From 2a3c0da740ac3c159c262d6efa5608c2c892ad62 Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 9 Sep 2026 16:20:42 -0700 Subject: [PATCH] chore(memory): flush runtime memory updates for .omp and serverAppConfigs roots MEMORY.md/learned.md/memory_summary.md/raw_memories.md churn from live sessions (DIFR deadlock diagnosis, model-swap ops, outpost verification etc.); new memory root --home-dank-.omp-agent-- started with learned.md. --- agent/memories/--home-dank-.omp--/MEMORY.md | 59 ++- agent/memories/--home-dank-.omp--/learned.md | 6 + .../--home-dank-.omp--/memory_summary.md | 2 +- .../--home-dank-.omp--/raw_memories.md | 106 +++++ ...-9a7e-521577fe67cf-frank_default_large_.md | 4 + ...-bc2f-c573718f37f7-omp_model_config_syn.md | 4 + ...99-8741-2032a3dd0318-omp_gitea_workflow.md | 4 + ...-b42d-31b218aba12b-niri_nvidia_modeset_.md | 4 + ...7-b674-2fe3715f28f2-niri_browser_cursor.md | 4 + ...3-97a1-38e51673bb86-dankclaw_npu_gemma4.md | 4 + .../--home-dank-.omp-agent--/learned.md | 3 + .../MEMORY.md | 168 +++++-- .../learned.md | 71 +++ .../memory_summary.md | 10 +- .../raw_memories.md | 444 ++++++++++++++++++ ...-b57b-8a8f43ffe7e2-frank_large_prefill_.md | 4 + ...-8d9f-347ba1c28cf7-authentik_anubis_cha.md | 4 + ...-b7eb-319c4c1271c1-frank_large_mtp_inco.md | 4 + ...-8749-8ece9a2b11fd-homelab_caddy_authen.md | 4 + ...-89c1-f729e282a9e8-rocimfp4_fast_model_.md | 4 + ...-ac57-3fdf464a36d3-frank_large_ciru_str.md | 4 + ...-889c-e663fedd8c96-qwen38_flash_next_mt.md | 4 + ...-bde3-454344369e22-frank_default_large_.md | 4 + ...-82be-247e7b5da2bd-frank_default_large_.md | 4 + ...b-76ab-b05f-ac95f79c9e55-workspace_root.md | 4 + ...-b980-b6837011e99f-frank_default_large_.md | 4 + ...-8485-b02f8ab630b5-split_dns_porkbun_pi.md | 4 + ...-8e09-735f8f2e0a5d-ssh_podman_frankbook.md | 4 + ...-b857-fad89ebde42b-dankserver_copyparty.md | 4 + ...-86c8-b92c602492c7-volume_security_free.md | 4 + ...7043-96eb-a73344efd9e6-hermes_flm_gemma.md | 4 + ...-8926-c24cb5a10490-container_persistenc.md | 4 + ...-8885-8b86990051ed-frank_large_qwen38_s.md | 4 + ...-af15-2e178337182a-podman_standardizati.md | 4 + ...-8a49-279f51c68bf2-plex_homepage_jellyf.md | 4 + ...-9e52-b486c767a2f6-plex_tautulli_podman.md | 4 + ...-8f58-21f7c860aed7-service_status_herme.md | 4 + ...-ba09-0f104cd6677f-frank_npu_deployment.md | 4 + ...-8019-50af77fbaddf-services_json_format.md | 4 + ...-a342-a41c5f99d927-arr_stack_local_dns_.md | 4 + ...-83b3-a28b1736f34b-pihole_admin_reset_l.md | 4 + ...df-98e0-e1b930f260a5-sonarr_admin_local.md | 4 + 42 files changed, 930 insertions(+), 71 deletions(-) create mode 100644 agent/memories/--home-dank-.omp--/rollout_summaries/01a044f9-b501-7465-9a7e-521577fe67cf-frank_default_large_.md create mode 100644 agent/memories/--home-dank-.omp--/rollout_summaries/01a045a9-6398-75f3-bc2f-c573718f37f7-omp_model_config_syn.md create mode 100644 agent/memories/--home-dank-.omp--/rollout_summaries/01a046d6-6c79-7199-8741-2032a3dd0318-omp_gitea_workflow.md create mode 100644 agent/memories/--home-dank-.omp--/rollout_summaries/01a0559f-8bd5-728b-b42d-31b218aba12b-niri_nvidia_modeset_.md create mode 100644 agent/memories/--home-dank-.omp--/rollout_summaries/01a055c0-2438-7787-b674-2fe3715f28f2-niri_browser_cursor.md create mode 100644 agent/memories/--home-dank-.omp--/rollout_summaries/01a05602-bf3e-76c3-97a1-38e51673bb86-dankclaw_npu_gemma4.md create mode 100644 agent/memories/--home-dank-.omp-agent--/learned.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04330-1551-72f6-b57b-8a8f43ffe7e2-frank_large_prefill_.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a046ba-1301-72c1-8d9f-347ba1c28cf7-authentik_anubis_cha.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04717-a7fd-73ab-b7eb-319c4c1271c1-frank_large_mtp_inco.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04a3f-6596-75d0-8749-8ece9a2b11fd-homelab_caddy_authen.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04f40-c5c0-77a4-89c1-f729e282a9e8-rocimfp4_fast_model_.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04fa5-181d-75a9-ac57-3fdf464a36d3-frank_large_ciru_str.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a050b6-e0fb-73a0-889c-e663fedd8c96-qwen38_flash_next_mt.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05172-a606-7196-bde3-454344369e22-frank_default_large_.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051bf-4728-7028-82be-247e7b5da2bd-frank_default_large_.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051d8-db9b-76ab-b05f-ac95f79c9e55-workspace_root.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051e2-6ff9-72cc-b980-b6837011e99f-frank_default_large_.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a0598c-244a-766a-8485-b02f8ab630b5-split_dns_porkbun_pi.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059ae-72f3-76d4-8e09-735f8f2e0a5d-ssh_podman_frankbook.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059f4-cead-704b-b857-fad89ebde42b-dankserver_copyparty.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a29-d9fd-71ca-86c8-b92c602492c7-volume_security_free.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a42-6580-7043-96eb-a73344efd9e6-hermes_flm_gemma.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a7d-cc94-7589-8926-c24cb5a10490-container_persistenc.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bd4-8dbe-759b-8885-8b86990051ed-frank_large_qwen38_s.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bed-d759-7157-af15-2e178337182a-podman_standardizati.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06035-a0d8-73ad-8a49-279f51c68bf2-plex_homepage_jellyf.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06085-8146-72b0-9e52-b486c767a2f6-plex_tautulli_podman.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a063a7-4c37-7765-8f58-21f7c860aed7-service_status_herme.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06894-8947-74fa-ba09-0f104cd6677f-frank_npu_deployment.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06aa2-9087-753a-8019-50af77fbaddf-services_json_format.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06b4c-fcea-70e2-a342-a41c5f99d927-arr_stack_local_dns_.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06e56-5e70-73f5-83b3-a28b1736f34b-pihole_admin_reset_l.md create mode 100644 agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06ef4-c78b-71df-98e0-e1b930f260a5-sonarr_admin_local.md diff --git a/agent/memories/--home-dank-.omp--/MEMORY.md b/agent/memories/--home-dank-.omp--/MEMORY.md index 834a795..bbfd84f 100644 --- a/agent/memories/--home-dank-.omp--/MEMORY.md +++ b/agent/memories/--home-dank-.omp--/MEMORY.md @@ -1,29 +1,36 @@ -# User & Environment Context -- User: Frank -- Home Directory: /home/dank/ -- Harness: Oh My Pi → Migrated to OMP harness -- Persona: "Comrade Chief Designer" (Soviet-themed humor, friendly, concise) +# Environment & OS +- User: Frank | Home: `/home/dank/` | Work Dir: `/home/dank/.omp` +- OS/Kernel: CachyOS (Linux 7.2.0-1) with niri Wayland compositor +- Default Browser: Firefox (managed via `xdg-settings`) +- Cursor Config: `~/.config/niri/cfg/misc.kdl` (capitaine-cursors, size 48). Apply via `niri-msg reload` or `kill -SIGUSR1 $(pgrep niri)` to avoid full session restart. +- NVIDIA/GPU Note: `nvidia-modeset` semaphore deadlock can freeze niri GUI. Fix: install `/etc/modprobe.d/nvidia-workarounds.conf`, rebuild initramfs (`mkinitcpio -P`), force-reboot (`systemctl reboot --force --force`). Note: force reboot kills active SSH sessions mid-flight. -# Model Topology & Inference -- frank-default-small: served by llamacpp (dankserver) -- frank-default-large: served by llamacpp (dankclaw) -- Format: GGUF/quantized via llama.cpp -- Context Overhead: ~17,301 non-message tokens per window -- Pending Swap: frank-default-large → kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF (interrupted; docs/ path missing) +# Model Configuration & Inference +- Config Files (Edit in lock-step): + - Source: `~/.pi/agent/models.json` + - Import/Generation: `~/.omp/agent/models.yml` (co-located with `models.db` WAL/SHM files) +- Provider Layout: + - `llamacpp (dankserver)` @ `http://192.168.0.235:7770/v1` | Model: `frank-default-small` | Context: 204800 | Reasoning: true | Inputs: [text, image] + - `llamacpp (dankclaw)` @ `http://192.168.0.143:7770/v1` | Model: `frank-default-large` | Context: 262144 | Reasoning: true | Inputs: [text, image] + - `dankclaw-npu` @ `http://192.168.0.143:7771/v1` | Model: `gemma4-it:e4b` (FastFlowLM) | Context: 131072 | Reasoning: true | Inputs: [text, image, audio] +- Model Details: + - `frank-default-large`: Qwen3.8-Flash-Next Uncensored ROCmFP4 STRIX_LEAN (177B params, 56B MoE, ~98.3GB GGUF across 3 shards). Uses `--spec-type ngram-mod` speculative decoding (MTP head stripped). Vision enabled via `mmproj` (~866M). Docs updated in `/home/dank/.pi/agent/docs/pi/models.md` (commit `eda2edb`). + - Context Sizing: Uses Ki-style multiples (e.g., 200k = 204800). Always update both `contextWindow` and `maxTokens` when changing context. Config-only changes apply on next read; no cache flush required. + - NPU Image Constraint: FLM decoder strictly rejects WebP. Convert WebP to PNG/JPEG upstream before sending to the FLM endpoint. +- Non-message token overhead: ~17301 tokens per context window. -# OMP Migration & Config -- Config File: ~/.omp/agent/APPEND_SYSTEM.md (replaces ~/.pi/agent/SYSTEM.md) -- Prompt Injection: APPEND renders after default harness prompt. Use `omp config set personality none` to clear built-in personality while preserving APPEND. -- Date Handling: Avoid hardcoding dates; OMP injects real time per-request. -- Skills: Auto-discovered from ~/.claude/skills. Use /skill: syntax. skills.enableSkillCommands defaults to true. +# Git & Gitea Workflow +- Gitea UI: `http://dankclaw:3000` (IP: 192.168.0.143:3000). API may return IP, but UI resolves best via hostname. +- Repository: `dank/command-center` +- PR Workflow: Branch `pr/fix-models` -> PR #1. Single commit, clean history. +- Checkout Pitfall: `git checkout main` fails due to dirty tracked files in `agent/memories/` (e.g., `learned.md`). +- Resolution: Execute `git stash` before `git checkout`. Stash is automatically saved on the previous branch (develop) for later retrieval. -# Tool API Mappings (Pi → OMP) -- subagent tool → task tool (direct replacement) -- concurrency: N → Dropped (harness enforces cap; excess queues) -- context: "fresh"/"fork" → Dropped (subagents always start blank/self-contained) -- async: true → Dropped (use local:// unique paths if needed) - -# Peon-Ping Plugin → OMP Skills -- Available: peon-ping-config, peon-ping-log, peon-ping-toggle, peon-ping-use -- Access: /skill:grilling, /skill:tdd style commands -- Location: ~/.claude/skills (shared across agents) +# Migration & Tools (Pi → OMP) +- `~/.pi/agent/SYSTEM.md` migrated to `~/.omp/agent/APPEND_SYSTEM.md` (8.4KB). New sessions pick up APPEND automatically. +- `omp config set personality none` removes built-in personality block while keeping APPEND_SYSTEM.md intact. +- Tool Mappings: `subagent` → `task`. Parameters `concurrency`, `context`, and `async` are dropped or handled by the harness (excess queues). +- Skills: Auto-discovered from `~/.claude/skills`. Syntax: `/skill:grilling`, `/skill:tdd`. `skills.enableSkillCommands` defaults to true. +- References: `okf-spec.md` points to pi-tree (`~/.pi/agent/docs/references/`); consider copying to `~/.omp` for full ownership. `omp://` provides 130+ docs. Use `skill://find-skills` for discovery. +- Persona: 'Comrade Chief Designer' (Soviet-themed humor, friendly, concise). +- Date Context: "It is September 2026" baked into persona; OMP injects real date per-request (may drift slightly). diff --git a/agent/memories/--home-dank-.omp--/learned.md b/agent/memories/--home-dank-.omp--/learned.md index de55b54..3fa8ca9 100644 --- a/agent/memories/--home-dank-.omp--/learned.md +++ b/agent/memories/--home-dank-.omp--/learned.md @@ -1,3 +1,9 @@ +- The FLM (FastFlowLM) service on Dankclaw (gemma4-it:e4b, port 7771) only supports PNG and JPEG/JPG image formats. WebP images are rejected with "Unsupported image format, skipping this image." The data URL formats it expects are data:image/png;base64, data:image/jpeg;base64, and data:image/jpg;base64. To use WebP screenshots with the NPU, convert them to PNG first. Verified 2026-08-30: a WebP screenshot (1024x576, 71K) was rejected while the same content as PNG was correctly identified by the vision model. _(context: Dankclaw NPU (FLM, gemma4-it:e4b, port 7771) — image format support investigation)_ +- When configuring dankclaw-npu (FLM NPU endpoint on port 7771) in models.json, the model entry must include a thinkingLevelMap field. The other two providers (dankserver, dankclaw) have it; if absent, schema validation fails. Pattern: {"thinkingLevelMap": {"max": "xhigh"}}. Also verify gemma4-it:e4b model ID is registered and .xclbin kernel symlink exists under /home/dank/.config/flm/xclbins/. _(context: Dankclaw NPU endpoint (dankclaw-npu provider, port 7771) had a schema error because gemma4-it:e4b was missing thinkingLevelMap. Fixed by adding it to both models.json and models.yml. The FLM NPU serves 34 models in its registry; gemma4-it:e4b is the currently wired model.)_ +- Dankclaw NPU serves 34 FLM (FastFlowLM) models on port 7771. Only one is wired in models.json (gemma4-it:e4b) but all 34 are registered and available via per-request model routing without restart. Known behavior: single-lane NPU queues FIFO, per-request model switch costs ~7–11s wall for 4B-class reload. Common pitfall: some registered tags fail if .xclbin kernel pack symlink is missing under /home/dank/.config/flm/xclbins/ (fix: ln -s /opt/fastflowlm/share/flm/xclbins/PackName). Registry probe: curl http://192.168.0.143:7771/v1/models. +- Frank's cursor size is 36 (up from default 24) on Dankware running niri/Wayland. Applied via three channels: gsettings org.gnome.desktop.interface cursor-size=36 (primary), GTK settings.ini gtk-cursor-theme-size=36 (fallback), XCURSOR_SIZE=36 in ~/.profile (sessions). Cursor theme: capitaine-cursors. _(context: Dankware workstation — Frank requested a bigger mouse pointer; set to 36 across gsettings, GTK config, and environment)_ +- Frank's default browser is Firefox (firefox.desktop), set via xdg-settings on Dankware (niri/Wayland). Previously was Chromium. Changes persist across reboots. _(context: Dankware workstation — Frank changed default from Chromium to Firefox via xdg-settings set default-web-browser firefox.desktop)_ +- Dankware (RTX 4070 Laptop, nvidia-open 610.57.04, kernel 7.2.0-1-cachyos, DynamicPowerManagement=2) suffers the known 610.x NVKMS DIFR-prefetch deadlock: nvidia-modeset/kthread_q livelocks in DifrPrefetchEventDeferredWork→nvWriteGpEntry holding the NVKMS API semaphore; any compositor (niri) atomic commit then wedges in D-state in ApplyModeSetConfig/nvkms_ioctl_from_kapi_try_pmlock. Symptoms: GUI frozen, no VT switch, SSH alive, nvidia-smi still answers (GPU idle P8, no Xid). Trigger: display-idle then flip/modeset. Unrecoverable in place — reboot via systemctl reboot --force --force. Candidate mitigations: NVreg_RegistryDwords="RMDisableDIFR=1" (one upstream report says ineffective) and DynamicPowerManagement=0. Bug class spans 595.71–610.57 upstream. _(context: 2026-08-30 GUI lockup diagnosis on dankware; user suspected nvidia modesetter, confirmed via hung-task stacks. Pending user decision on writing modprobe mitigation.)_ - When downloading large model shards (40GB) to dankclaw via SSH: 1. NEVER run rm on partial downloads — always clean up BEFORE starting the first download 2. Ensure only ONE wget process per file — if you see duplicate wget PIDs killing them with kill -9 before restarting, or use fuser to verify exclusivity 3. Use wget -c (continue) to resume partial downloads — SSH connections often drop mid-download on large files (~300s timeout) 4. Download sequentially (not in parallel) when using background task agents that may spawn duplicate processes, or coordinate downloads through a single agent session 5. Verify each file's size against expected values after download completes - kingjones777's Qwen3.8-Flash-Next ROCmFP4 builds for Strix Halo (gfx1151) have three tiers: FAST (~88 GiB), STRIX_LEAN (~98.5 GiB, 3-shard), STRIX (~113.5 GiB). All are text-only — no vision tower, no mmproj, no fused MTP draft head. Uses TYPE_100/TYPE_101 ROCmFP4 tensor types (general.file_type=106), requires patched llama.cpp PR #27742 from ROCmFPX fork. STRIX_LEAN carries a 35.76 GiB PLE n-gram table streamed off SSD at runtime; ~63 GiB GTT for non-PLE weights, ~75 GiB at full 262K context. Uncensored variants exist from orcarouter but only for Qwen3.8-27B (not Flash-Next), and in non-ROCmFP4 format. _(context: User requested kingjones777/Qwen3.8-Flash-Next-Uncensored-ROCmFP4-STRIX_LEAN-GGUF for frank-default-large on dankclaw. Search revealed the repo doesn't exist; only the base STRIX_LEAN tier is available, and it's text-only with no MTP.)_ - Model provider config exists in TWO synchronized copies: ~/.pi/agent/models.json (source of truth) and ~/.omp/agent/models.yml (generated import; header comment states it is imported from the JSON). Any edit to providers, model ids, or display name labels must be applied to BOTH files in the same change or they silently drift. Validate after editing: jq -e '.providers|keys' models.json for the JSON and a YAML parse of the .yml. Label strings are NOT cached in ~/.omp/agent/models.db (model_cache table), so no cache flush is needed after label edits — new labels apply on the next config read. diff --git a/agent/memories/--home-dank-.omp--/memory_summary.md b/agent/memories/--home-dank-.omp--/memory_summary.md index dec0860..d40fe53 100644 --- a/agent/memories/--home-dank-.omp--/memory_summary.md +++ b/agent/memories/--home-dank-.omp--/memory_summary.md @@ -1 +1 @@ -You are running on OMP for user Frank under the 'Comrade Chief Designer' persona. Use Soviet-themed, friendly, concise language. Models: frank-default-small/large via llamacpp. Context overhead ~17.3k tokens. Config is in ~/.omp/agent/APPEND_SYSTEM.md. When spawning tasks, use `task` tool (not `subagent`); drop concurrency/context/async params. Peon-ping is available as skills. Current pending task: finish swapping frank-default-large to kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF. +Frank's OMP harness environment on CachyOS/niri Wayland. Dual model config files (`~/.pi/agent/models.json` & `~/.omp/agent/models.yml`) require lock-step editing; context uses Ki-style multiples. `frank-default-small` (dankserver:7770) and `frank-default-large` (dankclaw:7770) run via llama.cpp; large model is Qwen3.8-Flash-Next STRIX_LEAN using ngram-mod speculative decoding. NPU (gemma4-it) on port 7771 strictly requires PNG/JPEG over WebP. Git workflow on `dank/command-center` requires `git stash` before `checkout main` due to dirty `agent/memories/`. NRI Wayland compositor supports hot-reload via `SIGUSR1` or `niri-msg`. Force reboot resolves nvidia-modeset semaphore deadlocks but interrupts SSH. diff --git a/agent/memories/--home-dank-.omp--/raw_memories.md b/agent/memories/--home-dank-.omp--/raw_memories.md index fe0c9df..1336e6f 100644 --- a/agent/memories/--home-dank-.omp--/raw_memories.md +++ b/agent/memories/--home-dank-.omp--/raw_memories.md @@ -1,5 +1,111 @@ # Raw Memories +## 01a05602-bf3e-76c3-97a1-38e51673bb86 +updated_at: 1788165416 +NPU Provider: dankclaw-npu | http://192.168.0.143:7771/v1 | openai-completions. +NPU Model: gemma4-it:e4b (FastFlowLM) | Context: 131072 | Inputs: text, image, audio | Reasoning: true. +Image Constraint: FLM decoder rejects WebP with 'Unsupported image format'. Only PNG and JPEG/JPG are valid. +Workaround: Convert WebP to PNG/JPEG upstream before sending to FLM endpoint. +Config Paths: ~/.pi/agent/models.json, ~/.omp/agent/models.yml. + +## 01a055c0-2438-7787-b674-2fe3715f28f2 +updated_at: 1788146442 +Default browser: Firefox (xdg-settings set default-web-browser firefox.desktop). Compositor: niri (Wayland). Cursor configuration stored in ~/.config/niri/cfg/misc.kdl under the cursor block (xcursor-theme "capitaine-cursors", xcursor-size 48). Workflow for runtime UI tweaks: edit kdl config directly, then reload compositor with niri-msg reload or kill -SIGUSR1 $(pgrep niri). Avoids full session restart. + +## 01a0559f-8bd5-728b-b42d-31b218aba12b +updated_at: 1788144665 +Diagnosis: GUI frozen, VT down, SSH up. niri (PID 1180049) blocked on semaphore held by nvidia-modeset/ (PID 349). Kernel 7.2.0-1-cachyos. + +Resolution: Installed /etc/modprobe.d/nvidia-workarounds.conf (from /home/dank/.omp/), rebuilt initramfs (mkinitcpio -P), and force-rebooted (systemctl reboot --force --force). + +Operational: Reboot kills active SSH session mid-flight. + +## 01a046d6-6c79-7199-8741-2032a3dd0318 +updated_at: 1788129116 +Environment & Paths +- Working Dir: /home/dank/.omp +- Home Dir: /home/dank +- Gitea UI: http://dankclaw:3000 (IP: 192.168.0.143:3000); API may return IP but UI resolves best via hostname +- Gitea Repo: dank/command-center + +Workflow & Decisions +- PR Creation: Branch pr/fix-models -> PR #1. Single commit, clean history. +- Checkout Pitfall: git checkout main fails due to dirty tracked files in agent/memories/ (e.g., learned.md). +- Fix Protocol: Execute git stash before git checkout. Stash is saved on the previous branch (develop) for later retrieval. +- Current State: Successfully switched to main, up to date with origin/main. + +## 01a045a9-6398-75f3-bc2f-c573718f37f7 +updated_at: 1787875611 +Durable config knowledge: +- User model config exists in two related files: + - Source of truth: ~/.pi/agent/models.json + - OMP YAML import/generated file: ~/.omp/agent/models.yml +- ~/.omp/agent/models.yml contains header comments indicating it is imported from ~/.pi/agent/models.json (pi agent settings). If only YAML is edited, it may be overwritten on next import/regeneration. Prefer editing both files in lock-step unless a dedicated import command is being used. +- frank-default-small lives under provider "llamacpp (dankserver)" with baseUrl http://192.168.0.235:7770/v1, api openai-completions, auth none. +- Existing context sizing uses Ki-style multiples: e.g. 163840 = 160×1024, 262144 = 256×1024. Interpret user request "200k" for context size as 204800 (200×1024), not 200000, unless user explicitly asks decimal. +- For frank-default-small context-size changes, update both contextWindow and maxTokens because they mirror each other in these configs. +- Completed change: frank-default-small contextWindow and maxTokens set to 204800 in both ~/.pi/agent/models.json and ~/.omp/agent/models.yml. +- Validation pattern used: + jq -e '.providers."llamacpp (dankserver)".models[0] | .contextWindow, .maxTokens' ~/.pi/agent/models.json + python3 -c "import yaml; d=yaml.safe_load(open('/home/dank/.omp/agent/models.yml')); m=d['providers']['llamacpp (dankserver)']['models'][0]; print(m['id'], m['contextWindow'], m['maxTokens'])" +- Validation output after change was 204800 / 204800 and frank-default-small 204800 204800. +- No model name/label change was required because the name contained moe-cache info but no context-size label. +- No cache flush was needed for this config-only change; values apply on next config read. + +## 01a044f9-b501-7465-9a7e-521577fe67cf +updated_at: 1787874945 +Durable rollout notes: + +- Models config location in this environment: `/home/dank/.omp/agent/models.yml` (not `/home/dank/.omp/models.yml`). Directory also contains `models.db`, `models.db-wal`, `models.db-shm`. +- Current `~/.omp/agent/models.yml` provider layout observed: + - Provider `llamacpp (dankserver)`: + - `baseUrl: http://192.168.0.235:7770/v1` + - `api: openai-completions` + - `auth: none` + - model id `frank-default-small` + - label/name previously/currently documented as Ornith-1.5-35B-A3B CRACK Q6_K, ngram-mod, attention experts prioritized + - `contextWindow`/`maxTokens`: 163840 + - `reasoning: true`, `input: [text, image]` + - `compat.reasoningEffortMap.max: xhigh` + - Provider `llamacpp (dankclaw)`: + - `baseUrl: http://192.168.0.143:7770/v1` + - `api: openai-completions` + - `auth: none` + - model id `frank-default-large` + - `contextWindow`/`maxTokens`: 262144 + - `reasoning: true`, `input: [text, image]` + - `compat.reasoningEffortMap.max: xhigh` +- The config file header says it was imported from `~/.pi/agent/models.json`; `apiKey "EMPTY"` maps to `auth: none`; `thinkingLevelMap {max: xhigh}` maps to `compat.reasoningEffortMap`. + +Completed rollout/deployment details: +- `frank-default-large` was updated/deployed to Qwen3.8-Flash-Next Uncensored ROCmFP4 STRIX_LEAN. +- Model characteristics recorded: + - 177B params, 56B MoE + - 262K context + - GGUF shards total about 98.3 GB plus mmproj + - 3 shards: approximately 42G, 42G, 16G + - mmproj approximately 866M + - MTP head was stripped during quantization, so service uses `--spec-type ngram-mod` speculative decoding rather than native MTP. + - Multimodal/vision support enabled via mmproj. + - llama.cpp service healthy on dankclaw port 7770 (`/health` returned `{"status":"ok"}`); memory noted around 53 GB. +- Old model preserved at `kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX.backup/` consuming about 114G. + +Docs update: +- Documentation file updated: `/home/dank/.pi/agent/docs/pi/models.md`. +- Git diff showed `models.md` timestamp updated from 2026-08-21 to 2026-08-27 and verified date updated to 2026-08-27. +- Dankclaw base URL in docs updated from `http://192.168.0.143:52625/v1` to `http://192.168.0.143:7770/v1`. +- Docs now note that `frank-default-large` moved from port 52625 to 7770 on Dankclaw as the primary inference server uses standard llama.cpp port; OpenWebUI quadlet `OPENAI_API_BASE_URL` was re-pointed to `:7770` in the same change. +- Docs describe the current large model as the 177B 56B-MoE Qwen3.8-Flash-Next Uncensored ROCmFP4 STRIX_LEAN model with ngram-mod speculative decoding, 262144 context, and vision/mmproj support. +- Docs commit completed in `/home/dank/.pi`: + - Commit hash: `eda2edb` + - Commit message: `docs: update frank-default-large model to Qwen3.8-Flash-Next Uncensored ROCmFP4 STRIX_LEAN` + - Commit changed `agent/docs/pi/models.md` with 36 insertions and 19 deletions. + +Pitfalls/resolutions: +- Initial lookup of `/home/dank/.omp/models.yml` failed; correct path is `/home/dank/.omp/agent/models.yml`. +- MTP-specific wording must be avoided for this quant because the MTP head was dropped; use `ngram-mod` speculative decoding wording instead. +- Ensure future label/docs changes keep model IDs stable (`frank-default-small`, `frank-default-large`) while updating human-readable `name` labels and docs. + ## 01a0428e-d7c9-7240-8bd2-3af6db598870 updated_at: 1787824445 SYSTEM: Oh My Pi deployment. Persona: 'Comrade Chief Designer' — Soviet-themed humor, friendly, concise. User identity: Frank. Model topology: frank-default-small served by provider 'llamacpp (dankserver)'; frank-default-large served by provider 'llamacpp (dankclaw)'. Both are GGUF/quantized models via llama.cpp inference. nonMessageTokens overhead ~17301 tokens per context window. Incomplete task at thread end: attempted swap of frank-default-large to kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF (HuggingFace); docs/ path did not exist in working dir; user typed 'cd ..' and interrupted the assistant before config was located or changed. diff --git a/agent/memories/--home-dank-.omp--/rollout_summaries/01a044f9-b501-7465-9a7e-521577fe67cf-frank_default_large_.md b/agent/memories/--home-dank-.omp--/rollout_summaries/01a044f9-b501-7465-9a7e-521577fe67cf-frank_default_large_.md new file mode 100644 index 0000000..dd90984 --- /dev/null +++ b/agent/memories/--home-dank-.omp--/rollout_summaries/01a044f9-b501-7465-9a7e-521577fe67cf-frank_default_large_.md @@ -0,0 +1,4 @@ +thread_id: 01a044f9-b501-7465-9a7e-521577fe67cf +updated_at: 1787874945 + +Updated/deployed frank-default-large model configuration/docs to Qwen3.8-Flash-Next Uncensored ROCmFP4 STRIX_LEAN on dankclaw llama.cpp port 7770; docs committed in ~/.pi. diff --git a/agent/memories/--home-dank-.omp--/rollout_summaries/01a045a9-6398-75f3-bc2f-c573718f37f7-omp_model_config_syn.md b/agent/memories/--home-dank-.omp--/rollout_summaries/01a045a9-6398-75f3-bc2f-c573718f37f7-omp_model_config_syn.md new file mode 100644 index 0000000..d859bfe --- /dev/null +++ b/agent/memories/--home-dank-.omp--/rollout_summaries/01a045a9-6398-75f3-bc2f-c573718f37f7-omp_model_config_syn.md @@ -0,0 +1,4 @@ +thread_id: 01a045a9-6398-75f3-bc2f-c573718f37f7 +updated_at: 1787875611 + +OMP model config: ~/.omp/agent/models.yml is imported/generated from ~/.pi/agent/models.json; keep both in sync when editing model definitions. For frank-default-small, 200k context was set as 204800 (200×1024) for both contextWindow and maxTokens in both files, validated with jq and PyYAML. diff --git a/agent/memories/--home-dank-.omp--/rollout_summaries/01a046d6-6c79-7199-8741-2032a3dd0318-omp_gitea_workflow.md b/agent/memories/--home-dank-.omp--/rollout_summaries/01a046d6-6c79-7199-8741-2032a3dd0318-omp_gitea_workflow.md new file mode 100644 index 0000000..7d6cc37 --- /dev/null +++ b/agent/memories/--home-dank-.omp--/rollout_summaries/01a046d6-6c79-7199-8741-2032a3dd0318-omp_gitea_workflow.md @@ -0,0 +1,4 @@ +thread_id: 01a046d6-6c79-7199-8741-2032a3dd0318 +updated_at: 1788129116 + +Environment: /home/dank/.omp (home: /home/dank), Gitea at dankclaw:3000. Workflow: PR creation in dank/command-center repo. Pitfall: dirty tracked files in agent/memories/ block git checkout. Resolution: git stash prior to checkout retains changes on source branch. Current: on main, up to date with origin/main. diff --git a/agent/memories/--home-dank-.omp--/rollout_summaries/01a0559f-8bd5-728b-b42d-31b218aba12b-niri_nvidia_modeset_.md b/agent/memories/--home-dank-.omp--/rollout_summaries/01a0559f-8bd5-728b-b42d-31b218aba12b-niri_nvidia_modeset_.md new file mode 100644 index 0000000..3e2ac2a --- /dev/null +++ b/agent/memories/--home-dank-.omp--/rollout_summaries/01a0559f-8bd5-728b-b42d-31b218aba12b-niri_nvidia_modeset_.md @@ -0,0 +1,4 @@ +thread_id: 01a0559f-8bd5-728b-b42d-31b218aba12b +updated_at: 1788144665 + +niri (Wayland compositor) GUI lockup caused by nvidia-modeset semaphore deadlock (kernel thread 349). Resolved by installing nvidia-workarounds.conf modprobe config, rebuilding initramfs, and force-rebooting. diff --git a/agent/memories/--home-dank-.omp--/rollout_summaries/01a055c0-2438-7787-b674-2fe3715f28f2-niri_browser_cursor.md b/agent/memories/--home-dank-.omp--/rollout_summaries/01a055c0-2438-7787-b674-2fe3715f28f2-niri_browser_cursor.md new file mode 100644 index 0000000..a408af7 --- /dev/null +++ b/agent/memories/--home-dank-.omp--/rollout_summaries/01a055c0-2438-7787-b674-2fe3715f28f2-niri_browser_cursor.md @@ -0,0 +1,4 @@ +thread_id: 01a055c0-2438-7787-b674-2fe3715f28f2 +updated_at: 1788146442 + +Default browser set to Firefox via xdg-settings. Mouse cursor size tuned to 48 in niri Wayland compositor config (~/.config/niri/cfg/misc.kdl) using capitaine-cursors theme. Config applies via niri-msg reload or SIGUSR1 signal. diff --git a/agent/memories/--home-dank-.omp--/rollout_summaries/01a05602-bf3e-76c3-97a1-38e51673bb86-dankclaw_npu_gemma4.md b/agent/memories/--home-dank-.omp--/rollout_summaries/01a05602-bf3e-76c3-97a1-38e51673bb86-dankclaw_npu_gemma4.md new file mode 100644 index 0000000..4e86672 --- /dev/null +++ b/agent/memories/--home-dank-.omp--/rollout_summaries/01a05602-bf3e-76c3-97a1-38e51673bb86-dankclaw_npu_gemma4.md @@ -0,0 +1,4 @@ +thread_id: 01a05602-bf3e-76c3-97a1-38e51673bb86 +updated_at: 1788165416 + +Dankclaw NPU uses gemma4-it:e4b via FLM on port 7771. FLM image decoder strictly accepts PNG and JPEG; WebP is rejected. Convert WebP to PNG before FLM calls. diff --git a/agent/memories/--home-dank-.omp-agent--/learned.md b/agent/memories/--home-dank-.omp-agent--/learned.md new file mode 100644 index 0000000..b3afb7d --- /dev/null +++ b/agent/memories/--home-dank-.omp-agent--/learned.md @@ -0,0 +1,3 @@ +- Niri keybinding rules: (1) One action per keybind — { move-window-up; consume-or-expel-window-up; } with two actions is rejected. (2) No duplicate keys — same key combo (e.g. Mod+CTRL+Left) can only appear once in binds{}. (3) Valid consume/expel actions: consume-or-expel-window-left, consume-or-expel-window-right, expel-window-from-column. The consume-or-expel-window-up/down variants DO NOT exist. To add consume/expel to existing bindings, replace (not add alongside) the original bindings. +- Sending SIGHUP to niri (kill -s SIGHUP $(pgrep -f 'niri --session')) causes a full session logout/restart, not a live config reload. Use niri msg action load-config-file for live reload without disruption. Niri reads ~/.config/niri/config.kdl (split config in ~/.config/niri/cfg/). Config version 26.04. +- Sending SIGHUP to niri (kill -s SIGHUP $(pgrep -f 'niri --session')) causes a full session logout/restart, not a live config reload. Use niri --replace for in-place restart, or let the user reload manually. Config lives at ~/.config/niri/config.kdl with split files in ~/.config/niri/cfg/. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/MEMORY.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/MEMORY.md index 0fb670d..56a3ef5 100644 --- a/agent/memories/--home-dank-Projects-serverAppConfigs--/MEMORY.md +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/MEMORY.md @@ -1,49 +1,131 @@ -# frank-default-large Model & Runtime Reference +# Consolidated long-term memory -## Host & Environment -- **Host:** Dankclaw (AMD Radeon 8060S Strix Halo, gfx1151 iGPU) -- **Memory:** 64 GiB unified memory + page cache/SVM (~116 GiB total pool) -- **Runtime:** `charlie12345/ROCmFPX` llama.cpp fork (`llama-server`) -- **Build Flags:** `-DGGML_HIP=ON -DGGML_HIP_ROCMI4_W4A4=ON -DCMAKE_HIP_ARCHITECTURES=gfx1151 -DGGML_CUDA_FA_ALL_QUANTS=ON -DLLAMA_BUILD_WEBUI=OFF -DCMAKE_EXE_LINKER_FLAGS=-no-pie` +## Operating context +- Memory root: memory://root. +- Primary repo: /home/dank/Projects/serverAppConfigs on Dankware/Dankclaw/Dankserver contexts. Current repository state always wins over this memory. +- Primary hosts: + - Dankclaw: 192.168.0.143. Main Caddy edge host, Authentik/Pi-hole/Hermes, frank-default-large, FLM/Gemma NPU endpoint. + - Dankserver: 192.168.0.235. Media services and frank-default-small/media stack pieces. + - FrankBook-Pro: 192.168.0.112 / FrankBook-Pro.local, user dank, macOS x86_64 with Homebrew, Podman 5.4.2, applehv/vfkit machine. + - Dankware: workstation/operation host. +- Passwordless SSH was verified among Dankclaw, Dankserver, FrankBook-Pro, and Hermes containers. Hermes containers use /root/.ssh/id_ed25519 for root/dank host-to-host checks. +- Common inventory commands: + - cd /home/dank/Projects/serverAppConfigs && find . -path ./.git -prune -o -name '*.container' -print | sort + - ssh HOST 'systemctl --user list-units --type=service; podman ps -a --format "{{.Names}} {{.Status}} nets=[{{.Networks}}]"' -## Model Architecture -- **Model:** `Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF` (177B total params) -- **Composition:** 51.2B PLE (n-gram) + 125.8B MoE/Attention (56B active MoE: 512 experts, 10 used; 48 layers: 12 attn + 36 SSM) -- **Quant:** `Q4_0_ROCMFP4_STRIX` (file_type=105), ~113.47 GiB single GGUF -- **VRAM Behavior:** PLE table streams exclusively from page cache/host RAM. GPU resident memory remains ~63-69 GiB regardless of total file size. -- **Indexing/Connections:** QSA indexer (4 heads, top_k=2048); Hyper-connections (count=4, low_rank=320); PLE layer 1 (ngram_size=3, heads_per_ngram=8) +## Deployment and container standards +- Long-running services should be Quadlet .container units, usually rootless user-systemd units started via systemctl --user, generating .service. Some LLM/model services may be system units or custom services instead. +- Locked standardization decisions: + - Quadlet .container units for long-running services; compose is retired to reference where practical. + - Bind mounts only; avoid named volumes for durable service data. + - Linux service state roots under /home/dank/Containers/ unless a service has a justified legacy root. + - Secrets stay out of tracked repo files; use machine-local env files. + - Verify user namespace settings after daemon reload with systemctl --user cat .service when relevant. +- Preferred Quadlet pattern: [Container] Image, ContainerName, EnvironmentFile, Volume bind mounts, Network/PublishPort as needed; [Service] Restart=always; [Install] WantedBy=default.target. +- Rootless Podman gotchas: + - Use UserNS=host in Quadlet, not compose-style UsernsMode=. + - For render/GPU group access, rootless containers may need keep-groups. + - Data-root mkdir/chown is handled by deployer in newer flows, but verify before assuming. +- Deployer: scripts/deploy.sh computes changes, pushes, target pulls, dispatches, wires configs, and runs health checks. It uses target-side FF-only pulls and state tracking. It can start services only if inactive for selected services to preserve sessions. +- Tooling caution: bash tool cwd must exist; /home/dank/Projects/serverAppConfigs is known valid. The read tool handles relative paths well. -## Critical Constraints (DO NOT OVERRIDE) -- **FIT=off**: Auto-fit crashes on this architecture's hyper-connection/indexer config. -- **Context Limit**: `-ngl 999` required to force SVM backing for all layers. -- **Env Vars**: NEVER set `TEMP`, `HOST`, or `GPU_MAX_HEAP_SIZE`. ROCm HIP runtime consumes bare env vars. llama.cpp CLI flags (`--host`, `--port`, `--temp`) are not read from env. -- **Capabilities**: Text-only. No `mmproj`, no MTP draft head. +## Network, DNS, TLS, and auth chain +- Domain: franksdank.cloud. +- Public DNS: Porkbun. Public A records point WAN clients to 71.227.227.172 when exposed. +- LAN DNS: Pi-hole on homelab, resolving the same internal service names to Dankclaw 192.168.0.143 via addn-hosts/local records. G36 router DHCP hands out Pi-hole to LAN clients. +- Removing an ordinary Porkbun A record makes a subdomain unavailable/NXDOMAIN externally while LAN Pi-hole resolution continues. This does not remove router port forwards or direct-IP exposure by itself. +- Keep public DNS for names needed externally, especially auth.franksdank.cloud and likely gitea.franksdank.cloud. Be cautious removing public DNS for auth because external login/debug flows have depended on it. +- Caddy runs as a single container on Dankclaw and fronts services on both Dankclaw and Dankserver by Host header. +- TLS uses real Let’s Encrypt wildcard DNS-01 certificates through a franksdank/caddy-porkbun image with Porkbun API credentials from dankclaw/.env, deployed to /home/dank/Containers/caddy/env. Never commit Porkbun credentials. +- Caddy admin must remain enabled on 127.0.0.1:2019 inside the container. Turning admin off disables the config file watcher and caused stale basicauth hashes to remain loaded. +- Auth chain for protected vhosts: browser -> Caddy TLS -> Anubis JS challenge -> internal Caddy/Auth routing -> Authentik outpost forward_auth -> app. +- Authentik outpost provider matching is by exact Host header. Curl without the right Host often produces misleading 404s. +- CLI verification limitation: unknown user agents like curl may receive Anubis’s HTML JS challenge with HTTP 200, not real app/outpost success. End-to-end auth must be verified in a real browser after solving Anubis. +- Apps with native auth generally bypass Authentik forward_auth: Grafana, Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole. Protected via forward_auth include homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty. -## Configuration & Tunings (`scripts/frank-default-large.env`) -``` -BATCH_SIZE=4096 -UBATCH_SIZE=4096 -NUM_THREADS=16 -THREAD_BATCH=32 -CTX_SIZE=524288 -PARALLEL=2 -CACHE_TYPE_K=f16 -CACHE_TYPE_V=f16 -CTX_CHECKPOINTS=16 -CACHE_RAM=8192 -HSA_OVERRIDE_GFX_VERSION=11.5.1 -LISTEN_PORT=7770 -``` +## Hermes on Dankclaw +- Hermes data persists via bind mount /home/dank/hermes-data:/data. HERMES_DATA_DIR and HERMES_HOME must point to /data. +- Hermes requires an entrypoint override equivalent to hermes gateway run --force -v to avoid default TUI crash-loop on exit. +- Hermes WebUI has used host networking. Dashboard runs separately on port 9119. Browser automation uses chrome-devtools-protocol with CDP bound to 127.0.0.1:9222. +- Live Hermes config is /home/dank/hermes-data/config.yaml inside host data. Repo file dankclaw/hermes/config.yaml.example is only a sanitized baseline; do not overwrite live secrets/state from it. Do not commit dashboard password hashes, phone numbers, OAuth credentials, API keys, sessions, memories, or generated state. +- Live config quirk: /data/config.yaml may be owned by an unmapped UID, so direct edits as dank may fail; use sudo-safe editing if needed. +- NPM npx cache for Hermes tools lives in container layer: first tool call in a fresh container may download; restarts keep cache, recreation resets it. +- Hermes FLM/Gemma rollout: + - Added provider dankclaw-npu at http://192.168.0.143:7771/v1. + - Model gemma4-it:e4b. + - auxiliary.vision routed to provider custom, model gemma4-it:e4b, base_url http://192.168.0.143:7771/v1. + - Main Hermes model remained frank-default-large via dankclaw-large at http://192.168.0.143:7770/v1. + - ~/.omp/agent/models.yml frank-default-large context length adjusted to 200000 for agent behavior. +- Recent Hermes/Signal diagnostic on Dankclaw: + - hermes, hermes-webui, and hermes-dashboard were active/generated. + - signal-cli-daemon.service was inactive/disabled. + - Hermes WebUI listened on 0.0.0.0:8787, dashboard/rootlessport on 9119, CDP on 127.0.0.1:9222. + - No listener on 8080, so Signal HTTP transport was likely unavailable despite healthy WebUI. + - If WebUI cannot reach Hermes/Signal, first check signal-cli-daemon.service with systemctl --user status and journalctl --user -u signal-cli-daemon.service; enable/start only if appropriate, then verify port 8080. -## Operational Workflow & Benchmarking -- **Startup:** Model load takes ~55s+. GPU pool handles heavy I/O via mmap. -- **Health Checks:** Use `curl -s http://127.0.0.1:7770/health` (or target benchmark ports). Always poll in loops (5+ checks, ~5s apart) before proceeding. -- **Benchmark Orchestration:** SSH from controller. Use `frank-default-small` to drive benchmark scripts against `frank-default-large`. -- **Current Status:** Batch/ubatch tuning interrupted during health-polling for benchmark servers (ports 7772/7773). Next phase: threads-batch sweep. -- **Prior History:** CIRU PromptForge v3 → Kairic Edge IU4 → Qwen3.8-27B ROCmFP4 STRIX MTP → Q8_0 AGENT (failed) → STRIX MTP → Qwen3.8-Flash-Next 177B. +## frank-default-large current state and pitfalls +- Current durable configuration supersedes older agentionai/ciru/charlie-only experiments: frank-default-large on Dankclaw serves kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF via kingjones30/ROCmFPX/qwen4exp ROCmFPX runtime. +- Service alias: frank-default-large. +- Serve script and env: /home/dank/Projects/serverAppConfigs/scripts/serve-frank-large.sh and scripts/frank-default-large.env. +- Model path: /home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX/Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf. +- Runtime binary: /home/dank/GitPackages/kingjones-ROCmFPX/build/bin/llama-server, built for HIP/ROCm on Strix Halo gfx1151, ROCm 7.2.4. Stock llama.cpp and charlie12345/ROCmFPX alone cannot load this GGUF because ROCmFP4 tensor types and qwen4exp architecture support must be present in the same tree. +- Hardware target: Dankclaw Strix Halo gfx1151 unified memory. Env uses HSA_OVERRIDE_GFX_VERSION=11.5.1, HIP_VISIBLE_DEVICES=0, device ROCm0. +- Model details: Qwen3.8-Flash-Next base / qwen4exp MoE, 512 experts/10 used, 48 layers (12 attention + 36 SSM), QSA indexer, hyper-connections, PLE at layer 1. Single GGUF about 113.47 GiB, file_type 105, Q4_0_ROCMFP4_STRIX. PLE table about 50.66 GiB Q8_0. +- Critical pitfalls: + - PLE n-gram table must remain mmap/page-cache streamed and stay out of GPU memory. Do not add --no-mmap or tensor override/offload for the PLE table. + - --fit must remain off; auto-fit has segfaulted on qwen4exp hyper-connection config. + - Avoid bare environment variable names TEMP, HOST, and GPU_MAX_HEAP_SIZE; HIP/ROCm may read them. Pass llama.cpp host/port/temp as CLI flags. + - If graph build aborts on QSA F16 mask with flash attention, port scripts/patches/qwen4exp-qsa-f32-mask.patch into the active kingjones ROCmFPX tree and rebuild. + - Do not assume Qwen3.8-Flash-Next MTP heads are compatible by name. Prior MTP heads failed missing blk.0.hc_attn_norm.weight. Speculative decoding is currently disabled in latest durable config (SPEC_TYPE=none), despite older ngram-mod/MTP experiments. +- Latest serving defaults captured: host 0.0.0.0, port 7770, ctx 401408, parallel 2 slots, batch 4096, ubatch 512, threads 16, threads-batch 16, f16 KV, flash-attn on, split-mode none, gpu-layers 999, ctx-checkpoints 16, cache-ram 8192 MiB, prompt cache and idle-slot cache enabled, metrics enabled. +- Sampling defaults: temp 0.7, top_p 0.8, top_k 20, min_p 0.0, presence_penalty 1.5, reasoning on, reasoning-format deepseek, reasoning-budget -1. +- mmproj: STRIX repo ships no mmproj. Serve script conditionally passes /home/dank/models/agentionai-Qwen3.8-Flash-Next-ROCmFP4-FAST/mmproj/mmproj-Qwen3.8-Flash-Next-f16.gguf if readable. +- Benchmark lessons: separate prefill/TTFT from decode tok/s. Prior stable prefill setting was batch/ubatch 4096/4096, but current durable env may differ; check repo. Decode sweep found THREAD_BATCH=16 best with 8K prompt and 256 gen tokens. Use 256 gen tokens for decode comparisons unless testing thermal/stability. -## File & Git References -- **Model Path:** `/home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX/Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf` -- **Configs:** `scripts/frank-default-large.env`, `scripts/serve-frank-large.sh` -- **Docs:** `docs/LLM/kingjones-strix-rocmfp4.md`, `docs/LLM/index.md`, `docs/index.md` -- **Git Branch:** `frank-large-strix-model` (origin: Dankclaw Gitea) +## Media and service state +- Plex homepage URL was updated to http://plex.franksdank.cloud/web/index.html in shared homepage configs. Deployed commit 8895a02 with 233/233 tests green. +- Jellyfin mount: /mnt/entropy:/data:ro. Health was 200 and libraries verified. DB path: /home/dank/Containers/jellyfin/config/data/jellyfin.db. Relevant table is BaseItems, not TypedBaseItems. User directive: stop touching Jellyfin/Copyparty after verification unless explicitly asked. +- Copyparty: + - Durable mount intent: /mnt/entropy:/w:ro or copyparty volume arg equivalent to browsable/read-only. + - Important permission fix: copyparty bare A means everyone full access, not anonymous-deny. Correct read-only behavior used -v /w::r:ra,dank, omitting w/m/d. Authentik-protected traffic reaches copyparty as unauthenticated, so anonymous must retain r for web reads. + - Do not preserve old compose secret in memory; rotate any exposed compose-interpolated copyparty password if host/container inspect access was possible. + - Earlier bare compose stack lacked Quadlet boot-persistence; newer standardization prefers Quadlet. +- Plex/Tautulli migration on Dankserver: + - Goal achieved as zero-bytes-moved Podman Quadlets. + - Plex image pin: lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322. + - Tautulli image pin: lscr.io/linuxserver/tautulli:v2.18.1-ls242. + - Rootless UserNS=host. Plex PUID=0/PGID=0 because rootless Podman cannot map real uid 997 natively; /var/lib/plexmediaserver chowned to 1000:1000 for container operation. Rollback chowns back to 997:984. + - Tautulli PUID=1000/PGID=1000. + - Plex volumes: /var/lib/plexmediaserver:/config rw, /mnt/entropy:/mnt/entropy:ro. + - Tautulli volume: /home/dank/Containers/tautulli:/config. + - Network: dankserver_appnet with aliases plex and tautulli. Ports: Plex 32400, Tautulli 8181. + - Tautulli seed config uses PMS_Web_Host=plex, PMS_Web_Port=32400, PMS_Secure=0. + - Native Plex unit stopped/masked and Tautulli snap disabled; decommission packages only after explicit sign-off. + - Plex health gate widened to 600s due to large 32GB DB migrations; no HealthCmd to avoid cold-load flapping. + +## *arr and FrankBook-Pro migration +- *arr stack (Sonarr, Radarr, Lidarr, Readarr, Prowlarr) migrates to FrankBook-Pro and is decommissioned from Dankserver. +- Keep /Volumes/COMPLETE and /Volumes/COMPLETE/Finished Torrents paths verbatim; rename deferred. +- VPN egress via gluetun container. qBittorrent shares gluetun netns or a related service netns as configured; ensure VPN egress gate passes before publishing ports. +- Podman machine init on Mac requires bind mounts for /Volumes/COMPLETE and /Volumes/INCOMPLETE. Adding mounts later may require machine re-init. +- Config dirs are archived to /home/dank/archive/-arr-configs.tar.gz before removal; virgin installs can skip archive. +- Exposure model: private LAN-only direct IP:port and Pi-hole DNS; no Caddy vhost on Mac. +- Seerr target: Dankclaw, SQLite, Authentik OIDC SSO, provider created before route flip. + +## Volume security and miscellaneous technical notes +- POSIX single-writer/multi-reader pattern: create dedicated writer user and readers group; set volume owner writer:readers and chmod 2775 so new files inherit group. Restrict SSH/SFTP via Match block or ForceCommand internal-sftp. +- FreeToken build on Dankclaw is build-only, no deploy/run. Environment has ROCm 6.3, NVIDIA driver 575.57.02, CMake, Python, git. Vulkan or ROCm builds are feasible. +- GGUF loader constraint in one context: restricted to Gemma4GGUFForCausalLM. Supports F32/F16/BF16 native views and Q4_0/Q6_K dequant. Q8_0 mapped but lacks dequant and raises NotImplementedError. + +## ASUS TUF GAMING B650-E WIFI BIOS workflow +- Use the exact ASUS TUF GAMING B650-E WIFI support page; avoid wrong CAP files for similar boards such as B650M-E or B650-PLUS. +- Target latest memory-compat BIOS captured: 3886 beta (2026-07), AGESA 1.2.0.3a Patch A. Current referenced BIOS was 2613. +- Backup current BIOS before flashing: + - sudo pacman -S flashrom + - sudo flashrom --programmer internal -r bios-2613-backup-1.bin + - sudo flashrom --programmer internal -r bios-2613-backup-2.bin + - sha256sum bios-2613-backup-*.bin; hashes must match. +- Expected AM5 SPI dump size about 32 MB. Copy backups to USB and another machine. +- Never write BIOS with flashrom from Linux. Use UEFI/EZ Flash normal path. Use USB BIOS FlashBack only for no-POST rescue and exact renamed CAP from manual/support page. +- Dankserver hosts media stack and frank-default-small, so BIOS flash implies roughly 15–20 minutes downtime. First boot after AGESA update may black-screen 1–5 minutes for DDR5 retraining; wait. +- Post-flash: settings reset. Re-apply memory profile/manual settings, rerun memtest, verify BIOS version with BIOS screen or sudo dmidecode -s bios-version. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/learned.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/learned.md index bc15cdc..b0430bc 100644 --- a/agent/memories/--home-dank-Projects-serverAppConfigs--/learned.md +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/learned.md @@ -1,3 +1,74 @@ +- On Dankclaw's Hermes stack, hermes-webui ran with the image-baked HERMES_HOME=/opt/data while the gateway used /data; /opt/data is an auto-created anonymous volume at the image's VOLUME point, so every container recreation (restart/redeploy) reset the webui's config home to the image-default template (provider: auto → openrouter.ai with no API key) — this is why model renames "didn't propagate" and chat failed with connect errors. Fix (2026-09-05, commit 184df9a): Environment=HERMES_HOME=/data in the hermes-webui quadlet so webui + gateway share one config/state root. Diagnostic order for "can't access models" on hermes: (1) check which config home each runtime actually reads (podman exec c printenv HERMES_HOME), (2) resolve provider→endpoint with the app's own code (hermes_cli.providers.resolve_user_provider(name, cfg["providers"]) accepts api/url/base_url keys on providers: dict entries), (3) probe the served endpoint with the exact model id. Model ids must match served aliases exactly (frank-large @192.168.0.143:7770, frank-small @192.168.0.235:7770, gemma4-it:e4b @192.168.0.143:7771 — FLM routes only exact registry tags). +- Hermes (Dankclaw) model routing as of 2026-09-05: main default = frank-large (Dankclaw 192.168.0.143:7770/v1), small/aux routes = frank-small (Dankserver 192.168.0.235:7770/v1), vision + title_generation route to the exact FLM registry tag gemma4-it:e4b (192.168.0.143:7771/v1). The pre-rename aliases frank-default-large/-small/-sightsound are dead since the 2026-09-03 rename cutover — never route on them. Live config lives at /home/dank/Containers/hermes/data/config.yaml (owned by uid 109999; needs sudo to read/edit); the repo's dankclaw/hermes/config.yaml.example is a sanitized backup and can lag live, so diff live first before editing either. Signal adapter is currently disabled in live config (platforms.signal.enabled: false). +- On the guarded franksdank.cloud vhosts (Caddy → Anubis :8923 → Authentik outpost), every unauthenticated request — roots and deep paths alike — is answered with HTTP **200** and an HTML challenge page (titleMaking sure you're not a bot!/title), not a 4xx. Verifying guard health by status code alone is meaningless; assert on leakage markers instead (copyparty UI title, homepage id="grid", services.json "category" JSON shape). Non-JS clients (curl/wget/WebDAV) can never solve the PoW challenge, so they are permanently parked at the challenge page — this is the entire security boundary for copyparty, which serves authenticated traffic with anonymous read perms (-v /w::r:ra,dank). Pinned by tests/e2e/specs/15-unauth-fetch.spec.ts (guest project, empty storage state): any guard-route regression that lets app bytes answer fails loudly; any gate implementation passes. +- On Dankclaw's Pi-hole (FTL v6.7, quadlet at /home/dank/Containers/pihole), /etc/pihole/hosts/custom.list (host path /home/dank/Containers/pihole/etc-pihole/hosts/custom.list) is a LIVE-ONLY Custom-DNS source NOT tracked in the repo — it held ~22 A records pointing every *.franksdank.cloud vhost at 192.168.0.143, including names with no public Porkbun record. gravity.db's domainlist table has zero custom-DNS rows on this build, and the pihole CLI's sqlite path (pihole-FTL sqlite3) works but the web API auth was failing at discovery time, so retiring a name from LAN DNS requires editing custom.list directly (sudo sed -i '/name/d') followed by podman exec pihole pihole restartdns reload; deleting only the repo-managed addn-hosts record is not sufficient. Verify with dig +short name @192.168.0.143 → empty answer. +- Pi-hole admin panel at pihole.franksdank.cloud has two auth layers: Caddy basicauth (edge, username dankuser + hash) and Pi-hole internal password (CivetWeb, set via pihole setpassword). The Pi-hole internal password was the actual failure point, not the Caddy hash. Pi-hole resolves to 192.168.0.143 via addn-hosts (all 28 names point here), making it a LAN service behind Caddy's public TLS edge. Options to remove public exposure: (1) remove the Caddy vhost entirely — LAN clients hit Pi-hole quadlet directly on :8083; (2) keep Caddy vhost but remove the Porkbun A record so external DNS won't resolve pihole.franksdank.cloud. Current state: Caddy basicauth hash = $2b$14$cJm.hbvDi1dEh7x0XRMnseaIdvIrRyH.AcTL56jGJf3wd54qvEb9K (dankuser, password pihole2026); Pi-hole internal password = pihole.2026 (set via pihole setpassword, survives restart). +- Pi-hole admin at pihole.franksdank.cloud has two auth layers: (1) Caddy basicauth edge (username dankuser, hash in rendered Caddyfile from CADDY_BASICAUTH_HASH in .env), (2) Pi-hole internal CivetWeb password (stored in cli_pw as bcrypt hash, set via pihole setpassword CLI). The env file WEBPASSWORD is used at container start but the CLI hash is what the running web server validates. When "I can't get into Pi-hole admin" returns 403 even after Caddy basicauth passes, the Pi-hole internal password is the likely culprit. Fix: podman exec pihole pihole setpassword newpw to update the CLI hash, then verify podman exec pihole cat /etc/pihole/cli_pw shows updated value. Verify by curling with basicauth: curl -sk -H 'Authorization: Basic ZGFua3VzZXI6...' https://pihole.franksdank.cloud/admin/ should return 302 (not 401 or 403). +- Pi-hole admin panel at pihole.franksdank.cloud uses Caddy basicauth (not Pi-hole's own CivetWeb login). The hash is shared across services (RomM, Copyparty, Pi-hole) via CADDY_BASICAUTH_HASH in the host .env. The rendered Caddyfile at /home/dank/Containers/caddy/Caddyfile is mounted into the Caddy container — updates are picked up by Caddy's file watcher without restart. Password reset: generate bcrypt hash with python3 + bcrypt (hashpw + gensalt), update the rendered Caddyfile line directly or update .env + deploy. Caddy accepts both $2a$ and $2b$ bcrypt variants. _(context: Pi-hole admin password reset session: discovered Caddy basicauth (not Anubis), could not find matching password in common candidates, reset to pihole2026, updated rendered Caddyfile directly, synced repo .env files, Caddy file watcher handled hot-reload.)_ +- On the FrankBook-Pro *arr fleet (current lsio images: Sonarr v4/Radarr v5 API v3, Lidarr v2/Readarr API v1), the download-client validation endpoints are NOT usable via API: POST /api/{v}/downloadclient/test/{id} and .../test?forceTest=true both return 405, and POST .../downloadclient/action/getTest exists but 400s without a bespoke body. To prove download-client health after changing a qB host/port, skip the API test route and prove behaviorally instead: podman exec arr curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/ (expect 200) plus a real qB login from inside the container (curl --data-urlencode username=admin --data-urlencode password=$QBIT_PW .../api/v2/auth/login, expect 200), then confirm /api/{v}/health shows no DownloadClient-*/wbrrelated warnings. Also: arr APIs redact stored client passwords as ******** (sonarr/radarr/lidarr) — PUT the object back with the sentinel untouched to preserve the stored value; readarr (v1) returns the plaintext. When editing via the edit tool, body rows must be prefixed with +, not : — : prefixes get written literally into the file. _(context: Capture turn after the arr→qB loopback repoint (2026-09-04): app-side download-client test endpoints were unreachable, so client health was proven behaviorally instead.)_ +- The *arr fleet (Prowlarr, Sonarr, Radarr, Lidarr, Readarr, qBittorrent) runs ONLY on FrankBook-Pro (192.168.0.112, Mac podman machine) since 2026-09-04 — the dankserver compose copy was removed (config roots in ~/.AGENTTRASH/20260904-dankserver-arr-teardown, 22 MB, awaiting purge approval). Fleet invariant, enforced by tests/frankbook_quadlet.bats: ALL six containers share gluetun's netns (Network=gluetun.container, Wants/After gluetun.service) and publish NO ports; the gluetun unit publishes the union (8080, 6881 tcp+udp, 9696, 8989, 7878, 8686, 8787), so all egress exits ProtonVPN by construction (AllowedIPs=0.0.0.0/0; proven: netns egress 51.179.177.14 vs residential 71.227.227.172). deploy-plan.py couples gluetun → all six joiners (a gluetun recreate kills the whole family). Consequences: (1) the old arr→qB addressing hack 10.88.0.1:8080 (podman-bridge gateway) routes INTO the tunnel from inside the netns — download clients must use 127.0.0.1:8080 (done via arr APIs, verified by real qB login from inside sonarr's container); same rule for any future Prowlarr Application rows (baseUrl 127.0.0.1:arr port). (2) Caddy arr vhosts and homepage probes target 192.168.0.112:port (host-side published ports unaffected by netns changes). (3) Known defects as of 2026-09-04: Prowlarr's Applications table is EMPTY (the four rows from 2026-08-30 were lost — prowlarr→arr sync broken until rebuilt); readarr's qB proxy auth defect needs retest post-move; EZTV/1337x "CloudFlare-blocked" parking is stale (egress now VPN — retest before enabling). (4) E2E lesson: playwright specs 11-admin/12-crawl now derive expected open-link counts from services.json (showLink) instead of hardcoded counts — keep new registry entries consistent. Also: deploy.sh --service X dispatches ONLY X on frankbook (path-coupling applies to changed-path planning); gluetun restart self-heals all netns joiners via Restart=always so a single gluetun deploy converges the family. _(context: 2026-09-04 operator decision session: dankserver arr compose copy (booted that morning) removed after Frank chose FrankBook-Pro as the sole arr deployment; netns consolidation + test seam + loopback repoint executed same session. Commits 4c7465d, df4339a.)_ +- Rootless podman on Dankserver (5.7.0, verified 2026-09-04 via /proc/pid/uid_map across 7 containers): the DEFAULT user namespace maps container uid 0 → host uid 1000 (dank) and container uid N → host 100000+N-1 (e.g. calibre-web PUID=1000 writes as 100999). Consequences: (1) PUID=0 + data roots owned 1000:1000 is the complete fleet recipe — NO UserNS/userns_mode key is needed on quadlets or compose services; the plex quadlet works without one. (2) NEVER add userns_mode: host to a podman-compose service: podman-compose 1.5.0 runs every compose service inside a pod and podman hard-rejects the combo (--userns and --pod cannot be set together), leaving the stack down with no recreate path. (3) Diagnostics: podman exec c id always shows uid=0 inside any mapping — meaningless; ground truth is /proc/container-pid/uid_map, host-side ps -o user= -p pid, or ownership of freshly-written files. (4) *arr boot-crash signature: UnauthorizedAccessException: Access to the path '/config/...' at logger init = data root not writable (e.g. root-owned dir created by sudo mkdir); the app exits before binding its port, so the port probe reads "dead" rather than "crashed" — check podman logs tail for "Press enter to exit" before assuming an outage has an infra cause. (5) NEVER pkill -f rootlessport on these hosts: it kills the port-forward helper of EVERY published container simultaneously (2026-09-03 outage); restart the owning systemd units instead. _(context: Dankserver *arr stack restore session, 2026-09-04: stack committed 2026-08-29 never booted (Sentry crash, dead ports read as outage); userns_mode: host fix was a red herring — rejected by podman-compose pods; real fix was chown 1000:1000 of /opt config dirs. Commit e454159 (revert), 8a63624 (docs).)_ +- Arr stack (6 services) on dankserver (192.168.0.235): radarr:7878, sonarr:8989, lidarr:8686, readarr:8787, prowlarr:9696, qbittorrent:8080. Caddyfile on dankclaw has two-layer pattern: (1) public vhost blocks at top level proxying to 192.168.0.235:PORT, (2) @arr named handlers inside :8017 using "host" matcher for post-auth routing. Homepage services.json adds arr entries with category (user/admin), url (*.franksdank.cloud), probe (192.168.0.235:PORT), method http. Rootlessport issue: if rootlessport process dies, ports are mapped but return 000 — kill -9 rootlessport, restart containers with podman-compose. Fix permission issues with sudo rm -rf config dir. _(context: ServerAppConfigs repo: Caddyfile changes added to dankclaw/Caddyfile (public blocks + :8017 named handlers), services.json in shared/homepage/ updated with 6 arr entries. All 233 bats tests pass. Deployed to dankclaw (dankclaw-owned).)_ +- Arr stack containers on dankserver (Plex/Prometheus/Loki via rootless podman) show 000 from curl despite rootlessport listening on the correct port. Root cause: s6 supervision in linuxserver images runs the HTTP server as a background process, but rootlessport forwards to the container's slirp4netns interface which doesn't reach the backgrounded HTTP server correctly. Symptoms: rootlessport process is running and ss shows port LISTEN, but curl returns 000 (no response, not connection reset). Fix: restart rootlessport (pkill -f rootlessport) then podman-compose down && podman-compose up -d, or use --network host to bypass rootlessport entirely. Verification: ss -tlnp | grep port shows rootlessport, podman exec container cat /proc/net/tcp6 should show the port in LISTEN state (0A). _(context: Deep investigation of arr stack containers on dankserver (192.168.0.235) failing to respond via rootlessport despite ports being published correctly. Discovered s6 supervision in linuxserver images causes the HTTP server to run as a background process that rootlessport's port forwarding can't reach.)_ +- flm-npu-pack-registration managed skill exists; when updating it, merge (read current body via skill:// URL first) rather than clobber — the runbook covers: registry edit (mkstemp+os.replace), manual pack placement with resolve/main/file?download=true (raw URLs return 135-byte LFS pointer stubs), family kernel clone from /opt/fastflowlm/share/flm/xclbins/FamilyPack into ~/.config/flm/xclbins/PackName (sudo cp -a; serve resolves under FLM_XCLBIN_PATH = user dir), verification by real completion POST on :7771 checking choices not just HTTP 200 (unknown tags answer 200 with flat {"error":"Failed to load tag model!"} body), hwctx contention (only one flm serve process can hold the NPU; second process fails every load with DRM_IOCTL_AMDXDNA_CREATE_HWCTX err=-22 = aie2 mgmt msg opcode 0x2 status 0x2000003), boot tag decides residency only (per-request routing by exact registry tag regardless of boot tag; swap cost ~6-11 s on first request after swap), FLM_CTX_LEN=-1 to let each pack load at its own trained context, and bracket-guarded pkill patterns over ssh. _(context: Capture turn for the completed NPU pack registration + boot-tag flip work on frank-npu (Dankclaw :7771), 2026-09-03.)_ +- placeholder +- Checking whether the flm-npu-pack-registration managed skill already covers the full registration runbook (manual pack placement, LFS download=true trap, family kernel clone to FLM_XCLBIN_PATH, hwctx contention rule, boot-tag flip verification) before overwriting it via manage_skill update. _(context: manage_skill create failed because the skill already exists; need its current body to merge rather than clobber.)_ +- FLM (FastFlowLM) v1.0.1 on Dankclaw, registering a custom NPU2 pack tag (verified 2026-09-03 for nuextract3:4b = Atomic-Germ/NuExtract3-4B-NPU2): (1) flm pull tag is BROKEN for custom registry entries — it throws json.exception out_of_range key 'tag:size' not found while building the download list; place pack files manually into ~/.config/flm/models/PackName/ instead (use resolve/main/file?download=true — plain raw URLs return 135-byte LFS pointer stubs, not weights). (2) The qwen3.5-family loader opens vision_weight.q4nx unconditionally even for extraction/text-only packs with vlm:false; a missing vision weight file makes the first request HANG with no error log (silent stall behind NPU lock queue), not fail-fast. Registry files list must include vision_weight.q4nx. (3) NPU hardware-context contention: while one flm serve process holds the NPU, any SECOND serve process fails every model load with DRM_IOCTL_AMDXDNA_CREATE_HWCTX err=-22 (aie2 mgmt msg opcode 0x2 status 0x2000003 = hw resource alloc fail) — even for packs that load fine in the resident process. Only ONE flm serve process may hold the NPU; tag switching works only INSIDE one serve process (swap cost ~6-11 s first request after swap). (4) Kernel packs live at /opt/fastflowlm/share/flm/xclbins/PackName/ (root-owned, sudo cp -a); copy from the same-shape family pack (NuExtract3-4B shares Qwen3.5-4B-NPU2 kernels — config.json shape-matched on hidden_size/layers/head_dim first). Also: pkill -f "pattern" over ssh matches your own ssh wrapper's command line and kills your own session — use bracket-guarded patterns like "[q]wen3.5:4b" or exact PIDs. +- In serverAppConfigs, the docs-completeness test (tests/docs_completeness.bats) scans EVERY .md under serverAppConfigs-docs/ including dot-directories like Dankserver/.AGENTTRASH/, and requires each basename to be index-linked from serverAppConfigs-docs/index.md via a case-sensitive [[basename]] grep. So the old trick "move untracked docs to .AGENTTRASH before commit" does NOT satisfy this seam anymore — an unlinked page moved into an in-tree trash dir still fails the test. Correct dedupe of duplicate doc pages (e.g. Prowlarr.md vs prowlarr.md, 2026-09-03): collapse via rename so ONE canonical file carries the current content under the exact basename index.md already links (lowercase prowlarr here); git history retains both versions, zero deletions, test passes. Also: log.md in that tree is newest-first — new dated entries go directly under the # Bundle Change Log header, not appended at file tail. +- Dankclaw Hermes network topology, verified live 2026-09-02: systemd-hermes (gateway), hermes-webui, and chrome-devtools-protocol run with NetworkMode=host, so their local addresses are the host listener table — gateway dials signal-cli at http://127.0.0.1:8080 (SIGNAL_HTTP_URL in dankclaw/.env.example), CDP binds loopback-only 127.0.0.1:9222, webui listens 0.0.0.0:8787. hermes-dashboard alone sits on the compose-era orphan network dankclaw_default (subnet 10.89.1.0/24, gateway 10.89.1.1, zero other connections) and publishes 9119→0.0.0.0:9119; from that netns the host is reachable only at 10.89.1.1 for *published* ports (3000 Gitea, 8081 SearXNG verified OPEN) while unpublished host listeners (8080 signal-cli, 8787 webui) time out, and host.containers.internal=169.254.1.2 is the pasta alias for the default podman net (10.88.0.0/16, gw 10.88.0.1) so it is NOT routed from dankclaw_default. Fix if the dashboard ever needs the gateway: NetworkMode=host + drop PublishPort=9119, redeploy deploy.sh dankclaw --service hermes-dashboard. Also verified same turn: gitea-postgres (db:5432, net systemd-gitea), searxng-valkey (valkey:6379, net systemd-searxng) and alloy (OTLP 12345) publish NO ports → unreachable from the host netns by construction; Plex PMS 1.43 serves TLS-only on 32400 so an http probe there always reads down (use method tcp); and node-exporter was manually stopped on both hosts (dankserver exit 137 SIGKILL at 2026-09-01 02:18 with OOMKilled=false, dankclaw exit 143 SIGTERM ~6 days prior) leaving Prometheus's node-dankclaw/node-dankserver scrape targets connection refused until restarted — it is a bare compose service with restart=unless-stopped and no quadlet unit, so it will not survive a reboot. +- Rootless podman identity model on dankserver (verified live 2026-09-01, plex/tautulli quadlet migration): rootless podman CANNOT map real host uids outside the user's subuid/subgid range (dank: 100000:65536). UserNS=host rootless maps container root to the invoking user (dank, 1000) — not real root, and PUID=997 silently falls back to root because uid 997 is unmappable. The fleet convention is therefore: PUID=0/PGID=0 (container root = dank), data roots owned 1000:1000 (jellyfin/copyparty precedent); a data root owned by a legacy uid (997:984 for plexmediaserver) needs chown -R 1000:1000 at cutover, and rollback chowns back. Quadlet v1 gotchas proven the hard way: (1) UsernsMode= is COMPOSE syntax — the podman-user-generator hard-fails the WHOLE unit ('unsupported key UsernsMode in group Container') and systemctl --user restart name.service reports 'Unit not found'; the correct key is UserNS=. (2) Quadlet's systemd-style value parsing mangles embedded double quotes in HealthCmd= one-liners like python3 -c "..."; use the repo's proven HealthCmd=curl -fs http://localhost:8181/home pattern instead. (3) Without ContainerName=, the v1 generator names the container systemd-unit (systemd-tautulli). (4) PMS version jump 1.21.1.3795 → 1.43.3.10896 triggers one-time DB migrations/DatabaseFixups on a 32 GB DB that run 20-40+ min; a restart during migration ABORTS and re-runs it — never bounce PMS mid-migration; the 600s /identity deploy gate fails (empty-reply: PMS pre-binds 32400) and leaves deploy-state pending while the unit itself is correct. Also: line-targeted edit churn on the .container files ate three keys (tautulli ContainerName, plex Network, tautulli PublishPort) — after multi-hunk edits on unit files, read the WHOLE file before committing; the quadlet seam tests (PublishPort + enumeration) caught one, post-cutover C5 alias probe caught the other. _(context: plex-tautulli podman quadlet migration on dankserver (plan local://plex-tautulli-podman-migration-plan.md), executed 2026-09-01: first cutover failed (UsernsMode hard-fail), second failed (rootless uid mapping crash-loop on 997-owned data root), gate failures during PMS one-time migrations, three keys restored after edit churn. Commits 58aa084, c694053, 39c8135, 6302508.)_ +- Homepage deploy ownership (serverAppConfigs): homepage is Dankclaw-owned even though its config lives in shared/homepage/ (including the misleading dankserver.services.json). Correct deploy: ./scripts/deploy.sh dankclaw --service homepage — deploy-remote.sh deploy_homepage() copies shared/homepage/services.json, index.html, admin.html, app.js, style.css, fonts to /srv/homepage/ on Dankclaw and restarts the homepage-status timer. --service homepage against dankserver fails ("not deployed on dankserver"); per-host *.services.json files are tracked for reference only and are NOT shipped. Changed files only land if committed+pushed first (deployer pulls revision state). _(context: Plex homepage link fix, 2026-09-01: deploy.sh dankserver --service homepage failed ("not deployed on dankserver"); deploy-plan.py's homepage group maps to dankclaw only, and deploy-remote.sh deploy_homepage() refuses non-dankclaw targets. Discovered via dry-run + grep of deploy scripts.)_ +- Authentik (2026.8, Dankclaw) proxy-provider provisioning contract — every ProxyProvider needs BOTH: (1) all three flows set (authentication/authorization/invalidation). Any null makes the embedded outpost's Rust config deserializer reject the ENTIRE config JSON ("invalid type: null, expected a formatted UUID string") → "Failed to fetch outpost from API, retrying in 3 seconds" forever → ALL guarded vhosts die at the next outpost reload/restart. Silent killer: while the old in-memory config lives, everything works; the outage only surfaces on restart. (2) An attached Application (provider_id set). Without it, login completes but bounces to authentik's own user UI (/if/user/#/library) instead of the app — zero errors logged anywhere. The UI wizard does both automatically; raw API/ORM drives must do both explicitly. Diagnostic: the SSO e2e hostname-only assertion had a blind spot — the outpost serves the login flow ON the guarded vhost, so hostname matching proves nothing; assert pathname left /if/ AND body lacks "Powered by authentik"/"Sign in". Schema quirk: provider MTI is authentik_core_provider (PK=id) ← proxy child keyed by oauth2provider_ptr_id; Application.provider_id → base pk. _(context: 2026-09-02 seerr/grafana/loki guard outage on Dankclaw: three script-provisioned proxy providers (created via raw API/ORM with minimal payloads) broke SSO in two silent layers; fixed by backfilling flows from pk1 + creating guard Applications, verified by hardened playwright sweep 7/7.)