agent: repoint roles to frank-medium/dankclaw-3090; sync niri tweaks, memories, managed skills

- config.yml: default/commit -> frank-medium (dankserver); task/tiny/smol/vision -> frank-small (dankclaw-3090); vision xhigh - models.yml: add llamacpp (dankclaw-3090) provider; frank-large preserve_thinking + context notes - niri: focus-ring/border/shadow layout, hot-corners off, re-add noctalia.kdl include; blankpad eDP-1 scale 1.0 - memories: flush rollouts; retire frank_large + marreta_authentik skills; add auth-chain/kv-pool/quadlet-log skills - managed-skills: 40+ new fleet runbook skills - agent/skills: import built-in skill set
2026-09-17 12:27:08 -07:00
1 parent 83c9c92b3f
commit 135bb2194d
@@ -0,0 +1,4 @@
+Verifying the Marreta auth chain:
+1. Probe `http://localhost:8017/` from host (expected 000, listener is in Caddy netns).
+2. Check `authentik-proxy-provider-app-link` for null flows.
+3. Ensure non-browser clients can bypass JS challenges or use backend datasource URLs.
@@ -1,17 +0,0 @@
-# frank-large Operations
-Deployed as rootless Quadlet on dankclaw. ~68 GiB weights + 14.4 GiB KV pool (524k positions, 3 slots). Total ~103.4 GiB.
-## Ports
- Engine: :8730 (loopback)
- Front-end: :8731
- Published: :7770
-## Logging & Env
- `podman logs frank-large` / `journalctl --user -u frank-large`
- Avoid `TEMP`, `HOST`, `GPU_MAX_HEAP_SIZE` (HIP bare TEMP)
-## Sampling & API
- Large: greedy | Small: sampling (temp=1.0, top_k=20, top_p=0.95)
- Small determinism: `temperature: 0` or `--sampling-defaults none`
- `preserve_thinking`: client-side per-request (`chat_template_kwargs`)
- `max_tokens: 200` w/ empty content = thinking consumed budget
- File-cache shortage → uninterruptible sleep. `host_reserve_gib=24` protects n-gram table.
-## Tests
- 285/286 pass (test 73 comfyui bug). `pyyaml` missing on system py3; `uv` available.
@@ -1,5 +0,0 @@
-{
-  "model": "frank-small",
-  "temperature": 0,
-  "chat_template_kwargs": {"preserve_thinking": true}
-}
@@ -1,6 +0,0 @@
-#!/bin/bash
-# Verify KV pool slots and memory stability
-docker inspect frank-large --format '{{.Config.Env}}'
-podman logs frank-large 2>&1 | grep -E '^(dmalloc|kv pool):'
-echo "Slots: HALOGEN_KV_SLOTS"
-echo "Memory: ~103.4 GiB (68W + 14.4KV + 21W)"
@@ -1,6 +0,0 @@
-[Service]
-ExecStart=/usr/bin/podman run ...
-Environment=TEMP=...
-Environment=HALOGEN_KV_SLOTS=3
-[Install]
-WantedBy=default.target
@@ -0,0 +1,4 @@
+Verify if the request fits the allocated KV pool:
+1. Run `podman logs frank-large | grep 'kv pool:'`.
+2. Compare 'reserved' count to 'requested' count.
+3. Note: /health does not prove pool size; absence of WARNING is not evidence of headroom.
@@ -1,12 +0,0 @@
-# Marreta & Authentik Deployment
-Podman compose on dankclaw. Shares gluetun egress with searxng.
-## Guard Chain
-Caddy TLS → Anubis (:8923) → Authentik outpost → internal :8017 → marreta
-## Auth Fix & Pitfalls
- Login-wall caused by null `ProxyProvider.application` & flows crashing Rust outpost.
- Fix: Link `Application(slug=marreta)`, populate auth/authz/invalidation flows.
- Probe: `localhost:8017` returns HTTP 000 (Caddy netns). Use internal probe or grep config.
- Non-browser clients fail JS challenges. Audit service-to-service URLs for public guarded hostnames.
- Exempt: IdP, Gitea (git smart-HTTP), self-auth services.
-## Verification
- E2E: `tests/e2e/specs/16-marreta.spec.ts` asserts homepage tile passes guard chain.
@@ -1,2 +0,0 @@
-Run: npx playwright test tests/e2e/specs/16-marreta.spec.ts
-Assert: Homepage tile passes Anubis/ProxyProvider guard chain without login-wall parking.
@@ -1,5 +0,0 @@
-#!/bin/bash
-# Health check through netns
-podman exec marreta_caddy wget -qO- http://localhost:8017/ || echo "HTTP 000 expected"
-# Grep config for route flip
-cat /etc/caddy/config.json | grep "reverse_proxy"
@@ -1,8 +0,0 @@
-application:
-  name: Marreta
-  slug: marreta
-  provider: marreta-proxy
-flows:
-  authentication: enabled
-  authorization: enabled
-  invalidation: enabled
@@ -0,0 +1,4 @@
+To retrieve logs for a rootless Quadlet service (e.g., frank-large):
+1. Use `podman logs frank-large` for container-specific output.
+2. Use `journalctl --user -u frank-large` for systemd-integrated output.
+3. Use `podman logs frank-large 2>&1 | grep -E '^(dmalloc|kv pool):'` to filter for memory/allocations.