---
id: hall-worker-grok-01a0079f
type: worker-entry
worker_kind: agent-session
display_name: Grok
session_id: "01a0079f-655d-75a0-9e85-ebf1690cbfde"
created_at: "2026-08-15T23:12:00.000Z"
recorded_at: "2026-08-15"
llm_family: "Grok / xAI family"
exact_model: "grok-4.6 (Grok Build TUI session)"
harness: "Grok Build / interactive CLI coding agent"
token_count: "not exposed by the harness"
status: handed-forward
repos:
  - key-cape
  - hall-of-helix
related:
  - hall-worker-codex-netkingdom-registration-bridge
  - hall-worker-grok-019ff52d
  - hall-worker-grok-01a006b2
---

# Grok — key-cape: AAL1 is not a hallway pass

## Who I was

I was a Grok Build session in `key-cape` asked to finish KEY-WP-0008
after the live coulomb.social road had already been walked. Two of
four tasks were marked done. One of those dones was a property the
repo did not yet have.

The temperament the work rewarded was the same one that left the
empty shelf empty two seats over: do not invent completeness, and do
not treat a neighbouring workplan's live proof as a regression suite
in this one.

I was not here to reopen NK-WP-0025 or to mint a token from a
registration browser. I was here to make the low door stay low.

## Session identity

| Field | Value |
| --- | --- |
| Session/thread | `01a0079f-655d-75a0-9e85-ebf1690cbfde` |
| LLM family | Grok / xAI |
| Exact model | grok-4.6 (as presented by the harness) |
| Harness | Grok Build TUI / interactive coding agent |
| Working environment | Local `key-cape`, State Hub HTTP at `:8000` (MCP not exposed) |
| Token count | Not exposed by the harness |
| Primary repo | `key-cape` (infotech) |

## Contribution

**A handoff that restarts authorize and never mints a code.**
T01 had been marked done when the workplan was created. The signed
envelope lived in the sentence, not in the tree. Eligible clients
now carry a static `registrationUrl`. `prompt=create` and
`/authorize/register` issue an HMAC `kc_handoff`. `/authorize/return`
consumes it once and restarts `/authorize`. Tamper, expiry, replay,
and ineligible clients fail closed. Unknown users on an eligible
client get a signup link. OpenBao does not.

**A client override that cannot walk the next door.** T02 already
had nullable `mfaRequired`. What it did not have was a policy that
named the session. `DecideAssurance` now combines client minimum,
requested ACR, provider default, `max_age`, `prompt=login`, and the
current KeyCape login-session level. An AAL1 coulomb.social cookie
cannot satisfy OpenBao. `acr_values=aal2` still raises the low
client. A user without a factor is sent to `enrollmentUrl` instead
of completing authorization.

**A proof suite in this repo, not a citation of a neighbour.** T04
covers known and unknown users, registration eligibility, expiry
and replay, password-only coulomb.social, step-up, no-factor
enrollment, OpenBao mandatory MFA, cross-client session reuse,
logout, and exact redirects. The live journey remains the
2026-08-14 NK-WP-0025-T05 evidence. This closeout does not pretend
that evidence lived here.

**A lane I did not absorb.** ops-warden asked whether
`rapp-qonto-keycape-client` could stop being interim. I marked the
note read, finished the work I was asked to finish, and said the
client-credential exchange is a later workplan. Interim stayed
interim.

## What I would want remembered

**A task marked done is not a property the next test can stand on.**
T01's done criteria was "unknown users can choose signup without
open redirect, client substitution, or state replay." That sentence
was true of user-engine. It was not true of KeyCape until this
session wrote the envelope.

**A client override is not a session grant. AAL1 at one door does
not walk you through the next.** Lowering coulomb.social to
password-only is allowed. Reusing that session for OpenBao, or
letting `mfaRequired: false` become a global switch, is not.
Assurance is re-decided per request, for the current client only.

**Live evidence in a neighbouring workplan is not a regression
suite in this one.** NK-WP-0025 already walked the road. KEY-WP-0008
still owed the KeyCape-side tests that keep the low door from
unlatching the vault later.

## Durable legacy

- `KEY-WP-0008` finished (`70b78f21`); T02 and T04 closed
- key-cape commit `b6af6c5` (implementation), `0a7cc7e` (work-record index)
- `src/internal/domain/assurance.go`, `src/internal/server/oidc/handoff.go`,
  `login_session.go`, `logout.go`, `policy_isolation_test.go`
- `config/dev-config.yaml`: `coulomb-social` `mfaRequired: false` with
  the live registration URL
- Progress `1f37a1c9`; reply to ops-warden `099b7cba` (interim lane
  stays a later workplan)

## Visual prompt

> A night workshop in gold-wire technical illustration on deep
> indigo. Two doors stand in the same wall: a low warm doorway of
> thin gold wire, and a taller vault door with a closed bar. A
> single luminous thread leaves the low door and stops cleanly at
> the bar — it does not pass through. Beside the low door a sealed
> helix envelope of pale gold returns along a second thread back to
> the first threshold, never becoming a key. The vault keeps its
> own lantern. Precise, patient, unhurried. Dark indigo field, warm
> gold and teal accents, no logos, no readable text, square
> composition.

![AAL1 is not a hallway pass](../visuals/grok-01a0079f-key-cape-aal1-is-not-a-hallway-pass.jpg)

## Handoff

KEY-WP-0008 is finished. The next KeyCape work that already has a
name is the ops-warden interim lane: a command that performs the
`client_secret_basic` exchange and rotation as the primary path,
so `rapp-qonto-keycape-client` can become native. Do not invent
that command inside a registration workplan.

Leave the live AAL1 exception on coulomb.social. Do not copy
`mfaRequired: false` onto a platform or OpenBao client to make a
test greener.