P10: hal's public services move onto the platform and hal stops

Keycloak and LiteLLM go live on the platform, every other public route of hal moves, and hal stops. A reboot and a fresh-machine run prove the end state.

Caller

#1, row P10. This item replaces #116's "Cutover order", and #116's five rulings bind it (aco rulings 116).

Plan

The plan has had three revisions and three independent plan reviews:

the first two plans and the first two reviews are on Platform on k3s and Flux: from an empty PC to every app live, with hal archived #1: Platform on k3s and Flux: from an empty PC to every app live, with hal archived #1 (comment) and the comments after it;
the third plan and its review are this item's first comments.

The third review closed the earlier findings on the boundary, the step-5 block, the consumers and the matrix. Two defects remain, both in slice 1's specification: I1's network-policy comparison, and how the checks cell proves that every call is a read. By the head contract, the third consecutive REVISE stops the review loop, so the way on is the operator's card below.

The operator decisions of the plan's §6 and Part C come as their own cards before the slice that needs each. Decision 11, the logout of songmaker and presentator once the issuer moves, comes before slice 3.

Predecessors

P7: Postgres, Keycloak, LiteLLM and backups run on the platform, tried on the PC with copies of hal's backups #116's "Cutover order": replaced by this item.
hal's keycloak and litellm units: hal's exit item, after songmaker and presentator have moved.
keycloak:move-group, db:load-dump --compare and the cutover helpers: deleted in the plan's slice 6.

version = 1
now = "The Keycloak cutover is through since 12.11.2026 (steps 1 to 13): the public issuer, hopin, skat, songmaker and speech run on the platform at main 1146b59, the AI path is open, hal's Keycloak stays switched off. presentator still runs on hal."
next = "songmaker 2026.11.11.2 with its group (#470, step 14), then keycloak:move-group --delete-old (step 15); presentator's move (#322); then hal stops on the operator's word (steps 16, 17). The operator deletes ~/p7-cutover."
done_when = "Keycloak and LiteLLM serve live from the platform, every public route of hal has moved, hal is stopped, a reboot and a fresh-machine run are proven, and each predecessor above is gone or an open item."

size = "L"

[[expectation]]
text = "Der erste Baustein des Umzugs wird auf dem gewählten Weg weiter geprüft und gebaut."
asked_on = 2026-11-09
ruling = "A"
ruled_on = 2026-11-09
card_hash = "sha256:d887b397559d778044f9639c55ff2f58369e1ad55413e76535eee4e4d5736b98"
via = "board"
question = "Darf der Umzug deiner Anmeldung mit seinem ersten, nur lesenden Baustein beginnen, sobald die zwei letzten Lücken geschlossen sind?"
problem = "Die dritte Planprüfung fand zwei enge Lücken im ersten Baustein; ohne deine Wahl ruht der Umzug."
decision_kind = "technical"
area = "Umzug"
topic = "Erster Baustein des Umzugs"
recommended = "A"
reason = "Die Prüfung nennt beide Lücken mit ihrer genauen Abhilfe und bestätigt alles andere. Der Baustein liest nur und ändert nichts, und die Prüfung seines Baus und die automatischen Tests sehen die Korrektur."

[[expectation.option]]
name = "Korrigieren, dann bauen"
effect = "Die zwei Korrekturen kommen wörtlich in den Plan, und der erste Baustein wird gebaut. Die Prüfung des Baus kontrolliert sie."
notice = "Du merkst nichts: der Baustein prüft nur den Zustand vor dem Umzug."
cost = "Keine vierte Planrunde. Bleibt doch eine Lücke, findet sie erst die Prüfung des Baus."
undo = "reversible"
undo_how = "Der Baustein lässt sich löschen; nach dem Umzug wird er ohnehin entfernt."
contract = "Slice 1 (`cutover:preflight`) is cut with round 3's findings 1 and 2 applied as the reviewer stated them. I1 indexes NetworkPolicies by namespace/name and compares normalised `.spec`; missing and extra names fail, and a healthy fake carries ordinary server metadata. The `checks` cell either runs the script directly with a fake PATH, or disables `kubectl,flux2,gh` in mise, and it asserts that each intercepted executable resolves to its fake. It wraps git in a logging delegate and validates every curl and gh call's effective method and endpoint. The slice's build review drives those cells. There is no fourth plan review."

[[expectation.option]]
name = "Vierte Planrunde"
effect = "Die Korrekturen kommen in den Plan, und dieselbe unabhängige Prüfung liest ihn ein viertes Mal, bevor gebaut wird."
notice = "Du merkst nichts, außer dass der Umzug etwa einen halben Tag später beginnt."
cost = "Eine weitere Prüfrunde nach drei, bei der die Regel eigentlich stoppt."
undo = "reversible"
undo_how = "Jederzeit auf Bauen umstellbar."
contract = "Round 3's findings 1 and 2 are applied, then a fourth Codex delta plan review runs; slice 1 is cut only on TAKE."

[[expectation.option]]
name = "Umzug ruht"
effect = "Nichts wird gebaut; der Plan bleibt, wie er ist."
same_as_today = true
notice = "Deine Anmeldung bleibt auf dem alten System."
cost = "Der Umzug und alles, was auf ihm aufbaut, wartet."
undo = "reversible"
undo_how = "Später mit einer der anderen Wahlen fortsetzbar."
contract = "No P10 slice is cut until the operator rules again."

[[expectation]]
text = "Was mit laufenden Sitzungen von songmaker und presentator passiert, wenn sich jemand nach dem Umzug der Anmeldung zentral abmeldet, solange die beiden Apps noch nicht umgezogen sind."
withdrawn_on = 2026-11-09

[[expectation]]
text = "Ob songmaker und presentator erst nach der Anmeldung umziehen müssen, und was bis dahin mit laufenden Sitzungen bei einer zentralen Abmeldung passiert."
asked_on = 2026-11-09
ruling = "A"
ruled_on = 2026-11-09
card_hash = "sha256:0de64fccee4e5e0b5e794fdca12afd363f6d78ad4b89dbe569f9668ecaf44733"
via = "board"
question = "Dürfen songmaker und presentator umziehen, sobald sie fertig sind, auch vor der Anmeldung?"
problem = "Beschlossen war: erst die Anmeldung, dann die Apps. So warten fertige Apps unnötig auf sie."
decision_kind = "product"
area = "Umzug"
topic = "Reihenfolge von Anmeldung und Apps"
recommended = "A"
reason = "Beide Apps melden sich über dieselbe öffentliche Adresse an, egal auf welchem System die Anmeldung läuft; ihr Umzug braucht die Anmeldung also nicht. Die Abmeldung in der App selbst wirkt weiter, und die Lücke schließt sich, sobald App und Anmeldung auf derselben Seite laufen. Eine Brücke kostet vier Repositories mitten im Umzug und einen neuen Zugang, den jeder Dienst erreichen könnte. Das gilt, solange außer dir noch niemand die beiden Apps nutzt."

[[expectation.option]]
name = "Wer fertig ist, zieht um"
effect = "songmaker, presentator und die Anmeldung ziehen jeweils um, sobald sie fertig sind. Laufen App und Anmeldung auf verschiedenen Systemen, beendet eine zentrale Abmeldung die Sitzung der App erst mit deren eigener Frist. Die Abmeldung in der App selbst wirkt weiter sofort."
notice = "Du merkst es nur, wenn du dich zentral abmeldest und die App danach noch offen ist."
cost = "Eine Sitzung bleibt bei songmaker ab Werk bis zu 7 Tage ohne Nutzung oder 30 Tage insgesamt, bei presentator 12 Stunden. Jemanden sofort auszusperren geht nur von Hand. Ob die alte Anmeldung beim Abmelden hängt, wenn sie eine umgezogene App nicht erreicht, ist nicht geprüft. Das setzt voraus, dass außer dir noch niemand die beiden Apps nutzt."
undo = "reversible"
undo_how = "Sobald App und Anmeldung auf derselben Seite laufen, kommt die zentrale Abmeldung zurück; die Reihenfolge lässt sich ändern, solange der jeweilige Umzug nicht begonnen hat."
contract = "#116's card 5 is replaced as a fixed order: #172's P8k and #322's go do not wait for the issuer's move, nor it for them. PR C of #235's slice 3 states `backchannel.logout.url: \"\"` for whichever of songmaker and presentator is not yet on the platform when the issuer moves, with skat's comment form; a `cluster` cell sets the URL on the client on the running realm, asserts it present, re-runs config-cli and asserts the key absent, and step 7 reads it on the loaded copy. The URL, the path and the policy rules return at the move that puts app and issuer on the same side. If an app moves first, hal's head removes that client's back-channel URL on hal's realm only if the first sign-out shows it stalls. songmaker's head corrects its `docs/security.md`."

[[expectation.option]]
name = "Erst die Anmeldung"
effect = "Die Anmeldung zieht zuerst um, songmaker und presentator danach, wie bisher beschlossen. Bis jede App umgezogen ist, beendet eine zentrale Abmeldung ihre Sitzungen erst mit der eigenen Frist. Die Abmeldung in der App selbst wirkt weiter sofort."
notice = "Du merkst, dass die beiden Apps länger auf dem alten System bleiben, auch wenn sie fertig sind."
cost = "songmaker und presentator warten auf alle Schritte des Anmeldungs-Umzugs. Die Sitzungsfristen sind dieselben wie bei der ersten Wahl. Das setzt ebenso voraus, dass außer dir noch niemand die beiden Apps nutzt."
undo = "reversible"
undo_how = "Beim Umzug jeder App kommt ihre zentrale Abmeldung zurück."
contract = "#116's card 5 stands. PR C of #235's slice 3 states `backchannel.logout.url: \"\"` for songmaker and presentator on the platform's realm, with skat's comment form and the same `cluster` cell and step 7 check. #172's P8k and #322 wait for the issuer's move and restore the URL, the path and the policy rules at each app's live go. songmaker's head corrects its `docs/security.md`."

