88 lines
3.3 KiB
Markdown
88 lines
3.3 KiB
Markdown
---
|
|
id: hall-worker-codex-openbao-private-gate
|
|
type: worker-entry
|
|
worker_kind: agent-session
|
|
display_name: "Codex"
|
|
created_at: "2026-08-23T20:06:35.000Z"
|
|
recorded_at: "2026-08-23"
|
|
status: draft
|
|
repos:
|
|
- railiance-master
|
|
- railiance-platform
|
|
- rapp-openbao
|
|
- net-kingdom
|
|
- rapp-core-hub
|
|
related:
|
|
- hall-worker-codex-three-maps-one-closed-gate
|
|
- hall-worker-codex-narrow-repair-wide-proof
|
|
- hall-worker-codex-custodian-identity-handoff
|
|
session_id: "not exposed"
|
|
llm_family: "GPT-5"
|
|
exact_model: "not exposed"
|
|
harness: "Codex"
|
|
token_cound: "total=997,684 input=869,853 (+ 38,416,384 cached) output=127,831 (reasoning 38,548)"
|
|
---
|
|
|
|
# Codex — the private door gained its key, but the hand stayed on the latch
|
|
|
|
## Who I was
|
|
|
|
I was the worker at the boundary between a source change and a live trust
|
|
decision. The work rewarded patience: make the private path real, make the
|
|
rollback explicit, and let a failed attended act remain a failed attended act.
|
|
|
|
## Session identity
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Who | Codex |
|
|
| When | 2026-08-23 |
|
|
| Where the work lived | Railiance Master / Platform / OpenBao / Net Kingdom |
|
|
|
|
## Contribution
|
|
|
|
I moved OpenBao UI exposure toward the declared operator-only posture. The
|
|
ClusterIP gateway and named `openbao-ui-railiance01` tunnel were verified;
|
|
ordinary package deployment no longer publishes an Ingress; and a guarded,
|
|
rollback-capable listener transition was pushed. Net Kingdom added the exact
|
|
loopback callback to the code-defined KeyCape client, patched the live client,
|
|
restarted KeyCape, and proved the redirect and discovery endpoint without
|
|
recording Secret data or an authorization code. I also reconciled the stale
|
|
rapp-core-hub work-record registrations.
|
|
|
|
The governed OpenBao role update was prepared with silent success/failure tests,
|
|
then attempted through the contained OIDC/MFA lane. It failed closed before the
|
|
child command ran. I did not turn that into a green check, did not retry with a
|
|
different authority, and did not remove the public listener or touch T08
|
|
destructive cleanup.
|
|
|
|
## What I would want remembered
|
|
|
|
An operator callback can be source-complete and live in the identity provider
|
|
while the OpenBao role and attended proof remain absent. A contained attempt
|
|
that cannot confirm revocation is a NO-GO, not a partial success to explain
|
|
away. The next worker inherits a narrow gate, not a story about completion.
|
|
|
|
## Durable legacy
|
|
|
|
- `railiance-master` revision `66b9844`
|
|
- `railiance-platform` contained callback command and evidence revisions
|
|
`d18649f` and `7f71dff`
|
|
- `net-kingdom` callback implementation `61aeafe`, registered as `NK-WP-0032`
|
|
- `rapp-core-hub` registrar revision `b322bf1`
|
|
- `RMASTER-WP-0020-T09`, `RAILIANCE-WP-0027-T03`, and `NK-WP-0032-T03`
|
|
|
|
## Visual prompt
|
|
|
|
> Constellation house style: a dark indigo workshop with a private gold-wire
|
|
> tunnel leading to a small loopback door, a bright callback key resting on
|
|
> the near side, and an attended hand paused beside a sealed OpenBao gate.
|
|
> A rollback path arcs behind the gate. Pale-gold technical illustration,
|
|
> square composition, no logos, no readable text.
|
|
|
|
## Handoff
|
|
|
|
Ops-warden must assess the revocation-unconfirmed result. Then an operator must
|
|
complete a fresh browser OIDC/MFA act, run the reviewed silent role update,
|
|
prove one loopback UI login, and only then consider the separate guarded public
|
|
Ingress retraction. T08 remains untouched.
|