# Private resume routing (no password/token/key material)

Snapshot: 2026-09-30 13:41:06 KST. Read the repository Owner's latest HTTP400 handoff first.
This file contains operational addresses and paths; do not copy it into Git or a public report.

Update 2026-09-30 about14:17 KST: user-reported overload was VSCode extensionHost
19084 child rg19687 enumerating / and /sys for95minutes at1200%CPU. User explicitly
approved only that child; identity/starttime/pidfd guarded SIGTERM exited in5s. Host
24CPU average50.2% ->7.6% ->2.9%, no rg replacement. VSCode parent remains ~19.4GB RSS;
no authority to restart it. ct and Contextra were not the heavy processes. Read
cpu-search-cleanup-and-history.json. Sept29 records show URLError/OSError and four
prepared field stages(version1), no session/leaf; the user's historical401 cause is
not established. No further logins/code/DB/Runtime changes occurred.

Update 2026-09-30 14:05:24 KST: cause confirmed in existing live-app log at13:37:47:
CONNECTION_VERSION_CONFLICT -> INVALID_PARAMS/HTTP400. Read login-version-conflict.json
and the latest checkpoint capsule before older hypotheses below. Web AI-01 stores test
address192.168.50.221/version1; ICERTI pending advertises192.168.50.7/version1. Installed
network_prepare.py matches source and copies the old version while changing addresses.
No code/runtime/auth/DB mutation or new login was performed. Next: seek agreement on ct
version lifecycle/error detail fix and preserved-stage reprepare; no test restart needed.
Actual repo HEAD during diagnosis: f5b8b978e08311e8c5410e62320851ed5fb28c7e, clean.
Running Web output is in /home/mhj/.gradle/daemon/8.14.4/daemon-74257.out.log; the old
.local-run/bootrun.log files stop atSep23 and do not contain today's failure.

## Identity and source

- profile: ltb1021; current owner work-session; server test.
- repo: /workspace/contextra-analytics-runtime-lifecycle-refactor
- branch: task/runtime-lifecycle-refactor
- HEAD before this handoff: 91c199dea16b79b66d346a729aa74da665459088
- Owner: docs/profiles/ltb1021/topics/runtime-lifecycle/README.ko.md
- New handoff: validation/20260930T134106+0900-handoff-field-login-http400.md
- Guide: docs/deployment/ICERTI_OFFLINE_MAINTENANCE.ko.md
- Implementation: tools/icerti_offline/maintenance/field_*.py, ct.py, network_prepare.py, network_apply.py.
- Enrollment implementation: tools/secure_bridge_enroll.py and control_sidecar/auth.py; installed vendor under bridge_tools.
- No Git switch/rebase/stash/merge/add/commit/push. User performs Closeout separately.

## Hosts and permissions

### ICERTI AI, temporarily in company LAN

- si@192.168.50.7:1023; NIC enp128s31f6; DHCP /24, gateway/DNS192.168.50.1.
- key: /root/.ssh/ltb1021_contextra_icerti_si_ed25519
- known_hosts: /root/.ssh/contextra_icerti_known_hosts
- verified HostKeyAlias: [58.233.207.31]:1023
- BatchMode/IdentitiesOnly/StrictHostKeyChecking, finite timeout. No new key or trust override.
- Valid sudo input file: /run/contextra-icerti-sudo.4nlWwu/password (root600).
- Older i1dRkJ input was invalid; do not retry it. Preserve all existing sudo files and SSH keys until user says delete.
- SSH helper: /tmp/codex/ltb1021/2026-09-30_icerti-maintenance-ab_r01/remote.py
- Helper reads sudo input through stdin and does not put it in args or output.
- Installed ct prefix: /usr/local/lib/contextra-maintenance/20260928-r01
- Runtime root: /workspace/contextra/runtime; data view: /workspace/contextra/data.
- Active remains offline-source-20260928T165350. All five containers stopped at snapshot.

### Company Web101 (READ ONLY)

- root@192.168.50.101:2222
- key: /root/.ssh/ltb1021_contextra_101_ed25519
- known_hosts: /root/.ssh/contextra_101_known_hosts; no HostKeyAlias needed.
- SSH args: -F /dev/null -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=yes.
- Helper: same run/read_web101.py. No mutation, restart, login replay or DB write authority.
- Actual project root: /mnt/workspace/mhj/projects/icerti_poc; owner mhj.
- Git read via runuser -u mhj to avoid root ownership warning; do not add safe.directory config.
- Actual checkout read: 9776f8e092283f1d5cf5f093aea2860882a328f6; colleague document source4309cf7 differs.
- App process observed1795455; classpath build/classes/java/main and build/resources/main. Re-discover PID if needed.
- Java/Javap: /home/mhj/oracleJdk-21/bin/{java,javap}. Do not attach heap dumps or restart the process.
- Auth code: src/main/java/com/icerti/platform/poc/service/security/ManagedTokenService.java
- Controller/DTO: controller/security/ManagedAuthController.java, dto/security/ManagedAuthContracts.java under same Java package.
- Mapper: src/main/resources/mappers/ManagedTokenMapper.xml; compiled runtime resource matched source.
- App logs: .local-run/bootrun.log and .1. Read bounded timestamp region only; no whole payload/secret output.
- DB container: icerti_poc-db-1, mariadb11.4, DB contextra, published loopback3316. ACCOUNT has login_id/password_hash/actor_type/server_id/enabled/must_change_password fields.
- Existing read helpers use container's own DB auth env internally; SELECT-only transaction and ROLLBACK. Never print credentials/hash.
- Known current AI identity: AI-01. User provided old/new password candidates were checked through hidden stdin; do not add values to files.
- password-comparison.json: new candidate matches DB and ICERTI profile, old candidate matches stopped test saved password but not DB.
- Source/bytecode uses per-login DB lookup plus BCrypt matching, not a separate old plaintext-password cache.