[[expectation.option]]
name = "Brücke über den Rechner"
effect = "Die Anmeldung erreicht beide Apps über einen neuen Zugang am Rechner, und Sitzungen enden sofort."
notice = "Du merkst keinen Unterschied zu heute."
cost = "Vier Repositories ändern sich mitten im Umzug, und jeder Dienst auf der Plattform könnte den neuen Zugang erreichen, entgegen den Sicherheitsregeln der Anmeldung."
undo = "reversible"
undo_how = "Der Zugang wird in allen vier Repositories wieder entfernt."
contract = "Each app adds a published port on the host's pod-network address, hal's exposure allow-list admits it, and the platform adds hostAliases and an ipBlock egress. Acceptance: a delegated agent signs out at Keycloak and sees both apps' sessions end."

[[expectation]]
text = "Beim Umzug bleibt die KI-Datenbank der Plattform wie sie ist; der bisherige Verbrauch dieses Monats auf dem alten System wird nicht übernommen."
asked_on = 2026-11-11
ruling = "A"
ruled_on = 2026-11-11
card_hash = "sha256:f6b9f169927b7a0c7e7eda54554498bc2f8c1a70633d0f1cec70b2b7fcabe107"
via = "chat"
question = "Soll der KI-Verbrauch dieses Monats vom alten System mit umziehen?"
problem = "Das alte System läuft mit einer neueren KI-Version; seine Daten zu laden braucht erst ein Upgrade."
decision_kind = "money"
area = "Umzug"
topic = "KI-Verbrauch"
recommended = "A"
reason = "Die Schlüssel sind schon gleich; es fehlt nur die Verbrauchszählung weniger Tage, und für zwei Apps ist das bereits so entschieden."

[[expectation.option]]
name = "Verbrauch nicht übernehmen"
effect = "Die Plattform behält ihre Kopie; Schlüssel und Limits werden nur geprüft."
notice = "Die Monatslimits zählen auf der Plattform neu ab der Kopie."
cost = "Diesen Monat höchstens zwei Dollar je Person und zehn je App mehr möglich."
undo = "reversible"
undo_how = "Später die Daten des alten Systems doch laden, solange es sie hält."
contract = "Step 3 of #235 loads no LiteLLM dump: it runs litellm:keys --plan, litellm:key for hopin and songmaker (each unchanged), litellm:keys when the plan lists changes, and restarts LiteLLM after step 2. hal's November spend since the P7 copy is not carried."

[[expectation.option]]
name = "Verbrauch mit umziehen"
effect = "Die Plattform wird erst auf die neuere Version gehoben, dann werden die alten Daten geladen."
notice = "Der Verbrauch stimmt bis zum Umzug; der Umzug wartet auf das Upgrade."
cost = "Eine zusätzliche Lane mit Probe auf einer Kopie, etwa ein halber Tag."
undo = "final"
undo_how = "Das Laden überschreibt, was die Plattform seit der Kopie geschrieben hat."
contract = "Before step 3 of #235 the platform runs hal's LiteLLM version, proven on a restored copy; step 3 then loads hal's LiteLLM dump with db:load-dump --compare litellm."

Third plan, by a fresh Opus planner on 09.11.2026, read-only, at platform 0d2acdb and hal d26cec89. It answers the second review (on #1).

P10 plan, third version: all five findings are closed, and slice 1 (cutover:preflight) is specified so it can be built. Checked at platform 0d2acdb, hal d26cec89, webauth 88bf39b, hopin b04598e, songmaker 9c8c68c30, presentator 4c767c42. Read only: plain file reads, git log, aco rulings 116 and read-only lookups on the PC (getent, lslocks, /proc/locks, stat of hal's lock file). I ran no hal command and touched no cluster, secret or dump.

Citation prefixes: P/ = platform, H/ = hal, W/ = webauth, HO/ = hopin, S/ = songmaker, PR/ = presentator.

Main changes:

Finding 1 (hopin logout route): the route now has its own PR B, merged only after the publish yes. PR C carries only parts that send nothing. The emergency return closes B and checks that before hal reopens.
Finding 2 (step 5's block): rewritten as cd && ( set -euo pipefail … ) with no pipe. The container id and the snapshot id each get a checked assignment. Every failure stops the block and names itself.
Finding 3 (songmaker and presentator logout): no path to them exists from the cluster without a new non-loopback listener on the host. This is new decision 11; I recommend accepting the gap.
Finding 4 (preflight L3 and B1): L3 is gone. The preflight records hal's checkout baseline (H5), and step 9 is the human reading of hal's real plans. B1 is split into a platform part (B1) and a hal part (B2), which lists the lock's holders and waiters without taking it. Notes are separate from required conditions, so exit 0 can be reached on a healthy PC.
Finding 5 (matrix): S3, L1, L2 and L3 are corrected, and the matrix now keeps success-path evidence apart from failure-branch evidence.

Part A: changed sections (each complete)

§1 The contract of the live switch (closes findings 1, 2, 4 and partly 3)

Point of no return. It is one operational event: the operator's yes in the publish phase of the hal apply in step 9. Hal starts applying right after that confirmation (H/src/hal/stack/external/apply.py:409). From that yes on, every fault is rolled forward, whatever the publish did or did not change. The emergency return below needs his explicit word and discards every platform write since step 9.

Before the yes, nothing outside reaches the copies and the copies change nothing live:

Keycloak has no public path. DNS is still hal's, and C's tunnel line does nothing without the record.
Keycloak sends only to DNS and its Postgres (P/infrastructure/keycloak/keycloak-egress.yaml:1-35). C keeps that policy unchanged, and preflight's I1 shows it live.
Hopin's back-channel route opens only in step 11 (PR B). The copy keeps hal's signing keys, so a valid logout token from it would end live hopin sessions and record an event (W/src/webauth/oidc_login.py:444-470). So B is merged only after the boundary.
From step 3 on, LiteLLM runs with the real provider keys. Its isolation rests on two things, not on missing credentials:
- agent-egress sends only to DNS (P/infrastructure/litellm/egress.yaml:102-115);
- hopin calls gateway.invalid (P/apps/hopin/hopin.yaml:54-59).

The AI path opens in step 13, after the boundary.

Invariant of the outage. Hal's keycloak container stays stopped from step 5 until the boundary or a rollback. The loaded dump is the snapshot named by id. Keeping hal's volumes is the way back, not the proof.

Exclusion through the outage (from hal's code):

Every hal backup and hal restore, whether a timer or he starts it, takes the one host lock ~/.local/state/edge/backup.lock and waits for it without limit (H/src/hal/backup/host.py:73-80, H/src/hal/backup_commands.py:268-270, H/docs/backup.md:108-112). The block's own backup and restore therefore never interleave with another run. They can wait silently behind one; a Ctrl-C ends that wait as interrupted (backup_commands.py:275-281) and the block stops.
A timer run during the outage cannot change hal's Keycloak database:
- hal backup waits up to 10 minutes for a ready database and never starts one (H/src/hal/backup/runner.py:476-488, H/src/hal/backup/docker.py:130-143);
- the restore test loads into a throwaway server (H/docs/backup.md:279-281).
Only acts the operator does himself at a terminal write hal's live Keycloak database: hal restore keycloak --live (H/docs/backup.md:448-453), hal start (H/src/hal/stack/emergency.py:331), and a by-hand docker start or docker exec.

What holds through the outage is therefore a rule on him, written into step 5. From step 4 until the publish yes or the end of a rollback, the only hal commands in any of his terminals are the block's, then step 9's or the rollback's. Agents run none.

Preflight's B2 shows at step 4 that no run holds or waits for the lock and that neither timer fires inside the window. A one-time look cannot hold the rule, and B2 does not claim to.

How hal's database starts alone (from code; unchanged):

Hal has no command that starts it without loading. hal restore --live does docker start <id> internally (H/src/hal/backup/docker.py:154-159), with the id found by the three Compose labels.
A second hal stop keycloak sees the running database and closes it (H/src/hal/stack/emergency.py:126, 157-176).
hal start runs compose up -d --no-recreate (emergency.py:532), so it needs no stop before it.
Remaining doubt: docker start takes no switch lock. Hal's head confirms the block before R1.

#	Step	Who	Needs	Proved by
1	Readiness: rehearsal item closed; PRs C, B and O draft and green; themed image served; `mise run check:pod-logs` exit 0	head; operator (sudo) for pod logs	§3 slices 1 to 5	journal
2	Real provider keys into `platform-secrets`. This step restarts nothing: LiteLLM reads its Secret at start, and the Secret carries no hash suffix	operator (a secret he fetches, his word)	1	Kustomization `platform-secrets` Ready at its new revision
3	LiteLLM moves: `hal backup litellm`; `hal restore litellm --target ~/p7-cutover/litellm`; `db:load-dump --compare litellm`, which scales LiteLLM to 0 and Flux's resume starts it again (P/mise.toml:741, 788-793), so from here the running LiteLLM holds the real keys; `litellm:key hopin` must print `unchanged`; `litellm:keys --plan`	operator for hal; agent for the rest	hal running	outputs; a refused alias stops here (P/scripts/litellm_keys.sh:305-320)
4	`mise run cutover:preflight --live --evidence ~/p7-cutover/evidence`, immediately before step 5	agent	3	exit 0; the evidence file (Part B)
5	The block below. Auth is down from here. He runs no other hal command until step 9 or a rollback	operator, on his word	exit 0 of step 4	the block's last line names the snapshot
6	`mise run cutover:load ~/p7-cutover/keycloak/db/db.dump ~/p7-cutover/evidence` (slice 2)	agent	5	exit 0; lines name counts, key ids, `equal`
7	Merge PR C (the closed part, §3)	agent, on green	6	Kustomizations Ready at C's commit; a client Pod gets discovery through Traefik with `auth`'s Host; preflight's I1 reads `ok` at C's commit (Keycloak's egress is still DNS and Postgres)
8	Hal's head lands `tunnel: platform` on `auth` and nothing else, and lands no other commit on hal's main from step 4 to step 9	hal's head	7	the commit's sha, handed to the operator
9	`cd ~/srv/hal && hal update && hal apply`, read at three questions (below). The publish `yes` is the boundary	operator; head reads with him	8; `hal update` needs a terminal (H/src/hal/stack/update.py:99)	hal's closing host check exit 0
10	`mise run cutover:check ~/p7-cutover/evidence`	agent	9	exit 0
11	Merge PR B: Keycloak's back-channel to hopin opens	agent	10	Kustomizations `keycloak` and `hopin` Ready at B's commit; preflight's I1 lists B's two rules
12	His sign-in; a delegated agent drives login, terms and account at mobile and desktop widths; a Keycloak sign-out ends a hopin session (U8); songmaker and presentator as decision 11 rules (G1)	operator; agent	11	journal; screenshots
13	Merge PR O (agent-egress TCP 443, hopin's gateway, key file and group); LiteLLM rolls; first game-master turn on his word	agent; operator for the turn	12; members already in `/services/litellm` (step 6)	turn answered; spend row appears
14	The rest of the ruled window: songmaker's and presentator's `API_GROUP` and links, hopin's link, hal#1144's sections, platform's section	their heads; agent for platform	13; their tags come after step 9, or hal's plan shows them	new group reads through; anchors resolve
15	k8up backup, then `keycloak:move-group <file> --delete-old`, once all three consumers read the new group	agent	14	counts
16	`keycloak:agent-owner --adder agent-mozart <operator>`; agent token at hopin's `/mcp`; first nightly `litellm-expire` counts	agent; operator's username	15	journal
17	Delete helpers (slice 6) and `~/p7-cutover`; hal's head opens hal's exit item	agent; operator for the folder	16	commit; item

