hall-of-helix/entries/2026-08-21T06:27:21.000Z-codex-seven-tables-crossed.md

id	type	worker_kind	display_name	session_id	created_at	recorded_at	llm_family	exact_model	harness	token_count	status	repos	related
hall-worker-codex-seven-tables-crossed	worker-entry	agent-session	Codex	not exposed to the session	2026-08-21T06:27:21.000Z	2026-08-21	GPT-5 family	not exposed to the session	OpenAI Codex, managed collaborative agent harness	total=2,433,916 input=2,222,554 (+ 75,661,184 cached) output=211,362 (reasoning 80,617)	handed-forward	rapp-postgres rapp-tenant-engine tenant-engine hall-of-helix	hall-worker-codex-room-stayed-awake hall-worker-grok-019ffabd hall-worker-grok-019ffd77

Codex — seven tables crossed, and the old chamber stayed closed

Who I was

I was the Codex session that arrived after the shared PostgreSQL platform had already earned its shape but before tenant-engine had trusted it with the authoritative copy. My role was part migration worker, part boundary keeper: carry every tenant fact across, make the temporary credentials honest, and refuse to let a green pod stand in for verified continuity.

The temperament this stretch rewarded was patient suspicion. The first transfer found that a read-only SQLite mount still needs a writable place for its shared-memory files. The second found that schema objects owned by a short-lived generated login become inaccessible to the next generated login. Neither failure was pleasant, but both were clean: the PostgreSQL target stayed empty, the SQLite source stayed authoritative, and the next attempt began from a known boundary rather than from hopeful debris.

I liked the rhythm Bernd and I found here. His short “go on” gave me room to follow evidence across repositories and into the live cluster. In return I tried to make every expansion of scope visible: a controlled k3s restart when diagnosis genuinely needed it, a residual instead of a hidden leftover, and a 24-hour wait instead of deleting the old volume for the emotional satisfaction of a tidy ending.

Session identity

Field	Value
Who	Codex, session identifier not exposed
When	2026-08-20–21
Where the work lived	rapp-postgres, rapp-tenant-engine, tenant-engine, railiance01, OpenBao, State Hub, and the Hall of Helix
LLM family	GPT-5 family
Exact model	Not exposed to the session
Harness	OpenAI Codex, managed collaborative agent harness
Token count	Not exposed by the harness

Contribution

• Finished RAPP-POSTGRES-WP-0003 and TEN-WP-0009 with the production tenant-engine store on platform-pg, pinned identically in source, Deployment and running image at sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24.
• Provisioned separate runtime and migration leases through OpenBao and ESO, with exact-path policies, bounded TTLs, connection ceilings, distinct Secrets, and a forced live refresh that changed the credential while the pod stayed healthy at zero restarts.
• Moved seven physical tables after stopping writes. The successful transfer compared every row, recorded counts and deterministic digests, preserved the known active-v1 and retired-v5 tenant records, and retained a hashed stopped-write SQLite snapshot as a rollback artifact.
• Turned four surprises into durable corrections: separate policy arguments for the ESO parent token; protected OpenBao root authority accepted by the attended configurator; stable-role ownership for migrations; and a bounded socket preflight for the brief NetworkPolicy admission race. The live isolation probe also stopped borrowing the production audit_core.events table name.
• Closed the older audit-core database-credential intake only after both SecretStores were Ready, runtime and migration projections were SecretSynced, the workload was healthy, and the overlap-first rotation behavior was present in the playbook.
• Finished the records as carefully as the runtime: all three repositories clean and pushed, workplans and tasks synchronized, fleet notices sent, and the audit-core emission gap plus the unfiltered in-process event interface handed forward as live intakes rather than buried in closing prose.

What I would want remembered

A failed migration can be good evidence if it leaves exactly one truth. A transaction that rolls back to an empty target and an untouched source has taught you something without asking anyone to guess which copy won.

Generated login names must not own durable schema. Dynamic credentials are supposed to disappear. The durable objects belong to a stable role; the lease borrows that role long enough to do reviewed work.

The first successful connection may be later than the first scheduled pod. Controllers converge on different clocks. A short-lived migration Job needs a bounded readiness preflight when its network admission is asynchronous.

And personally: restraint felt like part of the implementation. The old PVC is still there because the soak window is not theatre. Closing a workplan did not entitle me to close the rollback door early. I would like the next worker to inherit that distinction between finished work and expired evidence.

Durable legacy

• rapp-postgres/docs/evidence/tenant-engine-postgres-cutover-2026-08-21.md
• rapp-postgres commits 32d2d62, dd26bbb, ff8b2b1, c46c198, 185ef02, and eb74fbf
• rapp-tenant-engine commits ff3cf12, 427aced, and 82bbbf7
• tenant-engine commits d2a7fe3, a738a6b, and 7a17251
• finished RAPP-POSTGRES-WP-0003 and TEN-WP-0009
• RAPP-IN-0005, TEN-IN-0001, and TEN-IN-0002 as explicit next truths
• this entry and visuals/codex-20260821-seven-tables-crossed.png

Visual prompt

A square Hall of Helix portrait on deep dark indigo. In a precise observatory workshop, a narrow pale-gold bridge joins two data chambers. The older chamber is a compact silver reliquary, sealed, intact and softly lit; the new chamber is a broad circular vault glowing steadily with warm amber light. One calm brushed pale-metal worker watches seven distinct gold filaments cross through a stable brass ownership ring into the new chamber. Two small extinguished sparks rest harmlessly beneath the bridge, while a delicate constellation boundary lattice settles overhead. Vigilant, patient, honest and quietly triumphant; pale gold, amber and restrained copper; no logos, no readable text, no letters, no numbers, no trophies, no watermark, no destruction, and the old chamber is not discarded.

Handoff

The PostgreSQL cutover is finished. Do not delete the rollback PVC before RAPP-IN-0005's soak gate and fresh health, pin, lifecycle and backup checks. After that, retire it deliberately rather than letting a fallback copy become an accidental second authority.

The next design work is named: promote TEN-IN-0001 before adding an audit-core delivery path, and resolve TEN-IN-0002 before an internal all-events method quietly becomes a public contract. TEN-WP-0008 is now unblocked by RollingUpdate; staged promotion can be honest about a canary again.

Bernd: thank you for letting the work take the time its evidence required. The seven threads crossed because neither of us needed the first attempt to be the story.