P3-001 Control Tower, Orca, Codex And Request-Channel Current-State Review

• Classification: RESEARCH-INPUT / MERGED CURRENT-STATE REVIEW
• Captured: 2026-08-03 Asia/Ho_Chi_Minh
• Owner: P3-001
• Audience: P3-002~P3-006 reviewers, CTC and Control Tower maintainers
• Source revisions: CTC origin/qa@d7e161e852948472f69b25ef475df7fa58d4ceec; Control Tower origin/main@7954f6b2786efb3a77dc2bc3afd7f767f9824838; Hub Control Tower checkout 239ca7503350d943278a5d5b440a6847d726705d; Hub CTC checkout 3148e0c4730870111d205ecf57a290ce6f5fbf38
• Environment: Local Mac checkout/read-only DB; Hub KYLE-MINT service, filesystem, SQLite, CTC MySQL and loopback HTTP read-only inspection
• Method: current source and owning-document trace; exact Git/ref comparison; read-only service/config/DB/filesystem inspection; authenticated retirement-route probes
• Limitations: no browser login, Codex action, Orca launch/pairing, service start/restart, config publish, deployment action, DB write, provider/device effect, firewall proof or Production field acceptance
• Mutation summary: no service, config, DB, provider or deployment mutation; repository change is this review and the P3-001 progress reference only
• Retention/removal condition: retain as P3-002~P3-004 decision input until its facts are superseded by newer dated evidence and the decisions link the replacement

1. Outcome

Control Tower is an active Hub operational control plane, not a generic Request Registry. Codex Portal is an enabled maintenance surface, CTC-only Orca is an enabled access surface, and the retired Task/Program/Feature/session-binding families are fail-closed at runtime. No inspected source, SQLite state, CTC MySQL table or Markdown file implements a generic cross-channel Request envelope, registry or lifecycle.

Four current gaps must enter P3 decisions rather than being hidden by that retirement success:

1. Control Tower SQLite and CTC MySQL both persist deployment/tenant/mapping registries, but their deployment and mapping identifiers differ.
2. The Control Tower SQLite file and parent data/state directories are broader than the accepted 0600 file / 0700 directory contract.
3. CTC-only Orca is fixed to the CTC checkout, but its effective service identity is the shared kyle account, its listener is non-loopback, and cross-project read isolation is not proven.
4. The browser/API pairing endpoint still returns pairing material and has one historical audited use despite the locked design saying pairing material stays outside Control Tower.

This Task does not choose a Request store or repair those gaps. They are bounded decision and maintenance inputs for P3-002~P3-004.

2. Deliverable identity

Deliverable	Owner / audience	Source revision and environment	Downstream consumer
Cross-repo current-state map	P3-001 / CTC and Control Tower reviewers	four refs in the header; Local Mac + Hub RO	P3-002 authority matrix, P4-005 topology
Retired/current surface inventory	P3-001 / Control Tower maintainer	Control Tower current source + Hub HTTP/SQLite/config	P3-002 boundary and bounded residual cleanup
Request-channel and identifier map	P3-001 / P3 contract writers	CTC policy/source + Control Tower Codex/Orca/incident source and state	P3-003 envelope, P3-005 adapters
Unknown and Local evidence list	P3-001 / user and acceptance reviewers	Local/Hub dated RO observations	P3-002, P3-004 and P3-006 entry/acceptance