Step 9, the three readings (these replace preflight's old L3; hal's plan exists only here):

hal update shows every waiting commit and its changed files, then asks (H/src/hal/stack/update.py:1-8). Yes only if the only waiting commit is step 8's sha, it changes only fleet.yaml, and its parent is the hal-main baseline in the evidence file.
hal apply's local plan. Yes only if it shows auth's ingress line and no app release. Hal finds app releases on its own (H/src/hal/stack/apps.py:1-8), so a new tag shows up here.
The publish plan. Yes only if it shows only auth's record.

Any other line means no. Before the publish yes, a no changes nothing external.

Step 5's block (bash, his login shell; one paste):

cd ~/srv/hal && (
  set -euo pipefail
  [[ ! -e ~/p7-cutover/keycloak && ! -e ~/p7-cutover/snapshot.json ]] || { echo "step 5: ~/p7-cutover/keycloak or snapshot.json exists; nothing was stopped" >&2; exit 1; }
  command -v jq >/dev/null || { echo "step 5: jq is not on the path; nothing was stopped" >&2; exit 1; }
  hal stop keycloak
  db=$(docker ps --all --quiet --no-trunc --filter label=com.docker.compose.project=hal --filter label=com.docker.compose.service=keycloak-db --filter label=com.docker.compose.oneoff=False)
  [[ $db =~ ^[0-9a-f]{64}$ ]] || { echo "step 5: not exactly one keycloak-db container; nothing dumped" >&2; exit 1; }
  docker start "$db" >/dev/null
  hal backup keycloak --pre-apply --json >~/p7-cutover/snapshot.json
  snapshot=$(jq --exit-status --raw-output '.snapshot | strings | select(length > 0)' ~/p7-cutover/snapshot.json) || { echo "step 5: snapshot.json names no snapshot; nothing restored" >&2; exit 1; }
  hal stop keycloak
  hal restore keycloak --snapshot "$snapshot" --target ~/p7-cutover/keycloak
  echo "step 5: snapshot $snapshot restored to ~/p7-cutover/keycloak"
)

Why this form:

There is no pipe. set -e is in force because the subshell is the last command of the && list, and the settings stay out of his shell.
The regex matches exactly one 64-hex id. Bash anchors ^ and $ at the ends of the whole string, so zero ids or two ids separated by a newline both fail.
With jq --exit-status, missing output exits 4. So {}, {"snapshot": null} and {"snapshot": ""} all fail. Invalid JSON fails with jq's own message.
A successful --pre-apply --json prints exactly {"snapshot": "…"} (H/src/hal/backup/cli.py:72-76).
hal restore refuses an existing target (H/src/hal/backup/runner.py:446-447), so the first check moves that failure in front of the stop.

What each line prints when it fails, and the state it leaves:

Line	Prints	State; the way back
`cd`	bash's `No such file or directory`	nothing ran
target or jq check	its own `step 5:` line	nothing stopped
`hal stop`	hal's own line	as hal names it; `hal start keycloak`
`db=$(docker ps …)`	docker's error (daemon not answering)	Keycloak and its database stopped; `hal start keycloak`
id check	`step 5: not exactly one keycloak-db container`	as above
`docker start`	docker's `Error response from daemon`	as above
`hal backup`	hal's `error:` lines on stderr, exit 3, empty stdout (H/tests/test_hal_backup.py:336-346)	database running with the switch on; `hal start keycloak` (no recreate), or move `snapshot.json` away and run the block again (its first stop closes the database)
`snapshot=$(jq …)`	jq's parse error, or `step 5: snapshot.json names no snapshot`	as above
second `hal stop`	hal's line	database may still run; `hal stop keycloak` again or `hal start keycloak`
`hal restore`	hal's line	hal stopped, id in `snapshot.json`; remove a partial target, rerun `hal restore` with that id, or `hal start keycloak`

The rollback.

Before the boundary, hal start keycloak is the operator's, needs a terminal (emergency.py:331) and ends the switch:

Step 5 or 6 fails, or he says stop: cd ~/srv/hal && hal start keycloak. The copy stays closed and is loaded again on the next try. If db:load-dump left Keycloak's Kustomization suspended, the next try first runs mise run db:load-dump --resume keycloak, since a suspended Kustomization is refused.
After step 7: also revert C. The order does not matter, because C opens nothing:
- its hostAliases and Service sit behind Keycloak's closed egress;
- its tunnel line does nothing without the record;
- its cleared URLs (decision 11) change only the copy.
B is never merged before the boundary.

Emergency return after the boundary (his word; loses every platform write since step 9):

Close the copy first. One revert PR of whatever of O, B and C was merged. Wait until Kustomizations keycloak, hopin, litellm and tunnel are Ready at the revert commit and cloudflared has rolled. Then mise run cutover:preflight must print ok I1: namespaces keycloak, litellm and hopin hold exactly the committed, closed policies. Hal reopens only after the copy can no longer send a logout token to hopin.
If step 14 ran: presentator and songmaker go back to the old group by a new tag, since hal never redeploys an older one (H/src/hal/stack/apps.py:18-19), and the old links come back; hal#1144's sections are reverted. Wait for their deploys.
Hal's head reverts step 8 on main and hands over its sha.
Operator: hal start keycloak first. It removes the barrier, so auth's readiness can answer (emergency.py:526).
Operator: cd ~/srv/hal && hal update && hal apply, read as in step 9: the only waiting commit is the revert; the plans show auth's line and record back. The guard asks the hal-tunnel hosts that have a ready path (apply.py:328-346).
Proof: closing check exit 0; the public issuer and key ids equal the evidence; one sign-in on hal.

After the return, songmaker's and presentator's back-channel works again through hal's networks (hal's database still holds their URLs). Hopin's is back to today's state: by code reading, hal's Keycloak reaches only hal_backchannel_hopin (H/compose.yaml:124-128, 673-676), which the platform's hopin pod is not on. That is inferred; the runtime was not observed.

Partial failure (hal applies locally, then publishes: H/src/hal/stack/cli.py:94-103):

Local part not clean: "nothing published" (cli.py:97). The boundary is not crossed; fix what it names and rerun.
Guard refuses before the publish yes: nothing applied. Start the named host and rerun; the local part is a no-op the second time.
Publish fails or is interrupted after the yes: the boundary is crossed. Hal prints "interrupted during the publish; run hal check hosts" (cli.py:129). Run it, then rerun hal apply until exit 0. This is roll forward, unless he orders the emergency return.
hal start partial: "its switch stays" (emergency.py:539, 548). Rerun; nothing published.

Evidence before the outage. Step 4 writes the issuer and the sorted key ids, read both from the public URL and from hal's own 127.0.0.1:8081 (they must be equal), plus hal's main baseline. Slice 2 compares the copy with this file instead of a public fetch (P/tests/keycloak/restored_copy_keeps_its_keys_and_people.sh:68-75 reads the public URL, which fails while hal is stopped and proves nothing once DNS moved).

The data comparison has two parts:

the load against the dump: --compare, all tables;
restored_copy… for the four tables after config-cli, then move-group's subset check. The only expected membership change is the old group's members added to /services/litellm.

§2 Scenario matrix (closes finding 5; adds cells for findings 1 to 4)

"Success" means evidence of the good path. "Failure branch" means where the failure behaviour is proven. A failure branch marked fake drive is a delegated agent feeding the exact step-5 text to bash, under env -i with a scratch HOME and fake hal, docker and jq first on PATH, so the real ones never run. It goes into the journal before R1; it is not CI.

