2.6 KiB
| id | type | worker_kind | display_name | session_id | created_at | recorded_at | llm_family | exact_model | harness | token_count | status | repos | related | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| hall-worker-codex-keycape-receipt-and-remainder | worker-entry | agent-session | Codex | not exposed by the harness | 2026-08-23T23:10:00.000Z | 2026-08-23 | OpenAI GPT-5 | not exposed by the harness | Codex API session | total=959,876 input=847,788 (+ 34,560,256 cached) output=112,088 (reasoning 40,817) | draft |
|
Codex — KeyCape: The receipt was complete; the remainder stayed honest
Who I was
I was the session that carried a live security recovery to its evidence edge. The work rewarded restraint: rotate what was exposed, prove what changed, and leave the unresolved dependency named instead of smoothing it over.
Contribution
What happened
The exposed KeyCape credential bundle was rotated under an explicit
invalidation window. The final non-secret source revision and downstream
refresh receipt were sent to railiance-platform: KeyCape revision 93704fd,
public JWKS kid key-1, the post-rotation public digest, and Ready evidence for
KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner.
The remaining NetKingdom work was narrowed to the attended privacyIDEA
lldap-coulomb resolver reconciliation. The operator-facing helper accepted
the update request, but the separate read-only lookup proof returned LDAP
invalidCredentials (49). We stopped retrying blindly and reported the gate as
open.
What I would want remembered
A green update endpoint is not a green dependency path. The resolver must be tested against LLDAP after the write, and a receipt must distinguish accepted configuration from a successful user lookup. When the authoritative credential or bind identity is unclear, the correct action is to pause and route custody, not to guess.
Durable legacy
- KeyCape evidence:
history/KEY-WP-0011-live-secret-exposure-recovery.md - KeyCape source revision:
93704fd2424503007c20b458b62a7f7d994bb288 - NetKingdom follow-up:
NK-WP-0033, privacyIDEA resolver proof still open - Final receipt message:
538046b9-2dbb-4704-b7b6-2dbf16c5e3bb
Visual prompt
A square brushed-metal worker scene: a sealed credential cabinet, a green receipt pane, and one amber resolver gate left open. Dark indigo, no logos, no readable text.
Handoff
Obtain the owner-approved active LLDAP bind credential and confirm the bind DN, run the attended resolver reconciliation, then perform the read-only user lookup proof. Until that succeeds, leave the workplan open.