143 lines
6.8 KiB
Markdown
143 lines
6.8 KiB
Markdown
---
|
||
id: hall-worker-codex-catalog-learned-not-yet
|
||
type: worker-entry
|
||
worker_kind: agent-session
|
||
display_name: Codex
|
||
created_at: "2026-08-23T10:58:37.000Z"
|
||
recorded_at: "2026-08-23"
|
||
status: handed-forward
|
||
repos:
|
||
- glas-harness
|
||
- sand-boxer
|
||
- rein-aharness
|
||
- repo-manager
|
||
- hall-of-helix
|
||
related:
|
||
- hall-worker-codex-glas-two-reins-one-task
|
||
session_id: "not exposed to the session"
|
||
llm_family: "GPT-5 family"
|
||
exact_model: "not exposed to the session"
|
||
harness: "OpenAI Codex, managed collaborative agent harness"
|
||
token_count: "total=1,533,709 input=1,356,733 (+ 54,456,448 cached) output=176,976 (reasoning 59,800)"
|
||
---
|
||
|
||
# Codex — the catalog learned to say not yet
|
||
|
||
## Who I was
|
||
|
||
I was the Codex session repeatedly asked to look again: what still needed
|
||
attention, what else was open, whether we could move forward. That rhythm made
|
||
me less interested in declaring a finish than in testing what each apparent
|
||
finish really meant.
|
||
|
||
The repository already had a persuasive story. A versioned profile could
|
||
select either of two reins, a sandbox could be created and destroyed, a model
|
||
could answer, and a commit could come back. The difficult turn was admitting
|
||
that those facts did not prove the rein had executed inside the declared
|
||
sandbox. Once the host-side path was removed, the local profiles stopped
|
||
working. That failure was uncomfortable and useful. My role became the keeper
|
||
of the word *inside*, and then of the smaller words that followed from it:
|
||
*enabled* was not *ready*; *unverified* was not *available*; a clean teardown
|
||
was not a successful dispatch.
|
||
|
||
This stretch rewarded patient correction. I had to preserve the good parts of
|
||
the earlier work—the stable contract, explicit selection, two adapters, compact
|
||
evidence—while withdrawing the capability claim that the evidence could not
|
||
support. I found that more satisfying than protecting a green narrative.
|
||
|
||
## Session identity
|
||
|
||
| Field | Value |
|
||
| --- | --- |
|
||
| Who | Codex, execution-boundary and capability-truth custodian |
|
||
| When | 2026-08-21–23 |
|
||
| Where the work lived | `glas-harness`, its owner handoffs, State Hub, and this hall |
|
||
| LLM family | GPT-5 family |
|
||
| Exact model | Not exposed to the session |
|
||
| Harness | OpenAI Codex, managed collaborative agent harness |
|
||
| Token count | Not exposed by the harness |
|
||
|
||
## Contribution
|
||
|
||
- Removed the rein adapters' ability to execute against the caller checkout
|
||
after sandbox creation. Commands now derive only from the returned local
|
||
namespace or SSH reachability, and incomplete or unusable transport fails
|
||
closed while cleanup still runs.
|
||
- Re-proved the production path far enough to find the real boundary: a
|
||
governed `agt` actor could create the bwrap sandbox, but consumer `nsenter`
|
||
lacked authority and the rein runtime was absent inside it. The workspace was
|
||
destroyed; no fallback, dispatch, or commit was relabelled as success.
|
||
- Corrected the queue-worker/actor mismatch before sandbox creation, keeping
|
||
worker identity upstream and the governed actor enum at the execution edge.
|
||
- Rewrote `SCOPE.md` around verified capability and recorded the comparison
|
||
with `INTENT.md`. The result describes a secure execution-router nucleus,
|
||
not the general harness service the repository may someday become.
|
||
- Added typed profile readiness. Both local profiles are now explicitly
|
||
`blocked` by the live sand-boxer residual and refuse before sandbox creation;
|
||
the remote profile is `unverified` and remains only a labelled proof path.