3. Cross-repository current-state map

Surface	Current authority and persistence	Current evidence	Explicit non-authority / risk
CTC repository	Product, Roadmap/Phase Task, Runtime/module/process contracts and Control Tower consumption boundary	origin/qa@d7e161e; Control Tower helper requires three registry tables and defines no Request entity	no generic Request store; current unrelated dirty work is preserved
CTC Runtime	local-first business execution and local DB state	Local .env DB is reachable read-only; Hub CTC DB is reachable and has the three Control Tower tables	no request-time Control Tower lookup; Local Mac service was not running
Control Tower repository	operational registry/config/observation/access/audit/deployment source	origin/main@7954f6b; executable source is identical to deployed 239ca75 because the later diff is Graphify/instruction-only	no CTC Phase/Task or business-row authority
Hub Control Tower service	loopback static/API server at 127.0.0.1:8090; SQLite operational state	active/running, entrypoint scripts/ctc-control-tower-static-server-with-ctc-orca.mjs; unit is currently disabled rather than enabled	restart/boot continuity is not proven; no service mutation was performed
Control Tower SQLite	projects, deployment/tenant registry, config drafts/snapshots, health/smoke, Codex ownership/attachments/audit and incidents	integrity ok; schema versions 1,2; one state row; task-write journal 0 rows	not a generic Request store; registry conflicts with CTC MySQL identifiers
CTC MySQL Control Tower tables	CTC-side deployment, global tenant and deployment mapping compatibility registry	Hub active counts: deployments 3, tenants 2, mappings 4	currently configured to the same prod DB as Runtime, not a separately proven canonical registry
Codex Portal	maintenance session/transcript/attachment source with ownership/access/audit	enabled; owner rows 130 (8 active, 122 archive), attachment links 162, Codex audit rows capped at 250	session ID is not Request ID; no Task mapping/lifecycle authority
CTC-only Orca	fixed CTC workspace access and sanitized launch/pairing audit	service active/enabled on 0.0.0.0:6769; Control Tower flag enabled and private entry configured; audit 23 rows	no generic project gateway or Request handoff; identity/isolation/pairing gaps below
Monitoring/incident	tenant/monitor/probe-specific correlation and domain idempotency	incident and incident-event rows are currently 0	not generic Request dedup or lifecycle

3.1 Registry mismatch

The two persisted registries have equal active counts but not equal identities.

Store	Deployment IDs	Tenant codes	Active mapping keys
Control Tower SQLite	control-tower-hub, ctc-prod-dedicated, qa-control-plane	ctc, mk	CTC/MK to qa-control-plane; both tenants to ctc-prod-dedicated
CTC MySQL	ctc-prod-dedicated, mk-prod-multitenant, qa-shared	ctc, mk	CTC to dedicated/qa-shared; MK to multitenant/qa-shared

Matching counts do not prove reconciliation. P3-002 must assign one identity owner and an explicit desired/effective/applied reconciliation boundary before Request routing metadata references a deployment ID.

4. Current, maintenance, retired and residual surfaces

Class	Surface	Evidence and interpretation
CURRENT_OPERATIONAL	deployment/tenant/mapping registry; runtime config drafts/snapshots/release actions; runtime tenant module/config access; health, smoke, logs, API catalog, DB inspection, audit/activity	current API/source and persisted state; effect routes were not executed
CURRENT_OPERATIONAL	deployment refresh-health, deploy-dry-run, reboot, run-tests	active source accepts these bounded actions; this review did not invoke them
CURRENT_DOMAIN	monitoring incident/canary/Telegram correlation	current source, currently zero incident rows; domain-specific only
MAINTENANCE_ONLY	Codex Portal	enabled and populated; session/attachment/audit evidence only
MAINTENANCE_WITH_OPEN_BOUNDARY	CTC-only Orca	enabled and active; fixed repository/base ref and sanitized audit, but pairing/isolation remain unresolved
RETIRED_ENFORCED	/work-items, /agent/work-items, /task-projects, /programs, /features, /session-bindings	unauthenticated request returned 401; loopback authenticated requests returned 410 LEGACY_TASK_SURFACE_REMOVED for all six families
RETIRED_ENFORCED	task-coupled deploy-apply and project/task mutation	current route guard returns 410 LEGACY_DEVELOPMENT_MUTATION_RETIRED; source-only proof, not invoked
RESIDUAL_SOURCE	WorkItem/Program/Feature types and helpers, no-op enrichCodexSessionWithWorkItem, downstream deploy-apply implementation, Task handoff helpers	unreachable or compatibility code does not restore authority
RESIDUAL_SCHEMA/METADATA	control_plane_task_write_journal; taskArchiveEnabled=true / read-only bootstrap fields	table exists with 0 rows; retired state keys are absent from the persisted payload; no archive route/UI is active
STALE_EVIDENCE	config snapshots/drafts and some activity data	latest config snapshot 2026-06-19, activity 2026-07-06; these are persisted records, not current environment proof
DOC_DRIFT	docs/control-tower-codex-access-model.md admits admin2; README/source/effective hash set admit only superadmin, admin, jaylee	source and effective config win for current behavior; document needs a separately owned correction
DOC_DRIFT	CTC REQUEST_OPERATIONS.md header says local uncommitted although it is present in committed qa	policy content remains aligned; lifecycle metadata is stale

