From 834fec17c5b49cd2beb7e31ad1ae372bad7139f4 Mon Sep 17 00:00:00 2001 From: jenkins Date: Mon, 24 Aug 2026 14:41:17 -0300 Subject: [PATCH] docs(hux): record build-24 fleet-live, cluster read, worker staging Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf --- docs/hux/HANDOFF.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/docs/hux/HANDOFF.md b/docs/hux/HANDOFF.md index 7b0ba813..1903b8ac 100644 --- a/docs/hux/HANDOFF.md +++ b/docs/hux/HANDOFF.md @@ -506,3 +506,37 @@ Definitive remaining list: HUX-12 Vault key + scope ConfigMap (operator runbook above); approvals-UX inline prompts then re-enforcement via canary; Worker (worker.bstein.dev) integration as its own lane; titan-iac main CI baseline confirmation post node-skip hardening. + + +## Build 24 fleet-live + cluster read + worker staged (2026-08-24 ~16:xx UTC) + +Build 24 (d041f1d1 -> sha256:1ea5b4ad, promote 04f060db) on all four +tenants + the worker agent. Fleet verify 34/34 meaningful (enforcement +observe-only by design; Flux Ready=True after reconcile). Worker gates 6/6 +with identity PERSISTED across two rolls (hashes 7fa1c7d3/532b9745 unchanged) +and the auth matrix exact (unauth/badkey/wrongslot 401, worker caps=HUX-11). + +Shipped this cycle: +- Voice round 3: caption body-only extraction, dynamic endpointing, both + captions touch-scrollable, errors never spoken + resyncCapture, workspace + toggle in the sidebar rail, the false 'session unavailable' toast (409 from + a fail-closed profile-alias race - fixed at the cause), barge cut-point + marker, full language routing, speaking<->thinking cycling. +- Approvals UX: inline pending-approval dock above the composer; the default + grant matrix now asks (not denies) for network/web_search below autonomous, + SO-39 intact. Re-enforcement checklist items 1+2 done code-side. +- cluster_read: read-only Kubernetes visibility LIVE and verified in-chat + (pods/nodes/flux read; secrets refused; RBAC excludes Secrets). Required a + tenant egress fix to the real apiserver endpoints (192.168.22.11-13:6443, + which the except-block dropped post-DNAT) and a large-node-listing handler + hardening (ed0bc30d). +- Worker staged inert-HUX (foundation only, enforcement 0) - activation is a + reviewed one-line flip per WORKER-PLAN.md. + +Transient registry 404 during tenant-3's pull recurred (3rd time; VIP/registry +flake class) and self-cleared - worth a registry-reliability follow-up. + +Remaining: HUX-12 Vault key (operator); re-enforcement canary (approvals UX +now exists - operator tries the prompts, then canary re-enable per checklist); +worker HUX activation flip (WORKER-PLAN TODO 2); cluster_read handler +hardening activates on the next pod roll.