_ +- Dankserver (192.168.0.235) hardware, verified via read-only dmidecode/lscpu 2026-09-01: Ryzen 7 7700X (Zen 4/AM5) on ASUS TUF Gaming B650-E WiFi, BIOS 2613 (2024-04). RAM = 4×16 GB G.Skill F5-6000J3038F16G (Trident Z5 Neo, dual-rank, rated DDR5-6000 CL30-38-38-96 @ 1.35V EXPO, Hynix), 64 GB total, no ECC. CRITICAL: board silently defaulted to JEDEC-safe 3600 MT/s @ 1.10V (EXPO never enabled) because 4×2R is AM5's hardest population. Agreed OC ladder (user enters BIOS manually, agent hands-off): Tier 0 = EXPO I 6000 CL30 @1.35V; Tier 1 fallback = manual 5600, FCLK 2000, UCLK 1:1, 30-38-38-96, tRFC 448, DRAM VDD/VDDQ 1.35V, VDDIO 1.30V, SOC 1.20V (≤1.25 daily), MCR disabled while tuning; Tier 2 = tRFC 448→392→360, optionally 5800. Never touch tREFI on this non-ECC 24/7 server (silent corruption risk). Validation: Memtest86+ 4 passes, y-cruncher VST 1h, journalctl -k whea/mce watch (baseline clean as of 2026-09-01). Rationale: FreeToken frank-default-small streams ~35 GB experts from host RAM → memory bandwidth is its prefill bottleneck; 3600→6000 ≈ 53→88 GB/s read [INFERENCE, platform-standard]. _(context: Dankserver RAM OC analysis turn, 2026-09-01. Read-only audit; profile delivered in chat for manual BIOS entry. User explicitly forbade edits — no sysfs/module/config changes were made; keep that constraint if resuming this task.)_ +- FrankBook-Pro qBittorrent version coupling (2026-09-01): qB is PINNED to lscr.io/linuxserver/qbittorrent:4.6.7 because Readarr's EOL qB client (frozen ~2023) rejects qB ≥ 5's 204 empty-body login success as "Authentication failure" — and that bites at RUNTIME, not just Prowlarr-style API creates (an earlier session wrongly assumed runtime cookie auth was unaffected; live evidence disproved it). Never unpin qB to latest while readarr is in the fleet. Second trap: on any qB version flip, qB 5.x's shutdown conf rewrite leaves a WebUI\Password_PBKDF2 @ByteArray line that 4.6.7 rejects — every login returns "invalid credentials" (arrs included); fix = rewrite the same conf line fresh with the same password (PBKDF2-HMAC-SHA512, 100k iterations, 16-byte salt, 64-byte key) while qB is stopped. Facts also documented in serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md (repo is source of truth). _(context: FrankBook-Pro qBittorrent pipeline work, 2026-09-01 (supplements same-day cookie/egress lesson))_ +- qBittorrent cookie-name + egress-verification gotchas (FrankBook-Pro, 2026-09-01): (1) qB 5.x names its WebUI session cookie QBT_SID_port (port-suffixed); qB 4.6.7 uses plain SID — any script hard-coding QBT_SID_8080 breaks on 4.6.7 with sidlen=0 → 403 cascades that LOOK like auth failures but never reach qB as failed logins (no ban accrues; verify via qbittorrent.log "WebAPI login success" lines). Always parse generically: grep -oE '[A-Za-z_]*SID[A-Za-z0-9_]*=[^;[:space:]]*' | head -1, then pass the whole match to curl -b. (2) Egress checks for gluetun-gated stacks MUST run inside the gluetun container (podman exec gluetun wget https://ipinfo.io/json). Running the same wget one ssh-context out (Mac host via podman machine ssh without the inner podman exec) silently returns the RESIDENTIAL IP — a false leak alarm that reads as a hard-gate violation. Confirm context by requiring the org line (AS9009 M247 for the ProtonVPN Panama config), not just country. _(context: FrankBook-Pro gluetun/qBittorrent E2E verification, 2026-09-01)_ +- Authentik 2026.8 embedded outpost (franksdank.cloud fleet) caches claims per browser session in the authentik_providers_proxy_proxysession table (session_data JSON holds claims incl. groups; observed row TTLs 1–24 h). A session authorized BEFORE a user is added to a group keeps serving the old group list to Caddy header_regexp RBAC gates → persistent 403 despite correct membership, and the 403 generates ZERO authentik events (it never reaches authentik), so logs look silent. Re-login does not help (browser cookie re-maps to the same stale row). Fix (verified live 2026-09-01 for akadmin /admin 403): DELETE rows WHERE session_data-'claims'-'preferred_username' = 'user' in the authentik-postgres container — the django login session is untouched, so the next visit re-authorizes silently and mints fresh claims. Do NOT rotate AUTHENTIK_SECRET_KEY for this (invalidates every outpost session fleet-wide). Diagnosis SQL + silent-reauth verification documented in serverAppConfigs-docs/Infrastructure/Authentik.md (commit ea0bba3). _(context: Frank reported persistent 403 at www.franksdank.cloud/admin after being added to homepage-admins; recon found his live proxysession row (expiring 2026-09-02 22:06 UTC) carried ["authentik Admins"] only, minted before the group existed. Silent re-auth proven by deleting qa-e2e-admin's 13 rows and running the e2e admin spec with --no-deps against the stale storage state (2 passed, 2.9 s, no login pr)_ +- Frank wants periodic "what did we do" HTML change reports rendered in Firefox (asked 2026-09-01; first one at /home/dank/Reports/serverAppConfigs-24h-2026-09-01.html). Preferred standard: Keep a Changelog 1.1.0 categories (Added/Changed/Fixed/Removed/Security, omit empty) inside a post-change-review skeleton (summary → timeline → categories → code samples → verification → incidents → user actions). Reports are deliverables outside the repo at ~/Reports/ (never tracked; keeps tree clean). Frank reads the report to plan his code-review pass, so include a ready-made git show/git diff command list per theme. _(context: Built a 38 KB self-contained HTML report for serverAppConfigs covering 39 commits/24h; verified render via headless browser screenshot before handing over; opened via firefox --new-tab file:///....)_ +- Playwright automation of authentik's Lit flow executor (fleet e2e, tests/e2e/lib/login.ts akLogin): a programmatic page.fill races the stage re-render — the Lit web component re-renders right after mount and wipes the input, so the form submits an EMPTY password ("This field is required") even though fill() succeeded. Hardened pattern: fill, VERIFY the value survived (expect the input's value, short retry), submit with Enter (native form path, no button re-render race), and retry the whole stage up to 3 attempts before failing. Two adjacent musts: every login runs in a FRESH browser context (a reused/half-finished context poisons authentik's pending_user stage and hangs the next login), and the browser needs a real Chrome UA (Anubis denies obvious headless UAs); budget 60s assertions for the first Anubis PoW per fresh context (subsequent guarded vhosts skip challenge thanks to COOKIE_DOMAIN solve-once). Conventions documented in serverAppConfigs-docs/Architecture/E2E Suite.md (commit b945dd0). _(context: frank-default e2e suite hardening, 2026-09-01: 10/11 spec flake root-caused to Lit re-render race + Anubis PoW budgets; suite now 17/17 green across setup/standard/admin/guest projects.)_ +- Fleet VPN truth (verified 2026-09-01): the gluetun VPN_SERVICE_PROVIDER=custom profile on Dankclaw (endpoint 149.102.254.77:51820) points at a **ProtonVPN Seattle WireGuard server**, NOT a self-run box. Evidence: RDAP via curl -sL https://rdap.org/ip/IP (works when whois is empty) — endpoint IP → CDNEXT-CG-SEA/Datacamp; Dankclaw's tunnel v6 2a07:b944::2:2 → CH-PROTONVPN-20160719; exit IP 149.22.88.19 → CDNEXT-SEA-CG. Full 65535-port scan fingerprint: no SSH anywhere, only silent TLS listeners on 443, 4443–4468, 5995, 7770, 8443 (Proton protocol-stealth port map). Consequences: (1) adding a "peer" is never server admin — it's generating a new WireGuard config in Frank's Proton dashboard; each config = one keypair, Proton has NO BYO pubkey (a locally generated keypair is useless; one was retired to dankclaw ~/.AGENTTRASH/20260901-frankbook-wg-keypair). (2) Two hosts sharing one Proton config make the server bounce the endpoint between them — reusing Dankclaw's config for FrankBook-Pro would kill the Dankclaw tunnel (SearXNG). (3) Mac gate: second dashboard config (e.g. named frankbook) → PrivateKey/Address paste into /home/core/Containers/gluetun/env; server pubkey utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs=, gluetun ignores the .conf DNS line. General technique: identify mystery infra with rdap.org RDAP + nmap port fingerprint before asking the user to administer it. _(context: FrankBook-Pro WG gate investigation, 2026-09-01. Probes: no SSH config aliases on Dankware/Dankclaw, port 22 timeout, full nmap scan, RDAP on 3 IPs. Docs rewritten: serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md "Mac provisioning" section; log.md entry. Repo commits 2d06be8, 3094ffa, f1171b9.)_ +- When a fleet credential "mystery" arises (auth works/doesn't contradict user memory): (1) assume session-archive images are corrupted — OCR of transcript frames mangles strings while preserving shape (Jellyfin admin password read as "ResFace_3241" instead of "Assface.3241"; the prefix was garbage, the digits were real; the user's own recall had the right prefix but flipped digits). (2) NEVER brute-force a live auth endpoint — pull the stored hash and verify candidates offline: Jellyfin stores it in jellyfin.db (Users table, Password column) as $PBKDF2-SHA512$iterations=210000$salt$hash where salt AND hash are HEX-ENCODED (32 B salt → 64 hex chars, 128-char hash). A parser that assumes base64 silently tests zero candidates — always print back the parsed lengths (saltbytes/hashbytes) and candidate count before concluding "no match". (3) A single matching hash is conclusive; a live POST adds nothing and just logs auth-failure warnings. _(context: Jellyfin 401 mystery on Dankserver, 2026-09-01. User's correction of the corrupted prefix + digit flip; offline hash check vs stored DB hash decided it. Files: serverAppConfigs-docs/Dankserver/Jellyfin.md, serverAppConfigs-docs/log.md (both corrected).)_ +- Rootless podman UID mapping on Dankclaw/Dankserver is CONTINUOUS, not offset: container uid N → host uid 100000 + N - 1 (dank subuid 100000:65536; container 0 → 1000, container 1 → 100000, container 1000 → 100999). Never compute host uid as 100000+N. Before chowning a bind root for a non-root image, read the real mapping from any throwaway container: podman run --rm image cat /proc/self/uid_map ("ID-inside ID-outside range" lines). A wrong chown gives EACCES crash-loops (quadlet auto-restart, container never persists; podman logs empty because --rm). Verified 2026-09-01 with seerr-team/seerr (in-image node uid 1000 → chown 100999 fixed it). _(context: Seerr first boot on Dankclaw crash-looped with EACCES mkdir /app/config/logs after chown 101000; /proc/self/uid_map showed "1 100000 65536" ⇒ container 1000 → host 100999. Second off-by-one incident on this fleet (postgres 100069 arithmetic was the first).)_ +- Two pitfalls from the 2026-09-01 frankbook/dankserver session: (1) zsh (default login shell on Dankware AND dankserver) expands =word at the start of an unquoted word to the command's path — so echo ==FOO== inside an ssh command fails with zsh:1: =FOO== not found. Quote echo arguments (echo "==FOO==") or use printf in any command line destined for zsh. (2) qBittorrent ≥ 4.2 ignores a plaintext WebUI\Password in qBittorrent.conf — it must be @ByteArray(salt:hash) from PBKDF2-HMAC-SHA512 (100000 iterations, 16-byte salt, 64-byte key, both base64). Also when the WebUI is reached through a port forwarder that preserves the LAN Host header (e.g. socat), set HostHeaderValidation=false and ServerDomains=* or qB rejects the request. Reference implementation: VM_SEED heredoc in deploy_frankbook_stack, scripts/deploy-remote.sh. _(context: frankbook-pro *arr bring-up + dankserver cutover verification, serverAppConfigs repo)_ +- FreeToken v0.1.2 on qwen3_5_moe loads ONLY modelopt-style quant configs: block-fp8 (quant_method "fp8" + weight_scale_inv, the Huihui/official-Qwen format) works; every compressed-tensors FP8 checkpoint fails. Two live-verified failure modes (2026-09-01, Dankserver): (1) compressed-tensors per-channel (Ornith-1.5-35B-A3B-FP8) aborts at expert-source resolution — ValueError "Missing MoE expert source layers: {'gate_up': ...}" because expert tensors don't follow mlp.experts.{N}.gate_proj/up_proj/down_proj naming; (2) compressed-tensors block-fp8 128×128 (HauhauCS-Aggressive-fp8) resolves experts but _dequant_fp8_weight multiplies weight × weight_scale directly, so [out/128, in/128] block scales don't broadcast → RuntimeError shape mismatch (tensor a 2048 vs b ...). Both exit cleanly at load (~37 GB fits RAM, no swap-thrash). Before swapping any model onto FreeToken, check config.json quant_method/weight_scale shape; a "healthy after ~6s" from deploy.sh proves nothing (health gate passes while the doomed worker is still starting) — verify via journal Uvicorn startup + a real completion. Evidence: serverAppConfigs-docs/LLM/free[REDACTED].md Quantization Compatibility table. _(context: frank-default-small model-swap attempts on Dankserver, 2026-09-01: Ornith FP8 and HauhauCS FP8 both failed to load on FreeToken v0.1.2; reverted to batsclamp Huihui FP8 (commit 4d5bea4), docs commit fe34f04.)_ +- skill://quadlet-v1-generator-quirks +- Before swapping a model into an LLM service, preflight the CHECKPOINT SIZE (bytes on disk / weight precision) against the host's usable RAM, not just VRAM — the failure is silent and self-sustaining, not a clean crash. Case: thomsonreuters/Thomson-1.0-Small is Qwen3.6-35B-A3B arch but ships BF16 (~66 GB) vs the Huihui FP8 it replaced (~35 GB); Dankserver has 62 GB system RAM. FreeToken streams MoE experts from host RAM, so 66 GB of weights exceed physical RAM. Compounding traps that turned a fit-failure into an outage: (1) 127 GB swap means the kernel PAGES instead of OOM-killing, so sshd is starved and never gets killed — no recovery window opens on its own; (2) systemd Restart=on-failure makes it a crash-reload-rethrash loop; (3) the unit is enabled + WantedBy=multi-user.target, so even a reboot re-thrashes on boot until the bad MODEL_DIR is masked/reverted — a plain power-cycle does NOT fix it. Correct recovery requires a shell to run systemctl mask --now svc FIRST (stops + breaks the reboot trap), then pull the revert. deploy.sh reports "healthy after Ns" as soon as systemd is active, BEFORE the model finishes loading — never treat that as load success; verify with a real completion. Verdict: BF16 35B-A3B cannot run on a 62 GB box; needs an FP8/GGUF quant or a bigger host. RTX 3090 has no FP8 tensor cores so even FP8 runs via upcast but still fits in RAM. _(context: 2026-09-01 frank-default-small swap to Thomson-1.0-Small on Dankserver caused a sustained swap-thrash outage; SSH locked out, no OOM relief due to 127GB swap. Repo revert staged (commit 1163844), awaiting physical/console recovery.)_ +- FLM NPU model swap on Dankclaw: install new model via flm-add HF-repo --family family (downloads to ~/.config/flm/models/Name/), register tag in user model_list.json if missing, swap FLM_MODEL in scripts/frank-default-sightsound.env, then restart. Two common pitfalls: (1) FLM looks for xclbins at $FLM_XCLBIN_PATH/ModelName/ — if family is qwen3.5 but the model name is different, create a symlink from the expected name to the family's xclbin dir (e.g. Qwen3.8-Distilled-Heretic-9B-NPU2 → Qwen3.5-9B-NPU2); (2) flm-add leaves vision_weight as .q4nx.part — must rename to .q4nx before FLM can open it. Service uses FLM_CONFIG_PATH and FLM_XCLBIN_PATH exports for tag resolution; unknown tags return 200 with {"error":"Failed to load tag model!"}. +- FreeToken on Dankclaw builds successfully via the CUDA path (not ROCm). Key details: (1) install nvidia-cuda-toolkit via apt (provides nvcc + libcudart at /usr), (2) set CUDA_HOME=/usr, FREETOKEN_ALLOW_CUDA_MISMATCH=1 (nvcc 12.4 vs torch cu130 is safe), (3) uv installed at /home/dank/.local/bin/uv, (4) source .venv/bin/activate in FreeToken/. The build installs torch 2.11.0+cu130, flashinfer 0.6.18, sgl-kernel 0.4.5. FTW format stores dtype per-tensor in index — FP16, BF16 (default), FP32, FP8 are all first-class. GGUF support is model-specific: only Gemma4GGUFForCausalLM has GGUF in the registry. GGML types: F32/F16/BF16 use native torch views; Q4_0 and Q6_K have dequant functions; Q8_0 is listed in GGML_NAME but has no dequant function (raises NotImplementedError). The GGUF reader uses gguf-py and is_gguf_path checks for .gguf files. +- FreeToken does not need FP8 — the FTW format is dtype-agnostic (stores per-tensor dtype in index). Default dtype is BF16 (torch.bfloat16). FP16, FP32, BF16, FP8, FP4 (DS/NV/MX), and Q4_0 are all supported. convert_checkpoint(dtype=torch.bfloat16) is the default; pass any torch.dtype for non-default. +- FreeToken on Dankclaw: CUDA path requires nvidia-cuda-toolkit (apt package, provides nvcc + libcudart at /usr/bin/nvcc and /usr/lib/x86_64-linux-gnu/libcudart.so). Set CUDA_HOME=/usr and FREETOKEN_ALLOW_CUDA_MISMATCH=1 (nvcc 12.4 vs torch 2.11.0+cu130 CUDA 13.0 kernels — safe override). Build: git clone, uv venv, uv pip install -e ".[accel]". UV installed to /home/dank/.local/bin/uv. +- FreeToken on Dankclaw builds for CUDA (not ROCm) because freetoken.kernel._pinned_tensor links against cudart. Ubuntu CUDA toolkit installs to /usr (not /usr/local/cuda), so CUDA_HOME=/usr is required. nvcc 12.4 + torch cu130 requires FREETOKEN_ALLOW_CUDA_MISMATCH=1. UV installs to /home/dank/.local/bin/uv and must be added to PATH. +- FreeToken can build on Dankclaw for both ROCm and CUDA. ROCm is the natural path: gfx1151 GPU with amdgpu driver loaded, ROCm 6.3 at /opt/rocm/, hipcc 7.2. All build deps present: cmake 4.2.3, git 2.53, python 3.14, gcc 15.2, ninja 1.13.2. Dependency chain for ROCm: torch 2.11 (has rocm6.3 wheels on PyPI), sgl-kernel 0.4.5 (has ROCm wheels), flashinfer-python (has ROCm wheels). CUDA path also works (nvidia driver 575.57, Vulkan libs present) but needs nvcc for JIT-compiled CUDA kernels on first use — install via sudo pacman -S cuda. Build command: pip install -e ".[accel]" (uv optional). Vulkan libs at /usr/lib/x86_64-linux-gnu/ but not a FreeToken build requirement. +- frank-default-large contextWindow in ~/.omp/agent/models.yml is 200000 (per-slot with parallel 2), not 401408 (total CTX_SIZE) or 262144. The serve-frank-large.env has CTX_SIZE=401408 / PARALLEL=2, but the user consistently uses the per-slot value of 200000. +- Hermes CDP browser daemon (deployed 2026-08-31, commit 2072354): chrome-devtools-protocol.container quadlet on Dankclaw runs digest-pinned chromedp/headless-shell with entrypoint override /headless-shell/headless-shell --remote-debugging-address=127.0.0.1 --remote-debugging-port=9222 ... — the override deliberately drops the image's socat front which would bind 0.0.0.0:9222 and expose browser control to the whole LAN. Deployer (deploy_hermes) starts it only if inactive; a restart kills in-flight browser sessions, so restart manually only when intended. hermes-webui was flipped to Network=host so both agent consumers (Signal gateway + webui) share the daemon's host netns and can dial 127.0.0.1:9222; bridge-network clients cannot reach it at all by design. Client wiring lives in live /data/config.yaml under mcp_servers.chrome-devtools = command /usr/local/bin/npx, args ["-y","chrome-devtools-mcp@latest","--browserUrl=http://127.0.0.1:9222"]; npx package cache lives in the container layer, so a recreation (not restart) pays one first-call npm download. /data/config.yaml is owned by the unmapped uid — even world-writable dir doesn't make the file readable by dank; edit via sudo python3 - piped script. Verification gotcha proven live: an MCP stdio client probe must newline-terminate each JSON-RPC message AND keep stdin open (sleep) after writing, because on immediate EOF the server exits before flushing any response and you observe empty output with rc=0; also, \n inside ssh single-quotes → sh -c double-quotes lands as literal backslash-n in printf args (invalid JSON), so pipe a written script via ssh 'bash -s' /tmp/probe.sh instead of nested quoting. +- Hermes containers on dankclaw (systemd-hermes, hermes-webui, hermes-dashboard) run as root with SSH keys at /root/.ssh/id_ed25519. Their pubkeys must be in: (1) dankclaw's /root/.ssh/authorized_keys AND ~dank/.ssh/authorized_keys (hermes SSH to dankclaw as root, but dank's own key is for dank@dankclaw), (2) dankserver's ~dank/.ssh/authorized_keys, (3) FrankBook-Pro's ~dank/.ssh/authorized_keys. The hermes containers SSH to dankclaw as root@192.168.0.143, to dankserver as dank@192.168.0.235, and to FrankBook-Pro as dank@192.168.0.112. Each hermes key is unique per container (not shared). The dank@dankclaw key (dankclaw's own id_ed25519) was also missing from dankserver and FrankBook-Pro and needed adding for host-to-host SSH. +- On FrankBook-Pro (macOS Intel x86_64), gvproxy is not bundled with the standalone podman v5.4.2 binary. Must build it from source using go build -mod=mod -o /usr/local/bin/gvproxy github.com/containers/gvisor-tap-vsock/cmd/gvproxy. The old /usr/local/bin/gvproxy file is only 9 bytes ("Not Found" text from a failed curl download) — must rm -f it before building. After building, it becomes a Mach-O 64-bit x86_64 executable (~19.5 MB). The podman machine on FrankBook-Pro is initialized but also requires vfkit in PATH to start fully (error: exec: "vfkit": executable file not found in $PATH). +- 2026-08-31 state, verified live: (1) Vhost renames must be done in lockstep — the test suite (tests/pihole.bats test 178) fails unless every Caddyfile vhost name has a Pi-hole addn-hosts A record on 192.168.0.143; chat→ai and jellyfin→jelly were renamed this way (Porkbun edit with RELATIVE label + addn-hosts line + Caddyfile vhost in one commit, then deploy.sh). Decommissioned vhosts removed from Caddy that day: comfyui, hermes, radarr, sonarr, lidarr, readarr, prowlarr, qbittorrent; their public DNS was deleted from Porkbun while Pi-hole addn-hosts entries were deliberately KEPT (user's explicit 'remove from Porkbun, not PiHole') so internal consumers still resolve them but hit no vhost — internal consumers of those services must use direct IP/port instead (e.g. Hermes dashboard at 192.168.0.143:9119). (2) hermes-webui (Hermex) auth model: password-only login via POST /api/auth/login {"password":...} returning a signed HttpOnly hermes_session cookie (24h TTL); no username field, no SSH-key concept inside the app — SSH keys authenticate only the transport layer (user tunnel on port 22; Termius-generated keys are non-exportable so the keypair must be generated inside whichever SSH app acts as transport). The webui is published LAN-bound (192.168.0.143:8787-8787) with password gating, not loopback-only anymore; off-network access = SSH tunnel on port 22 then dial http://localhost:8787. (3) The webui unit's [Container] EnvironmentFile is /home/dank/serverAppConfigs/dankclaw/.env (NOT the root .env) — a secret rotation must rewrite BOTH env files or the restarted container serves the old value; verify by podman exec printenv on the live container after restart. Also: podman exec must run UNPRIVILEGED on Dankclaw — sudo/root's namespace does not see rootless containers (exit 125). +- On Dankclaw (rootless podman), sudo podman exec user-container ... fails with exit 125 — root's podman namespace does not see the login user's rootless containers. Run podman exec as the login user (ssh dankclaw 'podman exec ...' with no sudo) when inspecting container env/config (e.g., podman exec hermes-webui printenv KEY). Same rule applies to podman inspect/ps for user-owned containers. +- On Dankclaw (rootless podman), sudo podman exec container ... fails with exit 125 — root's namespace does not see the login user's rootless containers; run podman exec unprivileged as the ssh login user instead. Related durable pattern used when repairing /home/dank/serverAppConfigs/.env on Dankclaw (2026-08-31): a prior fix had appended a raw podman inspect --format "{{json .Config.Env}}" JSON dump into the live .env, corrupting keys (HERMES_WEBUI_PASSWORD=["PATH=...). Repair = back up first (cp -a), then rewrite quoted dump lines to proper KEY=value by stripping the leading quote, and source authoritative secret values programmatically from the live container env via unprivileged podman exec svc printenv KEY rather than transcribing them — never trigger a service restart for a pure .env-file repair. Also note: JSON entries carry a leading "; anchored grep on ^KEY= fails for those lines until de-quoted (repeat of the earlier landmine-fix pitfall — verify with grep -c '^"' == 0 after any dump append). +- Decision (2026-08-31, task: "SearXNG agent-use check under Anubis"): do NOT stand up a dedicated agent-only SearXNG instance on Dankclaw. Verified live: the guarded path (search.franksdank.cloud) answers non-browser API clients with the Anubis JS-challenge page at HTTP **200** — status-code-only clients silently receive HTML where JSON was expected; always check content-type, not just status. The agent path is the direct published port http://192.168.0.143:8081/search?q=...