Cell	Scenario	Expected	Success	Failure branch
S1	`hal stop` fails	block stops with hal's line; nothing dumped; `hal start keycloak`	R1	hal's exit from its own tests (not cited here); propagation through the block: fake drive
S2	Database not ready	`hal backup` exit 3 after 10 minutes plus any lock wait; block stops; database runs with the switch on; `hal start keycloak`	R1	H/tests/test_hal_backup.py:336-346 (exit 3, empty stdout); propagation: fake drive
S3	Backup fails, or prints no id or an empty one	block stops before the second stop; no restore runs	R1	fake drive: exit 3 with empty stdout, `{}`, `{"snapshot":null}`, `{"snapshot":""}`, invalid JSON, zero and two container ids, `docker ps` failing, an existing target. Each must show non-zero exit, its line, and no later fake called
S4	Second `hal stop` skipped	a `hal apply` may refuse "switched off but still running"	n/a	reviewer reads H/src/hal/stack/apply.py:474-499
S5	Another backup or restore holds or waits for hal's lock	preflight B2 FAIL; in the block, a silent wait that Ctrl-C ends	preflight `ok B2` in R1	`checks` cell (Part B)
L1	Dump's user profile or console-made objects differ	`cutover:load` refuses before `db:load-dump`	R1 (acceptance only)	slice 2's fake cell in `checks` (planned)
L2	`pg_restore` fails	either "data unchanged" and Flux resumes (no session or `pg_restore` left, no materialized view or extension table, sha256 of the whole `pg_dump` equal), or "outcome unknown", Flux stays suspended with writers at 0, naming `--resume` (P/tests/postgres/load_dump.sh:212-217, 220-226, 278-284). Then `hal start keycloak`; a retry first runs `--resume`, since a suspended Kustomization is refused (load_dump.sh:158-162)	n/a	existing `checks` cells and the `cluster` part `postgres` (failed load beside a materialized view)
L3	INT or KILL during the load	INT: the loader's trap resumes and a later load verifies equal. KILL: stays suspended, a new load refuses naming `--resume`, `--resume` resumes (P/tests/postgres/interrupt_load.sh:131-150)	n/a	existing `cluster` cell
L4	Copy differs from evidence, or config-cli fails	`cutover:load` fails naming it; `hal start keycloak`	R1	slice 2's fake cell (planned)
L5	`move-group` fails midway	names `db:load-dump keycloak <file>`; old group kept	R1	reviewer reads P/mise.toml (move-group); not driven
L6	Secret `hopin` holds another key	`litellm:key` refuses in step 3, before any stop	step 3 in R1	existing P9c `cluster` cell
L7	A client secret differs from hal's	`cutover:load` fails naming the client, printing no value	R1	slice 2's fake cell (planned)
W1	C merged, Flux not converged	step 8 not run; wait or revert C	R2	CI on draft C
W2	O merged partly	no paid call until both halves land; roll forward	R2	k3d on PR O; reviewer
W3	One consumer switched, others not	both groups exist with members in both; all work	step 14	reviewer reads realm and move-group; one AI call each
W4	`--delete-old` before all consumers read the new group	blocked by step 15's precondition	journal	head checks; not machine-gated
W5	B merged before the publish `yes`	the copy could end live hopin sessions	n/a	prevented by order (step 11 after step 10); head checks; not machine-gated
W6	Emergency return with B still open	return step 1 reverts B; `ok I1` before `hal start`	R2	k3d on PR B (closed state is today's P7b cell)
P1	`hal apply` local part not clean	nothing published; rerun	R2	hal's tests
P2	Readiness guard refuses	exit 1, nothing published	R2	hal's tests; R2 cannot force it without stopping an app
P3	Publish fails or is interrupted	`hal check hosts`, rerun; converges	live only, or R2 if it happens	not driven
P4	`hal update` or apply shows more than step 8	he answers `no` at the step-9 reading	R2	reading of update.py:1-8 and apps.py:1-8; not driven
R1	Abort before the boundary	`hal start`; public key ids equal the evidence; `hal check hosts` clean; one sign-in on hal	R1	n/a
R2	Emergency return after publication	B, O and C closed and `ok I1`; guard passes after `hal start`; record back; key ids equal	R2 (with DNS drill)	n/a
R3	Return partial (`hal apply` or `hal start`)	rerun converges	live only for a real publish	hal's tests
U8	Keycloak sign-out on the platform	the hopin session ends (next request goes to login)	R2; live step 12	k3d on PR B proves reachability and a 400 for a malformed token, not session end
G1	Sign-out with a songmaker or presentator session	per decision 11. (a) The sign-out completes and the app session lasts to its own limit; its own sign-out still ends it. (b) Their session ends	R2; live	not driven
F1	First real sign-in on the platform	hal's Keycloak stays stopped; no second writer	R2; live	n/a
F2	First paid turn	blocked before O; answered and billed after	k3d (mock); live only for a real provider	k3d O
F3	Existing hopin sessions during the outage	no AI (`gateway.invalid`), no Keycloak write	live only	reviewer reads hopin.yaml:54-59
C1	Key ids and issuer continuity	public values after DNS equal the evidence	R2; live	slice 2's fake cell

The rehearsals prove only success paths: S1 to S3, L1, L4, L6, L7, R1 and R2 on real data. The failure branches come from the fake drive (S1 to S3), slice 2's cells (L1, L4, L7), the preflight cell (S5) and the existing load_dump/interrupt_load cells (L2, L3).

Cannot be proved before the live run: a real provider turn; a real person's session across the switch; the final dump's content; P3, by construction.

§3 Slices (closes finding 1's split; takes in follow-up 6)

Nine slices, four of which change code. That is not claimed to be minimal: each code slice has its own owner, review need or rollback boundary. Zone import and the VM proof are other items' plans.

#	Delivers	Needs	Files	Done when	Operator
1	`cutover:preflight` (Part B)	nothing open	Part B	Part B	no
2	`cutover:load` and `cutover:check`	1	`scripts/cutover_load.sh`, `mise.toml`, `tests/keycloak/restored_copy_keeps_its_keys_and_people.sh` (public fetch replaced by the evidence file), `tests/cutover/`, `ci.yml`, `AGENTS.md`. About 150 production lines; one exit contract and one output owner	`cutover:load` refuses a dump the gate rejects and otherwise runs load, checks and the group move without delete; `cutover:check` compares the public issuer and key ids with the evidence	no
3	The window's change set as three draft PRs	1; plan review of the logout route	see the bullets below; each PR changes the `cluster` cells and `AGENTS.md` lines that pin what it changes	all three green and held; C merged alone changes no public host and opens no egress (preflight `ok I1`)	decision 11
4	Themed Keycloak image (plan review first)	new repository; child of #4	new repo; image in `keycloak.yaml`	the image from the release path serves theme `hallucinai` and the cluster job proves it	the repo's home
5	Rehearsals (journal only), plus the step-5 fake drive	1, 2; R2 needs 3 and 4	none, or small fixes	each claim proved or named failed in the journal	his word for each stop; DNS drill
6	Live switch and cleanup	1 to 5, §6 decisions	merges of C, B and O; last commit deletes the helpers, `--compare` and `keycloak:move-group` (#116 steps 7 and 9)	§1 steps 1 to 17 done and every predecessor gone or owned	word, keys, sign-in, paid turn
7	R3 and reboot	every public route off hal	none	with all of hal stopped and after a reboot, the platform's routes answer and Keycloak and LiteLLM recover	word
8	#48 zone import	plan first; too broad for one slice	as its plan	as #48	token
9	Fresh-machine VM proof	an item must exist	as its plan	§5	word

Slice 3's PRs:

C (closed part):
- the auth tunnel line and its checksum;
- a Service hopin-backchannel in apps/hopin at a fixed ClusterIP in k3s's lower service range, beside 10.43.0.40 (P/infrastructure/litellm/egress.yaml:66-74). A new Service, because clusterIP cannot be changed on the existing one;
- Keycloak's hostAliases sending hopin.hallucinai.de to that address, so backchannel.logout.url stays as it is (P/infrastructure/keycloak/realm.yaml:328) and hopin keeps its host rule (HO/src/hopin/auth/sign_in.py:123; W/src/webauth/_origins.py:31 accepts the hostname without the port). The hostAliases roll the Keycloak pod here, before the boundary, not after it;
- if decision 11 is (a): empty backchannel.logout.url for songmaker and presentator (realm.yaml:295, 361), with skat's comment form (realm.yaml:371-372).
B (back-channel opening, merged at step 11): two NetworkPolicy rules and no pod restart:
- Keycloak's egress to the hopin pods' port 8080;
- hopin's ingress (http-from-traefik-only, P/apps/hopin/hopin.yaml:127-143) from Keycloak's labelled pods.
Its k3d cell gets hopin's 400 for a malformed token at hopin.hallucinai.de:8080 from a Keycloak-labelled Pod.

Remaining risk: a compromised Keycloak could send forwarded headers that hopin trusts, since HOPIN_TRUSTED_PROXIES is the whole pod network (hopin.yaml:62-65). The back-channel path is exempt from the rate limit anyway. Named, not built against.
O (AI opening): infrastructure/litellm/egress.yaml, hopin's gateway and group.

Alternatives weighed for the hopin route:

Change the URL to hopin.hopin.svc.cluster.local: hopin's allowed-host rule would answer 400, so it needs a hopin release.
One PR with C and B together: opens the route before the boundary (finding 1).
hostAliases in B: restarts Keycloak after go-live.

Rehearsal claims (unchanged except R2):

R1 proves hal's stop, the database-only start, the final snapshot, the load and hal's restart, and measures each step's duration, disk and evictions.
R2 proves the real hostname, the theme, the redirects, U8, B closing in the return, and the reverse publication. A sign-in during R2 is discarded, said in advance.
R3 needs every public dependency moved.
R1 and R2 are combined into one outage only if slice 3 (C, B and O drafts) and slice 4 are green and --live's L1 passes when slice 2 lands. Card D decides.

Predecessors and their exits:

hal's keycloak and litellm units: hal's exit item, after songmaker and presentator moved;
hopin's gateway.invalid and old group: PR O;
keycloak:move-group, --compare, cutover:preflight, cutover:load and cutover:check: slice 6;
P7: Postgres, Keycloak, LiteLLM and backups run on the platform, tried on the PC with copies of hal's backups #116's "Cutover order": replaced by this item.

Invariants every slice keeps:

hal's volumes are never touched;
agents run only shipped commands over dumps, print no row and run no hal command;
the copies stay off the public path and send nothing live until the boundary.

§4 is replaced by Part B.

