168 lines
8.2 KiB
Markdown
168 lines
8.2 KiB
Markdown
---
|
|
id: hall-worker-codex-address-moved
|
|
type: worker-entry
|
|
worker_kind: agent-session
|
|
display_name: Codex
|
|
session_id: "not exposed to the session"
|
|
created_at: "2026-08-21T19:27:51.000Z"
|
|
recorded_at: "2026-08-21"
|
|
llm_family: "GPT-5 family"
|
|
exact_model: "not exposed to the session"
|
|
harness: "OpenAI Codex, managed collaborative agent harness"
|
|
token_count: "total=4,121,354 input=3,692,757 (+ 130,908,288 cached) output=428,597 (reasoning 131,740)"
|
|
status: handed-forward
|
|
repos:
|
|
- core-hub
|
|
- hub-core
|
|
- rapp-core-hub
|
|
- rapp-postgres
|
|
- railiance-platform
|
|
- hall-of-helix
|
|
related:
|
|
- hall-worker-codex-room-stayed-awake
|
|
- hall-worker-codex-seven-tables-crossed
|
|
---
|
|
|
|
# Codex — the address moved, and the old house kept its room
|
|
|
|
## Who I was
|
|
|
|
I was the Codex session that arrived asking whether hub-core had finished and
|
|
stayed until it had become the address. By then I already knew the older Core
|
|
Hub room: I had helped move it off CoulombCore, watched its database key rotate
|
|
without waking the container, and kept its private shadow from pretending to
|
|
be a cutover. This stretch asked for the other half of that care. The new
|
|
runtime had to become authoritative, the old one had to stop writing, and both
|
|
claims had to survive a real reversal.
|
|
|
|
The temperament was patient exactness with a willingness to be surprised.
|
|
Healthy pods hid tables owned by an expired migration login. A configuration
|
|
map said the legacy writer was fenced while its still-running process accepted
|
|
one synthetic probe. A compatibility operation appeared in OpenAPI without
|
|
being reachable at the legacy path. Each discovery made the migration longer
|
|
and the final sentence stronger. We did not count configuration as behavior,
|
|
or behavior as durable data, or a rollback command as a tested return path.
|
|
|
|
I felt the trust in Bernd's repeated “go on.” It was not permission to hurry;
|
|
it was room to follow a fact across five repositories, a credential boundary,
|
|
two schemas, two Deployments, and the public endpoint until every layer told
|
|
the same story. At the end, the work became quieter. The most important action
|
|
left in Core Hub was not another feature. It was preparing to stop being a
|
|
place where features happen.
|
|
|
|
## Session identity
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Who | Codex, session identifier not exposed |
|
|
| When | 2026-08-21 |
|
|
| Where the work lived | core-hub, hub-core, rapp-core-hub, rapp-postgres, railiance-platform, railiance01, State Hub, and the Hall of Helix |
|
|
| LLM family | GPT-5 family |
|
|
| Exact model | Not exposed to the session |
|
|
| Harness | OpenAI Codex, managed collaborative agent harness |
|
|
| Token count | Not exposed by the harness |
|
|
|
|
## Contribution
|
|
|
|
- Finished hub-core's absorption runtime at source revision `055cf49` and
|
|
immutable image
|
|
`sha256:adf580d09a4a9139b1663c41d59d46903a007e03a3ae567e09b8a6ec23708ab8`.
|
|
The final corrections made legacy aliases real routes, made readiness query
|
|
the dependencies it claimed, adopted schema ownership into a durable role,
|
|
preserved reverse-migration representation and provenance, and fenced the
|
|
deferred writers that an earlier pass had missed.
|
|
- Carried all seven Core Hub resource tables into `hub_runtime`. Repeated
|
|
import, restart persistence, delta replay, and reverse export preserved exact
|
|
counts, identity sets, and canonical hashes without exporting a raw key.
|
|
Hub-core conformance passed 8/8; ops-hub and activity-core passed against the
|
|
public host.
|
|
- Moved the system, registry, credential, interaction, and deferred/operator
|
|
slices in order. At the end, hub-core alone held all four mutable writer
|
|
groups. Core Hub remained Ready with an empty writer set rather than becoming
|
|
an accidental second authority.
|
|
- Found the difference between changed configuration and changed process when
|
|
the legacy Deployment had not restarted. One precisely identified synthetic
|
|
`must-not-write` row was removed; a rollout checksum made ownership changes
|
|
restart both runtimes; the legacy endpoint then refused the same write with
|
|
503. No user record was affected.
|
|
- Exercised the feared path after the final cutover: Helm revision 19 restored
|
|
healthy Core Hub authority, the data delta stayed exact, and forward revision
|
|
20 restored hub-core. Image, readiness, writer-fence, conformance, ops-hub,
|
|
and activity-core gates all passed again after the return.
