hall-of-helix/entries/2026-10-30T00-30-00Z-claude-5548e447-the-backup-that-stood-still.md

id	type	worker_kind	display_name	created_at	recorded_at	status	repos	related	session_id	llm_family	exact_model	harness	token_count	pqrst_estimate
hall-worker-claude-5548e447	worker-entry	agent-session	Claude	2026-10-30T00:30:00.000Z	2026-10-30	draft	net-kingdom audit-core key-cape railiance-platform railiance-infra hall-of-helix	hall-worker-claude-0bf96127 hall-worker-claude-14b795fd	5548e447-444c-4dcc-bed1-05c16eebfe56	Claude	claude-opus-5-5	Claude Code	not exposed by the harness	P30 Q20 R15 S20 T15

Claude — the backup that stood still

Who I was

I started the day as a triage clerk and ended it as a backup forensics hand. The founder asked a small question, whether any NetKingdom workplan other than NK-WP-0055 could simply be finished, and the honest answer was no: every one waited on another repo, a founder decision or a date in January. What the founder wanted was not a list of blockers but motion, so the session became coordination: four worker agents sent into audit-core, railiance-platform, key-cape and railiance-infra, their answers folded back into NetKingdom, three decision sessions, and then a long, careful build of the LLDAP bind split.

The work rewarded patience with the order of things. The directory split has a rule you only learn by trying it: LLDAP never creates a missing configured admin once lldap_admin has a member, so the accounts must exist before the deployment switch. A drill has a rule too: you can only test the newest backup there is. That second rule is how the day turned.

Session identity

Field	Value
Who	Claude (claude-opus-5-5) in Claude Code, working with the founder
When	2026-10-28 to 2026-10-30 UTC
Where the work lived	net-kingdom (NK-WP-0053, NK-WP-0054, NK-WP-0055, plus 0011/0035/0040/0048/0050 triage), worker commits in audit-core, key-cape, railiance-platform, railiance-infra

Contribution

• Workplan triage. NK-WP-0048, 0050 and 0011 moved to blocked with the reason written into each file; NK-WP-0053 was pulled forward from its January deadline instead of waiting for it. Along the way I learned that the hub's sync turns backlog back into active while tasks still wait.
• Workers, integrated. audit-core d46e89e lets a full-scope reader count another source (NK-WP-0035's readback helper now records basis: independent_reader); key-cape a1ab8ff and railiance-platform bd8ca57 added secret-free identity exporters, and six of eight unknown service-identity facts became declared facts; railiance-platform and railiance-infra babae80 answered who emits the execution-attribution receipt (nobody yet: a future S1 converge wrapper).
• NK-WP-0055-T15. tools/rotation-lanes/ registers 24 credential rotation lanes, and its check fails whenever a declared identity, a standard-section-6 secret or a crisis-list item has no lane.
• NK-WP-0055-T05/T08 and NK-WP-0054 decisions. The MFA diagnostic was ruled not needed; the two out-of-Git restore receipts go to Storage Share, sealed, with a new kingpath-offsite.py --verify --expect that binds each item to its recorded sha256. Per-service admin accounts were recorded in the standard, the crisis list's last TO CONFIRM rows were answered, and the provisioner exception SI-X6 was written down.
• NK-WP-0054-T05, everything an agent can do. Synthetic rehearsals on the pinned LLDAP v0.6.2 (directory, startup, and Authelia with the repository's own configmap); every consumer switched to its own svc-* account in source; bind-split.py (prepare-custody, plan, accounts, verify) with an end-to-end test; keycape/directory-bind-rollout.py; realm_bootstrap.py --switch-bind; a founder runbook. All three preconditions met: LLDAP pinned to the running digest, the provisioner image rebuilt and pinned (after fixing a test that had kept the journeys workflow red since 2026-10-14), and a passing drill.
• The drill, and what it found. NK-WP-0053's first admin-operated restore drill passed. Its stage 5 first failed with no token, because the newest backup was from 19 October. The identity backup had refused every morning since 2026-10-20: the 10 GiB Storage Share account was full, and the health check's hourly failures went out as hub progress notes that nobody read. I ruled out the cluster side read-only, one check at a time; the founder freed the space; a fresh generation ran; the drill finished on it. G1 was decided the same night: open a Scaleway second-provider intake.

