chore(memory): flush runtime memories and promote managed skills
Memory-file flush for the dotfiles-deploy session with the blankpad admin credential scrubbed to a placeholder; sessions transcripts untracked (gitignored) since harness transcripts can carry raw secrets. Managed skills: command-center-dotfiles-import, ssh-fish-host-remote-exec, stash-supersession-audit-before-drop.
This commit is contained in:
Frank
@@ -0,0 +1,35 @@
|
||||
---
|
||||
name: command-center-dotfiles-import
|
||||
description: "Runbook for deploying the command-center repo (dotfiles env layer + OMP harness) to fleet machines via full-replica rsync and deploy.sh, including override-package mechanics and ssh/sshpass transport gotchas; executed end-to-end on blankpad 2026-09-09."
|
||||
---
|
||||
|
||||
# Command-center fleet deployment (repo = deployment)
|
||||
|
||||
Repo `~/.omp` is itself the deployment: packages are home-relative trees under `dotfiles/<pkg>/`; `scripts/deploy.sh` symlinks live files into the repo checkout. `git pull` + `deploy.sh` is the whole propagation story.
|
||||
|
||||
## Transport decision (agreed with Frank, executed 2026-09-09)
|
||||
- Ship via **full-replica rsync of `/home/dank/.omp/` including `.git`** to `<user>@<host>:/home/<user>/.omp/`, NOT clone-from-Gitea — `main` can be ahead of `origin/main`; push is a user-only trigger, so clone would ship stale state.
|
||||
- Deploy runs on-target as the target user: `bash /home/<user>/.omp/scripts/deploy.sh` (resolves repo via `git -C $(dirname $(realpath $0)) rev-parse --show-toplevel`, so `.git` must be present at target path — full-replica transport guarantees this).
|
||||
|
||||
## Pre-overwrite audit (MANDATORY before first sync on a non-blank host)
|
||||
Diff every file that `deploy.sh --check` reports as DRIFT against the repo copy BEFORE letting quarantine-and-replace run. Host-specific divergence belongs in an override package, not in quarantine:
|
||||
1. Pull divergent live files from target (`ssh ... 'cat <path>' > local-staged-copy`).
|
||||
2. Secret-audit staged copies (grep token/secret/password/key shapes) before anything enters git.
|
||||
3. Compose `dotfiles/zz-<hostname>/` on the source machine from those live copies; commit to repo first.
|
||||
4. Ship package dir via rsync, then run deploy sync — override deploys LAST and wins over base packages.
|
||||
|
||||
## deploy.sh mechanics (verified on blankpad)
|
||||
- `--check` = pure report (ADOPT/LINK/DRIFT lines), writes nothing. Run it first, always.
|
||||
- Default mode = sync: adopt identicals silently, link new, quarantine-and-replace divergents into `.quarantine/<host>/<ts>/` (gitignored; never rm).
|
||||
- **Override-target bug (fixed cc2c652):** `zz-<host>` packages nest base-package dirs internally (`zz-blankpad/niri/.config/...`); target derivation must strip the nested package segment, else overrides deploy to phantom `$HOME/niri/.config/...` while real targets keep pointing at canonical copies (visible symptom: check shows 0 actions but `readlink ~/.zshrc` points at base `zsh/.zshrc`).
|
||||
- systemd units auto-enable only when ExecStart binary resolves on that host; dconf package loads via `dconf load /`, never symlinks.
|
||||
- `core.hooksPath=.githooks` is armed by deploy.sh per machine — set it once post-transfer even before first sync.
|
||||
|
||||
## ssh/sshpass transport gotchas (bit us live)
|
||||
- Resolve target via mDNS FQDN (`avahi-resolve -4 -n <host>.local`); bare hostname may not resolve. Drop-not-refuse on port 22 = sshd down or firewall default-drop, not auth failure — needs local/console fix on target.
|
||||
- `SSHPASS='...' sshpass -e ssh ...` inline per invocation; env passed via tool `env` param did not propagate to the sshpass child process.
|
||||
- Remote login shell may be **fish**: never send bash syntax (`for/do/done`, `$?`) bare through `ssh host 'cmd'`; wrap as `bash /path/script.sh` or `bash -c "..."`.
|
||||
- File shipping: `ssh 'cat > /remote/path' < localfile` (stdin redirect). A here-doc attached to the ssh command is consumed by `cat` — the intended script body becomes the file content, silently. Verify shipped bytes with md5sum compare on both ends; do NOT compare `/dev/stdin` after `cat` drained it (false DIVERGED).
|
||||
|
||||
## Verification of a completed deploy
|
||||
Re-run `deploy.sh --check` → expect exactly zero actions/quarantined/skipped = idempotent steady state. Spot-check `readlink` on override files points into `dotfiles/zz-<host>/`, not base packages.