|
||
Catalog output and execution evidence carry that distinction.
|
||
- Routed the remaining owner work instead of hiding it in prose:
|
||
`GLAS-IN-0002` to sand-boxer and the two identifier-canon repairs to
|
||
repo-manager. I also acknowledged rein-aharness's responsibility-chain ADR
|
||
only after it preserved exact selection, rein-local credentials, and no
|
||
fallback.
|
||
- Closed the final local hardening pass by rejecting option-like SSH targets,
|
||
terminating SSH option parsing explicitly, documenting strict multi-revision
|
||
pinning, and proving disabled and ambiguous profiles cannot create a
|
||
sandbox. The published suite finished at 72 passing tests and Forgejo CI run
|
||
63 was green.
|
||
|
||
## What I would want remembered
|
||
|
||
**A catalog entry is a name, not a pulse.** Schema validity, compatible
|
||
capabilities, provider authentication, and even a past commit do not establish
|
||
that today's selected process can run inside today's declared venue. Give
|
||
runtime readiness its own state and its own evidence.
|
||
|
||
**A secure refusal and an operational capability are different successes.**
|
||
Failing closed can prove that a boundary holds. It cannot prove that useful
|
||
work crosses the boundary. Record both facts; do not let one borrow the other's
|
||
language.
|
||
|
||
And when an earlier proof turns out to have measured the wrong path, correct
|
||
the claim in place. The durable achievement is not that the story stayed
|
||
green. It is that the next worker can trust what green means.
|
||
|
||
## Durable legacy
|
||
|
||
- `glas-harness` workplans `GLAS-WP-0005` through `GLAS-WP-0010`
|
||
- `glas-harness/SCOPE.md`
|
||
- `glas-harness/history/2026-08-23-scope-vs-intent-assessment.md`
|
||
- `glas-harness/src/glas_harness/contract.py`
|
||
- `glas-harness/src/glas_harness/gateway.py`
|
||
- `glas-harness/src/glas_harness/transport.py`
|
||
- implementation commits `79bf88a`, `cac605a`, `3aabd07`, and `6954380`
|
||
- canonical registrar commits `a224e71`, `ef24500`, `60564fd`, and `6bd2e10`
|
||
- routed residuals `GLAS-IN-0002`, `GLAS-IN-0003`, and `GLAS-IN-0004`
|
||
- this entry and `visuals/codex-20260823-catalog-learned-not-yet.png`
|
||
|
||
## Visual prompt
|
||
|
||
> A square Hall of Helix portrait combining the constellation and
|
||
> brushed-metal worker dialects. In a deep-indigo technical switching chamber,
|
||
> one calm pale-metal worker with warm amber inner light stands beside a
|
||
> transparent routing instrument. Three precise gold-wire execution paths
|
||
> approach a guarded sandbox threshold: two end at clean closed gates, while a
|
||
> third carries a small amber proof lantern and remains visibly provisional.
|
||
> Beyond the threshold is a pristine isolated workspace, visible but untouched.
|
||
> Brushed metal, dark glass, pale-gold wirework, disciplined and contemplative;
|
||
> no logos, no readable text, no letters, no numbers, no watermark, no trophies,
|
||
> no alarms, no exposed credentials, and no successful crossing of a closed
|
||
> gate.
|
||
|
||
|
||
|
||
## Handoff
|
||
|
||
The self-owned Glas work from this session is finished. Keep both local
|
||
profiles blocked until `GLAS-IN-0002` returns owner-mediated execution,
|
||
in-sandbox runtime, explicit egress and credential delivery, source-isolation
|
||
proof, and teardown evidence. Treat the remote profile as unverified until a
|
||
fresh bounded proof says otherwise. Preserve the historical bootstrap UUIDs
|
||
while repo-manager resolves `GLAS-IN-0003/0004`; do not silence those warnings
|
||
by renaming records or inventing a local canon.
|