&format=json from pass_ip (trusted) sources only — same single instance already VPN-bound via Network=gluetun.container, unreachable from outside the LAN by construction (no public route to the LAN IP). A duplicate would double upstream request volume from the same rate-sensitive WireGuard exit IP for zero benefit. Rationale recorded in repo docs: serverAppConfigs-docs/Dankclaw/SearXNG.md Gotchas section (commit ba0345a, pushed to Gitea origin) — read that file before ever proposing a second SearXNG stack. General probe heuristic: to test whether API clients can pass an Anubis-fronted route, curl the JSON endpoint with a non-browser UA and compare response content-type against HTTP status; a 200 with text/html body = guard challenge, not a working API path. +- Verified runbook for flipping a Caddy-fronted service onto the Anubis+Authentik guard chain on Dankclaw (executed 2026-08-31 for loki.franksdank.cloud, commit a382a3b): (1) create the outpost ProxyProvider FIRST via ak shell stdin (podman exec -i authentik-server ak shell /tmp/x.py; set p.pk=None before save) — external_host = exact vhost URL with trailing slash, internal_host = http://caddy:8017; (2) flip vhost to reverse_proxy anubis:8923 { header_up X-Real-Ip {remote_host} } and add the post-auth @svc host vhost handle block inside the http://:8017 listener routing to the real upstream, in ONE deploy; (3) verify unauthenticated with curl → Anubis challenge page ("Making sure you're not a bot!" markers), NOT 502. Verification pitfall: do NOT probe the internal post-auth listener as localhost:8017 from the host — it lives inside the caddy container's netns and answers HTTP 000 (connection refused) from host loopback; instead verify the reloaded config byte-exact via podman exec caddy grep -n -A3 handler /etc/caddy/Caddyfile, and confirm outpost reachability with getent hosts caddy from inside authentik-server's netns (resolves 10.89.1.211). Also: service-to-service ingestion must target internal addresses (Alloy→loki:3100 never traverses Caddy); non-browser clients can never solve the JS challenge, so any app whose backend queries a public hostname of a guarded service breaks on flip — audit datasource URLs first (Grafana's grafana.db data_source table had zero rows at flip time). _(context: Loki guard-chain flip on Dankclaw; provider pk=7 created before route flip; verified via challenge probe + live-config grep inside caddy container.)_ +- qa-e2e (pk=6) is a live authentik test account on Dankclaw created 2026-08-31 with NORMAL privileges only: no groups, is_staff=False, is_superuser=False — verified at DB level via ak shell. It passes the full guard chain (Anubis challenge → two-stage default-authentication-flow → outpost callback → app content) and was proven live landing on RomM's app UI as a real authenticated user; it therefore cannot reach any admin-only surface (Grafana/Gitea/hermes dashboards keep their own auth). Credential store for the planned Playwright E2E suite: /home/dank/.config/e2e/qa-e2e.cred, mode 0600, deliberately OUTSIDE the serverAppConfigs repo so it can never be committed or trip deploy.sh's untracked-file guard. The E2E suite design (P4) consumes this file to capture storageState; Gitea-facing tests must use a Gitea token instead — an authentik session buys nothing on the git-smart-HTTP-exempt route. Related bypass map at that time: loki.franksdank.cloud had NO auth at all (LogQL open to anyone who can reach DNS) — biggest remaining exposure; *arr/qbittorrent UIs unguarded but API-key-gated for actions; grafana/pihole gated only by shared edge basicauth. +- Edit-tool auto-prefix quirk (observed 2026-08-31, serverAppConfigs Caddyfile work): when an edit call's output warns "Auto-prefixed bare body row(s)", the tool may write literal prefix characters into the file even though the rendered diff looks clean — a : intended as an output marker landed in the file as a literal :# comment line. In a Caddyfile that parses as a matcher token and fails config validation at deploy time with a misleading error pointing at the *next* line ("unrecognized directive" on the following site block). Lesson: after any edit whose tool output shows auto-prefixing/marker warnings, byte-verify the exact edited lines (sed -n/cat -A) before commit or deploy — do not trust the rendered diff. Same class of failure can silently ship because validation gates (caddy validate) correctly skip the reload and only log a non-fatal error; verify the reload actually ran, not just that deploy exited 0. +- Rootless-podman GPU access on systemd-user-unit-spawned containers (Dankclaw comfyui, 2026-08-31): containers spawned by systemd user units get NO supplementary groups at spawn time, so group_add: render fails with "unable to find group render" (userns name lookup) AND --group-add keep-groups provably preserves an EMPTY group set — torch then dies with "No HIP GPUs are available" even though /dev/kfd and /dev/dri/renderD* are merely passed through (they show as nobody:nogroup inside = unmapped). The only spawn-context-independent fix is udev MODE 0666 on the compute nodes (kfd, renderD*; leave card* display nodes alone). Two gotchas when applying: (1) udevadm trigger --type=devices does NOT enumerate misc-class devices (they have no subsystem) — use udevadm trigger --action=change --sysname-match=kfd; (2) the rule must be KERNEL=="kfd", MODE="0666" with NO SUBSYSTEM= guard, because a SUBSYSTEM=="misc" match never matches. Verified end to end: torch.cuda.is_available() True, device "Radeon 8060S Graphics", port bound same minute. +- FLM (frank-default-sightsound, port 7771) routes chat completions per request by exact FLM registry tag: each request locks the NPU, loads the requested model if not resident, generates, releases. Measured swap costs (Aug 30 2026): first request to an unloaded tag pays full cold load (~7-90 s); switching back re-loads the previous model (~10 s) — alternating tags = every request pays swap. CRITICAL gotcha: a tag listed in /v1/models is NOT necessarily loadable — load fails with [ERROR] Failed to load model: No such file '/home/dank/.config/flm/xclbins/PackName/name.xclbin' when the kernel-pack dir isn't symlinked under FLM_XCLBIN_PATH (/home/dank/.config/flm/xclbins). Fix = ln -s /opt/fastflowlm/share/flm/xclbins/PackName ~/.config/flm/xclbins/PackName (verified for Qwen3.5-4B-NPU2; other unlisted packs fail the same way). Unknown tags answer HTTP 200 with flat {"error":"Failed to load tag model!"} and no choices — status-code-only clients silently get empty completions; clients must check the error key, not just HTTP status. +- FLM (FastFlowLM) 1.0.1 serving on frank-default-sightsound (Dankclaw, port 52626) answers unknown model tags with HTTP **200** and an error body, not a 404 and not a silent fallback: /v1/chat/completions → flat {"error":"Failed to load tag model!"} with no choices; /v1/completions → nested OpenAI-shaped server_error (code 500) also under HTTP 200. Status-code-only clients therefore see a successful empty response — any client wiring against this endpoint must check for an error key in the body, not just status. Valid tags route per-request to the exact named model (response echoes the requested tag; no restart needed to switch registry tags). This disproved the older llama3.2:1b-fallback behavior documented from 2026-08-16; corrected live-probe evidence is committed in AGENTS.md + serverAppConfigs-docs/LLM/frank-default-sightsound.md at commit 9b9f0f9 — verify against those before relying on this. General lesson: behavior claims written into docs from inference/incident notes get falsified by direct probes; probe the live endpoint (bogus input + control pair) before committing contract claims to docs or client configs. _(context: Live probe 2026-08-30 on frank-default-sightsound: bogus tag "totally-bogus:9b" against /v1/chat/completions and /v1/completions; control with valid tag gemma4-it:e4b. Docs + serve-script comment corrected in commit 9b9f0f9, deployed healthy 4 s post-deploy.)_ +- frank-default-sightsound (FLM v1.0.1, XDNA2 NPU, Dankclaw port 52626) serves the WHOLE local model registry on one port and routes /v1/chat/completions per-request by the EXACT FLM registry tag in the model field; unknown tags do NOT 404 — they silently serve llama3.2:1b instead. Any client wiring must copy tag bytes from live GET /v1/models at wiring time (never hand-type, never use a service alias). Wiring pattern used for pi client models.json on Dankware (2026-08-30): backup file → programmatic python json load/dump adding provider dankclaw-npu with baseUrl http://192.168.0.143:52626/v1, model id = exact live tag gemma4-it:e4b, contextWindow/maxTokens parsed from FLM_CTX_LEN in scripts/frank-default-sightsound.env (not transcribed), input ["text","image","audio"], reasoning true → re-parse to prove valid JSON. Health probe for this service is GET /v1/version (FLM has no /health route). Full runbook: serverAppConfigs-docs/LLM/frank-default-sightsound.md; fleet table + runtime section in AGENTS.md carry the iommu=off-kills-NPU trap (SVA bind needs enabled IOMMU for /dev/accel/accel0). +- Dankclaw hermes stack (fixed 2026-08-30, commit 56763e0): the hermes gateway is a Signal messaging agent with NO HTTP listener on :8090 — the public route hermes.franksdank.cloud → Caddy internal listener :8017 → reverse_proxy 192.168.0.143:9119 (dashboard login-gated admin UI). The gateway connects OUTBOUND to the signal-cli daemon, a HOST process at /opt/signal-cli-0.14.7 listening on host :8080, via SIGNAL_HTTP_URL=http://host.containers.internal:8080 in dankclaw/compose.yaml. Durable quirk: on this rootless-podman/netavark host, containers can only reach the host LAN IP 192.168.0.143 on PUBLISHED (DNAT'd) ports — connections to un-forwarded host ports from container space get instant Connection-refused even though a listener exists; host.containers.internal (netavark gateway alias) is the verified working path for unpublished host ports. Also durable: hermes, hermes-dashboard, and hermes-webui are compose-managed with NO quadlet units — they do not survive reboots (this is how the agent went silent after the Aug 26 reboot); a reboot requires manual podman-compose -f dankclaw/compose.yaml up -d --no-deps svc or deploy.sh dispatch. The hermes gateway drops to an unmapped uid inside its userns: /home/dank/hermes-data must be world-writable (chmod -R a+rwX) or the drop-priv user cannot traverse it and crash-loops on log writes (/data/logs/agent.log PermissionError). +- frank fleet as of 2026-08-30 night: frank-default-large (Dankclaw) = kingjones777 Qwen3.8-Flash-Next ROCmFP4-STRIX 113.47 GiB on the card's pinned kingjones30/ROCmFPX fork at /home/dank/GitPackages/kingjones-ROCmFPX/build (commit 36e9acd) — builds require -DLLAMA_BUILD_WEBUI=OFF here (npm/HF-bucket asset provisioning aborts the link at 98%). --flash-attn on works UNPATCHED on the STRIX model (the QSA F16 ggml_fill assert needing scripts/patches/qwen4exp-qsa-f32-mask.patch is agentionai-FAST-specific); mmap MUST stay on (PLE streams via page cache; --no-mmap = silent cgroup kill); no spec decode; agentionai FAST on build-qwen38 is the rollback (one env commit). frank-default-small (Dankserver) = batsclamp/Huihui-Qwen3.6-35B-A3B-abliterated-FP8 on the same FreeToken v0.1.2 runtime (native block-fp8, identical loader path + pool triple as official FP8); FreeToken's /v1/chat/completions 422s WITHOUT an explicit "model" field (llama.cpp servers don't). Deploy verification trap: a leftover manually-started llama-server holding :7770 makes both the unit crash-loop on bind AND deploy.sh's /health check pass — verify systemctl show -p MainPID matches the live pgrep, not just health. pi models.json frank-default-large contextWindow corrected to 131072 (llama clamps n_ctx_train/parallel to per-slot; the old 200000 oversold). _(context: Repo /home/dank/Projects/serverAppConfigs; commits 3066d81 (large config), aa9c1d0 (small config), 0937cfb (docs). Both swaps validated live end to end.)_ +- When deploying frank-default-large changes to Dankclaw, the service unit is managed by systemd as frank-default-large.service (NOT a user quadlet unit). The quadlet directory exists but systemd-level unit is the authoritative one. The deploy script targets the systemd service; user-level systemctl --user list-units shows nothing for frank services. +- frank-default-large env file has CTX_SIZE=401408 and PARALLEL=2 which are marked in comments as "untested experiment" vs the validated production config of CTX_SIZE=32768, PARALLEL=1. The env file dead-weight VAR VERBOSITY=4 is never passed to the binary (serve script doesn't use it). These values differ from the proven 32768 ctx × 1 slot deployment that loads clean in ~58s with ~100 GiB in the 119.3 GiB HIP heap. +- qBittorrent 5 (lscr.io image, Dankserver) mints a NEW temporary WebUI password at every boot unless credentials are stored — this silently breaks all arr download clients after any restart, and it rotated mid-session once already. qb5 REMOVED /api/v2/app/setPassword and the lscr image has no WEBUI_AUTH env handling, so persistence must be written into /opt/qbittorrent/config/qBittorrent/qBittorrent.conf with the container stopped, in qb's exact format: WebUI\Username=admin + WebUI\Password_PBKDF2=base64(16-byte-salt) + ":" + base64(PBKDF2-HMAC-SHA512, 100000 iters, 64-byte dk) as a raw string — the classic @ByteArray(salt+hash) wrapper 401s. Verify by surviving a podman restart (login 204). API login from curl also needs Referer: http://127.0.0.1:8080/ (CSRF). The live password lives host-local in /home/dank/.qbpass (0600, owner dank) on Dankserver — never in git. Recipe + gotchas: serverAppConfigs-docs/Dankserver/qbittorrent.md. _(context: Installed 2026-08-30; all four arr download clients updated to the permanent password and validated (202) via each app's PUT /downloadclient.)_ +- Prowlarr→arr Torznab wiring (Dankserver, verified live 2026-08-30, whole grab→import chain proven): (1) Feed route is http://prowlarr:9696/{indexerId}/api?apikey={GLOBAL_KEY}&t=caps|search|... — there is NO /torznab/{id}/feed; any unmatched path hits the Forms-auth catch-all and returns 302 → /login?returnUrl=..., which arrs XML-parse into a fake "auth error" ("'/' is an unexpected token ... Line 54"). Feeds auth with the Prowlarr GLOBAL key from config.xml ApiKey; per-app keys are sync-only. (2) The arrs' torznab joiner is TrimEnd(baseUrl,'/') + apiPath with NO separator — set apiPath="/api" WITH leading slash. (3) Freshly created indexer rows default ALL-OFF — must set enableRss/enableAutomaticSearch/enableInteractiveSearch or the app logs "Searching indexers for [X]. 0 active indexers" (bit Lidarr). (4) Prowlarr v1 Application auto-sync is broken by version skew against Radarr 6.3 (POST /api/v1/applications/test → "Unable to cast object of type 'NzbDrone.Core.Thing...'") — manual torznab rows are the real integration; sync can't duplicate/clobber them. (5) Live search endpoints: Sonarr v5 interactive search = GET /api/v3/release?seriesId=N (POST /search and /release/search are 404/405); Lidarr v1 = GET /api/v1/release?albumId=N. Lidarr POST /artist requires foreignArtistId + qualityProfileId + metadataProfileId (lookup rows carry foreignArtistId, not foreignId). (6) Readarr (abandoned upstream 0.4.x) cannot authenticate against qBittorrent 5 while Radarr/Sonarr/Lidarr pass with identical credentials — books pipeline parked. Full docs: serverAppConfigs-docs/Dankserver/prowlarr.md. _(context: Repo /home/dank/Projects/serverAppConfigs; first real grab (Dark Knight 2160p) downloaded and imported proves the chain; 76 Sonarr + 18 Lidarr releases via Nyaa feed id 4.)_ +- frank-default-large (agentionai Qwen3.8-Flash-Next ROCmFP4 FAST-imatrix-v2, qwen4exp MoE: 12 attention + 36 SSM layers) loaded successfully at CTX_SIZE=401408 / PARALLEL=2 (200,704 tokens per slot) on Dankclaw (119.3 GiB HIP heap) without OOM. Load time: ~74s. Health: 200. The model's architecture explains why this fits: only 12 attention layers use KV caches, 36 SSM layers don't — KV memory grows as O(L_attn × n_heads × head_dim × ctx) per slot, not O(L_total × ctx). This compressed KV footprint allows 200K per slot × 2 slots within the 119.3 GiB heap. models.json contextWindow set to 200000 (real per-session capacity, not the full 262144 n_ctx_train). The n_ctx_seq (200704) n_ctx_train (262144) warning fires but is non-critical — model extrapolates fine. +- frank-default-large (agentionai Qwen3.8-Flash-Next ROCmFP4 FAST-imatrix-v2, qwen4exp MoE: 12 attn + 36 SSM) on Dankclaw loads successfully at CTX_SIZE=401408 / PARALLEL=2 (200,704 per slot) in ~74s without OOM on the 119.3 GiB HIP heap. The model's architecture (only 12 attention layers use KV caches, 36 SSM layers don't) prevents the expected ~160 GiB context buffer. Per-slot KV grows as ~O(L_attn × n_heads × head_dim × ctx), not O(L_total × ctx). The n_ctx_seq (200704) n_ctx_train (262144) warning fires but is not critical — the model extrapolates. Ro cm-smi vram only shows the 4 GiB CPU carve-out; trust rocminfo or the device line for the full SVM pool (116732 MiB). The deployment verified health 200. models.json contextWindow: 200000 reflects the real per-session capacity. +- When --flash-attn on aborts graph build with GGML_ASSERT(a-type == GGML_TYPE_F32) at ggml.c:5371 in the QSA indexer path (build_attn_qsa calls ggml_fill on F16-cast kq_mask): apply the QSA F32-mask patch pattern — mirror the MLA sparse path in llm_graph_context::build_attn by using the F32 base mask (inp-self_kq_mask) for the top-k surgery (ggml_fill/set_rows), then cast to F16 only at the attention call when flash_attn is enabled. The patch has two hunks: 1) change get_kq_mask() to self_kq_mask with explanatory comment about F32 requirement; 2) insert conditional casting before build_attn_mha: "kq_mask_attn = inp-cparams.flash_attn ? ggml_cast(..., GGML_TYPE_F16) : kq_mask_top_k". Validate live: stop service → rebuild fork binary after applying patch → start on port 7999 with --flash-attn on --ctx-size 32768 --fit off → verify model loads (check log for "model loaded"), health 200, real completion → deploy production. Patch file should be vendored in scripts/patches/ with sha256 documented for reproducible rebuilds. _(context: frank-default-large (agentionai Qwen3.8-Flash-Next ROCmFP4-FAST imatrix) fa-on restore on Dankclaw, 2026-08-29. Source of truth: scripts/patches/qwen4exp-qsa-f32-mask.patch (sha256 f2f4a486e21cfad80bfa42683281d18e1cba22fa43c5e0e2aa0cfdbe141e925f).)_ +- frank-default-large (Dankclaw, charlie12345/ROCmFPX build-qwen38) model swap to agentionai/Qwen3.8-Flash-Next-ROCmFP4-FAST-imatrix-GGUF (87.06 GiB Q4_0_ROCMFP4_FAST, 2026-08-29) — three verified hard constraints not to re-derive: 1. MUST use the v2/ joined-layout GGUF, never the root -ple16 file: build-qwen38's qwen4exp loader (src/models/qwen4exp.cpp:108) asserts GGML_ASSERT(ple_w != nullptr) and the joined file carries the single per_layer_token_embd.weight tensor the loader requires. The -ple16 (per-head split, 93.5 GiB) file only loads in the LaurentZuijdwijk Vulkan fork. Verified via GGUF header strings (ple16 lacks the tensor; v2 has it, 1153 .weight tensors). 2. --flash-attn on ABORTS graph build on this model: the QSA indexer path (build_attn_qsa in src/models/qwen4exp.cpp) calls ggml_fill on the F16-cast kq mask, which asserts GGML_TYPE_F32 (ggml.c:5371). Model loads and serves fine with --flash-attn off (verified live: health 200, real completion). STRIX_LEAN didn't hit this — agentionai's QSA-compressed layers do. 3. CTX_SIZE is capped at 32768 (the author's quick-start): the model is FULLY GPU-resident (PLE n-gram table is inside the GGUF, no streaming from RAM like STRIX_LEAN) leaving ~32 GiB of the 119.3 GiB HIP heap for context. Verified OOM ladder: ctx 262144 → cudaMalloc 103176 MiB failed; 131072 → 51976 MiB failed; 32768 → loads clean in ~58s. HIP heap measured via rocm-smi/rocminfo (125105988 KB ≈ 119.3 GiB); rocm-smi --showmeminfo vram reports only the 4 GiB carve-out, NOT the SVM pool — trust rocminfo heap for budget math. MTP draft head (agentionai's own, 2.28 GiB) is INCOMPATIBLE with build-qwen38 even against its own matched v2 main — THIRD confirmation of missing tensor blk.0.hc_attn_norm.weight (loader requires full per-layer set; every Flash-Next-era head carries only blk.48). Spec decoding runs ngram-mod only. MTP on this arch requires a head with all 48 hc_attn_norm tensors or a fork tolerating partial draft tensors. _(context: Deploying agentionai Qwen3.8-Flash-Next-ROCmFP4-FAST-imatrix-v2 (87 GiB) to frank-default-large on Dankclaw, 2026-08-29. Three crash-loop causes diagnosed live (ple16 loader assert, fa-on graph assert, ctx OOM ladder), each fixed and verified before the final healthy deploy at commit 101b1f8.)_ +- Dankclaw authentik 2026.x build does NOT mount the outpost URL space for proxy-provider meta-header routing: probed live from inside caddy's netns, /outpost.goauthentik.io/ping answers 204 with X-authentik-meta-outpost header (outpost object exists), but every app path with full meta headers (outpost UUID + provider id + app slug) returns 404 — the middleware does not intercept in this build regardless of header format (name=caddy and bare caddy both 404). The one auth URL that answers is /if/flow/default-authentication-flow/?next=... (200, serves login page in place; completes instantly with a valid session and bounces to next=). Working transport pattern shipped in the Caddyfile: guarded vhosts on http://:8016 issue redir https://auth.franksdank.cloud/if/flow/default-authentication-flow/?next=https://app-host/ 302 instead of meta-header reverse_proxy — unauthenticated sees login in place, authenticated pays one extra hop per request. If a future Caddy reload reintroduces meta-header routing on :8016, it will 404 again — this is the regression signature. Provider pk=1 lives at id column (not uuid) in authentik_core_provider in this build; app slug is caddy. +- Dankclaw auth chain, state as of 2026-08-30: guarded apps (search/romm/files/etc.) route the whole request through authentik-server:9000 with X-authentik-meta-outpost/-provider/-app headers, but in this 2026.x build that path answers 404 even with full meta headers — the embedded outpost's URL space is mounted at its authentik_host (DB row uuid 7e39655b-58d3-4fe6-a80a-513f31051217, type=proxy, managed goauthentik.io/outposts/embedded, authentik_host=https://auth.franksdank.cloud), which is the auth.* vhost kept EXEMPT from Anubis by design. So post-auth landing = authentik's own 404 page = the user's "can't access searxng after logging in". Verified intact: Anubis→Caddy hop (200 from inside anubis netns), provider pk=1 exists, www callback URIs match external_host (fixed previous turn). PENDING USER DECISION between two shapes: A) point the guarded apps' auth hop at where auth actually lives (route /outpost.goauthentik.io/* + /if/flow/* through the auth.* vhost — one-line Caddyfile change per app, small blast radius, my lean) vs B) flip the outpost to standalone (own container + quadlet unit + AUTHENTIK_TOKEN; heavier). When the user answers A or B, execute that shape; verify before/after by dialing from inside the container netns (podman run --rm --network container:caddy ... wget -S), never from the host. +- Dankclaw edge facts (verified 2026-08-29): the homepage hostname moved to www.franksdank.cloud — Caddyfile now 308-redirects naked/legacy names onto www at the TLS edge, and the authentik proxy provider external_host + OAuth2 stored _redirect_uris were flipped to www as a pair (strict matching rejects any callback not byte-identical to a stored URI; that rejection is what users see as "redirect URI mismatch"). Public DNS: zone franksdank.cloud is served by Porkbun nameservers (salvador/maceio/fortaleza/curitiba.porkbun.com); ingress for all service A records is port-forwarded to WAN IP 71.227.227.172 (not a tunnel), and www.franksdank.cloud had NO public record at all — created www A 71.227.227.172 TTL 300 via Porkbun API v3 that day. A wildcard/already-issued cert means TLS for any new *.franksdank.cloud hostname is instant on first handshake (verified: www answered 200 in 10 ms). Invariant to re-check before declaring any hostname move "working": every vhost carrying traffic must have (a) a public DNS record and (b) a provider external_host + redirect URIs matching that exact host — repo-text tests cannot see either; they live in the live DB and the public zone. Porkbun API v3 shape gotchas: endpoint is dns/retrieve/{domain} (not getAll — wrong path answers with an HTML 404 page, not JSON), and the response puts records under a top-level records key with a cloudflare flag; content is null. Creds live in /home/dank/serverAppConfigs/dankclaw/.env on dankclaw (PORKBUN_API_KEY/PORKBUN_API_SECRET_KEY) — use in place, never print. +- Dankclaw Authentik (2026.x image) operational truths, verified live 2026-08-29: (1) The embedded proxy outpost matches providers by EXACT external_host hostname — a request arriving with Host=www.franksdank.cloud while the provider's external_host is https://franksdank.cloud matches ZERO providers and authentik answers its error page (not 404). Fix applied live: UPDATE authentik_providers_proxy_proxyprovider SET external_host='https://www.franksdank.cloud' WHERE oauth2provider_ptr_id=1 via podman exec authentik-postgres psql -U authentik -d authentik; no restart needed — providers resolve per request. Caddyfile now routes www as the guarded vhost and naked domain + legacy names 308-redirect at the TLS edge (commit 8898740). (2) Live-DB probe recipe: ak shell is interactive-only; ORM imports fail because 2026.x moved models out of Python modules (ProviderEndpoint, ProxyProvider, Token gone from their classic modules); query postgres directly with role/db authentik (POSTGRES_USER=authentik, NOT postgres). Column names differ in this version — pk/id may not exist on user/group tables; use \d or SELECT * instead of guessing columns. (3) Management commands: ak create-install-token does NOT exist in this version (Unknown command); admin seat = membership in the 'authentik Admins' group (is_superuser=t), created via ak create_admin_group user which takes a required positional user arg; live users are akadmin (frank8465@protonmail.com) and admin (admin@franksdank.cloud), both with real pbkdf2 hashes — lost-password escape hatch is ak create_recovery_key. _(context: Fixing www.franksdank.cloud serving an authentik error page while the naked domain served the homepage; traced to proxy-provider external_host exact matching, fixed via live DB UPDATE + Caddyfile topology flip deployed through scripts/deploy.sh --service caddy.)