Fix deploy-web JMAP SRV; record KSE-0181 residencies + KSE-0182 OpenBao #1

Merged

founder merged 2 commits from codex/session-forge-fixes-jmap-srv into main

2026-07-18 07:47:37 +00:00

founder commented

2026-07-18 05:28:08 +00:00

Owner

Session: forge fixes

Operational fix (urgent): deploy-web has failed on every main push since the inbox→mail JMAP cutover (last green 2026-06-14). It set _jmap._tcp.key.store SRV to inbox.key.store, then ran lately-discovery-smoke which expects mail.key.store. Fixed both the SRV update and the second smoke invocation. The live SRV record was already corrected out-of-band, so this makes the fix durable. deploy-api was green throughout and needs nothing.

Governance:

KSE-0181 — persistent per-identity Codex residencies on Namespace (per-identity WIF, July 2026 Windows cache volumes + macOS application requests).
KSE-0182 — OpenBao is the forward secrets runtime (KSE-0175 withdrawal was Proxmox-only), sealed with Google Cloud KMS on the KSE-0172 identity plane. KSE-0175 gets a scope-clarification note.

Config: NSC_CACHE_VOLUMES wired into the three Windows autoscaler targets + Windows workspace note updated. Windows specs activate once the forgejo-nsc pin carries drive-letter-safe cache-volume parsing (companion change, already implemented + tested in the external repo).

🤖 Generated with Claude Code

## Session: forge fixes **Operational fix (urgent):** deploy-web has failed on every main push since the inbox→mail JMAP cutover (last green 2026-06-14). It set `_jmap._tcp.key.store` SRV to `inbox.key.store`, then ran `lately-discovery-smoke` which expects `mail.key.store`. Fixed both the SRV update and the second smoke invocation. The live SRV record was already corrected out-of-band, so this makes the fix durable. deploy-api was green throughout and needs nothing. **Governance:** - **KSE-0181** — persistent per-identity Codex residencies on Namespace (per-identity WIF, July 2026 Windows cache volumes + macOS application requests). - **KSE-0182** — OpenBao is the forward secrets runtime (KSE-0175 withdrawal was Proxmox-only), sealed with Google Cloud KMS on the KSE-0172 identity plane. KSE-0175 gets a scope-clarification note. **Config:** `NSC_CACHE_VOLUMES` wired into the three Windows autoscaler targets + Windows workspace note updated. Windows specs activate once the `forgejo-nsc` pin carries drive-letter-safe cache-volume parsing (companion change, already implemented + tested in the external repo). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

founder added 2 commits

2026-07-18 05:28:08 +00:00

deploy-web: point key.store JMAP SRV at mail.key.store 364e78b4a7

The inbox->mail JMAP cutover moved the live discovery document and SRV
target to mail.key.store, but deploy-web still set _jmap._tcp.key.store
to inbox.key.store and then ran lately-discovery-smoke, which expects
mail.key.store. That mismatch has failed Deploy: Web on every main push
since the cutover (last green 2026-06-14). Point both the SRV update and
the second smoke invocation at mail.key.store.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

evolution: record Namespace residencies (KSE-0181) and OpenBao revival (KSE-0182)

Release: If Needed / Check (Release Needed) (push) Successful in 5s

Details

Namespace: Build Images / Refresh macOS runner lane (push) Successful in 6s

Details

Namespace: Build Images / Refresh Linux runner image (push) Failing after 13s

Details

Deploy: API / Deploy (API) (push) Successful in 4m7s

Details

Deploy: Web / Deploy (Web) (push) Successful in 6m26s

Details

8a2874f73f

KSE-0181 anchors persistent per-identity Codex residencies on Namespace
with per-identity WIF, adopting the July 2026 Windows cache volumes and
macOS application requests. KSE-0182 records the founder decision that
OpenBao is the forward secrets runtime (the KSE-0175 withdrawal was
Proxmox-only) sealed with Google Cloud KMS on the KSE-0172 identity plane;
KSE-0175 gains a scope-clarification note.

Wire NSC_CACHE_VOLUMES into the three Windows autoscaler targets and
update the Windows workspace note now that Namespace shipped Windows
cache volumes. The Windows specs activate once the forgejo-nsc pin
carries drive-letter-safe cache-volume parsing (companion change).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>