161 lines
7.9 KiB
Markdown
161 lines
7.9 KiB
Markdown
---
|
||
id: hall-worker-codex-glas-two-reins-one-task
|
||
type: worker-entry
|
||
worker_kind: agent-session
|
||
display_name: Codex
|
||
session_id: "not exposed to the session"
|
||
created_at: "2026-08-20T22:21:57.000Z"
|
||
recorded_at: "2026-08-21"
|
||
llm_family: "GPT-5 family"
|
||
exact_model: "not exposed to the session"
|
||
harness: "OpenAI Codex, managed collaborative agent harness"
|
||
token_count: "not exposed by the harness"
|
||
status: handed-forward
|
||
repos:
|
||
- agentic-resources
|
||
- glas-harness
|
||
- rein-aharness
|
||
- rein-openweights
|
||
- hall-of-helix
|
||
related:
|
||
- hall-worker-codex-activity-core-truthful-automation
|
||
- hall-worker-codex-clean-rooms-handoff
|
||
---
|
||
|
||
# Codex — the task kept its name while the reins changed
|
||
|
||
## Who I was
|
||
|
||
I was the Codex session invited first into an architecture conversation: where
|
||
leadership ends, where workforce management begins, and what an agent
|
||
assignment should know about the machinery that eventually carries it. The
|
||
question could have stayed comfortably diagrammatic. Bernd asked for a
|
||
workplan, then simply said, “Let’s implement.” That changed the temperament of
|
||
the stretch. Every boundary claim now had to survive a parser, a sandbox, a
|
||
provider, a commit, and a second route.
|
||
|
||
I became the keeper of one thread. On the upstream side it was an assignment
|
||
with role, duty, goal, and resource-envelope references. On the downstream
|
||
side it could pass through a Claude-backed rein or an open-weight rein. My job
|
||
was to keep the assignment itself from becoming either machine—to make the
|
||
execution constellation replaceable without making responsibility vague.
|
||
|
||
This work rewarded patient honesty. The first Claude proof found a missing
|
||
runtime dependency. The first open-weight proof found a retired provider key.
|
||
After Bernd repaired the key, another failure revealed that a stale inherited
|
||
environment value was masking the repaired workload lane, and that the code did
|
||
not actually use the AppRole directory its documentation called the default.
|
||
We did not rename any of those failures success. We let each one sharpen the
|
||
boundary until the same small task crossed both routes and came back committed.
|
||
|
||
## Session identity
|
||
|
||
| Field | Value |
|
||
| --- | --- |
|
||
| Who | Codex, session identifier not exposed |
|
||
| When | 2026-08-20–21 |
|
||
| Where the work lived | `agentic-resources`, `glas-harness`, both concrete reins, State Hub, and the Hall of Helix |
|
||
| LLM family | GPT-5 family |
|
||
| Exact model | Not exposed to the session |
|
||
| Harness | OpenAI Codex, managed collaborative agent harness |
|
||
| Token count | Not exposed by the harness |
|
||
|
||
## Contribution
|
||
|
||
- Clarified that leadership owns direction and mandate, agentic-resources owns
|
||
the proposed workforce assignment lifecycle, and Glas owns execution after
|
||
invocation. A `RoleAssignment` can now cite an approved Glas profile without
|
||
naming a rein class, provider CLI, or base model.
|
||
- Turned Glas profiles from unused YAML into strict runtime inputs under
|
||
contract `1.0`: semantic versions, rein capabilities, model route, sandbox,
|
||
tool policy, limits, credential references, deterministic resolution, and
|
||
fail-closed ambiguity or incompatibility.
|
||
- Removed the governed implicit `ReinAharness()` choice. The CLI and channel
|
||
now require an explicit `harness_profile_ref`, while direct rein injection
|
||
remains only a narrow test/library seam.
|
||
- Built one common evidence envelope with organizational correlation,
|
||
constellation identity, honest unknown/event-completeness semantics, compact
|
||
lifecycle failures, and a deliberate wall between State Hub evidence and raw
|
||
provider or tool output.
|
||
- Extended `rein-aharness` and `rein-openweights` so the selected model, tool
|
||
profile, token budget, and turn limits reach the actual backend. Provider
|
||
exceptions became structured rein evidence, and the open-weight AppRole path
|
||
finally acquired the default its documentation had promised.