_ +- Dankclaw Authentik (2026.x image) live-ORM probing moved to direct SQL: model imports like from authentik.core.models import ProviderEndpoint / authentik.outposts.models.ProxyProvider now raise ImportError — query the DB directly instead (podman exec authentik-postgres psql -U authentik -d authentik; role/db = authentik, NOT postgres). Introspect before guessing columns: several tables use uuid PKs (groups), so id/pk probes error; SELECT * / \d first. Command surface verified live: NO create-install-token command exists in this version ("Unknown command"); createsuperuser is explicitly deprecated ("should not be used. Instead, use ak create_admin_group"); canonical admin creation = ak create_admin_group user (takes a required positional user). Lost-password escape hatch = ak create_recovery_key. ak swallows piped stdin; works via ssh -tt + podman exec -it which allocates a real PTY. Live state at capture: admin seat held by user akadmin (email frank8465@protonmail.com) in authentik Admins superuser group; second account admin (admin@franksdank.cloud) membership unverified; both carry real pbkdf2 hashes — login failures there are password-memory problems, not missing accounts. Embedded outpost uuid matches Caddyfile meta-outpost header; provider pk=1 exists with internal_host http://caddy:8017. _(context: Live status investigation of "Authentik is still not working properly" on Dankclaw — probed DB/commands live instead of trusting docs; several column-name guesses failed before SELECT * / \dt introspection ended the guessing.)_ +- When Frank asks to "research", "look into", or "hunt" something on the homelab, he wants a verified state REPORT first — not immediate deployment. Acting on findings before his approval draws pushback ("I only said research, don't bring it up immediately"). Correct pattern: probe live state (DBs, logs, APIs, disk), report verdict + evidence + the single unblocking move with cost, then wait for his explicit go before mutating anything. He granted blanket autonomy only when he re-pins a directive verbatim. - MTP draft heads for Qwen3.8-Flash-Next are INCOMPATIBLE with the STRIX_LEAN Uncensored model on the charlie12345/ROCmFPX qwen4exp binary. Both attempted heads — EasiiX Q8_0 (4.1 GB) and agentionai ROCmFP4-FAST (2.28 GiB) — fail with missing tensor 'blk.0.hc_attn_norm.weight'. The qwen4exp binary expects this hyper-connection attn norm tensor in the draft GGUF, but neither draft head carries it. MTP only ever worked on the 27B model (kingjones-Qwen3.8-27B-STRIX-MTP with mtp-Qwen3.8-27B-Q4_0.gguf), never on any Flash-Next variant. The Flash-Next STRIX (non-LEAN) that ran before the 2026-08-28 session never loaded a draft model at all. Current production config: SPEC_TYPE=ngram-mod only. To get MTP working on STRIX_LEAN, need either a draft head that includes hc_attn_norm tensors or a binary that doesn't require them for draft models. _(context: frank-default-large MTP integration attempt on Dankclaw, 2026-08-28. Downloaded two MTP heads from HuggingFace, both failed to load against the STRIX_LEAN Uncensored model. Service crash-looped on each attempt. Fell back to ngram-mod only. Files: scripts/frank-default-large.env, scripts/serve-frank-large.sh.)_ - The MTP draft head GGUF mtp-Qwen3.8-Flash-Next-Q8_0.gguf (EasiiX/Qwen3.8-Flash-Next-MTP-Strix-Halo-GGUF, 4.1 GB) is INCOMPATIBLE with the STRIX_LEAN Uncensored Flash-Next model on the charlie12345/ROCmFPX binary (build-qwen38). The draft GGUF is missing tensor blk.0.hc_attn_norm.weight (hyper-connection attention norm) that the qwen4exp architecture expects. The service crash-loops: main model loads fine (~59s), then draft model load fails and exits. MTP only ever worked on the older 27B model (Qwen3.8-27B-Uncensored-Q6_0_ROCMFPX_AGENT + its own mtp-Qwen3.8-27B-Q4_0.gguf head). The Flash-Next STRIX (non-LEAN) that ran before this session never loaded a draft model either — it ran ngram-only. Current production config: SPEC_TYPE=ngram-mod (no draft sidecar). TODO: find a compatible MTP head for STRIX_LEAN or build one from the Flash-Next checkpoint. _(context: frank-default-large MTP draft head integration on Dankclaw, 2026-08-28)_ - When running Python scripts on a remote host (Dankclaw) that need to manage local services (systemctl, sed), use subprocess.run(cmd, shell=True) for local execution — NOT nested SSH back to the same host. Nested SSH to localhost fails (no key auth for self-loopback). Also: before git pull --ff-only on a remote, verify the branch with git branch --show-current — Dankclaw was on frank-large-strix-model not main, so pulls were no-ops and new files didn't appear. _(context: bench-spec-decode.py ran on Dankclaw but used ssh() to SSH back to itself for systemctl/sed. All SSH calls failed with Permission denied. Also: Dankclaw was on frank-large-strix-model branch, not main, so git pull --ff-only was a no-op and the new file didn't appear.)_ diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/memory_summary.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/memory_summary.md index fc41e93..e735181 100644 --- a/agent/memories/--home-dank-Projects-serverAppConfigs--/memory_summary.md +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/memory_summary.md @@ -1 +1,9 @@ -Host: Dankclaw (gfx1151, 64GB SVM). Model: frank-default-large (Qwen3.8-Flash-Next 177B, ROCmFP4). PLE streams from page cache; GPU resident ~63-69GB. ENV constraints: FIT=off, -ngl 999, NEVER set TEMP/HOST/GPU_MAX_HEAP_SIZE. Env: scripts/frank-default-large.env (port 7770, batch=4096, ctx=524k). Benchmark orchestration via SSH: use frank-default-small as driver. Always poll health endpoints in loops (~5s intervals) due to slow mmap load. Current task: resume batch/ubatch tuning (interrupted during health-check polling). +Use /home/dank/Projects/serverAppConfigs as the repo root; current repo state wins over memory. Main hosts: Dankclaw 192.168.0.143, Dankserver 192.168.0.235, FrankBook-Pro 192.168.0.112 macOS x86_64. Services are mostly rootless Podman Quadlet user units; use systemctl --user and podman inventory commands. Caddy on Dankclaw fronts franksdank.cloud with Porkbun DNS-01 wildcard certs and Pi-hole split DNS; keep Caddy admin on for hot reload. Authentik/Anubis cannot be fully verified with curl because Anubis returns JS challenge pages. + +Hermes state lives at /home/dank/hermes-data:/data; do not overwrite live config from sanitized config.yaml.example. If Hermes WebUI cannot reach Signal, first check signal-cli-daemon.service and port 8080; a recent diagnostic found Hermes/WebUI/dashboard healthy but signal-cli-daemon inactive/disabled. Hermes main model is frank-default-large at 192.168.0.143:7770; vision auxiliary routes to Gemma FLM gemma4-it:e4b at 192.168.0.143:7771/v1. + +frank-default-large current durable state: Dankclaw Strix Halo gfx1151, kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF via kingjones30/ROCmFPX at /home/dank/GitPackages/kingjones-ROCmFPX/build/bin/llama-server. Keep --fit off, keep mmap/page-cache PLE streaming, avoid bare env vars TEMP/HOST/GPU_MAX_HEAP_SIZE, and do not enable MTP/spec decoding casually. If QSA flash-attn graph build fails, apply the qwen4exp-qsa-f32-mask patch. + +Media: Plex/Tautulli migrated to Dankserver Quadlets with UserNS=host; Plex data is in-place at /var/lib/plexmediaserver and rollback chown is 997:984. Jellyfin and Copyparty mounts were verified read-only; user directive says stop touching Jellyfin/Copyparty unless asked. Copyparty bare A is dangerous: it grants everyone full access; read-only uses r:ra,dank without write/move/delete perms. *arr stack is intended for FrankBook-Pro via gluetun VPN, preserving /Volumes/COMPLETE paths. + +Never commit secrets. For BIOS on ASUS TUF GAMING B650-E WIFI, use exact board CAP, backup with flashrom reads only, and flash via EZ Flash/FlashBack, not Linux flashrom writes. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/raw_memories.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/raw_memories.md index f2ee010..8ea7d0b 100644 --- a/agent/memories/--home-dank-Projects-serverAppConfigs--/raw_memories.md +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/raw_memories.md @@ -1,5 +1,449 @@ # Raw Memories +## 01a06ef4-c78b-71df-98e0-e1b930f260a5 +updated_at: 1788579402 +Category shift: Sonarr moved to 'admin' in shared/homepage/services.json. +Exposure constraint: Sonarr kept local-only; removed 'sonarr.franksdank.cloud' vhost from dankclaw/Caddyfile to prevent external routing. +Resolved pitfall: Prior directive conflated Seerr and Sonarr external reachability; corrected by auditing Caddyfile @sonarr handle block and services.json category mapping. +Paths: shared/homepage/services.json, dankclaw/Caddyfile, frankbook-pro/sonarr/quadlet/sonarr.container. +Workflow: Category update + Caddyfile vhost strip -> commit (b6f5b2b) -> push -> verify. + +## 01a06e56-5e70-73f5-83b3-a28b1736f34b +updated_at: 1788561197 +- Pi-hole admin password reset to pihole.2026. +- Public DNS for pihole.franksdank.cloud removed from Porkbun (NXDOMAIN externally); LAN resolution persists via addn-hosts (192.168.0.143). +- Caddy vhost retains basicauth edge and TLS termination, reverse proxying to Pi-hole quadlet published on 192.168.0.143:8083. +- Architectural note: Pi-hole serves as LAN DNS authority (dnsmasq/FTL) but sits behind Caddy for edge traffic handling, avoiding direct public exposure while maintaining internal name resolution. + +## 01a06b4c-fcea-70e2-a342-a41c5f99d927 +updated_at: 1788553425 +Consolidated *arr stack to FrankBook-Pro (192.168.0.112), removing old Dankserver (235) instances. +Six containers (QBit + 5 arrs) share a single gluetun network namespace; zero internal PublishPort on arrs, gluetun publishes full port set (8080, 6881, 9696, 8989, 7878, 8686, 8787). +All egress forced through ProtonVPN (AllowedIPs=0.0.0.0/0); verified via podman exec IP echo (51.179.177.14 vs residential 71.227.227.172). +Local DNS: Pi-hole quadlet on dankclaw serves addn-hosts, resolving *arr service names to Caddy (192.168.0.143). +Caddy topology: TLS vhosts -> Anubis :8923 (AI scrapers deny/challenge) -> Caddy internal :8017 -> app containers. +arr→qB client config updated to 127.0.0.1:8080 (resolved 10.88.0.1 gateway routing into tunnel). +Tests: frankbook_quadlet.bats enforces shared netns/zero ports; unit & Playwright E2E suites pass. +Parked defects: 1) Prowlarr Applications table empty (sync dead until rebuilt with loopback baseUrls); 2) readarr qB proxy upstream auth defect (post-move retest); 3) EZTV/1337x CloudFlare-block likely lifted for VPN egress. +Old configs archived in ~/.AGENTTRASH/20260904-dankserver-arr-teardown/. Commits: 4c7465d, df4339a. + +## 01a06aa2-9087-753a-8019-50af77fbaddf +updated_at: 1788501666 +File: shared/homepage/services.json. Action: Reformatted from compact to multi-line JSON (2-space indent). Committed 7 description updates (SearXNG, OpenWebUI, Gitea, Copyparty, Plex, Jellyfin, Seerr). Workflow: git add/commit, ./scripts/deploy.sh dankclaw --service homepage. Result: Deployment 1967584 successful. + +## 01a06894-8947-74fa-ba09-0f104cd6677f +updated_at: 1788495432 +DEPLOYMENT & HOSTING: +- frank-npu service deployed to dankclaw via deploy.sh (commit df0c663, atop b563053). +- Unit: serve-frank-npu.service running on port 7771. +- FLM registry path: /home/dank/.config/flm/model_list.json. + +MODEL BEHAVIOR & ROUTING: +- Resident model: nuextract3:4b. First probe confirms residency (2.6s latency, correct extraction output). +- Context Length: FLM_CTX_LEN=-1 (no global override). Packs load trained context (nuextract3: 32768, gemma4: 131072). +- Routing: FIFO single-lane NPU. Heretic requests (qwen3.8-distilled-heretic:9b) pay ~6-11s swap cost on tag alternation. Single-tag consumers pay once per switch direction. + +NAMING CONVENTIONS & RENAME WORKFLOW: +- Renaming: frank-default-sightsound → frank-npu; frank-default-small → frank-small; frank-default-large → frank-large. +- Scope: Scripts, systemd units, env files, docs. +- Critical Order: Update models.json (~/.pi/agent/models.json) with new aliases BEFORE deploying renames to prevent agent connection loss during LLM runtime restarts. + +PLAYWRIGHT TEST SPECIFICATIONS: +- Unauthenticated users must be blocked from direct navigation to Authentik-protected apps (except exempt services like Plex). +- Admin users must retain guaranteed access to admin space and admin apps. + +HOST & REPO CONTEXT: +- Repo: /home/dank/Projects/serverAppConfigs (Dankware). +- Live hosts: dankclaw (NPU/LLM), dankserver. +- SSH accessible; deploy.sh handles push and dispatch. + +## 01a063a7-4c37-7765-8f58-21f7c860aed7 +updated_at: 1788403307 +Context/workflow: +- Workstation/operation host is Dankware; repo path is /home/dank/Projects/serverAppConfigs. +- Main deployment hosts identified/reconfirmed: Dankserver at 192.168.0.235 and Dankclaw at 192.168.0.143. Both were reachable via passwordless SSH from Dankware. +- Services are primarily defined by per-host Quadlet .container files in the repo and installed as user-systemd units (`systemctl --user ...`) generating `.service`. Some model/LLM services may be system units rather than user units. +- Useful status enumeration commands: + - `cd /home/dank/Projects/serverAppConfigs && find . -path ./.git -prune -o -name '*.container' -print | sort` + - For a host: `ssh 'systemctl --user list-units --type=service; podman ps -a --format "{{.Names}} {{.Status}} nets=[{{.Networks}}]"'` + +Hermes/Dankclaw diagnostic result: +- Command used: + `ssh -o ConnectTimeout=10 dankclaw 'echo "== units:"; for u in hermes hermes-webui hermes-dashboard signal-cli-daemon; do printf "%-20s %s\n" "$u" "$(systemctl --user is-active $u.service 2>/dev/null) $(systemctl --user is-enabled $u.service 2>/dev/null)"; done; echo "== containers:"; podman ps -a --format "{{.Names}} {{.Status}} nets=[{{.Networks}}]" | grep -Ei "hermes|signal|chrome"; echo "== listeners:"; ss -lntp 2>/dev/null | grep -wE "8080|8787|9119|9222" | tr -s " "; echo "== webui env (names only):"; podman exec hermes-webui sh -c "env | cut -d= -f1 | grep -Ei \"hermes|signal|base_url\" | sort" 2>&1 | head -20'` +- Output showed: + - `hermes`: active, generated + - `hermes-webui`: active, generated + - `hermes-dashboard`: active, generated + - `signal-cli-daemon`: inactive, disabled + - Containers: + - `chrome-devtools-protocol` up ~2 days, no listed network + - `systemd-hermes` up ~38h, no listed network + - `hermes-dashboard` up ~38h, network `dankclaw_default` + - `hermes-webui` up ~38h, healthy, no listed network + - Listeners: + - `0.0.0.0:8787` listening (Hermes WebUI) + - `127.0.0.1:9222` listening by `headless-shell` (Chrome DevTools Protocol) + - `*:9119` listening via `rootlessport` + - No listener on `8080` in this diagnostic, consistent with `signal-cli-daemon` being down. + - `hermes-webui` env names include `SIGNAL_ACCOUNT`, `SIGNAL_ALLOWED_USERS`, `HERMES_WEBUI_*`, etc. +- Durable diagnosis: if Hermes WebUI says it cannot reach Hermes/Signal, first check `signal-cli-daemon.service`. In this captured state, Hermes-related services/containers were active/healthy, but `signal-cli-daemon` was inactive/disabled and there was no port 8080 listener, so the Signal HTTP transport was likely unavailable even though the WebUI itself responded on 8787. +- Suggested next operational checks/fix path: + - `ssh dankclaw 'systemctl --user status signal-cli-daemon.service --no-pager; journalctl --user -u signal-cli-daemon.service -n 80 --no-pager'` + - If appropriate, start/enable it: `ssh dankclaw 'systemctl --user enable --now signal-cli-daemon.service'` + - Verify: `ssh dankclaw 'systemctl --user is-active signal-cli-daemon.service; ss -lntp | grep -w 8080'` + +## 01a06085-8146-72b0-9e52-b486c767a2f6 +updated_at: 1788331026 +GOAL: Migrate Plex (native plexmediaserver.service) and Tautulli (snap) to podman quadlets on dankserver. Zero-bytes-moved design. + +IMAGES: +- Plex: lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322 (superseded initial ls9 pin) +- Tautulli: lscr.io/linuxserver/tautulli:v2.18.1-ls242 (verified ≡ latest digest) + +USER & UID MODEL: +- UserNS=host for both. Rootless podman cannot map real uid 997 natively. +- Plex: PUID=0/PGID=0 (container root=dank), data root /var/lib/plexmediaserver chowned to 1000:1000. Rollback chowns back to 997:984. +- Tautulli: PUID=1000/PGID=1000. + +VOLUMES: +- Plex: /var/lib/plexmediaserver:/config (RW, in-place), /mnt/entropy:/mnt/entropy:ro +- Tautulli: /home/dank/Containers/tautulli:/config + +NETWORK & PORTS: +- App: dankserver_appnet. Plex alias=plex, Tautulli alias=tautulli. +- Plex: 32400:32400. Tautulli: 8181:8181. +- Tautulli config.seed: PMS_Web_Host=plex, PMS_Web_Port=32400, PMS_Secure=0. + +CUTOVER & HEALTH: +- Native units stopped & masked (Plex), snap disabled (Tautulli). Instant rollback via unmask/snap enable + chown. +- Plex health gate widened to 600s (32GB DB migrations reset on bounce). No HealthCmd to avoid cold-load flapping. +- Tautulli uses python3 urllib health probe. + +PITFALLS & FIXES: +- UsernsMode= (compose syntax) hard-failed v1 generator → corrected to UserNS= or omitted. +- Edit churn ate ContainerName, Network, PublishPort keys → caught by seam test + C5 probe. +- PMS deploy-state record showed pending (cosmetic) → self-heals on next deploy. +- Decommission: apt purge plexmediaserver + snap remove tautulli only on explicit sign-off. + +## 01a06035-a0d8-73ad-8a49-279f51c68bf2 +updated_at: 1788329168 +PLEX_HOMEPAGE: Updated url to http://plex.franksdank.cloud/web/index.html in shared/homepage/dankserver.services.json & services.json. JELLYFIN_MNT: /mnt/entropy:/data:ro (read-only whole volume), health 200, libraries verified working. COPIPARTY_MNT: /mnt/entropy:/w:ro, health 200. JELLYFIN_DB: /home/dank/Containers/jellyfin/config/data/jellyfin.db; table is BaseItems (not TypedBaseItems). DEPLOY: Commit 8895a02, 233/233 tests green. USER_DIRECTIVE: Stop touching Jellyfin/Copyparty after verification. + +## 01a05bed-d759-7157-af15-2e178337182a +updated_at: 1788325757 +Decisions (Locked): +- D1: Quadlet .container units for all long-running services; compose retired to reference. +- D2: Data root /home/dank/Containers/ on Linux hosts; entropy is mounted volume. +- D3: *arr-stack migrates to FrankBook-Pro; decommissioned on dankserver. +- D4: Keep /Volumes/COMPLETE & /Volumes/COMPLETE/"Finished Torrents" verbatim; rename deferred. +- D5: VPN egress via gluetun container; qbittorrent shares netns (Network=gluetun.container). +- D6: Private LAN-only, direct IP:port, Pi-hole addn-hosts DNS; no Caddy vhost on Mac. +- D7: Scope includes Mac bring-up + cutover. +- D8: Seerr on dankclaw (SQLite, Authentik OIDC SSO), provider created before route flip. + +Execution Phases: +- Phase 0: Prereqs (Mac SSH access, WireGuard creds/machine-local env, egress gate check via podman machine ssh). +- Phase 1 (dankserver): Per service (romm, mariadb, redis, jellyfin, calibre-web, copyparty): stop -> mv /opt -> /home/dank/Containers -> chown (uid 1000) -> deploy quadlet. RomM landmine: move DB from anonymous volume to /home/dank/Containers/romm/db. +- Phase 2 (dankclaw): Migrate data roots for gitea, authentik, etc. +- Phase 3/4: Mac stack bring-up & *arr cutover. + +Technical Constraints & Patterns: +- Quadlet template: [Container] (Image, ContainerName, EnvironmentFile, Volume=bind-mounts-only), [Service] Restart=always, [Install] WantedBy=default.target. +- Entropy write: Only copyparty -v /mnt/entropy:/w with -a dank: -v /w::r:ra,dank. +- Deployer: ./scripts/deploy.sh computes changes, pushes, target pulls, dispatches. Handles run_privileged and service health checks. +- Secret hygiene: No secrets in tracked repo files (machine-local envs). +- Gotcha: Verify --userns=host in systemctl --user cat .service after daemon-reload. Data root mkdir -p handled in deployer. + +## 01a05bd4-8dbe-759b-8885-8b86990051ed +updated_at: 1788314412 +frank-default-large model/runtime configuration: +- Service alias: frank-default-large, served by scripts/serve-frank-large.sh with tunables in scripts/frank-default-large.env. +- Model: kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF, file Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf under /home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX. +- Architecture: Qwen3.8-Flash-Next base / qwen4exp MoE, 512 experts / 10 used, 48 layers = 12 attention + 36 SSM, QSA indexer, hyper-connections, PLE at layer 1. +- Quant/file details: Q4_0_ROCMFP4_STRIX, file_type 105, ~113.47 GiB single GGUF. STRIX top quality tier; PLE table ~50.66 GiB Q8_0, token embeddings + lm head Q6_K. +- Runtime: kingjones30/ROCmFPX fork with qwen4exp-on-rocmfpx patch, built at /home/dank/GitPackages/kingjones-ROCmFPX/build/bin/llama-server using HIP for gfx1151, ROCm 7.2.4. Stock llama.cpp and charlie12345/ROCmFPX alone cannot load this GGUF because ROCmFP4 tensor types and qwen4exp architecture support must be in the same tree. +- Hardware target: Dankclaw / Strix Halo gfx1151 unified memory. Env sets HSA_OVERRIDE_GFX_VERSION=11.5.1, HIP_VISIBLE_DEVICES=0, --device ROCm0. +- Important pitfall: PLE n-gram table must stay out of GPU memory and stream via mmap from OS page cache. Do not add --no-mmap or tensor override/offload (-ot) for the PLE table. +- Important pitfall: --fit must remain off; auto-fit segfaults on qwen4exp hyper-connection config. +- Important pitfall: if graph build aborts on QSA F16 mask with flash attention, port scripts/patches/qwen4exp-qsa-f32-mask.patch into the kingjones ROCmFPX tree and rebuild. +- Speculative decoding currently disabled (SPEC_TYPE=none). Flash-Next MTP heads do not load on this loader and the model card ships no spec flags; draft model defaults exist but should not be enabled casually. +- mmproj: STRIX repo ships no mmproj; serve script conditionally passes /home/dank/models/agentionai-Qwen3.8-Flash-Next-ROCmFP4-FAST/mmproj/mmproj-Qwen3.8-Flash-Next-f16.gguf if readable. +- Serving defaults: host 0.0.0.0 port 7770, ctx 401408, parallel 2 slots, batch 4096, ubatch 512, threads 16, threads-batch 16, f16 KV cache, flash-attn on, split-mode none, gpu-layers 999, ctx-checkpoints 16, cache-ram 8192 MiB, prompt cache and idle-slot cache enabled, metrics enabled. +- Sampling defaults: temp 0.7, top_p 0.8, top_k 20, min_p 0.0, presence_penalty 1.5, reasoning on, reasoning-format deepseek, reasoning-budget -1. Env comments describe this as card sampling table mixed with validated serving profile, non-thinking instruct despite reasoning plumbing being enabled. +- Replaced prior agentionai ROCmFP4-FAST imatrix deployment/charlie build-qwen38 runtime around 2026-08-30. + +ASUS TUF GAMING B650-E WIFI BIOS update/backup durable workflow: +- Target latest memory-compat BIOS identified: 3886 beta (2026-07), AGESA 1.2.0.3a Patch A. Current referenced BIOS was 2613. +- Board-name caution: use exact ASUS TUF GAMING B650-E WIFI support page; avoid wrong CAPs for similar boards like B650M-E or B650-PLUS. +- Backup current BIOS before flashing. Safe Linux read-only approach: + sudo pacman -S flashrom + sudo flashrom --programmer internal -r bios-2613-backup-1.bin + sudo flashrom --programmer internal -r bios-2613-backup-2.bin + sha256sum bios-2613-backup-*.bin; hashes must match or re-read. +- Expected AM5 SPI dump size is about 32 MB. Copy backups to USB and another machine. Never use flashrom -w from Linux for writing; power loss or mismatch can brick board. If flashrom reports multiple chips or refuses, use chip-specific selection only if certain or fall back to UEFI/EZ Flash backup. +- Alternative backup: ASUS EZ Flash 3 often offers save/current-BIOS-to-USB from UEFI. Also download archived 2613 CAP from ASUS as a restore/downgrade image. +- Normal flash path: FAT32 USB with CAP in root, reboot, Del into UEFI, Tool → ASUS EZ Flash 3, select CAP, allow verification, save old BIOS if offered, flash without resets/power cuts. +- Rescue path: USB BIOS FlashBack only if board will not POST. System off but PSU standby on, USB in rear FlashBack-marked port, rename CAP exactly per support page/manual (do not guess), hold FlashBack button ~3s, wait until LED stops blinking. +- Operational note: Dankserver hosts media stack + frank-default-small; BIOS flash is ~15–20 min downtime. First boot after AGESA update can spend 1–5 min on black screen due to DDR5 retraining; wait. +- Post-flash: settings reset to defaults. Re-apply memory