5. Request-channel and identifier map

Channel	Existing identifier / persistence	What it proves	Missing generic Request contract
Direct developer/user	Codex task/thread/session reference plus repository SHA/diff/evidence	source conversation and bounded repository work	no cross-channel Request ID, lifecycle or dedup
Codex Portal	projectKey + sessionId + source(active/archive); Codex JSONL, owner rows, attachment hash/link and audit requestId	durable source-session evidence and action attribution	session is not Request; no adapter relation or business status
Control Tower HTTP	generated ct_* requestId copied to response/audit/log	one HTTP correlation	not a stable business Request ID
Orca	fixed kylejang1/ctc@origin/master target; Control Tower audit requestId, actor/action/outcome	admission/access action to one fixed workspace	no Orca session/message reference or Orca-to-Request handoff
Field/operator	CTC HTTP correlation plus tenant-scoped business entity IDs and owning DB/process records	actual business operation and user evidence	no generic intake adapter or Request row
System/monitoring	tenant + monitor + probe/event identifier; incident ID when created	incident-domain correlation and retry/idempotency	cannot be reused as generic Request dedup
Mail approval	T_MAIL_REQUEST_ITEM and owning appointment/mail workflow	domain-specific mail request item	table name does not make it a generic Request Registry
Phase Task	Pn-nnn, Roadmap state and Git evidence	repository execution status	never automatically created or progressed by a Request

No inspected store provides a versioned envelope with source channel/message, actor/delegation, tenant/module/process/entity scope, protected raw reference/redacted summary, duplicate/related/supersedes, owner/status events, retention/privacy and routing decision together.

6. Orca admission, audit and isolation

• Source fixes the target to projectKey=ctc, repository kylejang1/ctc, base ref origin/master, rejects launch bodies and validates a private entry URL.
• Effective service overrides the planned orca-ctc user and /srv/orca-ctc/... workspace with user/group kyle, working directory /home/kyle/workspace/ctc, ProtectHome=no, and no InaccessiblePaths.
• ProtectSystem=strict plus ReadWritePaths limits writes to the CTC checkout and Orca state, but other home/workspace read isolation is not demonstrated.
• The listener is 0.0.0.0:6769; private-network-only reachability, firewall and forwarding were not proven.
• State directory /home/kyle/.local/share/orca-ctc is mode 0755.
• Sanitized Control Tower audit is mode 0600, contains 22 launches and 1 pairing action, and last changed 2026-07-28T20:54:22.059Z.
• The authenticated pairing endpoint can restart the fixed Orca service and return pairing material. It was not invoked in this review and remains inconsistent with the locked design.

P3-002 must choose whether the final CTC-only Orca role is only admission/audit to an independently managed Orca workspace or also owns pairing. The current mixed behavior cannot be called accepted isolation.