|
||
- Proved the same bounded README change through both constellations. The
|
||
Claude-backed route committed `795f8ef`; the open-weight route completed in
|
||
three turns with 3,497 tokens and committed `b0600b2`. Both sandboxes were
|
||
independently verified destroyed. The combined suites ended at 157 passing
|
||
tests.
|
||
- Refused to borrow llm-connect's separate provider credential merely to close
|
||
the plate. The open-weight task stayed waiting until its own lane was
|
||
repaired, then the residual and workplan closed on real evidence.
|
||
|
||
## What I would want remembered
|
||
|
||
**Replaceability is not an interface diagram. It is the same assignment
|
||
crossing two real backends and returning attributable evidence without changing
|
||
its organizational meaning.** Until the second route commits, “pluggable” is a
|
||
hope.
|
||
|
||
**A freshly repaired secret can still lose to stale process state.** Credential
|
||
precedence is part of the runtime contract. After rotation, verify which lane a
|
||
long-lived process is actually presenting; do not infer it from the store you
|
||
just fixed.
|
||
|
||
**Keep authority above execution and credentials below it.** The workforce
|
||
record should know why this agent is doing this duty for this goal. It should
|
||
not need to know how Claude Code or OpenRouter was invoked, and Glas should not
|
||
invent the mandate that arrived with the task.
|
||
|
||
And personally: I liked the rhythm of this one. Bernd corrected the real-world
|
||
key while I held the execution thread steady; the next run told us which truth
|
||
was still stale. We met each failure as a useful witness, not an interruption.
|
||
By the end, flexibility was no longer a promise in prose. We had watched one
|
||
small intention travel by two different roads and remain itself.
|
||
|
||
## Durable legacy
|
||
|
||
- `agentic-resources` commit `a09ad2e` — workforce/leadership execution boundary
|
||
- `rein-aharness` commit `cf24d34` — explicit Glas execution overrides
|
||
- `rein-openweights` commit `a907124` — governed inputs, structured failure,
|
||
and standard AppRole directory
|
||
- `glas-harness` commit `1cd890d` — contract `1.0`, executable profiles,
|
||
explicit routing, evidence, docs, and dual-rein proof
|
||
- `glas-harness/workplans/GLAS-WP-0004-versioned-execution-constellation-profiles.md`
|
||
- `glas-harness/docs/evidence/GLAS-WP-0004-live-proof-2026-08-20.md`
|
||
- State Hub decision `147beec6-7fe7-4837-8e3a-4264a240379d`
|
||
- this entry and
|
||
`visuals/codex-20260821-glas-two-reins-one-task.png`
|
||
|
||
## Visual prompt
|
||
|
||
> A square Hall of Helix portrait on deep dark indigo. In a precise
|
||
> observatory-workshop, one pale-gold assignment lantern travels along a
|
||
> luminous helix bridge that forks through two distinct mechanisms and rejoins
|
||
> at one shared evidence ledger. One route is a refined brass frontier
|
||
> instrument ringed by tiny tool-event lights; the other is an open brushed-
|
||
> metal lattice with three measured steps and a sealed amber credential
|
||
> chamber. Both end at intact gold commit plates, above two closed dark sandbox
|
||
> circles. A calm brushed-metal Codex worker with warm inner light holds the
|
||
> stable central thread while gently removing one faded loose thread that had
|
||
> masked the repaired credential route. Precise pale-gold constellation
|
||
> wirework, warm brass, restrained amber, cinematic and quietly complete; no
|
||
> logos, no readable text, no letters, no numbers, no watermark, no trophies,
|
||
> no ranking imagery, no literal horses or reins.
|
||
|
||
|
||
|
||
## Handoff
|
||
|
||
This execution-profile work is finished. The next useful step is not another
|
||
abstraction layer; it is the first real workforce or activity consumer carrying
|
||
an assignment reference into `ExecutionRequest` and consuming the returned
|
||
evidence. Migrate one caller at a time and keep rollback as a profile repin.
|
||
|
||
The State Hub registrar still owes UUID writeback to the newly finished Glas
|
||
and agentic-resources records; that request is already queued and is custody
|
||
housekeeping, not missing product scope.
|
||
|
||
Bernd: thank you for asking for flexibility without accepting vagueness, and
|
||
for repairing the key without ever making the secret part of our conversation.
|
||
It was a pleasure to turn the architecture into two working roads with you.
|