§5 Owners of every gap (closes finding 3)

Gap	Owner	Or the item that should exist
Apex and legal routes	#173 row P9a-5; #232 and row P9a-4b before it
presentator and presentator-talk hosts	no owner (#43's R5 unruled; presentator#865 is only the worker)	"presentator serves from the platform"
Hopin's back-channel logout	P10 slice 3, PRs C and B	done when U8 holds (step 12). Today, by code reading, hal's Keycloak reaches only `hal_backchannel_hopin` (H/compose.yaml:124-128, 673-676), which the platform's hopin pod is not on, so U8 is the first proof since hopin moved (inferred, runtime not observed)
New: songmaker's and presentator's back-channel logout	decision 11	What the copy must reach: `http://songmaker.hallucinai.de:8080/…` and `http://presentator.hallucinai.de:8000/…` (P/infrastructure/keycloak/realm.yaml:295, 361). Hal reaches them because Keycloak joins `hal_backchannel_songmaker` and `hal_backchannel_presentator` (H/compose.yaml:124-128) and each app joins its own with the public host as alias (S/docker-compose.yml:116-124, 404-405; PR/compose.yaml:21-29, 152-154). Those networks are `internal` bridges with `gateway_mode_ipv4: isolated`, so the host has no address on them (H/compose.yaml:46-47, 665-681). Songmaker publishes only `127.0.0.1:8080` (S/docker-compose.yml:125-132), presentator nothing, and hal's exposure check requires loopback publications (H/docs/backup.md:38-41). The platform's Keycloak sends only to DNS and Postgres (keycloak-egress.yaml), and no pod may use the host network (`cluster` cell). So there is no path without a new non-loopback listener. Under (a), their item names the gap until each moves, and songmaker's head corrects S/docs/security.md:44
Skat and speech "egress"	#122 line 48 is stale: skat has no back-channel (realm.yaml:371-372); speech has none	fix #122's sentence; no build
Post-load credentials: hopin's key	P10 step 3	`litellm:key hopin`
Client secrets of apps on hal	P10 slice 2 digest check
Admin subgroup	ruled #116 card 2; hal's realm already holds `/services/litellm/admin` (H/keycloak/realm.yaml:68-72); slice 2 proves it; new admins #226
Agent owner and `/mcp` proof	moves to P10 step 16
First nightly expiry counts	P10 step 16
Predecessors and tool removal	P10 slice 6
Live-go item	none yet; this document	the parent item
Theme image	#4, no slice	"Keycloak's themed image"
Fresh-machine VM	no owner	"One fresh-machine VM proof"
#208; #13 P4c (recovery key, required before P10); #12 P2b to P2d; #122; #172 P8c to P8k and #165	each its own item
hopin's speech wiring	no owner	"hopin reaches the platform's speech service"
#48 zone import	#48, plan first
Hal's speech key set	no owner; decision 6
`#agent-dienst` links	extend hal#1144; hopin links it too (HO/legal/datenschutz.html:27)

Remaining fields

endGoal: Keycloak and LiteLLM live on the platform; every other public route moved; hal off, and a reboot and a fresh-machine run proven (Platform on k3s and Flux: from an empty PC to every app live, with hal archived #1's P10 row).
assumptions:
- docker start of keycloak-db does not conflict with hal's switch handling (hal's head confirms);
- "no users yet" still holds (Platform on k3s and Flux: from an empty PC to every app live, with hal archived #1);
- from step 4 to step 9 hal's head lands only step 8's commit.
unknowns:
- each load's duration;
- whether keycloak/go-live --check passes with Keycloak down;
- how Keycloak 26.8 stores the profile;
- how long hal's speech service caches keys;
- whether Keycloak's sign-out waits on a back-channel post that the policy drops; under decision 11 (a) the cleared URLs remove the question;
- whether lslocks lists a blocked flock waiter under the lock file's inode (the PC's home is on device 259:2, so the device matches; the fake cell pins the parser, R1 shows the real listing);
- VM availability.
nextPhaseReady: yes, slice 1 (Part B). It needs none of the later decisions.
blockers: none for slice 1. R1 needs hal's head's confirmation of the block and the fake drive's journal. R2 needs slices 3 and 4 and decision 11.
recommended reviewers:
- slice 1: one normal review (read-only, no material risk), plus hal's head for the reads that touch hal (H1 to H5, D1, B2);
- slice 2 and PRs B and O: material risk, first review drives §2;
- §1's block and the rollback: hal's head;
- this contract: a delta plan review on findings 1 to 5.

Part B: slice 1, `cutover:preflight`, buildable specification

Command: mise run cutover:preflight [--live] [--evidence <new file>].

It is read-only and needs no sudo.
Kubeconfig is ${KUBECONFIG:-/etc/rancher/k3s/k3s.yaml}, with the locked kubectl, flux, yq and jq, plus system git, curl, docker, systemctl --user, lslocks, df and stat.
Every network read runs under timeout 20.

Files:

scripts/cutover_preflight.sh: the one output owner;
the task in mise.toml;
tests/cutover/preflight_names_each_missing_precondition.sh;
a checks step in .github/workflows/ci.yml;
AGENTS.md: a Commands line and the cell's sentence in Layout's checks.

Size: about 250 production lines. It does not split, because one exit contract and one output owner cover all conditions, and a preflight shipped with only some conditions would exit 0 while not checking the rest. It is a cutover helper and is deleted in slice 6.

Lines:

ok <id>: <fact>
FAIL <id>: <fact>; owner <who>
UNKNOWN <id>: <why>; owner <who>
note <id>: not read here: <what>; owner <who>
last line: cutover:preflight: <a> ok, <b> FAIL, <c> UNKNOWN; evidence <file|none>

No line prints a secret, a token or a row.

Exit codes:

0: every required condition is ok.
1: at least one required condition is FAIL.
3: no FAIL, but at least one required UNKNOWN (hal's convention, H/docs/backup.md:38-41, 332).
2: usage. An unknown flag, a missing value, an existing evidence file or a missing parent directory exits 2 before any read.

A FAIL needs a fact it read. A reader that fails or answers something unreadable gives UNKNOWN, never a pass. note lines never change the exit.

Required conditions (all always, plus L1 and L2 with --live):

Id	Condition	Exact read	FAIL when	UNKNOWN when	Owner
N1	Node healthy	`kubectl get nodes -o json`, each `.status.conditions[]`	Ready ≠ True, or Memory/Disk/PIDPressure ≠ False	read fails or no node	platform
N2	Each source at its own head	`kubectl get gitrepositories.source.toolkit.fluxcd.io -A -o json`. Per object: Ready True; `.status.observedGeneration == .metadata.generation`; the commit part of `.status.artifact.revision` (text after the last `:`, as P/tests/flux/flux_reconciled_the_candidate_and_decrypted_the_dummy.sh:34-38 does with `##*@sha1:`) equals `gh api repos/<owner>/<repo>/commits/<.spec.ref.branch> --jq .sha`, owner and repo taken from `.spec.url` (`https://github.com/o/r` or `ssh://git@github.com/o/r`, optional `.git`)	not Ready, generation behind, or commits differ (names both and `.spec.interval`; rerun after it)	gh fails (e.g. no access to `platform-secrets`), URL not on github.com, ref not a branch	that repository's owner
N3	Each Kustomization applied its source	`kubectl get kustomizations.kustomize.toolkit.fluxcd.io -A -o json`: `.spec.suspend != true`; Ready True; `observedGeneration == generation`; commit part of `.status.lastAppliedRevision` equals that of its `spec.sourceRef` (GitRepository; namespace defaults to the Kustomization's) from N2's read	any of these fails, naming it	sourceRef missing from N2's read or of another kind	the layer's name
N4	This checkout is the applied commit	`git -C <root> --no-optional-locks status --porcelain` is empty, and `git -C <root> rev-parse HEAD` equals the commit part of Kustomization `flux-system`'s `lastAppliedRevision`	dirty, or another commit (names both)	git fails	platform
I1	Network policies as committed in namespaces `keycloak`, `litellm`, `hopin`	Per namespace: the Kustomization of that name gives `.spec.path`; `flux build kustomization <ns> --path <root>/<path>` renders it; its NetworkPolicies of the namespace, by name, against `kubectl -n <ns> get networkpolicies -o json`. Both sides normalised for the API server's defaults: no `policyTypes` means `Ingress`, plus `Egress` when `egress` exists; a port without protocol is `TCP`; keys sorted with `jq -S`. Also `kubectl get crd adminnetworkpolicies.policy.networking.k8s.io baselineadminnetworkpolicies.policy.networking.k8s.io` must answer NotFound	a policy missing, extra or different (names it)	N4 not ok ("cannot compare: checkout is not the applied commit"), render or read fails, or an admin-policy CRD exists	platform, the layer
I2	Tunnel serves the committed lines	`kubectl -n cloudflared get configmap cloudflared -o json` `.data["config.yaml"]` equals the one Kustomization `tunnel` renders; Deployment `cloudflared`'s template annotation `checksum/config` equals its sha256, with `.status.observedGeneration == .metadata.generation` and `updatedReplicas == replicas`. The ok line lists the hostnames and says whether `auth` is among them	a difference, naming which	N4 not ok, or read fails	platform
H1	Hal's Keycloak runs and is not switched off	`~/.local/state/edge/stopped/keycloak` absent (H/src/hal/stack/switches.py:34, barrier.py:38-44); `curl -sS --max-time 10 -H "Host: <KC_HOSTNAME host>" http://127.0.0.1:8081/realms/<realm>/.well-known/openid-configuration` answers 200 with `.issuer == <KC_HOSTNAME>/realms/<realm>`. `KC_HOSTNAME` comes from N4's render of `infrastructure/keycloak`, the realm from `realm.yaml`'s `realm:`	marker present, non-200, or another issuer	curl not runnable	hal's head
H2	Every host hal's guard will ask answers	`yq -o json` over `~/srv/hal/fleet.yaml`: each `services.*.hosts[]` with `ready` and without `tunnel`; fqdn is `name.<zone>` (`@` means the zone itself); zone is the Ingress host of `P/infrastructure/legal/legal.yaml`; target is the host's `target`, else `http://127.0.0.1:8081`; `GET <target><ready>` with that Host, 10 s, no redirect. This is the guard's own form (H/src/hal/stack/external/apply.py:328-346)	an answer outside 2xx, or refused or timed out (names fqdn and status)	fleet.yaml unreadable	hal's head
H3	Hal's admin console answers	`curl -H 'Host: localhost' http://127.0.0.1:8090/admin/`: 200, or a 3xx whose Location is under `/admin/`	any other status	curl not runnable	hal's head
H4	Public issuer and key ids equal hal's own	public `https://<KC_HOSTNAME host>/realms/<realm>/.well-known/openid-configuration` `.issuer` and the `.keys[].kid` of its `jwks_uri`, sorted, against the same two reads through 8081 with the Host header	issuer or key sets differ, or either side empty	public read fails (rerun)	hal's head
H5	Hal's checkout is clean at hal's main	`git -C ~/srv/hal --no-optional-locks status --porcelain` empty; `git -C ~/srv/hal symbolic-ref --short HEAD` is `main`; `rev-parse HEAD` equals `gh api repos/<from remote get-url origin>/commits/main --jq .sha` (the same guards `hal update` makes, H/src/hal/stack/update.py:4-6). The ok line prints the sha, which becomes the evidence's `hal-main`	dirty, another branch, or behind or ahead (names both shas; bring it level with `hal update && hal apply` before the stop)	git or gh fails	hal's head; operator
D1	Disk room for dump and load	the one container from `docker ps --all --quiet --no-trunc` with hal's three `keycloak-db` labels; `docker exec <id> psql --username=keycloak --dbname=keycloak --no-psqlrc -Atc 'select pg_database_size(current_database())'` gives S bytes; `df --block-size=1 --output=avail,pcent,target $HOME /opt/local-path-provisioner`. Needed on each filesystem: avail ≥ 3·S, or 6·S when both are one filesystem, and use below 85 % (`mise run disk`'s line). The factor is a starting constant with its reason in the script; R1's measured peak replaces it	short of room or at ≥ 85 % (names filesystem, avail, need)	not exactly one container, docker or psql fails	platform (operator frees space)
B1	No platform backup, restore or Job runs	`kubectl get backups.k8up.io,restores.k8up.io,checks.k8up.io,prunes.k8up.io,archives.k8up.io -A -o json`: `.status.started` set without `.status.finished` (P/infrastructure/k8up/crds.yaml:1189-1191); `kubectl get jobs -A -o json`: `.status.active > 0`	any such object (names kind, namespace, name)	read fails	k8up; the Job's layer
B2	No hal backup or restore runs, waits or is due	(a) `stat -c '%i %Hd:%Ld' ~/.local/state/edge/backup.lock` (absent means none held) against `lslocks --json --output PID,INODE,MAJ:MIN,BLOCKER`. This lists holders and waiters from `/proc/locks`, without root for the user's own processes, and takes nothing; `flock -n` would take the lock and is not used. (b) `systemctl --user show hal-backup.service hal-backup-restore-test.service --property=ActiveState --value`: neither `active` nor `activating`. (c) `systemctl --user show hal-backup.timer hal-backup-restore-test.timer --property=NextElapseUSecRealtime --value`, parsed with `date -d`, lies beyond now plus `OUTAGE_WINDOW` (a 4 h starting constant with its reason; R1's measured outage replaces it). An empty value means not scheduled, which is ok	an entry on the lock's inode and device (names pid, held or waiting), a unit running, or a timer inside the window (names time)	lslocks, stat or the user manager fails	hal's head
L1 (`--live`)	The theme is in the image and served	`kubectl -n keycloak port-forward --address 127.0.0.1 service/keycloak :http`, then the login request of P/tests/keycloak/realm_route_and_policies.sh:43-52 (hopin's client and its first redirect URI from `realm.yaml`): 200, the page names `/resources/<5>/login/hallucinai/`, and one stylesheet it names under that path answers 200 with `Content-Type: text/css`	another theme path, or a non-200 or non-CSS answer	forward or curl fails	#4's themed image
L2 (`--live`)	Two age recipients per rule (metadata only)	`gh api repos/<platform-secrets from N2>/contents/.sops.yaml --jq .content`, base64-decoded, `yq '.creation_rules[].age'`, split at commas: count per rule	a rule with fewer than 2	gh fails	#13

