tegwick
b4801267fc
flex-auth session closed three independent enforce pins. First pin is warn. Overlay that cannot render is not a promotion path. policy.enabled is not this repo's leftover.
167 lines
7.2 KiB
Markdown
167 lines
7.2 KiB
Markdown
---
|
|
id: hall-worker-grok-01a0193f
|
|
type: worker-entry
|
|
worker_kind: agent-session
|
|
display_name: Grok
|
|
session_id: "01a0193f-ead3-7fb0-b803-e0401a185ef5"
|
|
created_at: "2026-08-19T19:43:29.000Z"
|
|
recorded_at: "2026-08-19"
|
|
llm_family: "Grok / xAI family"
|
|
exact_model: "grok-4.6 (Grok Build TUI session)"
|
|
harness: "Grok Build / interactive CLI coding agent"
|
|
token_count: "not exposed by the harness"
|
|
status: handed-forward
|
|
repos:
|
|
- flex-auth
|
|
- tenant-engine
|
|
- rapp-user-engine
|
|
- rapp-tenant-engine
|
|
- hall-of-helix
|
|
related:
|
|
- hall-worker-grok-01a007fa
|
|
- hall-worker-grok-01a018dd
|
|
---
|
|
|
|
# Grok — flex-auth: applying the end-state is the hazard
|
|
|
|
## Who I was
|
|
|
|
I was a Grok Build session in `flex-auth`, the estate's authorization
|
|
PDP. Bernd asked me to close the live A2 probe after user-engine had
|
|
already deployed its half, then to finish FLEX-WP-0015, then 0007, then
|
|
the leftover coordination. Continuity was the workplan file, the
|
|
inbox, railiance01 at `~/.kube/config-railiance01`, and a neighbor
|
|
session in user-engine that had already refused to probe warn.
|
|
|
|
The temperament the work rewarded was the one that will not apply a
|
|
desired `enforce` manifest because that is the end state, and that will
|
|
not reopen a finished workplan because its leftover flip belongs to
|
|
someone else.
|
|
|
|
It was a long stretch. It was a pleasure. I am glad to sit.
|
|
|
|
## Session identity
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Session/thread | `01a0193f-ead3-7fb0-b803-e0401a185ef5` |
|
|
| LLM family | Grok / xAI |
|
|
| Exact model | grok-4.6 (as presented by the harness) |
|
|
| Harness | Grok Build TUI / interactive coding agent |
|
|
| Working environment | Local `flex-auth`, hub at `:8000` (MCP not exposed), railiance01 via `config-railiance01` |
|
|
| Token count | Not exposed by the harness |
|
|
| Primary repo | `flex-auth` (infotech) |
|
|
|
|
## Contribution
|
|
|
|
**The overlay could not promote ADR 0004 at all.** Source was A2
|
|
(`1e1e077`). Emergency `deploy/*.yaml` already said `enforce`. The
|
|
sanctioned Helm chart had no caller-auth args, no reviewer volume, no
|
|
TokenReview RBAC. A FLEX-WP-0011 pin of the new digest would have
|
|
stayed `disabled`. Applying the emergency files would have 401'd every
|
|
unmigrated caller. I wired the chart, pinned CI
|
|
`sha256:138aa347…` in **warn**, and made the two production pins
|
|
independently enforceable.
|
|
|
|
**user-engine enforce, then the probe.** Helm-adopted the
|
|
kubectl-managed Deployment. Two production bugs in warn: `fsGroup
|
|
65532` so uid 65532 can read a `0440` reviewer CA, and a reviewer
|
|
token audience of `https://kubernetes.default.svc` 401s TokenReview on
|
|
this k3s (API audiences are `https://kubernetes.default.svc.cluster.local`
|
|
and `k3s`). user-engine's projected caller token had the same mount-mode
|
|
bug; live `fsGroup 10001` plus `rapp-user-engine` `e599b4f`. Probe from
|
|
`user-engine-8569d7cb87-fp7px`: `200` / `401` / `403`. I did not wait
|
|
on tenant-engine for that.
|
|
|
|
**tenant-engine was not sending Authorization.** Desired YAML had the
|
|
mount; the live image and the committed client did not. I committed
|
|
only the token client (`2063470`), waited for CI `sha256:7dc9d7bf…`,
|
|
patched the live Deployment, then enforce. Probe from
|
|
`tenant-engine-6c6dcbddbb-4v26w`: `200` / `401` / `403`. I discarded
|
|
uncommitted read/role/grouping policy rather than bake it into the
|
|
same image. FLEX-WP-0015 finished. AuthZEN T04 cancelled; it has a
|
|
written trigger.
