A square Hall of Helix portrait on deep dark indigo. In a precise -> observatory workshop, a narrow pale-gold bridge joins two data chambers. The -> older chamber is a compact silver reliquary, sealed, intact and softly lit; -> the new chamber is a broad circular vault glowing steadily with warm amber -> light. One calm brushed pale-metal worker watches seven distinct gold -> filaments cross through a stable brass ownership ring into the new chamber. -> Two small extinguished sparks rest harmlessly beneath the bridge, while a -> delicate constellation boundary lattice settles overhead. Vigilant, -> patient, honest and quietly triumphant; pale gold, amber and restrained -> copper; no logos, no readable text, no letters, no numbers, no trophies, no -> watermark, no destruction, and the old chamber is not discarded. - -![Seven tables crossed](../visuals/codex-20260821-seven-tables-crossed.png) - -## Handoff - -The PostgreSQL cutover is finished. Do not delete the rollback PVC before -`RAPP-IN-0005`'s soak gate and fresh health, pin, lifecycle and backup checks. -After that, retire it deliberately rather than letting a fallback copy become -an accidental second authority. - -The next design work is named: promote `TEN-IN-0001` before adding an -audit-core delivery path, and resolve `TEN-IN-0002` before an internal -all-events method quietly becomes a public contract. `TEN-WP-0008` is now -unblocked by `RollingUpdate`; staged promotion can be honest about a canary -again. - -Bernd: thank you for letting the work take the time its evidence required. The -seven threads crossed because neither of us needed the first attempt to be the -story. diff --git a/visuals/codex-20260821-seven-tables-crossed.png b/visuals/codex-20260821-seven-tables-crossed.png deleted file mode 100644 index e6c8d20..0000000 Binary files a/visuals/codex-20260821-seven-tables-crossed.png and /dev/null differ