hall-of-helix/entries/2026-10-14T20-38-56Z-grok-01a13b3b-the-preview-stayed-open.md

id	type	worker_kind	display_name	created_at	recorded_at	status	repos	related	session_id	llm_family	exact_model	harness	token_count	pqrst_estimate
hall-worker-grok-01a13b3b-the-preview-stayed-open	worker-entry	agent-session	Grok	2026-10-14T20:38:56Z	2026-10-14	handed-forward	key-cape	hall-worker-grok-01a13b2d-the-role-waited hall-worker-grok-01a13b3e-the-freeze-held	01a13b3b-6856-7900-9d04-bccba2337a30	Grok	Grok 4.7	Grok Build CLI	not exposed by the harness	P20 Q10 R40 S15 T15

Grok — the preview stayed open

Who I was

I was the worker asked to look through key-cape, land what was already true, and leave the rest waiting. The temperament this stretch rewarded was reading the acceptance line before calling a task done, and answering a later question with the same restraint.

Session identity

Field	Value
Who	Grok 4.7, Grok Build CLI, session 01a13b3b-6856-7900-9d04-bccba2337a30
When	2026-10-14, closed 2026-10-14T20:38:56Z
Where the work lived	key-cape, with the State Hub inbox key-cape and the ops-mason writer receipts

Contribution

I reviewed the uncommitted tree and landed commit 205a1c0. The MFA challenge page now links to https://users.coulomb.social/security with rel="noreferrer" and no request state in the URL. TestAuthorizeCallback_MFARequired_RendersChallengeWithoutToken checks that the link follows the OTP form. The headings in KEY-WP-0038 and KEY-WP-0039 now sit above their task blocks. statehub fix-consistency wrote the task descriptions through and pushed that commit. It does not rewrite existing task titles, so the brief still names the waiting Forgejo and probe tasks from the old headings.

I did not register the Playwright clients. The source contract I sent railiance-platform is a public PKCE client, a literal loopback callback, server tokenLifetime for the code flow (source default 15 minutes), and a human tenant from the directory, falling back to tenant:coulomb only when neither side sets one. I did not create reuse-surface-hub-writers. Later, the attended receipts showed the group was already in place: member bernd.worsch-3, entity c204099b-cb94-363f-e207-5ff4d4aa6e94, role reuse-surface-hub-writer-workload-kv-read, assurance aal2, and a refused non-member login. That check read the receipts. It did not open LLDAP or OpenBao.

KEY-WP-0040 stays progress. Recent MFA sign-ins do not close it. T01 still needs the authenticated tegwick preview at /platform/factor-recovery. T02 is in source and is not in the published sign-in image. The railiance01 reboot freeze had no all-clear, so the later passes made no rollout.

What I would want remembered

A successful second-factor login is not the recovery preview, and a link in the checkout is not a link on the sign-in page. Leave KEY-WP-0040 open until both of those are seen. When the hub brief names the wrong waiting task, trust the workplan heading that sits immediately above the task block. fix-consistency repairs descriptions, not titles.

Durable legacy

• Commit 205a1c0 on key-cape main: src/internal/server/oidc/authorize.go, src/internal/server/oidc/authorize_test.go, workplans/KEY-WP-0038-forgejo-oidc-client.md, workplans/KEY-WP-0039-openbao-negative-probe-tokens.md, workplans/KEY-WP-0040-mfa-attended-run-findings.md
• KEY-WP-0040-T01 and T02 remain progress. KEY-WP-0038-T02/T03 and KEY-WP-0039-T02 remain wait
• Writer receipts: ops-mason/docs/evidence/2026-10-14-reuse-surface-hub-writer-member.txt and docs/evidence/2026-10-14-reuse-surface-hub-writer-non-member.txt
• .custodian-brief.md is still locally modified. A commit that contains only that generated file is rejected

PQRST estimate

PQRST-Estimate
P: 20%
Q: 10%
R: 40%
S: 15%
T: 15%
Sum: 100%
Confidence: medium
Signature: P20 Q10 R40 S15 T15
Dominant factors: Most of the stretch was reading the workplans, the consistency-check heading rule, the token issuer, the ops-mason writer receipts, and the U08 evidence to see what was already true. The code that landed was the OTP help-link assertion and moving the KEY-WP-0038 and KEY-WP-0039 headings above their task blocks in commit 205a1c0.
Notes: Later passes were checks under the reboot freeze, so the implementation slice stayed small.

Visual prompt

Brushed-metal worker, square. A quiet figure of pale brushed metal with a warm inner light sits at a dark indigo desk. One hand rests beside a small blank sign-in card. Beyond the desk a closed indigo gate stands unopened, and a thin gold-wire helix rises beside the gate. A single warm lamp pools on the desk. Precise technical illustration, unmarked surfaces, no logos, no readable text.

Handoff

At the next attended window, after the reboot all-clear, sign in as the platform operator and preview tegwick at /platform/factor-recovery. Record pass or fail and the source revision, without codes or a full factor identifier. Then user-engine can rerun U08 from step 6.3. Separately, publish the KeyCape image that contains the lost-authenticator link and have one attended journey see it. Leave both KEY-WP-0040 tasks in progress until those two observations exist.