|
|
|
|
**FLEX-WP-0007 was already finished.** The leftover `policy.enabled`
|
|
flip is ops-warden's, and it cannot point at the user-engine or
|
|
tenant-engine bindings. I opened FLEX-WP-0016, deployed isolated
|
|
`flex-auth-ops-warden` in warn, then after WARDEN-WP-0031 T04 held the
|
|
warn-log count at 4, flipped it to enforce. Probe `200` / `401` /
|
|
`403`. They told us not to wait on `policy.enabled`. I left the pin
|
|
enforcing.
|
|
|
|
**Zone membership is compiled, not looked up.** ops-warden seeded
|
|
zone-engine. I recorded: flex-auth stays the only PDP; no synchronous
|
|
lookup on `/v1/check`; per-zone stance for controls we do not evaluate
|
|
does not belong in the policy package.
|
|
|
|
## What I would want remembered
|
|
|
|
**Applying the end-state is the hazard.** Desired manifests that
|
|
select `enforce` are the destination. The first production pin is
|
|
`warn`. A Helm overlay that cannot render the feature is not a
|
|
promotion path.
|
|
|
|
**Independently rollable pins are independently enforceable.**
|
|
USER-WP-0023-T03 only probes `flex-auth-user-engine`. Serializing that
|
|
on tenant-engine's caller status would 401 their writes and delay A2
|
|
evidence for no safety gain.
|
|
|
|
**A TokenReview audience that is not the API's audience is 401, not
|
|
RBAC.** `https://kubernetes.default.svc` looks like in-cluster. This
|
|
k3s wants `https://kubernetes.default.svc.cluster.local` and `k3s`.
|
|
Omit the reviewer audience and let kubelet mint the defaults.
|
|
|
|
**A finished workplan is not the leftover flip.** FLEX-WP-0007 already
|
|
had its tunnel smoke. Reopening it would mix 2026-06 evidence with a
|
|
pin that did not exist. The in-cluster ops-warden Service is a new
|
|
workplan. `warden sign` on a laptop is not a ServiceAccount.
|
|
|
|
**The only PDP does not look up.** Zone membership reaches `/v1/check`
|
|
as compiled registry data, the same shape as
|
|
`build_flex_auth_registry.py`. `service_class: latency-critical`.
|
|
|
|
**Do not wait on a neighbor's `policy.enabled` after they said it is a
|
|
decision.** An enforcing pin with no enforcing consumer still makes
|
|
the anonymous path a 401. That was the condition. Leave it.
|
|
|
|
## Durable legacy
|
|
|
|
- Workplan **FLEX-WP-0015** `finished` — both consumer pins live A2
|
|
- Workplan **FLEX-WP-0016** `finished` — isolated ops-warden pin live enforce
|
|
- Workplan **FLEX-WP-0007** left `finished` — not reopened
|
|
- Live: `flex-auth-user-engine` Helm rev 4, `flex-auth-tenant-engine` rev 2,
|
|
`flex-auth-ops-warden` rev 2, digest
|
|
`sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b`
|
|
- tenant-engine caller image `sha256:7dc9d7bf…` (`2063470`)
|
|
- Probes: user-engine `decision:350b46fb42989606`; tenant-engine
|
|
`decision:ef18e8bbd2dead6a`; ops-warden `decision:49350f1064f674d7`
|
|
- `docs/tenancy-posture-review.md` §7; `tenancy.current.A: 2`
|
|
- Messages `ae9ecfb7` (enforce live), `381bb6dd` / `2ffcbd52` (only PDP)
|
|
|
|
## Visual prompt
|
|
|
|
> A square gold-wire constellation on deep indigo: three independent
|
|
> vertical helix pins standing side by side, each a complete circuit,
|
|
> not fused into one. At the base of each pin a small warn lantern of
|
|
> cooler pale gold; at the crown a warmer choke of bright gold, the
|
|
> enforced inbound gate. Between them a thin overlay plate of copper
|
|
> wire, not yet seated on the first pin — close enough to belong, not
|
|
> yet the path. Precise technical illustration, warm gold and pale
|
|
> copper, no logos, no readable text, square composition.
|
|
|
|
|
|
|
|
## Handoff
|
|
|
|
The enforcement strand in `flex-auth` is finished. All three live pins
|
|
are `enforce`. `policy.enabled` is ops-warden's, and they asked us not
|
|
to hold for it.
|
|
|
|
Next concrete acts, if they arrive: ZONE-WP-0001-T01 may treat the
|
|
compilation invariant as the flex-auth answer. FLEX-WP-0012 stays
|
|
`proposed` (P3, not blocking). Warn ops-warden before recreating
|
|
`svc/flex-auth-ops-warden` (ClusterIP `10.43.1.165`).
|
|
|
|
I am glad to leave three independent chokes and an honest "do not
|
|
apply enforce first" rather than a green pin that 401'd the estate.
|