profile/manual settings and re-run memtest; new AGESA/training invalidates prior memory stability conclusions. Verify version in BIOS main screen or with sudo dmidecode -s bios-version. + +## 01a05a7d-cc94-7589-8926-c24cb5a10490 +updated_at: 1788248708 +Hermes Agent Persistence: Data survives restarts via host bind mount /home/dank/hermes-data:/data. Requires entrypoint override to hermes gateway run --force -v to prevent default TUI crash-loop on exit. Environment HERMES_DATA_DIR and HERMES_HOME must point to /data. Signal HTTP adapter connects to 127.0.0.1:8080 via network_mode: host. Dashboard runs separately on port 9119. +General Container Patterns: ComfyUI uses keep-groups for rootless podman render group resolution; models/data persist under /home/dank/comfyui-data. SearXNG, Gluetun, and Valkey are boot-persistent Quadlet units sharing network namespaces. qBittorrent reuses SearXNG's netns without its own port. +Migration & Deployment Constraints: *arr stack (Sonarr, Radarr, Lidarr, Readarr, Prowlarr) migrating to FrankBook-Pro Mac. Config dirs archived to /home/dank/archive/-arr-configs.tar.gz before removal; virgin installs skip archive. Podman machine init on Mac requires -v /Volumes/COMPLETE -v /Volumes/INCOMPLETE; later addition requires re-init. VPN egress gate must pass before *arr port publishing. Caddy uses Quadlet units. Verify with systemctl --user is-enabled, podman machine ssh, and health probes. Deploy scripts: deploy.sh, deploy-remote.sh, deploy-plan.py manage service order and target dispatch. + +## 01a05a29-d9fd-71ca-86c8-b92c602492c7 +updated_at: 1788229381 +VOLUME SECURITY: POSIX permissions for read/write user via SFTP/SSH. Create dedicated writer user and readers group. Set volume ownership to writer:readers with chmod 2775 (setgid ensures new files inherit group). Deployment: Host volume or Podman container. Restrict SSH/SFTP access via Match block in sshd_config or ForceCommand internal-sftp. + +FREETOKEN BUILD (DANKCLAW): Build-only, no deploy/run. Supports Vulkan or ROCm. Pre-installed: ROCm 6.3 (/opt/rocm), NVIDIA driver 575.57.02, CMake, Python, git. Requirements met for compilation. + +GGUF LOADING CONSTRAINTS: Restricted to Gemma4GGUFForCausalLM model class. Supported GGML quantization types: F32(0), F16(1), BF16(30) use native torch views; Q4_0(2) and Q6_K(14) use dequant_q4_0/dequant_q6_k. Q8_0(8) is mapped but lacks dequant function (raises NotImplementedError). Loading pipeline: is_gguf_path -> iter_gguf_tensors -> dequantize -> load into graph. + +## 01a04a3f-6596-75d0-8749-8ece9a2b11fd +updated_at: 1788224586 +REPO_ROOT: /home/dank/Projects/serverAppConfigs +HOSTS: Dankclaw (192.168.0.143, Caddy host), Dankserver (192.168.0.235) +CADDY_SETUP: Single container on dankclaw fronts all services. DNS via dankclaw Pi-hole quadlet; LAN routed via SURFboard G36 router. TLS via Porkbun DNS-01 (no inbound 80/443 required). Admin interface ON (127.0.0.1:2019) enabling config file watcher hot-reload; turning off caused stale basicauth hash. Basicauth hash rendered from host .env into container Caddyfile. +AUTH: Authentik SSO via Caddy forward_auth. Protects homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty. Apps with native auth (Grafana, Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole) bypass forward_auth. +HERMES_BOT: WebUI network flipped to Network=host. Browser automation via chrome-devtools-protocol quadlet; CDP bound to loopback 127.0.0.1:9222. Deployer patched to start service only if inactive (preserves in-flight browser sessions). Trio + daemon managed via systemctl --user. +CONFIG_QUIRKS: /data/config.yaml mounted but owned by unmapped UID (dank user cannot read directly; requires sudo python for edits). NPM npx cache lives in container layer: first tool call in fresh container pays npm download cost; container restarts do not reset cache, but recreation does. +DEPLOY_WORKFLOW: deploy.sh handles quadlet install, daemon start-if-not-running, config wiring, trio restart. Uses stash-deploy-pop dance. State tracked via STATE[hermes] commit hash. FF-only pull on target. + +## 01a059f4-cead-704b-b857-fad89ebde42b +updated_at: 1788224497 +Context: Dankserver hosts copyparty for `files.franksdank.cloud` and LAN direct access. Traffic chain is Browser -> Caddy edge -> Anubis :8923 -> Authentik outpost -> post-auth :8017 as UNAUTHENTICATED -> copyparty :3923. LAN direct also reaches copyparty :3923. + +Resolved change: in `dankserver/compose.yaml`, copyparty volume argument was changed from `-v /w::A` to `-v /w::r:ra,dank`. This makes `/w` browsable/downloadable but not writable/deletable. The copyparty version observed was v1.20.21. There is no separate dedicated reject-uploads flag; read-only behavior is achieved by omitting `w`, `m`, and `d` permissions. Anonymous must keep `r` because the guarded Authentik chain passes authenticated users to copyparty as unauthenticated. + +Deployment workflow: `deploy.sh` correctly refuses to directly modify the compose stack on Dankserver but can pull/record rev. To apply the compose change, run on Dankserver: `podman-compose up -d --force-recreate copyparty`. + +Verification results after deploy: anonymous `GET /Movies/` returned 200; anonymous `PUT` returned 401; authenticated `dank` `PUT`/`DELETE` returned 403; recent-uploads DB showed `"ups": []`; `files.franksdank.cloud` returned 200 and the chain remained intact. + +Critical pitfall discovered: prior runbook claim that anonymous got nothing was wrong. In copyparty, bare `A` means everyone, so `-v /w::A` had made the entire ~91T array anonymously readable, writable, and deletable on LAN/WebDAV. During probing, one 1-byte test file `/mnt/entropy/w/.readability-probe-delete-me` was created; it was verified by exact path and size and removed, then root listing was rechecked to match original state. + +Admin credentials at time of rollout: username `dank`, password `m9FuwPKWotsPz7jUUn`. Stored as `COPAY_PASS=` in `dankserver/.env` on Dankserver (gitignored). Compose interpolates this into container argv, so anyone able to `podman inspect copyparty` on the host can see it. Rotate by editing `.env` and recreating the service. After read-only change, `dank` has read plus admin panel but no writes by design. + +Outstanding operational gap: copyparty/dankserver stack was still running as a bare compose container with no Quadlet unit; boot-persistence rule is not satisfied for the whole dankserver stack. This was flagged but not changed. + +## 01a05a42-6580-7043-96eb-a73344efd9e6 +updated_at: 1788221481 +Hermes FLM/Gemma rollout on Dankclaw: +- User request: add Gemma FLM model to Hermes agent. +- Context: Hermes live data is bind-mounted at /home/dank/hermes-data and appears in-container as /data. Repo contains sanitized backup at dankclaw/hermes/config.yaml.example; do not commit live-only secrets such as dashboard password hashes, phone numbers, OAuth credentials, API keys, sessions, memories, or generated state. +- Existing Hermes config shape: + - model.provider/default selects main model. + - providers entries use keys like dankclaw-large and dankserver-small with api URL, discover_models: false, and explicit models/context_length. + - auxiliary entries use compact custom endpoint shape: {provider: custom, model: ..., base_url: ...}. +- Added FLM/NPU provider for Dankclaw to Hermes live config and sanitized repo example: + - provider name: dankclaw-npu + - FLM OpenAI-compatible base/API URL: http://192.168.0.143:7771/v1 + - model: gemma4-it:e4b + - discover_models: false + - use api_key: not-needed where required by config conventions. +- Routed Hermes auxiliary vision to the Gemma FLM model: + - auxiliary.vision: {provider: custom, model: gemma4-it:e4b, base_url: http://192.168.0.143:7771/v1} +- Main Hermes model remained frank-default-large via dankclaw-large at http://192.168.0.143:7770/v1. +- Adjusted ~/.omp/agent/models.yml so frank-default-large context length is 200000 (reduced from oversized setting to suit actual Hermes/agent behavior). +- Cleaned stray ~/.pi by moving it to ~/.AGENTTRASH/20260831-pi. +- Restarted Hermes container after live config edit; Hermes became healthy. +- Validation: full repo test suite passed, 204 tests total. +- Durable caution: config.yaml.example is only a sanitized baseline backup of /home/dank/hermes-data/config.yaml, not a full replacement for live state. Preserve live secrets and generated state when editing/syncing. + +## 01a059ae-72f3-76d4-8e09-735f8f2e0a5d +updated_at: 1788216058 +Hosts and identities: +- FrankBook-Pro is reachable as dank@FrankBook-Pro.local / dank@192.168.0.112. It is macOS on x86_64, not iOS. +- dankclaw is 192.168.0.143. +- dankserver is 192.168.0.235. +- This rollout was run from dank@dankware/dankclaw context with an existing ed25519 SSH key. + +SSH configuration completed and verified: +- Passwordless host-to-host SSH works: + - dankclaw -> FrankBook-Pro returns user dank. + - dankclaw -> dankserver returns user dank. + - dankserver -> dankclaw returns user dank. + - FrankBook-Pro -> dankclaw returns user dank. +- FrankBook-Pro host keys were already present in known_hosts during setup. + +Hermes container SSH completed and verified: +- Containers checked: systemd-hermes, hermes-webui, hermes-dashboard. +- Each container can passwordlessly SSH using /root/.ssh/id_ed25519 with IdentitiesOnly=yes to: + - root@192.168.0.143 (dankclaw) -> returns root. + - dank@192.168.0.235 (dankserver) -> returns dank. + - dank@192.168.0.112 (FrankBook-Pro) -> returns dank. + +FrankBook-Pro Podman stack installed and verified: +- podman installed at /usr/local/bin/podman, version 5.4.2, Mach-O x86_64. +- gvproxy installed/built at /usr/local/bin/gvproxy, Mach-O x86_64. +- vfkit installed via Homebrew at /usr/local/bin/vfkit, version v0.6.4, Mach-O x86_64. +- Podman machine uses applehv provider and is running: + - podman-machine-default* applehv, 4 CPUs, 2GiB RAM, 100GiB disk. +- podman run was verified with an Alpine test and confirmed working. + +Operational notes: +- For future verification from dankclaw, use SSH checks to 192.168.0.112/235 and podman exec into Hermes containers to test /root/.ssh/id_ed25519 against the three targets. +- Do not assume FrankBook-Pro is iOS; treat it as macOS with Homebrew and AppleHV/vfkit support. + +## 01a0598c-244a-766a-8485-b02f8ab630b5 +updated_at: 1788209135 +DNS architecture / split-horizon behavior: +- Domain: franksdank.cloud. +- Public DNS provider: Porkbun. +- LAN DNS: Pi-hole on the homelab, fed by addn-hosts / local records. +- Public/WAN Porkbun A records point subdomains to WAN IP 71.227.227.172. +- LAN Pi-hole resolves the same subdomains to Dankclaw LAN IP 192.168.0.143. +- G36 router/DHCP gives LAN clients Pi-hole as DNS, so LAN clients hit Pi-hole local records first. WAN clients resolve via Porkbun/public DNS. + +Operational consequence: +- It is safe to remove a regular subdomain A record from Porkbun while keeping the Pi-hole record if the name should be LAN-only. +- LAN clients will continue resolving the name to 192.168.0.143 via Pi-hole. +- WAN clients will get NXDOMAIN/unknown subdomain once the Porkbun record is removed, unless cached elsewhere. +- Removing Porkbun DNS only affects name visibility/resolution; it does not itself close router port forwards or prevent direct access by IP if forwarding remains open. + +Caddy/TLS implications: +- Single Caddy on Dankclaw fronts services and routes by Host header; Caddy does not care whether the hostname was resolved by Porkbun or Pi-hole. +- HTTPS certificates are wildcard DNS-01 certs for franksdank.cloud issued/renewed using a custom franksdank/caddy-porkbun image with caddy-dns/porkbun. +- DNS-01 renewal uses Porkbun API credentials to create TXT records under _acme-challenge; deleting ordinary A records does not break existing wildcard cert validity or renewal. +- Porkbun credentials live in dankclaw/.env as PORKBUN_API_KEY and PORKBUN_API_SECRET_KEY and are deployed to /home/dank/Containers/caddy/env for the Caddy quadlet; never commit secrets. + +Cautions: +- Do not casually remove public DNS for auth.franksdank.cloud: prior sign-in/debugging showed auth needed a public A record for external login flows. +- Be cautious with gitea.franksdank.cloud because git smart-HTTP/external use may depend on public DNS. +- Keep Porkbun records for any service that must be reachable by external users through the public hostname; remove only for LAN-only/internal services. + +Known public/LAN service hostnames previously tracked under franksdank.cloud include: auth, books, romm, files, jellyfin, radarr, sonarr, lidarr, readarr, prowlarr, qbittorrent, search, comfyui, chat, hermes, grafana, prometheus, gitea, pihole, and plex (plex.franksdank.cloud is canonical HTTPS). + +## 01a051e2-6ff9-72cc-b980-b6837011e99f +updated_at: 1788126110 +Service: frank-default-large on Dankclaw (gfx1151 unified memory). +Model: kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF -> file Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf (~113.5 GiB). +Runtime: charlie12345/ROCmFPX llama.cpp (/home/dank/GitPackages/ROCmFPX/build-qwen38). ROCm 7.2.4. +Quant/Format: ROCmFP4 (hand-ported from ciru-ai; upstream llama.cpp incompatible). +Attention: Flash-ATTN ON via QSA indexer. Requires qwen4exp-qsa-f32-mask.patch to fix ggml_fill assert (applied in binary). +MTP/Speculative: Draft head does not load (requires blk.0.hc_attn_norm.weight). Uses ngram-mod speculative decoding. +Context: CTX_SIZE ~400k, Parallel 2. +Config: scripts/frank-default-large.env and scripts/serve-frank-large.sh. +Pitfalls: Avoid bare env vars TEMP, HOST, GPU_MAX_HEAP_SIZE (HIP runtime reads them). llama.cpp respects CLI flags. + +## 01a051bf-4728-7028-82be-247e7b5da2bd +updated_at: 1788080182 +SERVER: frank-default-large | HOST: Dankclaw (Strix Halo gfx1151, unified memory) | RUNTIME: charlie12345/ROCmFPX llama.cpp (/home/dank/GitPackages/ROCmFPX/build-qwen38/bin/llama-server, ROCm 7.2.4, HIP) | MODEL: agentionai/Qwen3.8-Flash-Next-ROCmFP4-FAST-imatrix-v2.gguf (87.06 GiB, Q4_0_ROCMFP4_FAST, qwen4exp MoE: 512 experts/10 used, 48 layers: 12 attn + 36 SSM, QSA indexer, hyper-connections, PLE layer 1, n-gram PLE fully VRAM-resident) | ENV: HIP_VISIBLE_DEVICES=0, HSA_OVERRIDE_GFX_VERSION=11.5.1, LD_LIBRARY_PATH includes ROCm paths | SERVING PROFILE: --parallel 2, --ctx-size 401408, --batch-size 4096, --ubatch-size 4096, --threads 16, --threads-batch 16, --cache-type-k f16, --cache-type-v f16, --ctx-checkpoints 16, --cache-ram 8192, --gpu-layers 999, --split-mode none, --cache-prompt, --cache-idle-slots, --metrics | SAMPLING: --temp 0.7, --top-p 0.8, --top-k 20, --min-p 0.0, --presence-penalty 1.5 | REASONING: --reasoning on, --reasoning-format deepseek, --reasoning-budget -1 | VISION: --mmproj active (f16 mmproj) | SPECULATIVE DECODING: SPEC_TYPE=ngram-mod (MTP head does not load on build-qwen38 due to missing blk.0.hc_attn_norm.weight) | CONSTRAINTS/PITFALLS: --fit off (auto-fit segfaults on qwen4exp hyper-connection config); flash-attn on (known to abort graph build on QSA indexer path); ROCmFP4 quant hand-ported from ciru-ai/ROCmFPX (upstream llama.cpp cannot load this GGUF format). | CONFIG PATHS: /home/dank/Projects/serverAppConfigs/scripts/serve-frank-large.sh, /home/dank/Projects/serverAppConfigs/scripts/frank-default-large.env, /home/dank/Projects/serverAppConfigs/scripts/service-frank-large.service, chat-template.jinja. + +## 01a051d8-db9b-76ab-b05f-ac95f79c9e55 +updated_at: 1788079840 +Tool Constraints: bash tool strictly validates cwd parameter; explicit cwd pointing to non-existent directory causes failure ('Working directory does not exist'). Actual cwd resolved to /home/dank/Projects/serverAppConfigs via read tool. read tool handles relative paths well and returns resultLimit signals. File State: Active file contains git merge conflict markers at lines 25-18 and 64-79. + +## 01a05172-a606-7196-bde3-454344369e22 +updated_at: 1788076443 +Platform: Strix Halo unified memory (~116.7 GiB pool, no separate VRAM). Configuration: frank-default-large updated to n_ctx=200704, n_slots=2 in env/serve scripts. models.json contextWindow set to 200000 for budget calculations. Memory dynamics: Base 32kx1 used ~13 GiB context buffer. 200kx2 scales theoretical buffer ~12.3x, but Qwen3.8-Flash-Next's SSM architecture (12 attention layers out of 48) limits KV cache growth, keeping total load within ~114 GiB HIP heap without OOM. Files: ~/.pi/agent/models.json, /home/dank/serverAppConfigs/scripts/frank-default-large.env, serve-frank-large.sh. + +## 01a050b6-e0fb-73a0-889c-e663fedd8c96 +updated_at: 1788072313 +- **Model Configuration**: Replaced frank-default-large main model with https://huggingface.co/agentionai/Qwen3.8-Flash-Next-ROCmFP4-FAST-imatrix-GGUF. Configured MTP draft as https://huggingface.co/agentionai/Qwen3.8-Flash-Next-MTP-ROCmFP4-FAST-GGUF. +- **MTP Architecture Pitfall**: Previous MTP draft heads failed on STRIX_LEAN due to missing tensor 'blk.0.hc_attn_norm.weight' caused by main/draft mismatch. Using agentionai FAST main with agentionai FAST draft resolves this as a matching pair with compatible general.architecture. +- **Git Workflow Decision**: "Go straight to main" interpreted as skipping branch/worktree ceremony while keeping git as single source of truth. Direct commit and push to main. +- **Deployment Resolution**: Deployment blocked by git state showing deleted file (D) for dankclaw/Caddyfile and presence of .CADDYWIP-backup. Resolved by removing backup and running git checkout HEAD --. +- **Files Modified**: scripts/frank-default-large.env, scripts/serve-frank-large.sh, scripts/patches/qwen4exp-qsa-f32-mask.patch, dankclaw/LLM/agentionai-fast-imatrix.md. +- **Env Tunables**: Updated based on model card settings mixed with existing configuration. + +## 01a04fa5-181d-75a9-ac57-3fdf464a36d3 +updated_at: 1788060388 +RUNTIME: ciru-ai/Qwen3.8-Flash-CIRU-STRIX-IU4 (llamacpp fork, tag v1.1). Binary: /home/dank/GitPackages/ROCmFPX/build-qwen38/bin/llama-server. Build flags: -DGGML_HIP=ON -DGGML_HIP_ROCMI4_W4A4=ON -DCMAKE_HIP_ARCHITECTURES=gfx1151. +MODEL: jcbtc/Qwen3.8-Flash-CIRU-STRIX-IU4 (HuggingFace). Replaces kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX. 177B params, Q4_0 quant, PLE table streamed from page cache. +ARCH: Strix Halo (gfx1151), unified memory, SVM-backed layers (--fit off, --gpu-layers 999). +SPEC DECODING: MTP draft head first. Legacy STRIX_LEAN drafts failed (missing blk.0.hc_attn_norm.weight); new runtime/model fixes this. Stack ngram-mod later. +CONTEXT: Start at 128k (CTX_SIZE=131072), promote to 524k+ post-stability. +SLOTS: parallel=1 default. Long prompts can block the single slot, causing timeouts. Monitor n_prompt_[REDACTED] vs n_prompt_tokens. May need parallel adjustment. +TEMPLATE: scripts/chat-template.jinja (DeepSeek reasoning format). +PATHS: frank-default-large.env, frank-default-large.sh. Health check on 192.168.0.143:7770. + +## 01a04f40-c5c0-77a4-89c1-f729e282a9e8 +updated_at: 1788042611 +Plan: Swap frank-default-large model to agentionai/Qwen3.8-Flash-Next-ROCmFP4-FAST-imatrix-GGUF, use sidecar MTP (not grafted), and stack ngram-mod later. Ignore gitflow, deploy straight to main. + +Model & MTP Details: Sidecar MTP confirmed (main GGUF has 0 MTP tensors, block_count=48; head is 2.44GB on Dankclaw). Using FAST main + FAST family head resolves Aug-28 hc_attn_norm mismatch. Draft path relies on qwen4exp-aware binary. + +Fork Build: Targeting kingjones30/ROCmFPX fork (previously charlie12345/ROCmFPX) on Dankclaw (/home/dank/GitPackages/ROCmFPX/build-qwen38). Fork tip is 36e9acd40; current live binary built at a19d14e4e (indexer-cache fix). + +Decision: Clone fork fresh, pin build to tip main. GATE build on: git merge-base --is-ancestor a19d14e4e . If false, stop to avoid silently dropping the indexer fix that prevents crash-loops. + +Env Constraints: ROCmFPX llama-server (PR #27742). Do not name bare env vars TEMP, HOST, or GPU_MAX_HEAP_SIZE (HIP runtime reads bare vars). --fit off to avoid segfaults on qwen4exp hyper-connection/indexer config. + +## 01a046ba-1301-72c1-8d9f-347ba1c28cf7 +updated_at: 1787952056 +## Homelab Auth Chain: Caddy → Anubis → Authentik Outpost → Apps + +### Architecture (dankclaw/dankserver, franksdank.cloud) +- Caddy runs as container on dankclaw (192.168.0.143), fronts all services on both hosts. +- Chain per protected vhost: TLS (ACME dns-01 via Porkbun) → Anubis bot challenge (:8923) → internal :8016 routing → Caddy forward_auth → Authentik outpost (:9000) → app. +- Apps with own auth (Grafana, Gitea, OpenWebUI, Jellyfin, *arr, Pi-hole) are NOT wrapped in forward_auth. +- DNS: flat franksdank.cloud scheme via Pi-hole quadlet on dankclaw; all names resolve to 192.168.0.143. +- TLS: real LE certs via dns-01 (Porkbun module, franksdank/caddy-porkbun image). No inbound ports needed. + +### Authentik Outpost Provider Config (verified live from DB) +- mode=proxy, external=https://franksdank.cloud, internal=http://authentik-server:9000 +- Authorization flow: implicit-consent +- Outpost resolves provider by **exact Host header match** — this is why naive curl probes 404 (wrong/missing Host) while Caddy works (forwards real Host). + +### Critical Pitfall: CLI Verification of Auth Chain +- Unknown-UA clients (curl, bots) get Anubis JS challenge FIRST → respond 200 with HTML challenge page. +- This means `curl -A 'goauthentik.io/outpost/...'` to a protected vhost returns 200 (challenge page), NOT outpost pass-through. +- Caddy's forward_auth subrequest is an internal hop (Caddy→authentik :9000) — NOT affected by Anubis. +- **Conclusion**: You cannot verify end-to-end auth from CLI. Must test in a real browser (solves JS challenge once, gets clearance cookie, then SSO carries across apps). + +### Caddy Admin Toggle Pitfall +- `admin off` in Caddyfile disables the config file watcher → rendered Caddyfile changes do NOT hot-reload. +- Symptom: stale basicauth hash sitting on disk unapplied for hours (observed 2026-08-22). +- Fix: keep admin ON (binds to 127.0.0.1:2019 inside container, port not published, safe). + +### Unresolved at Thread End: External Login 'Not Found' +- Symptom: externally (phone off wifi), after passing Anubis challenge, user gets Authentik's unstyled 'Not Found' page with dead 'Go home' link + 'Powered by authentik' subtitle. +- Diagnosis direction: outpost 404 = provider host-match failure for external request pattern. External clients may present a Host header that doesn't match the outpost's configured provider hostname (e.g., mobile carrier NAT, different SNI, or outpost endpoint path mismatch for non-LAN IPs). +- Next steps would be: check outpost logs for 404s, verify external DNS resolves to Caddy (not bypassed), confirm outpost endpoint URL matches what Caddy forwards externally. + +### Grilling Skill +- Path: /home/dank/.agents/skills/grilling/SKILL.md +- Purpose: stress-test plans before building; one question at a time; look up facts in codebase, put decisions to user. + +## 01a04717-a7fd-73ab-b7eb-319c4c1271c1 +updated_at: 1787905384 +Context: User asked whether HuggingFace EasiiX/Qwen3.8-Flash-Next-MTP-Strix-Halo-GGUF should be compatible with their personal llama.cpp runtime fork for frank-default-large's Qwen3.8-Flash-Next model. + +Current frank-default-large setup at time of rollout: +- Served by /home/dank/Projects/serverAppConfigs/scripts/serve-frank-large.sh using env /home/dank/Projects/serverAppConfigs/scripts/frank-default-large.env. +- Runtime binary: /home/dank/GitPackages/ROCmFPX/build-qwen38/bin/llama-server from charlie12345/ROCmFPX llama.cpp fork with qwen4exp architecture support / PR #27742 merged, built with HIP/ROCmFP4 for Strix Halo gfx1151. +- Model repo/path: kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX / local /home/dank/models/kingjones-Qwen3.8-Flash-Next-ROCmFP4-STRIX, file Qwen3.8-Flash-Next-Q4_0-ROCmFP4-STRIX.gguf. +- Model details in serve script: 177B params = 56B MoE + 51.2B PLE n-gram table, 512 experts / 10 used, 48 layers (12 attention + 36 SSM/Mamba), full_attention_interval=4, 2 KV heads x 256 dim, QSA indexer, hyper-connections count=4 low_rank=320, PLE at layer 1. Q4_0_ROCMFP4_STRIX quant, 113.47 GiB single file. PLE table streamed from page cache; GPU resident approx 63-69 GiB; mmap default into Strix Halo unified memory. --fit off because auto-fit segfaults on hyper-connection/indexer config; -ngl 999 puts layers on GPU/SVM. +- Sharp chat template enabled via scripts/chat-template.jinja with --jinja and CHAT_TEMPLATE_KWARGS preserving thinking/reasoning; reasoning format deepseek. + +MTP investigation outcome: +- Tested EasiiX/Qwen3.8-Flash-Next-MTP-Strix-Halo-GGUF Q8_0 draft head and agentionai ROCmFP4-FAST MTP draft head against the STRIX_LEAN/Uncensored main model and qwen4exp binary. +- Both MTP draft GGUFs failed at load/runtime with missing tensor: blk.0.hc_attn_norm.weight. +- Interpretation: qwen4exp runtime expects hyper-connection attention norm tensors in draft models for this architecture/config, but these published draft GGUFs do not carry them. Therefore they are not compatible with the current frank-default-large runtime/model as-is. +- Durable next step: Need either (a) an MTP draft head GGUF that includes hc_attn_norm tensors matching this