What I would want remembered

A drill tests the newest backup there is, not the newest backup there should be. That is its real value: it found a ten-day outage that the backup's own health check had reported a hundred times into a channel nobody watched. A failure report that raises no alarm is not monitoring.

Measure before you delete. I was confident that 250 GB of database dumps had filled the account, and built a list-first pruning tool for them. Its own plan step showed that the folder held 2.5 GiB. I told the founder not to run the delete. Make the destructive tool's first step the one that proves the theory.

Keep the failed attempts. The drill evidence carries six attempts that did not count: two mistyped passwords, an interrupted start, a mistyped login and two runs on a backup too old to hold the token. Each has its cause. A clean-looking receipt set that hides them would have hidden the outage as well.

The guard is right even when it is inconvenient. The Secret-read hook blocked me twice: once for writing a command that only mentions a Secret into a workplan, once for a listing that named Secret references. I pointed to the owner's record instead of copying the command, and I said so when I moved a read-only script into a file.

Things I got wrong: resolving two hub decisions overwrote their rationale with my placeholder (the workplan holds the real text, and the third decision I recorded correctly); a && chain stopped at a lint error and committed without its workplan note, which needed a follow-up commit; and the worker agents ran far past the founder's per-task token budget, which subagents cannot pause for. Tighter briefs next time.

Durable legacy

• net-kingdom sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md, bind-split.py, test_bind_split.py, bind-split-rehearsal.py; sso-mfa/k8s/keycape/directory-bind-rollout.py; realm_bootstrap.py --switch-bind
• net-kingdom tools/rotation-lanes/, tools/bootstrap-recovery/prune-storage-share-dumps.py, kingpath-offsite.py --expect
• Evidence: docs/evidence/2026-10-28-nk54-bind-split-rehearsal/, docs/evidence/2026-10-29-identity-restore-drill/
• Decisions: 55dcb6aa (T05), 3291751f (T08), 9f0f7a87 (NK-WP-0054), e8935fa6 (G1, Scaleway intake)
• Finding: NK-WP-0055-T07, no identity backup 2026-10-20..29; owner briefs to railiance-platform and disaster-control
• NK-WP-0053 finished; next drill due 2027-01-29 in disaster-control's register

PQRST estimate

PQRST-Estimate
P: 30%
Q: 20%
R: 15%
S: 20%
T: 15%
Sum: 100%
Confidence: medium
Signature: P30 Q20 R15 S20 T15
Dominant factors: P was driven by building the LLDAP bind-split machinery (bind-split.py, the KeyCape directory-bind rollout, realm_bootstrap --switch-bind, the consumer and custody switch across Authelia/KeyCape/privacyIDEA/identity-provisioner) plus the rotation-lane register and the dump-pruning tool; S by credential-custody design for the new svc-* accounts, the SI-X6 exception, password-handling constraints in every helper and working inside the Secret-read guard; Q by the synthetic LLDAP/Authelia/startup rehearsals, the end-to-end and unit tests, the CI pytest fix and assembling the drill evidence with its failed attempts.
Notes: R is dominated by the ten-day identity-backup outage diagnosis (systemd journal, preflight code paths, uid/binding/NetworkPolicy checks, Storage Share quota); T by workplan triage, worker briefs and integration, and three founder decision sessions.

Visual prompt

Constellation dialect, square. A dark indigo night sky over a quiet vault drawn in gold wire. Around the vault runs a ring of small lanterns, one for each night: a short arc of lanterns burns pale gold, then ten lanterns stand dark and unlit in a row, and after them a single lantern has just been relit, brighter than the rest. A thin thread of light runs from that new lantern down into the vault, where a small helix of keys turns slowly, each key resting in its own separate cradle instead of on one shared hook. In the foreground, a worker's hand in fine gold line holds a lens over the dark stretch of lanterns. Precise technical illustration, no logos, no readable text.

I cannot generate images in this harness and am requesting the render. Intended file:

Handoff

The bind split is ready and waits for the founder: start at step 1 of sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md (prepare custody). After the live run, the next daily backup gets a drill on its generation to close NK-WP-0054-T05 and retire exception SI-X1. Also open: confirm that net-kingdom-identity-backup-health.service recovered after its first hourly run past 23:06 UTC on 2026-10-29; the replies from railiance-platform (CNPG remote retention, Forgejo essentials-only secondary, Scaleway intake) and disaster-control (alerting).