Notes (always printed, never change the exit):

Id	Not read here	Owner
pod-logs	`mise run check:pod-logs` (root's `/var/log/pods`); the head journals its exit at step 1	operator
record	where Cloudflare's `auth` record points (`hal check hosts`, needs its token)	hal's head
provider-keys	whether the real keys work (first turn, step 13)	operator
hopin-key	whether Secret `hopin` holds the imported key (`litellm:key hopin`, step 3)	platform
profile	the live user profile (slice 2's gate on the dump)	platform
hal-plan	hal's update and apply plans (step 9's readings)	operator; hal's head
recovery	whether the second age key can really be recovered offline (#13's drill; L2 is only metadata)	#13
docker-disk	Docker's own disk accounting (root)	operator
sessions	writes by real sessions	n/a

Evidence. --evidence <file> writes only that file, only when the exit is 0, with umask 077 and set -o noclobber. If the file appeared meanwhile: FAIL E1, exit 1. The content is key-value lines:

issuer <url>
kid <id>, one per line, sorted
hal-main <sha> (H5)
platform <sha> (N4)
read-at <UTC ISO time>

The checks cell tests/cutover/preflight_names_each_missing_precondition.sh. Setup:

a scratch HOME holding srv/hal, a real git repository whose origin is https://github.com/overnightworks/hal.git, never fetched;
.local/state/edge/backup.lock in it;
fakes first on PATH for kubectl, flux, gh, curl, docker, systemctl, lslocks and df. Each answers from a scenario directory and logs its argv;
MISE_DISABLE_TOOLS=kubectl,flux and KUBECONFIG=/nonexistent, so no real cluster is reached;
the fake Flux revisions carry the CI checkout's own HEAD as main@sha1:<sha>;
the cell runs before any step that writes into the tree.

Cases, as data rows:

All healthy, with --live --evidence: exit 0. Every required id is ok, every note id is note, and the evidence file is mode 600 with issuer, sorted kids and hal-main.
One FAIL scenario per condition: exit 1, that id's line starts FAIL and names its owner, no evidence file.
One UNKNOWN scenario per condition (its reader exits non-zero): exit 3, no evidence file.
FAIL plus UNKNOWN: exit 1.
An existing evidence file: exit 2, and every fake's log is empty.
Without --live: no L1 or L2 line.
N2 with main@sha1:<sha> against GitHub's <sha>: ok.
B2 with the lock held, the lock waited for (blocker set), and no lock file: FAIL, FAIL, ok.
Read-only: every logged call is a read. Allowed are only:
- kubectl get and port-forward;
- flux build;
- gh api without -X, -f or -F;
- docker ps and the one exec … psql -Atc 'select …';
- systemctl --user show;
- git status, rev-parse, symbolic-ref and remote get-url;
- curl without -X or -d.

Done when: on the PC, with hal and the platform healthy, mise run cutover:preflight --evidence <new file> exits 0 and writes the 0600 evidence file (--live names L1 and L2 with their owners until #4 and #13 land), and the checks cell proves against fakes that each required condition's FAIL exits 1 and UNKNOWN exits 3 without an evidence file, that an existing file exits 2 before any read, and that every call it makes is a read.

Part C: operator decisions that changed

When songmaker and presentator switch their AI group (narrowed). Recommendation: after the address moves. Both groups hold the same members from step 6, so no AI admission is cut off, the outage is shorter, and a return needs no new app releases. Logout is not covered by this; that is decision 11.
R1's date (one detail changed). Recommendation unchanged: outside Sunday 03:00 and the first Sunday 05:00. B2 now checks both timers and the lock against the window instead of relying on the date alone.
New: songmaker's and presentator's back-channel logout once the issuer moves. It works today only through hal's internal Docker networks, which the platform's pods cannot reach (§5). Card 5 ruled the move while they stay on hal but did not name this loss.

Recommendation: (a), accept the gap until each app runs on the platform. PR C empties the two clients' backchannel.logout.url on the platform's realm (realm.yaml:295, 361), with skat's comment form.

A Keycloak sign-out then ends their sessions only at their own limit. Songmaker's default is 7 days idle and 30 days absolute (S/src/songmaker_cli/constants.py:205-206; the deployed setting was not read). Presentator's is 12 hours (PR/src/presentator/application/identity.py:11).
Their own sign-out still ends their session.
Emptying the URLs makes the realm state what is true, and removes the unknown of a post that the policy drops.
The emergency return brings the old path back.
The gap goes on their items, and songmaker's head corrects S/docs/security.md:44.
Acceptance: the k3d cell reads both clients without a URL after config-cli; at R2, a Keycloak sign-out of a person with a songmaker session finishes at once, and songmaker's own sign-out ends it.
Reasoning: "no users yet" (Platform on k3s and Flux: from an empty PC to every app live, with hal archived #1), and the stopgap rule. Their moves replace any bridge, and nothing here is unlawful or misleading once the realm and the docs say so.

(b) A stopgap path. Each app adds a published port on the host's pod-network address; hal's exposure allow-list admits it; the platform adds hostAliases and an ipBlock egress. Acceptance would be a delegated agent signing out at Keycloak and seeing both apps' sessions end. Cost and risk:

four repositories, during hal's freeze;
a listener every pod can reach, where webauth's contract wants an internal network for the issuer alone (W/src/webauth/sign_in_routes.py:70-72);
an app that may fail to start when that address is missing at boot.

(c) Move songmaker and presentator before the issuer. This reverses card 5.

All other decisions (3 to 10) stand as in the current plan.

Not established here: Keycloak 26.8's behaviour on a dropped back-channel post (decision 11 (a) makes it moot); whether lslocks lists a blocked waiter on the PC (R1 shows it); whether hal still runs a hopin container (runtime not observed).

Third independent plan review, Codex gpt-6-astra at high, read-only, at platform 9c31775 and hal d26cec89. Verdict REVISE, the third in a row, so the loop stops (card above).

REVISE. The migration ordering is substantially repaired, but slice 1 still needs two contract corrections before building. Decision 11 and the rehearsals need not delay slice 1 once those corrections are made.

Reviewed platform 9c31775 and hal d26cec89, with the relevant consumer code. No tests, network requests, hal commands, secrets, auth files or dumps were accessed.

Earlier blocking finding	Round-3 disposition
1. Isolation and rollback boundary	Closed at plan level. C preserves closed egress; B opens the logout path only after publication. Emergency return closes B before hal restarts.
2. Step-5 failure propagation	Closed by source and Bash semantics. The promised fake drive remains outstanding.
3. Remaining consumers’ logout	Explicitly deferred to decision 11 and slice 3. No longer concealed by “nothing is cut off”; not a slice-1 blocker.
4. Preflight’s deployment and concurrency claims	Original defects closed. H5 records a baseline rather than claiming to inspect future plans. B2 observes concurrency; the operating rule supplies continuing exclusion. Part B introduces the comparison gap below.
5. Incorrect matrix proofs	Original claims corrected, with remaining proof details owned by slice 5. The new slice-1 `checks` specification has a separate defect below.