### Company test AI

- Existing docker project contextra: analytics, ai-control-sidecar, ai-gateway, redis, postgresql.
- All five stopped by explicit user request until user asks to resume. Do not auto-start.
- Registered36 already stopped/children0; Gateway SIGQUIT then30s SIGKILL137, OOMfalse. Other stop outcomes in test-hold-result.json.
- Source config: /workspace/contextra-runtime-config. Same Web101 and identityAI-01 are now reserved for ICERTI testing today.
- Resuming test may need password/session re-registration, not merely docker start. Preserve existing data and configs meanwhile.
- Old unrelated SSIMS and other services are not part of this task.

### Closed installation LAN

- AI192.168.105.40/24, Web.42, media.41, no gateway/DNS prepared.
- Actual switch/routing test SKIP because user cannot prepare another host/isolated LAN. Company acceptance replaces today's test scope, not proof of closed-site network.
- Do not activate field profile or change current DHCP/IP/SSH port.

## Current enrollment state

- Selected profile office: /workspace/contextra/setup/profiles/office.json
- Account reference: /workspace/contextra/setup/profiles/office.private/main.credentials.json
- Selected CA: /workspace/contextra/setup/profiles/office.private/main.ca.crt
- Stage: /workspace/contextra/data/site/field-20260930T125714-23731
- CSR: /workspace/contextra/setup/outbox/field-20260930T125714-23731.csr
- Latest result mtime13:37:47 KST: UNCONFIRMED / LOGIN_REJECTED / HTTP400 / returncode2.
- Existing enroll-intent.json plus enroll-intent-20260930T133737.previous.json. Do not delete or overwrite intent to bypass retry checks.
- No stage session/issued leaf. Config validation and frozen-file/profile checks PASS at13:41:06.
- Need identify existing400 response reason before another user retry. No automatic login.
- Prepared body location: stage/bridge/login-body.json. It contains Redis auth; print only allowlisted nonsecret fields/shape when comparing contracts.
- Candidate next comparison: DTO validation, advertised address/ports, registration/version policy. None is confirmed cause yet.
- Active runtime site still refers to previous deployment network. Apply has not happened; do not run ct start against stale active settings.

## ARP exception: important on reboot

- Actual Web101 MAC from its interface: bc:24:11:8a:6e:f4, interface enp6s18.
- test uses permanent neighbor for101 matching that MAC.
- ICERTI initially used74:86:e2:0f:f3:28, causing TCP443/2222 refusal. Wrong device identity unknown.
- User approved ICERTI-only kernel mapping: ip neigh replace192.168.50.101 lladdrbc:24:11:8a:6e:f4 nudpermanent dev enp128s31f6 (tokens separated in actual command).
- TCP443/2222 and TLS1.3 CA/IP-SAN verification then PASS. No HTTP/login was made by this check.
- Current neighbor remains PERMANENT in kernel, but no boot persistence was configured. Reboot/NIC reset can remove it.
- Return to dynamic neighbor only when intended: sudo ip neigh del 192.168.50.101 dev enp128s31f6.
- Keep it for today's company test. Do not transfer this exception to closed-site profile or silently add persistence.

## CA/USB

- USB T31, exFAT /dev/sdb1 was mounted ro,nosuid,nodev,noexec at /mnt/ct-usb.
- Folder: /mnt/ct-usb/260930_아이서티_컨텍스트라_청계산입구_테스트용_스인101_ca파일
- File manager-ca.crt originally was ICERTI CA, not101 CA. User approved replacement; read-only state restored after atomic write/fsync.
- Current101 CA file SHA256:59baabe4c577f8d84e505f97bdf9e2313162485dd48012af15d27fdb92ebf324.
- Original ICERTI public CA backup (no private key): /data/codex-artifacts/contextra/field-maintenance/2026/2026-09-30_icerti-ca-backup_r01/manager-ca.crt
- Original CA SHA256:96a7b202c1e2e8b1964dedfaa1a3a00131345f65efbfad1f5c590f8857eb99b4.
- User directly completed ct ca USB selection/TRUST. Profile CA matched. SSH transfer test still pending.

## User-provided Web context

- /workspace/260716_아이서티관련문서/260930/siai/26_09_30_ai_web_integration_share_brief.md
- /workspace/260716_아이서티관련문서/260930/siai/codex-mhj_26_09_30_01_current_state_plan_gap_analysis.md
- Read these once; do not repeat full824-line analysis. Main source/reference gap is already recorded.
- Critical claims must be crossed with actual code/config/runtime; no blind trust of these docs.

## Workflow and UX

- User operates si CLI one small step at a time. Explain purpose,1-2 short commands, expected output; collect output/UX before next step.
- Stable MT-01..14 and UX candidates are in Git handoff. Do not repeat baseline/performance/full tests.
- USB mount selection and English physical-console mode are direction-accepted but NOT implemented.
- Profile paths currently mixes editable source, accepted runtime imports and protected locations. Do not promise all files can be freely changed.
- Emergency is supported-config import plus prepared apply, not a permanent protection bypass. Prepared file edits invalidate frozen checks.
- Final guide/PDF after testing: scenario index, stable procedure IDs, printed pages, common steps once, branching results, exact editable fields/recovery.
- Next immediate work is bounded read-only400 diagnosis. Do not begin unrelated improvements while resuming.