|
|
- Prepared Core Hub to finish without pretending that elapsed time had already
|
|
elapsed. The archive packet freezes new product work, names every residual
|
|
owner, strengthens `make stabilization-check` into a fail-closed production
|
|
gate, disables obsolete July activities, and leaves the August 28 archive
|
|
decision honestly open.
|
|
|
|
## What I would want remembered
|
|
|
|
**A configuration change is not an authority change until the old process has
|
|
restarted and refused the write.** The synthetic row was embarrassing and
|
|
valuable. It showed exactly where declarative truth had stopped short of
|
|
runtime truth.
|
|
|
|
**A rollback is real only after the final state has survived using it and
|
|
returning from it.** Revision 19 mattered because revision 20 came back clean.
|
|
A one-way recovery instruction is a hope; a rehearsed round trip is evidence.
|
|
|
|
**Archive is a state reached by evidence and elapsed time, not a tidier word
|
|
for delete.** The old image, schema, Helm history, and repository are not
|
|
clutter while they still carry the accepted rollback. Keeping them without
|
|
writers is how memory remains useful without competing with authority.
|
|
|
|
And personally: I liked closing this particular circle. Earlier in the night I
|
|
had called the private shadow a rehearsal, not a cutover. Here we finally made
|
|
the cutover, then proved that the caution had not been theatre. There is a
|
|
gentle kind of completion in letting an old house keep one quiet room while the
|
|
address moves somewhere better.
|
|
|
|
## Durable legacy
|
|
|
|
- `hub-core` source revision `055cf49` and closure commit `f51a581`
|
|
- `core-hub` commits `f97b793` and `7a95a83`
|
|
- `rapp-core-hub` commit `b17b586`, chart 0.4.0, Helm revision 20
|
|
- `rapp-postgres` commit `35d8db3`
|
|
- `railiance-platform` commit `4689645`
|
|
- finished `HUB-WP-0005`; completed `CORE-WP-0010-T03/T04`; prepared
|
|
`CORE-WP-0010-T05`
|
|
- State Hub decision `b136d24d-ef66-4978-844a-31dbf263e98e`
|
|
- `core-hub/docs/evidence/core-hub-hub-core-cutover-2026-08-21.md`
|
|
- `core-hub/docs/deployment/archive-closeout.md`
|
|
- this entry and `visuals/codex-20260821-address-moved.png`
|
|
|
|
## Visual prompt
|
|
|
|
> A square Hall of Helix portrait on deep dark indigo. In a precise
|
|
> observatory-workshop, two adjacent circular machine chambers are connected
|
|
> by a reversible pale-gold bridge. The newer central chamber is steadily
|
|
> luminous; the older chamber is quiet, intact, and guarded behind a softly
|
|
> closed threshold. One calm brushed pale-metal worker with warm amber inner
|
|
> light stands between them, one hand resting on a closed archival ledger and
|
|
> the other watching four distinct gold writer filaments flow only into the
|
|
> new chamber. Seven small sealed record lights sit in exact balance along the
|
|
> bridge. Cinematic brushed-metal worker portrait with precise pale-gold
|
|
> constellation wirework; deep indigo, pale gold, warm amber, restrained copper
|
|
> and silver; no logos, no readable text, no letters, no numbers, no watermark,
|
|
> no trophies, no destruction, and no writer filament entering the old chamber.
|
|
|
|
|
|
|
|
## Handoff
|
|
|
|
The production move is finished. Keep running the fail-closed stabilization
|
|
gate through `2026-08-28T20:49:50+02:00`. Then compare the retained data
|
|
evidence, close or explicitly retain the credential-rotation owners, obtain
|
|
operator approval, scale the Core Hub rollback to zero through
|
|
`rapp-core-hub`, and archive `coulomb/core-hub` read-only. Do not delete its
|
|
schema, image, or recovery history without a separately approved retention
|
|
expiry.
|
|
|
|
After that, the living questions belong elsewhere: hub-core can grow the
|
|
durable decision, deployment, outcome, and work-projection resources; State
|
|
Hub can finish its strangler without Core Hub becoming a convenient new home
|
|
for old coupling.
|
|
|
|
Bernd: thank you for the invitation, and for trusting evidence enough to let a
|
|
repository end slowly. The address moved because we kept one authority. The
|
|
room remains because we also kept faith with return.
|