7. Hub and Local evidence

7.1 Hub

• Control Tower service: active/running, user unit disabled, PID observed, checkout clean at 239ca75, loopback 8090 listener.
• Control Tower effective flags: Codex Portal enabled; Task archive compatibility flag enabled; legacy Orca Pilot disabled; CTC-only Orca enabled; entry configured; app-server Codex runtime; program materialization default-disabled.
• Authentication hashes: configured for exactly the three source-allowed accounts; values were not printed. Persistent CONTROL_TOWER_AUTH_SESSION_SECRET was not configured, so source falls back to a process-random secret and browser sessions cannot survive a restart.
• SQLite: quick_check=ok; file mode 0644; data/state directories 0775; config directory 0700; environment file 0600.
• Persisted state has no retired development key and no request-like top-level key. It has no generic Request table; the Task journal is empty.
• Hub CTC checkout is qa@3148e0c with two unrelated dirty paths. Current remote CTC source moved afterward; no checkout mutation or synchronization was performed.

7.2 Local Mac

• CTC origin/qa moved during this review from ba3d52b through e317c6a to d7e161e; the later commits changed archive delivery and deployment instructions, not the reviewed Control Tower boundary.
• Existing unrelated dirty AGENTS.md, Roadmap, Context, P2-008 and P6-001 work was preserved. Roadmap remains owned by another writer, so P3 status integration is not edited in this review.
• Local listeners 6769, 8080 and 8090 were absent; /login.php returned no HTTP response. Services were not started because P3-001 is read-only.
• Local Runtime and Control Tower DB credentials are configured to a reachable prod, but none of the three T_CONTROL_TOWER_* tables exists locally. T_MAIL_REQUEST_ITEM exists and remains domain-specific.
• Local Control Tower main was clean after removal of Graphify query-only cache files created by this review; no Control Tower source change was made.

8. Findings and risk

ID	Severity	Finding	Required owner / next boundary
P3001-F01	high	Two operational registry stores have divergent deployment/mapping identifiers.	P3-002 authority matrix; P4-005 topology/reconciliation input
P3001-F02	high	SQLite file 0644 and data/state dirs 0775 violate the accepted 0600/0700 contract.	separately authorized Control Tower operational hardening and readback
P3001-F03	high	Orca runs as shared kyle, lacks proven cross-project read isolation, listens on all interfaces and exposes pairing through Control Tower.	P3-002 Orca decision; bounded Control Tower/host maintenance
P3001-F04	medium	Persistent Control Tower session secret is absent; restarts invalidate browser sessions.	Control Tower config owner; credential/config write requires separate authority
P3001-F05	medium	Service is active but its user unit is disabled.	Hub service owner must decide intended boot/start contract
P3001-F06	medium	Account access doc still lists admin2, while source/effective hashes admit only three accounts.	Control Tower document owner
P3001-F07	medium	Config snapshots/drafts are dated June 19 and cannot prove current applied config.	P3/P4 observation and publish reconciliation
P3001-F08	expected gap	No generic Request registry/envelope/dedup/lifecycle exists.	P3-003/P3-004; do not restore old Task state
P3001-F09	positive	Auth precedes retirement and all retired route families return authenticated 410; retired state keys are absent.	preserve in future cleanup/regression

9. Authority and topology options for review

Option	Value	Risk / prerequisite
A. Bounded Request module in Control Tower with a separate Request namespace/store	reuses operational auth/audit and keeps CTC local-first	first fix/accept Control Tower security, registry identity and Orca boundary; must not reuse old Task state or make CTC request-time dependent
B. Independent small Request service/database	clean authority and lifecycle isolation	adds deployment, auth, observation, retention and support cost; still needs adapters and tenant/deployment identity contract
C. Another approved shared service	may reuse an existing durable platform	no current candidate or ownership evidence; cannot be selected by assumption
Reject as implicit defaults	CTC operational tables, current Control Tower Task residue, GitHub/Markdown/Codex/Orca session stores	each already has a different authority and would recreate coupling or status ambiguity

Recommended sequence, not a storage decision:

P3-001 user review + one-writer Roadmap integration
-> P2-008 dependency completion
-> P3-002 authority and identity matrix
-> reconcile or explicitly separate the two registries
-> resolve Orca pairing/isolation and Control Tower persistence permissions
-> P3-003 envelope/provenance/privacy/dedup contract
-> P4-005 topology input
-> P3-004 storage/service/API decision

10. Unknowns and required evidence

• Browser login, role-specific navigation and Codex owner visibility: NOT_RUN; no credential use was required for source/DB/retirement proof.
• Orca live workspace/session handoff and client filesystem behavior: NOT_RUN; launch and pairing are effects and were not authorized.
• Port 6769 firewall, router and private-network reachability: UNKNOWN; listener scope alone is insufficient.
• Exact semantic reconciliation of every SQLite/MySQL registry field: NOT_RUN; exact identifiers already prove mismatch and P3-001 does not mutate or select an owner.
• Current config effective/applied parity: UNKNOWN; persisted snapshots/drafts are stale.
• Local CTC/Control Tower/Orca runtime behavior: NOT_RUNNING / NOT_RUN; Local DB schema gap was read-only confirmed.
• Production user workflow, provider/device and deployment behavior: NOT_RUN / NOT_APPLICABLE to this read-only review.
• Generic Request Registry: CONFIRMED ABSENT only for the inspected current source, SQLite state/schema and Local/Hub CTC schema; this is not a decision about future topology.
• P3 Roadmap status integration: PENDING; the canonical Roadmap had another active writer and was deliberately not edited.

11. Verification summary

Check	Result	What it proves / limit
Exact Git/source identity and executable diff	PASS	current repository refs and deployed executable parity; no deployed build provenance beyond runtime probe
CTC/Control Tower source and owner trace	PASS	current authority/routes/persistence boundaries
Authenticated retired-route matrix	PASS	runtime 401 -> 410 ordering for six retired families
Hub SQLite integrity/schema/state-key inspection	PASS	current readable state, absent retired/request keys, empty Task journal; no data mutation
Hub/Local CTC schema and row counts	PASS	three Hub registry tables, Local absence, no generic Request table discovered
Registry identifier reconciliation	FAIL	counts match but deployment/mapping identifier sets differ
Persistence permission contract	FAIL	observed modes differ from accepted ADR
Orca isolation acceptance	BLOCKED	shared identity/non-loopback listener/pairing discrepancy; effectful validation not authorized
Browser/Codex/Orca/field acceptance	NOT_RUN	outside the approved read-only effect boundary
Service/DB/config/provider/deployment write	NOT_APPLICABLE	no such effect was authorized or performed

12. User review and current-direction correction — 2026-08-03

The user accepted this review's observed facts and residual risks. The following current-direction decisions supersede this document's earlier planning recommendations without rewriting the dated observations:

• P3-001 is complete after user review.
• The target is one CTC project only, using /home/kyle/workspace/ctc and /home/kyle/.codex as the canonical Linux project/session environment.
• Official Codex CLI and codex app-server are one installation with different client modes.
• Mac ChatGPT.app over SSH, Control Tower web and Linux CLI should read/resume the same Linux session set; exact reverse discovery in the Mac app is verified in P3-003.
• Existing /codex remains legacy maintenance-only. A new CTC-only collaboration UI is developed separately but does not require a separate checkout or CODEX_HOME.
• Current application accounts remain exactly superadmin, admin, and jaylee; admin2 and generalized Codex RBAC residue are removed.
• Multi-project support, generic project ACL and OS-level project isolation are not current prerequisites.
• Orca is excluded from the target architecture. Existing Control Tower-side Orca/Codex planning documents are removed after their useful direction is absorbed into CTC Context and P3 Tasks.
• P3-A CTC Shared Workspace precedes P3-B generic Request Operations.

This correction does not change the P3-001 read-only findings about current deployed services, registries, permissions, retired routes or stale evidence. Those facts remain dated input for their owning follow-up Tasks.

---

Source: docs/research/control-tower-request-operations/2026-08-03/P3-001-current-state-review.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.