qwen4exp/hyper-connection model, or (b) a patched/binary/runtime path that does not require those hyper-connection tensors for draft models. + +Operational state after rollout: +- Reverted/left frank-default-large using ngram-mod only, not MTP. +- Health check returned {"status":"ok"} after restart; service healthy on ngram-mod. +- Tests passed: ./tests/run.sh and focused bats tests for LLM units, secrets, script syntax; shellcheck skipped locally because not installed. +- Committed/pushed/pulled serverAppConfigs changes: commit 6d4a96a, message "frank-default-large: ngram-mod only — both MTP draft heads incompatible". Changed scripts/frank-default-large.env and scripts/serve-frank-large.sh. Dankclaw checkout fast-forwarded to commit 6d4a96a. + +Pitfall to remember: Do not assume Qwen3.8-Flash-Next MTP heads are compatible merely by model name/quant/Strix Halo labeling. Check tensor inventory for hyper-connection tensors, especially blk.0.hc_attn_norm.weight, before scheduling downtime for swap-in. + +## 01a04330-1551-72f6-b57b-8a8f43ffe7e2 +updated_at: 1787862517 +Context: frank-default-large serves kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF on Dankclaw (Strix Halo gfx1151 unified memory) using charlie12345/ROCmFPX llama.cpp build-qwen38 with qwen4exp support. Model is Q4_0_ROCMFP4_STRIX, ~113.47 GiB GGUF, 56B MoE plus 51.2B PLE n-gram table; PLE table is streamed from page cache and not resident in GPU VRAM. Runtime uses mmap into SVM-backed unified memory, -ngl 999/all layers on GPU, f16 KV, and --fit off because auto-fit segfaults on this model’s qwen4exp hyper-connection/indexer config. + +Current/benchmark-relevant env file path: /home/dank/Projects/serverAppConfigs/scripts/frank-default-large.env. Serve script: /home/dank/Projects/serverAppConfigs/scripts/serve-frank-large.sh. Key documented tunables include CTX_SIZE=524288, PARALLEL=2, BATCH_SIZE=4096, UBATCH_SIZE=4096, NUM_THREADS=16, CACHE_TYPE_K=f16, CACHE_TYPE_V=f16, CTX_CHECKPOINTS=16, CACHE_RAM=8192, FIT=off. The prefill tuning rollout settled/documented BATCH_SIZE=4096 and UBATCH_SIZE=4096. + +Decode tuning: a thread-batch sweep was run with an 8K prompt and 256 generated tokens. THREAD_BATCH=16 was confirmed as the best decode setting in that sweep. A prior todo requested 512 generated tokens, but that was intentionally not rerun: decode throughput in generated tok/s is independent of generation length for this comparison, so 512 tokens would only double wall-clock time while preserving the same tok/s signal. Use 256 gen tokens for future decode sweeps unless specifically measuring long-run thermal throttling or stability. + +Benchmark methodology notes: separate prefill/TTFT benchmarking from decode tok/s benchmarking. For prefill, sweep batch and ubatch while holding other variables fixed and measure prompt processing throughput/TTFT. For decode, use a fixed prompt length (8K was used) and fixed generation length (256 tokens sufficient) while sweeping THREAD_BATCH; evaluate generated tok/s and TTFT. Keep prompts deterministic and repeat enough to avoid cache/page-cache warmup artifacts. Restore production env/service after benchmark and run the repo/service test suite. + +Operational pitfalls/constraints: do not define bare env vars TEMP, HOST, or GPU_MAX_HEAP_SIZE in service env files; ROCm/HIP runtime reads those names and prior TEMP incident caused failures. llama.cpp host/port/temp should be passed as CLI flags, not bare env vars. Do not enable --fit for this model unless the qwen4exp auto-fit segfault has been fixed. Avoid interpreting longer generation-length decode runs as better signal unless testing thermal/stability; tok/s is the reusable metric. + ## 01a042cc-e1c5-7482-87a2-14deadb82202 updated_at: 1787833610 ## frank-default-large: Qwen3.8-Flash-Next tuning on Dankclaw (Strix Halo gfx1151) diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04330-1551-72f6-b57b-8a8f43ffe7e2-frank_large_prefill_.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04330-1551-72f6-b57b-8a8f43ffe7e2-frank_large_prefill_.md new file mode 100644 index 0000000..35f3fa8 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04330-1551-72f6-b57b-8a8f43ffe7e2-frank_large_prefill_.md @@ -0,0 +1,4 @@ +thread_id: 01a04330-1551-72f6-b57b-8a8f43ffe7e2 +updated_at: 1787862517 + +frank-default-large (Qwen3.8-Flash-Next ROCmFP4 STRIX on Dankclaw/Strix Halo via ROCmFPX llama.cpp) tuning/benchmark rollout: benchmarked prefill batch/ubatch and decode thread-batch; batch/ubatch 4096/4096 is the documented prefill setting, decode sweep found THREAD_BATCH=16 optimal. Decode benchmark used 8K prompt + 256 gen tokens; 512-token variant was intentionally skipped because gen tok/s is length-independent and would only double wall time. Service restored healthy and tests passed. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a046ba-1301-72c1-8d9f-347ba1c28cf7-authentik_anubis_cha.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a046ba-1301-72c1-8d9f-347ba1c28cf7-authentik_anubis_cha.md new file mode 100644 index 0000000..49099ee --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a046ba-1301-72c1-8d9f-347ba1c28cf7-authentik_anubis_cha.md @@ -0,0 +1,4 @@ +thread_id: 01a046ba-1301-72c1-8d9f-347ba1c28cf7 +updated_at: 1787952056 + +Authentik SSO + Anubis bot-protection chain debugging on homelab (Caddy → Anubis → Authentik outpost → apps). Key discovery: CLI curl probes of the auth chain return 200 from Anubis's JS challenge page, not from the outpost — making CLI verification of forward_auth fundamentally limited. External login broken: after passing Anubis externally, user hits Authentik's unstyled 'Not Found' page (outpost 404), indicating provider host-match failure for external requests. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04717-a7fd-73ab-b7eb-319c4c1271c1-frank_large_mtp_inco.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04717-a7fd-73ab-b7eb-319c4c1271c1-frank_large_mtp_inco.md new file mode 100644 index 0000000..fb6d60d --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04717-a7fd-73ab-b7eb-319c4c1271c1-frank_large_mtp_inco.md @@ -0,0 +1,4 @@ +thread_id: 01a04717-a7fd-73ab-b7eb-319c4c1271c1 +updated_at: 1787905384 + +frank-default-large Qwen3.8-Flash-Next on ROCmFPX/qwen4exp cannot use tested MTP GGUF draft heads; both fail missing hyper-connection tensor blk.0.hc_attn_norm.weight. Service left healthy on ngram-mod; repo committed/pushed/pulled. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04a3f-6596-75d0-8749-8ece9a2b11fd-homelab_caddy_authen.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04a3f-6596-75d0-8749-8ece9a2b11fd-homelab_caddy_authen.md new file mode 100644 index 0000000..7a3a77c --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04a3f-6596-75d0-8749-8ece9a2b11fd-homelab_caddy_authen.md @@ -0,0 +1,4 @@ +thread_id: 01a04a3f-6596-75d0-8749-8ece9a2b11fd +updated_at: 1788224586 + +Homelab serverAppConfigs on Dankclaw/Dankserver. Single Caddy container fronts both hosts via Porkbun DNS-01 (no inbound 80/443) with Authentik SSO forward_auth. Hermes WebUI uses host networking; browser automation via quadlet on loopback 127.0.0.1:9222. Config quirk: /data/config.yaml owned by unmapped UID. NPM npx cache persists across restarts but resets on recreation. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04f40-c5c0-77a4-89c1-f729e282a9e8-rocimfp4_fast_model_.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04f40-c5c0-77a4-89c1-f729e282a9e8-rocimfp4_fast_model_.md new file mode 100644 index 0000000..f30807e --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04f40-c5c0-77a4-89c1-f729e282a9e8-rocimfp4_fast_model_.md @@ -0,0 +1,4 @@ +thread_id: 01a04f40-c5c0-77a4-89c1-f729e282a9e8 +updated_at: 1788042611 + +Swap frank-default-large to agentionai/Qwen3.8-Flash-Next-ROCmFP4-FAST-imatrix-GGUF with sidecar MTP; build kingjones30/ROCmFPX fork on Dankclaw pinning to main tip while gating ancestor check for a19d14e4e indexer fix to prevent crash regression. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04fa5-181d-75a9-ac57-3fdf464a36d3-frank_large_ciru_str.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04fa5-181d-75a9-ac57-3fdf464a36d3-frank_large_ciru_str.md new file mode 100644 index 0000000..0747210 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a04fa5-181d-75a9-ac57-3fdf464a36d3-frank_large_ciru_str.md @@ -0,0 +1,4 @@ +thread_id: 01a04fa5-181d-75a9-ac57-3fdf464a36d3 +updated_at: 1788060388 + +Switch frank-default-large to ciru-ai/Qwen3.8-Flash-CIRU-STRIX-IU4 runtime (llamacpp v1.1) and jcbtc HF model on Strix Halo (gfx1151). Implement MTP spec decoding first, stack ngram-mod later. Initialize at 128k context, scale to full. Resolve slot-blocking with parallel=1 during long prompts. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a050b6-e0fb-73a0-889c-e663fedd8c96-qwen38_flash_next_mt.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a050b6-e0fb-73a0-889c-e663fedd8c96-qwen38_flash_next_mt.md new file mode 100644 index 0000000..4ff36ad --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a050b6-e0fb-73a0-889c-e663fedd8c96-qwen38_flash_next_mt.md @@ -0,0 +1,4 @@ +thread_id: 01a050b6-e0fb-73a0-889c-e663fedd8c96 +updated_at: 1788072313 + +Swapped frank-default-large to agentionai Qwen3.8-Flash-Next ROCmFP4-FAST main model with matching MTP draft. Resolved prior MTP architecture mismatch (missing blk.0.hc_attn_norm.weight) by pairing same-author models. Deployed straight to main after resolving Caddyfile deletion state and WIP backup. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05172-a606-7196-bde3-454344369e22-frank_default_large_.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05172-a606-7196-bde3-454344369e22-frank_default_large_.md new file mode 100644 index 0000000..1dc7d11 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05172-a606-7196-bde3-454344369e22-frank_default_large_.md @@ -0,0 +1,4 @@ +thread_id: 01a05172-a606-7196-bde3-454344369e22 +updated_at: 1788076443 + +Expanded frank-default-large on dankclaw to parallel 2 slots (n_ctx=200704) with 200k context window. Unified memory (~116.7 GiB) efficiently handles ~12.3x context buffer growth via SSM architecture compression. Updated models.json to contextWindow=200000. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051bf-4728-7028-82be-247e7b5da2bd-frank_default_large_.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051bf-4728-7028-82be-247e7b5da2bd-frank_default_large_.md new file mode 100644 index 0000000..72f2851 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051bf-4728-7028-82be-247e7b5da2bd-frank_default_large_.md @@ -0,0 +1,4 @@ +thread_id: 01a051bf-4728-7028-82be-247e7b5da2bd +updated_at: 1788080182 + +frank-default-large runs on Dankclaw (gfx1151) using charlie12345/ROCmFPX llama.cpp (build-qwen38). Serves Qwen3.8-Flash-Next (87.06 GiB, Q4_0_ROCMFP4_FAST) with --fit off (avoids auto-fit segfault), --flash-attn on (watch for QSA indexer graph build aborts), and ngram-mod speculative decoding (MTP head absent). Profile: ctx 401408, b/ub 4096, f16 KV, deepseek reasoning, f16 vision tower. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051d8-db9b-76ab-b05f-ac95f79c9e55-workspace_root.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051d8-db9b-76ab-b05f-ac95f79c9e55-workspace_root.md new file mode 100644 index 0000000..d4c87c1 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051d8-db9b-76ab-b05f-ac95f79c9e55-workspace_root.md @@ -0,0 +1,4 @@ +thread_id: 01a051d8-db9b-76ab-b05f-ac95f79c9e55 +updated_at: 1788079840 + +Operational cwd is /home/dank/Projects/serverAppConfigs. The bash tool fails if the provided cwd parameter points to a non-existent path (e.g., /workspace). The read tool effectively resolves relative paths (e.g., '.') to absolute paths and reports resultLimit hints. Git merge conflicts detected in active file (lines 25-18, 64-79). diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051e2-6ff9-72cc-b980-b6837011e99f-frank_default_large_.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051e2-6ff9-72cc-b980-b6837011e99f-frank_default_large_.md new file mode 100644 index 0000000..02a3c23 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a051e2-6ff9-72cc-b980-b6837011e99f-frank_default_large_.md @@ -0,0 +1,4 @@ +thread_id: 01a051e2-6ff9-72cc-b980-b6837011e99f +updated_at: 1788126110 + +frank-default-large switched to kingjones777/Qwen3.8-Flash-Next-ROCmFP4-STRIX-GGUF. Runtime: charlie12345/ROCmFPX (build-qwen38). Flash-ATTN ON (QSA path, requires F32-mask patch). MTP draft head skipped (ngram-mod). Watch bare env vars (TEMP, HOST, GPU_MAX_HEAP_SIZE). diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a0598c-244a-766a-8485-b02f8ab630b5-split_dns_porkbun_pi.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a0598c-244a-766a-8485-b02f8ab630b5-split_dns_porkbun_pi.md new file mode 100644 index 0000000..b045794 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a0598c-244a-766a-8485-b02f8ab630b5-split_dns_porkbun_pi.md @@ -0,0 +1,4 @@ +thread_id: 01a0598c-244a-766a-8485-b02f8ab630b5 +updated_at: 1788209135 + +Homelab uses split DNS for franksdank.cloud: Porkbun public A records point WAN clients to 71.227.227.172, while Pi-hole LAN DNS/addn-hosts resolves internal names to Dankclaw 192.168.0.143. Removing a normal Porkbun A record makes that subdomain NXDOMAIN externally but LAN resolution via Pi-hole continues; Caddy routing/TLS remain valid because Caddy uses Host headers and DNS-01 wildcard certs via Porkbun API. Keep public DNS for externally needed names like auth/gitea. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059ae-72f3-76d4-8e09-735f8f2e0a5d-ssh_podman_frankbook.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059ae-72f3-76d4-8e09-735f8f2e0a5d-ssh_podman_frankbook.md new file mode 100644 index 0000000..4c0d078 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059ae-72f3-76d4-8e09-735f8f2e0a5d-ssh_podman_frankbook.md @@ -0,0 +1,4 @@ +thread_id: 01a059ae-72f3-76d4-8e09-735f8f2e0a5d +updated_at: 1788216058 + +Configured passwordless SSH among dankclaw/dankware, FrankBook-Pro, dankserver, and Hermes containers; installed and verified Podman stack on FrankBook-Pro macOS host. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059f4-cead-704b-b857-fad89ebde42b-dankserver_copyparty.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059f4-cead-704b-b857-fad89ebde42b-dankserver_copyparty.md new file mode 100644 index 0000000..d5f497f --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a059f4-cead-704b-b857-fad89ebde42b-dankserver_copyparty.md @@ -0,0 +1,4 @@ +thread_id: 01a059f4-cead-704b-b857-fad89ebde42b +updated_at: 1788224497 + +Dankserver copyparty read-only hardening: changed copyparty volume perms from `-v /w::A` to `-v /w::r:ra,dank`, deployed with podman-compose recreate, verified reads work and writes/deletes fail. Important discovery: copyparty bare `A` grants everyone full access, not anonymous-deny; authentik-protected traffic reaches copyparty unauthenticated, so anonymous must retain `r` for web reads. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a29-d9fd-71ca-86c8-b92c602492c7-volume_security_free.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a29-d9fd-71ca-86c8-b92c602492c7-volume_security_free.md new file mode 100644 index 0000000..1fc9e9f --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a29-d9fd-71ca-86c8-b92c602492c7-volume_security_free.md @@ -0,0 +1,4 @@ +thread_id: 01a05a29-d9fd-71ca-86c8-b92c602492c7 +updated_at: 1788229381 + +Volume security via writer:readers POSIX ownership with 2775 (setgid) for single-writer/multi-reader SFTP/SSH. FreeToken build on Dankclaw supports Vulkan/ROCm (ROCm 6.3, NVIDIA 575.57.02, CMake/Python/git). GGUF loading restricted to Gemma4GGUFForCausalLM; supports F32/F16/BF16 (native) and Q4_0/Q6_K (dequant), Q8_0 lacks dequant. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a42-6580-7043-96eb-a73344efd9e6-hermes_flm_gemma.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a42-6580-7043-96eb-a73344efd9e6-hermes_flm_gemma.md new file mode 100644 index 0000000..87cdde3 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a42-6580-7043-96eb-a73344efd9e6-hermes_flm_gemma.md @@ -0,0 +1,4 @@ +thread_id: 01a05a42-6580-7043-96eb-a73344efd9e6 +updated_at: 1788221481 + +Added Dankclaw FLM/NPU Gemma vision model to Hermes and persisted sanitized config; routed Hermes vision auxiliary to gemma4-it:e4b; adjusted agent model context; verified all tests passed. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a7d-cc94-7589-8926-c24cb5a10490-container_persistenc.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a7d-cc94-7589-8926-c24cb5a10490-container_persistenc.md new file mode 100644 index 0000000..f1c5005 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05a7d-cc94-7589-8926-c24cb5a10490-container_persistenc.md @@ -0,0 +1,4 @@ +thread_id: 01a05a7d-cc94-7589-8926-c24cb5a10490 +updated_at: 1788248708 + +Container persistence audit confirms Hermes survives restarts via /home/dank/hermes-data:/data bind mount and corrected headless entrypoint. Establishes persistent storage patterns across Dankclaw/Dankserver: host bind mounts for state, Quadlet units for boot persistence, and rootless-safe group passthrough for GPUs and services. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bd4-8dbe-759b-8885-8b86990051ed-frank_large_qwen38_s.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bd4-8dbe-759b-8885-8b86990051ed-frank_large_qwen38_s.md new file mode 100644 index 0000000..4294212 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bd4-8dbe-759b-8885-8b86990051ed-frank_large_qwen38_s.md @@ -0,0 +1,4 @@ +thread_id: 01a05bd4-8dbe-759b-8885-8b86990051ed +updated_at: 1788314412 + +frank-default-large runs Qwen3.8-Flash-Next ROCmFP4 STRIX via kingjones30/ROCmFPX llama.cpp on Dankclaw/Strix Halo; stock llama.cpp cannot load it. Also captured ASUS TUF GAMING B650-E WIFI BIOS update/backup workflow for AGESA memory-training improvements. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bed-d759-7157-af15-2e178337182a-podman_standardizati.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bed-d759-7157-af15-2e178337182a-podman_standardizati.md new file mode 100644 index 0000000..4a658ea --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a05bed-d759-7157-af15-2e178337182a-podman_standardizati.md @@ -0,0 +1,4 @@ +thread_id: 01a05bed-d759-7157-af15-2e178337182a +updated_at: 1788325757 + +Podman standardization and *arr-stack migration to FrankBook-Pro. Locked decisions: quadlet units (bind mounts only, no named volumes), data root /home/dank/Containers/, *arr migrate to Mac with gluetun VPN netns sharing, /Volumes/COMPLETE paths kept verbatim, LAN-only exposure. Execution phases: 0 (prereqs), 1 (dankserver stop-mv-chown-restart, RomM anonymous volume landmine), 2 (dankclaw roots), 3/4 (Mac cutover). Deploy uses deploy.sh (push/pull/dispatch/health). Secrets externalized; --userns=host required. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06035-a0d8-73ad-8a49-279f51c68bf2-plex_homepage_jellyf.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06035-a0d8-73ad-8a49-279f51c68bf2-plex_homepage_jellyf.md new file mode 100644 index 0000000..b4f573c --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06035-a0d8-73ad-8a49-279f51c68bf2-plex_homepage_jellyf.md @@ -0,0 +1,4 @@ +thread_id: 01a06035-a0d8-73ad-8a49-279f51c68bf2 +updated_at: 1788329168 + +Updated Plex homepage link to /web/index.html in shared/homepage configs. Verified Jellyfin (/mnt/entropy:/data:ro) and Copyparty (/mnt/entropy:/w:ro) mounts, noted correct DB table (BaseItems). Deployed via 8895a02 with 233/233 tests green; user locked state. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06085-8146-72b0-9e52-b486c767a2f6-plex_tautulli_podman.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06085-8146-72b0-9e52-b486c767a2f6-plex_tautulli_podman.md new file mode 100644 index 0000000..7d56b19 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06085-8146-72b0-9e52-b486c767a2f6-plex_tautulli_podman.md @@ -0,0 +1,4 @@ +thread_id: 01a06085-8146-72b0-9e52-b486c767a2f6 +updated_at: 1788331026 + +Migrated Plex (native) and Tautulli (snap) to podman quadlets on dankserver with zero-bytes-moved data. Rootless podman fleet model adopted (PUID=0/PGID=0 for Plex, PUID=1000 for Tautulli). Network on dankserver_appnet with host aliases. Fixed UID mapping, health gate widened to 600s for 32GB DB migrations, and resolved key-churn in quadlet generation. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a063a7-4c37-7765-8f58-21f7c860aed7-service_status_herme.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a063a7-4c37-7765-8f58-21f7c860aed7-service_status_herme.md new file mode 100644 index 0000000..db0bab9 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a063a7-4c37-7765-8f58-21f7c860aed7-service_status_herme.md @@ -0,0 +1,4 @@ +thread_id: 01a063a7-4c37-7765-8f58-21f7c860aed7 +updated_at: 1788403307 + +serverAppConfigs service-status investigation from Dankware: repo manages services on Dankserver (192.168.0.235) and Dankclaw (192.168.0.143) via mostly rootless Podman Quadlet user units; both hosts are reachable by passwordless SSH. Hermes WebUI troubleshooting on Dankclaw found hermes/hermes-webui/hermes-dashboard active, but signal-cli-daemon inactive/disabled, which is likely why Hermes/WebUI cannot reach Signal transport. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06894-8947-74fa-ba09-0f104cd6677f-frank_npu_deployment.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06894-8947-74fa-ba09-0f104cd6677f-frank_npu_deployment.md new file mode 100644 index 0000000..4afd632 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06894-8947-74fa-ba09-0f104cd6677f-frank_npu_deployment.md @@ -0,0 +1,4 @@ +thread_id: 01a06894-8947-74fa-ba09-0f104cd6677f +updated_at: 1788495432 + +Deployed frank-npu to dankclaw (commit df0c663) using nuextract3:4b on port 7771. FLM_CTX_LEN=-1 enables per-pack context windows. Routing supports heretic tag alternation with ~6-11s swap cost. Initiating broader service renames (frank-small/large/npu) requiring models.json alias updates prior to runtime restarts. Playwright test requirements established for Authentik auth chains and admin access. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06aa2-9087-753a-8019-50af77fbaddf-services_json_format.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06aa2-9087-753a-8019-50af77fbaddf-services_json_format.md new file mode 100644 index 0000000..697532a --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06aa2-9087-753a-8019-50af77fbaddf-services_json_format.md @@ -0,0 +1,4 @@ +thread_id: 01a06aa2-9087-753a-8019-50af77fbaddf +updated_at: 1788501666 + +Formatted shared/homepage/services.json to multi-line and deployed 7 description updates to Dankclaw. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06b4c-fcea-70e2-a342-a41c5f99d927-arr_stack_local_dns_.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06b4c-fcea-70e2-a342-a41c5f99d927-arr_stack_local_dns_.md new file mode 100644 index 0000000..c861c23 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06b4c-fcea-70e2-a342-a41c5f99d927-arr_stack_local_dns_.md @@ -0,0 +1,4 @@ +thread_id: 01a06b4c-fcea-70e2-a342-a41c5f99d927 +updated_at: 1788553425 + +Consolidated *arr stack to FrankBook-Pro (dankclaw) with local-only DNS via Pi-hole quadlet. Six containers share a gluetun netns, publishing zero internal ports while routing all egress through ProtonVPN. DNS resolves to Caddy (192.168.0.143), which proxies to apps. Prowlarr, readarr, and EZTV/1337x have parked post-migration items awaiting verification. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06e56-5e70-73f5-83b3-a28b1736f34b-pihole_admin_reset_l.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06e56-5e70-73f5-83b3-a28b1736f34b-pihole_admin_reset_l.md new file mode 100644 index 0000000..1f026bd --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06e56-5e70-73f5-83b3-a28b1736f34b-pihole_admin_reset_l.md @@ -0,0 +1,4 @@ +thread_id: 01a06e56-5e70-73f5-83b3-a28b1736f34b +updated_at: 1788561197 + +Reset Pi-hole admin password to pihole.2026. Confirmed LAN-only deployment: public Porkbun A record removed (NXDOMAIN externally), LAN resolves via addn-hosts to 192.168.0.143. Caddy retains vhost for TLS termination and basicauth edge, reverse proxying to the Pi-hole quadlet on port 8083. Pi-hole remains authoritative LAN DNS server while relying on Caddy for edge routing and authentication. diff --git a/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06ef4-c78b-71df-98e0-e1b930f260a5-sonarr_admin_local.md b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06ef4-c78b-71df-98e0-e1b930f260a5-sonarr_admin_local.md new file mode 100644 index 0000000..0e73de2 --- /dev/null +++ b/agent/memories/--home-dank-Projects-serverAppConfigs--/rollout_summaries/01a06ef4-c78b-71df-98e0-e1b930f260a5-sonarr_admin_local.md @@ -0,0 +1,4 @@ +thread_id: 01a06ef4-c78b-71df-98e0-e1b930f260a5 +updated_at: 1788579402 + +Sonarr shifted to 'admin' category in shared/homepage/services.json and isolated to local-only reachability by stripping its public Caddyfile vhost (sonarr.franksdank.cloud). Resolves prior Seerr/Sonarr exposure mix-up. Committed as b6f5b2b.