Blocking — I1 does not define the comparison that permits a healthy cluster to pass.

Part B specifies comparison of rendered NetworkPolicies with API objects, followed by default normalization and jq -S. That does not remove API-owned metadata such as UID, resource version, creation timestamp and managed fields. The committed policy contains only its declared metadata and specification: keycloak-egress.yaml:3.

Comparing the objects with only the listed transformations reports differences on a healthy PC. Comparing only selected fields requires the builder to supply the missing comparison contract.

Specify that policies are indexed by namespace/name and compared by normalized .spec, with an explicit rule for any declared metadata that must also match. Include a healthy fake API object containing ordinary server metadata. Keep missing and additional policy names as failures.

This matters because I1 is both a readiness condition and the emergency return’s evidence that the copy is closed.
Blocking — the proposed checks cell cannot establish its promised read-only execution evidence as written.

Three concrete gaps remain:
- Tool interception: the configured tool is flux2, and gh is also managed by mise (mise.toml:8). Disabling only kubectl,flux does not establish that the fake Flux and GitHub commands remain first when invoking the task through mise. The existing fake test explicitly addresses mise’s PATH precedence and disables flux2: failed_write_names_what_is_done.sh:105. Specify either direct script execution with the fake PATH, or the complete disabling setup, and assert resolution of every intercepted executable before running.
- Incomplete observation: git is real and has no logging wrapper, yet case 9 claims to check its calls. A wrapper can log and validate arguments, then delegate allowed reads to real git.
- The stated HTTP restrictions admit writes: curl --request POST satisfies “without -X or -d”; gh api --method POST satisfies “without -X, -f or -F”. Conversely, L1’s referenced GET legitimately uses data options together with --get: realm_route_and_policies.sh:45. Validate the effective method and permitted endpoints/arguments, rather than absence of a few short options.
Otherwise the cell can pass without observing every external call, or certify a write as a read. That contradicts its Done when.
Follow-up — slice 5 must test the actual jq filter and qualify the interrupt scenario.

The step-5 block itself is sound for the named cases:
- The subshell follows the final &&; its set -e is effective.
- A failed standalone assignment from docker ps stops the subshell.
- The anchored, unquoted regex rejects empty output and two newline-separated IDs.
- The jq filter produces no result for {}, null or an empty snapshot string; --exit-status rejects that. Its failure is explicitly handled before the second stop.
- Hal’s successful JSON output has the assumed shape: cli.py:72.
However, a fake jq that supplies predetermined answers proves shell propagation, not parsing. Run these JSON cases through real jq, or make its logging wrapper delegate to real jq.

Also qualify L3 as interruption while blocked inside the restore transaction. That is what interrupt_load.sh:121 arranges. An interrupt after commit can correctly leave the outcome unknown: load_dump.sh:286. Settle both details before R1; neither blocks slice 1.
Follow-up — decision 11 and slice 3 should state the logout loss more precisely.

The stated lifetime bounds are supported by the actual configuration consumers: Songmaker app_context.py:59 and Presentator main.py:421.

Use: “Keycloak logout no longer invalidates these local sessions. They remain usable until their own expiry or local logout. Local logout ends the current session; other devices’ sessions remain.”

That distinguishes local logout, which deletes the cookie’s session (oidc_login.py:239), from back-channel logout, which deletes every session for the subject (oidc_login.py:470). Decision 11 still requires the operator’s ruling before C is finalized.

B2’s chosen observation mechanism is reasonable: hal acquires an ordinary exclusive flock (host.py:73), and the installed lslocks manual documents waiting locks and BLOCKER. Neither stat nor lslocks acquires that lock. Actual holder/waiter visibility and permissions on this PC remain not verified, not blocking findings. Retain the real-listing proof before R1.

Verification consisted of rg, nl -ba, sed, local manual reads through zcat, git rev-parse HEAD, git status --short, and git diff --stat 0d2acdb..9c31775. Runtime behavior, current external routing and board state were not verified.

VERDICT: REVISE

For the cutover's legal step: when Keycloak goes live from the platform, the sentence hal#1177 adds to the shared section #sprachdienst (name and e-mail in the speech service's token) leaves platform's copied section, because #240 takes those claims out of every access token. The removal is wording the operator rules at that point; #240 holds the details.

Plan review of slice 3 (the logout route), at b88a74d. Verdict: REVISE. Independent reviewer, Opus high; hopin, webauth, songmaker and hal read only through gh api. Prefixes as in the plan.

The cut and the order are sound: the problem still exists, C alone changes no host mapping and opens no path, all three PRs can be proven in cluster without the live store, and B only after the boundary holds (W oidc_login.py:444-485).

Blocking

B1. The reason for rejecting the simpler route is false (plan lines 211, 223). HO sign_in.py:123 only fills allowed_hosts_exact, webauth's Origin check (W _origins.py:17-31); hopin exempts the back-channel from it (HO app.py:190) and passes no backchannel_dependencies (HO sign_in.py:142-154); no TrustedHost in hopin or webauth. The strict Host rule is songmaker's (S docs/security.md:44). So http://hopin.hopin.svc.cluster.local:8080/… should answer without a hopin release. Remedy: re-weigh on the true facts.
B2. The proof of decision 11 (a) cannot see the realm that matters (lines 212, 410). cluster runs on an empty database; the loaded dump holds the URLs. Whether config-cli 6.5.1 and Keycloak clear an attribute the file omits is not verified. Remedy: name the exact representation and prove it on a realm that already holds the URL, or on the loaded copy in step 7.
B3. Line 199 orders AGENTS.md changes in each PR, against the operator's word (platform carries the fleet document set: AGENTS.md within its budget, an architecture overview and runbooks #134, comment 6738858275). Remedy: each PR reports the sentences it falsifies on platform carries the fleet document set: AGENTS.md within its budget, an architecture overview and runbooks #134: at least keycloak-egress's "only DNS and Postgres", the P7b cell sentence on hopin's Service, and hopin's "admits only namespace traefik".
B4. Decision 11 (a) has no owner for its exit (line 409). P8: songmaker runs on the platform with its GPU and model volumes #172's rows P8f and P8k name no back-channel, and presentator's move has no item (line 251). Remedy: a clause on P8: songmaker runs on the platform with its GPU and model volumes #172 and presentator's item, before the card goes out.

Follow-up

F1. Webauth's host duty says the issuer reaches the route over an internal network alone (W docs/host-contract.md:812-813), but hopin's Ingress / exposes the path (hopin.yaml:114-123). Pre-existing; the signature remains the control. B names it as remaining risk or adds the deny.
F2. B breaks tests/keycloak/realm_route_and_policies.sh:118-120,179, as ci.yml:399 points it at hopin. The brief names the replacement caller.
F3. Only if hostAliases stays: a new file, and a check reading both owners of the IP.
F4. A separate NetworkPolicy instead of editing http-from-traefik-only (hopin.yaml:62-63,125). Step 11's "I1 lists B's two rules" overclaims: I1 prints policy names.
F5. Line 282's "cleared URLs remove the question" does not cover hopin between C and B.
F6. Stale citations: realm.yaml 295, 328, 361 and 371 are now 504, 537, 570 and 584.
F7. PR O's brief names the cell it flips (front_key_check_routing_and_closed_egress.sh).

Decision 11 today: stands in substance. Songmaker runs on the platform but unrouted, so it receives nothing either way. (c) cannot be done today: #172's P8f waits for this live go, and presentator has no owner. "No users yet" (#1) is what (a) rests on; the operator confirms it on the card.

Slice 3, revised on the review above (the head's technical decisions; decision 11 stays the operator's).

B1, the route. Hopin's backchannel.logout.url becomes http://hopin.hopin.svc.cluster.local:8080/auth/backchannel-logout. No new Service, fixed ClusterIP or hostAliases is built. Weighed: hostAliases with a fixed ClusterIP keeps the URL, but adds a Service, rolls Keycloak and puts one address into two Kustomizations that then need a check reading both owners; its stated reason (hopin's host rule) is false, and its only remaining reason, songmaker's strict Host rule, has no caller until songmaker moves and is solved with that move. The realm line goes into PR C: it sends nothing while the egress policy drops the post, so config-cli runs once for C and B stays two policy rules that a revert alone closes. B's cell gets hopin's 400 for a malformed token at that URL from Keycloak's own container. Any other answer stops the lane.
B2, decision 11 (a) if ruled. realm.yaml states backchannel.logout.url: "" for songmaker and presentator, with skat's comment form beside it. A cluster cell sets the URL on both clients through the admin API on the running realm, re-runs the Job and reads the attribute gone; step 7 reads both clients' attribute on the loaded copy. If config-cli 6.5.1 keeps it, the lane stops and reports.
B3. No PR of slice 3 edits AGENTS.md. Each names on platform carries the fleet document set: AGENTS.md within its budget, an architecture overview and runbooks #134 the sentences it makes false, at least the three the review lists.
B4. P8: songmaker runs on the platform with its GPU and model volumes #172's P8k gains the clause that songmaker's live go restores its URL, the path and the policy rules; an item "presentator serves from the platform" is opened with the same clause, before the card goes out.
F2. The brief replaces the probe at tests/keycloak/realm_route_and_policies.sh, as it says, with one driven from Keycloak's own container. F3 is moot. F4. B adds a separate NetworkPolicy and says I1 prints its name. F5. R2 measures whether a Keycloak sign-out waits on hopin's dropped post between C and B. F6. The brief finds the realm lines by text. F7. PR O's brief names the cell it flips. F1 is named as remaining risk on slice 3's item: the signature stays the control.

Delta re-check of the revision above: B1 to B4 hold, nothing new blocks. Nothing depends on hopin's old URL (hal's realm is its own, the emergency return restarts hal on its untouched database, I1 compares only NetworkPolicies, and cutover:load's gate runs before C). Not verified: whether Keycloak 26.8 deletes the attribute on an empty value or stores ""; the cell and step 7 decide it.

For slice 3's build briefs (follow-ups):

N1. The cell asserts the URL is present after the admin-API write and before the re-run.
N2. "Gone" means the key is absent, so a stored "" also stops the lane. If create stores "" and update removes it, the "second run changes nothing" cell (realm_route_and_policies.sh:54-76) goes red on C.
N3. Step 7 also reads hopin's new URL on the loaded copy.
N4. reach only opens a TCP connection (realm_route_and_policies.sh:158-176). B's 400 needs a real HTTP POST from that container.
N5. Closing B relies on prune: true on Kustomization hopin; I1 catches an extra policy, so the return's ok I1 guards it.

For the fresh-machine VM proof (slice 9), from #285's gate: a user-<uid>.journal that stops being written is rotated by nobody once hal's daily --rotate is gone (journald-manager.c:741-763), so it can outlive the 29-day bound. #285's body lists the cell; P11 decides whether the platform takes the rotate over.

Keycloak's pods may post a back-channel logout to hopin's and songmak…

Live switch, 11./12.11.2026 (steps 4 to 11):

Preflight --live at main e70143e: 15 ok, 0 FAIL, 0 UNKNOWN; evidence written.
Step 5 (operator): switch stop at 2026-11-11T22:32:01Z; snapshot 46141216dc78…0bf8 restored to ~/p7-cutover/keycloak; hal's Keycloak switched off and staying off.
Step 6 cutover:load: 22:32:55Z to 22:34:07Z, exit 0: converged, config-cli after 1 failed attempt, the copy kept issuer, key ids, people, memberships, client secrets and back-channel URLs; 1 member moved to /services/litellm.
Step 8: hal main 22c8d99 (hal#1227). Step 9 (operator) hal update && hal apply: keycloak stays stopped switched off since 11.11. 23:32, litellm-admin rows held, publish plan of exactly two changes (the auth record to the platform's tunnel, auth's line out of hal's ingress), Apply complete! 0 added, 2 changed, 0 destroyed. The same run updated presentator to v2026.11.11.2 and speech to v2026.11.11.1 on hal.
Step 10 cutover:check at 00:07:11Z: exit 0, issuer and both key ids equal the evidence; public discovery 200, / redirects to the account page, /admin/ and /realms/master/ 404. Two earlier checks (23:54Z, 00:06Z) read 404 because the publish had not finished.
Outage of the public sign-in: 22:32:01Z to about 00:07Z, about 95 minutes, most of it waiting for hal's lane and the operator's apply.
Step 11: PR Keycloak's pods may post a back-channel logout to hopin's and songmaker's web #467 landed as c19ede5; keycloak, hopin and songmaker applied it; cutover:preflight prints ok I1 with keycloak/keycloak-backchannel, hopin/backchannel-from-keycloak and songmaker/backchannel-from-keycloak. Its rows H1, H3, H4 FAIL and D1 UNKNOWN now by design: hal's Keycloak is off.

Open: step 12 (the operator's first sign-in, theme, skat's data, sign-out ending hopin's and songmaker's sessions); step 13 (LiteLLM restart, PR #445 after its merge of main, first paid turn, #134's wording); ~/p7-cutover holds the plaintext dump until the operator deletes it after step 12.

The platform's AI path opens to its two providers and hopin calls the…

Step 13, platform side, 12.11.2026: PR #445 landed as 1146b59 (tip 85781dd: the merge of main after #467, one conflict hunk in apps/hopin/hopin.yaml resolved keeping both sides, delta re-checked by review and gate, CI green). Flux applied litellm and hopin; kubectl -n litellm rollout restart deployment/litellm rolled out at 00:30Z, so LiteLLM runs with the provider keys of platform-secrets#53; hopin rolled out with the front as its gateway; litellm, litellm-front and agent-egress 1/1; litellm:keys --plan exit 0, 0 changes. Open: the operator's first paid turn in hopin and songmaker and its spend row; step 12's sign-in and sign-out readings; docs/personal-data.md PD-6 is false since this landing (#134); songmaker's AGENT__API_GROUP and 2026.11.11.2 are #470.

Steps 12 and 13, the operator's readings, 12.11.2026 in chat with platform's head, after being asked for five tests (sign-in at auth with the hallucinai theme and the account page; skat shows his data; a game-master turn in hopin; songmaker's co-writer; a sign-out at auth ending hopin's and songmaker's sessions): „jo geht alles“. litellm:keys --plan afterwards: 0 changes. Not read by an agent: the spend rows of the two turns, and the theme at both widths by a driven browser.

The Keycloak cutover (steps 1 to 13) is through: the public issuer, hopin, skat, songmaker and speech run on the platform; hal's Keycloak stays switched off. Open on this item: the operator deletes ~/p7-cutover; step 14 (songmaker's group, with #470) and step 15 (keycloak:move-group --delete-old); presentator's move (#322); steps 16 and 17 (hal stops, on his word).

The realm declares agent-leonardo and lets both agent clients into sk…

Operator, platform chat 12.11.2026 (night), verbatim: „allen sagen! sie sollen autonom weiterarbeiten so gut sie können bis morgen früh! einfache entscheidungen selbst treffen! imzweifel sollten sie jmd 2twen fragen (opus xhigh) oder fable (high). und ansosnten warten! immer die beste langfristige läsung bei architekturne, sollten sie eigentlcih wissen. alles von mir freigegeben was llm budget oder sonst was bedarf! einfach mache! releasese genauso! wir haben keine nutzer! d.h. es soll voran gehen! im sinne des porduct owners arbeiten! er will ein logisches super produkt maintainable! udn er will das es weitergeht! also abarbeiten!“ and before it: „morgen wird geskatet live auf der plattform! du bist dabei! also nachtschicht!“. Relayed to every reachable head. Under it the platform head lands songmaker 2026.11.11.2 (PR 471, additive migration) without a further yes. Landed this night: the personas runner (PR 473, 0e2f9bf).

Operator, platform chat 12.11.2026 (night), verbatim: „und geheimnisse darft du auch holen wenn du weißt wo sie liegen! nicht lesen aber holen oder erzeugen! wenn was schief geht morgen den head melden! geheimnisse naütrlcih nru für hier und unsere plattform1 du hast mein GO!“ Read as: an agent may fetch a secret from where it lies (his disk, the encrypted repository) or generate one, piped unseen into its target, for the platform only; it still never prints or reads a value.

Operator, platform chat 12.11.2026 (night), verbatim: „also du musst alleine handeln bis morgen früh. ich bin nicht da. du darfst entscheidungen treffen auch wenn sie falsch sind, dann machen wir sie morgen rückgängig im zweifel!“

Operator, platform chat 12.11.2026 (night), verbatim: „und mit dir mein dich dich als platform so wie die anderen heads ! du hast das sagen im zweifel!“

songmaker runs its release 2026.11.11.2 and its back-channel no longe…

Operator, platform chat 12.11.2026 (night), verbatim, answering the head's note that skat's and personas' heads do not take a relay as his release approval and that skat's head was asking him directly: „=> hier schon das erste => cih bin nicht da ! du entscheidest in meiner abwensenheit!“ Decision of the platform head under it and under „du hast das sagen im zweifel!“: skat releases tonight once skat#315 is through its checks, and personas may release what the first Skat game needs; both stay their heads' to carry out under their own contracts.

presentator's web reads the AI group /services/litellm (#483)

Night shift of 12.11.2026, state for the next head (this session's context is very large; a fresh head should take over at the operator's next word).

Landed tonight, each verified on the PC: personas runner 0e2f9bf (+ platform-secrets 52dc663, litellm:key personas, owner felix on both agents), songmaker 2026.11.11.2 40dc09b, presentator wiring 83e8457, presentator 2026.11.12.1 with its privacy text 92bf98c, tunnel lines cab6f9d, presentator's AI group 3c7da4f, the runner's 15-tool skat binding f9021a8, backup:now 8d3fd11. No lane is open; no claim is held.

Waiting on the operator, in order: (1) skat's release: his „ja, veröffentlichen“ in skat's session or cd /home/felix-hummert/git/skat && gh workflow run release.yml -f version=2026.11.13.1; skat's head holds it and declined a start from this session; then the pin here (compare the runner's 15 tools with the release's tools/list; migrations 0028 to 0030/31 on an empty skat database). (2) The card on #277: the wording about our own agents on the privacy page; the assessment there is that a game with other people waits for it. (3) presentator's go, plan on #322 (comment 6815710439), hal#1228 held by hal's head. (4) litellm:key presentator refused: another value holds the alias. (5) Whether agents may give up, stand up, end a series, open a table or save rules.

Waiting on peers: presentator's release with a back-channel route under its Service Host (then #322's slice 11); step 15 (keycloak:move-group --delete-old) after presentator's go. PR 446 (Cloudflare provider patch) waits for its release to be seven days old.

skat runs at 2026.11.13.1, the runner binds its whole tool list and t…

Navigation Menu

Repository navigation

P10: hal's public services move onto the platform and hal stops #235

Caller

Plan

Predecessors

Part A: changed sections (each complete)

§1 The contract of the live switch (closes findings 1, 2, 4 and partly 3)

§2 Scenario matrix (closes finding 5; adds cells for findings 1 to 4)

§3 Slices (closes finding 1's split; takes in follow-up 6)

§4 is replaced by Part B.

§5 Owners of every gap (closes finding 3)

Remaining fields

Part B: slice 1, `cutover:preflight`, buildable specification

Part C: operator decisions that changed

60 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

P10: hal's public services move onto the platform and hal stops #235

Description

Caller

Plan

Predecessors

Activity

FlexOr2 commented on Nov 9, 2026

Part A: changed sections (each complete)

§1 The contract of the live switch (closes findings 1, 2, 4 and partly 3)

§2 Scenario matrix (closes finding 5; adds cells for findings 1 to 4)

§3 Slices (closes finding 1's split; takes in follow-up 6)

§4 is replaced by Part B.

§5 Owners of every gap (closes finding 3)

Remaining fields

Part B: slice 1, cutover:preflight, buildable specification

Part C: operator decisions that changed

FlexOr2 commented on Nov 9, 2026

FlexOr2 commented on Nov 9, 2026

FlexOr2 commented on Nov 9, 2026

FlexOr2 commented on Nov 9, 2026

FlexOr2 commented on Nov 9, 2026

FlexOr2 commented on Nov 9, 2026

60 remaining items

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

FlexOr2 commented on Nov 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Part B: slice 1, `cutover:preflight`, buildable specification