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
name: ssh-fish-host-remote-exec
|
||||
description: "Runbook for password-auth SSH exec/file-ship to fleet hosts whose login shell is fish (e.g. blankpad), avoiding the fish-parsing and heredoc-swallow traps"
|
||||
---
|
||||
|
||||
## When
|
||||
Running remote commands or shipping files over SSH to a host whose login shell is **fish** (blankpad: user `blank`, reachable only as mDNS FQDN `blankpad.local` / 192.168.0.83 — bare hostname does not resolve from Dankware).
|
||||
|
||||
## Procedure
|
||||
1. **Auth**: `SSHPASS='<pw>' sshpass -e ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@host '...'` — password via env, never argv (ps-visible).
|
||||
2. **Remote exec**: `ssh host 'cmd'` pipes the command string to the login shell (fish). Bashisms like `for ... do`, `$?`, heredoc markers fail at *parse* time on fish (`Missing end to balance this for loop`). Always wrap compound commands: `ssh host 'bash -c "for b in a b c; do command -v $b || echo MISSING; done"'` (escape inner `$`).
|
||||
3. **File shipping**: never combine `cat > /remote/path <<EOF` with a trailing `bash -s` in the same ssh command — `cat` drains stdin, so the interpreter silently runs on empty stdin and prints nothing (silent no-op that *looks* like success). Ship real bytes via local-file stdin redirect: `ssh host 'cat > /remote/path' < localfile`, then verify byte-truth with md5sum on both ends.
|
||||
4. **Exit codes**: `$?` in an unquoted remote command is parsed by fish (`$status` there) — wrap in bash or drop the status echo; ssh's own exit code propagates to the caller anyway.
|
||||
|
||||
## Why
|
||||
Both traps fired during the 2026-09-09 blankpad dotfiles deploy: first probe attempt died on fish loop parsing; a `cat >` ship silently swallowed the heredoc that was meant for `bash -s`, deploying the wrong file bytes until md5-compared.
|
||||
@@ -0,0 +1,33 @@
|
||||
---
|
||||
name: stash-supersession-audit-before-drop
|
||||
description: "Before dropping a stale git stash, prove it's superseded by HEAD via per-file line-set diff of git show stash@{0}:file vs HEAD; archive as an annotated tag and drop only after auditing unique facts — zero-loss alternative to blind drop."
|
||||
---
|
||||
|
||||
# Stash Supersession Audit Before Drop
|
||||
|
||||
Use when a repo (especially a live-deployment checkout where the working tree IS the deployment, e.g. `~/.omp` command-center) has an old stash whose content may have been superseded by later commits, and dropping blindly risks losing unique facts.
|
||||
|
||||
## Procedure
|
||||
|
||||
1. **Inventory the stash** — see which files it touches:
|
||||
```bash
|
||||
git stash show --stat stash@{0}
|
||||
```
|
||||
2. **Probe for unique content per file.** For each touched file, diff stash version against HEAD and count lines that exist only in the stash version:
|
||||
```bash
|
||||
git show "stash@{0}:<path>" > /tmp/stash_copy
|
||||
# compare normalized line sets; report lines present in stash but absent from HEAD
|
||||
```
|
||||
A file with `unique-vs-HEAD = 0` is fully superseded — safe to drop for that file.
|
||||
3. **Classify each unique-content hit**:
|
||||
- *Stale fact* (superseded by a later refactor, e.g. old model/provider naming) → drop is correct.
|
||||
- *Live durable fact* (e.g. an operational invariant never re-recorded) → extract it into the live memory/docs file or flag to the user before dropping.
|
||||
4. **Archive before dropping** — zero-loss: tag the stash commit, then drop from the stash list:
|
||||
```bash
|
||||
git tag archive/stash-<YYYY-MM-DD>-<base-branch>-wip "stash@{0}"
|
||||
git stash drop "stash@{0}"
|
||||
```
|
||||
The tag pins the full stash object (including its index parent); recoverable later via `git show archive/stash-...` or `git checkout archive/stash-...^3 -- <path>` for the untracked-files third parent if present.
|
||||
|
||||
## Why
|
||||
Stashes are invisible in normal history and expire from reflogs (~90 days). A stash that *looks* superseded can still hold the only copy of a durable fact; tagging converts "drop" into a reversible archive with zero workflow cost.
|
||||
@@ -1,36 +1,29 @@
|
||||
# Environment & OS
|
||||
- User: Frank | Home: `/home/dank/` | Work Dir: `/home/dank/.omp`
|
||||
- OS/Kernel: CachyOS (Linux 7.2.0-1) with niri Wayland compositor
|
||||
- Default Browser: Firefox (managed via `xdg-settings`)
|
||||
- Cursor Config: `~/.config/niri/cfg/misc.kdl` (capitaine-cursors, size 48). Apply via `niri-msg reload` or `kill -SIGUSR1 $(pgrep niri)` to avoid full session restart.
|
||||
- NVIDIA/GPU Note: `nvidia-modeset` semaphore deadlock can freeze niri GUI. Fix: install `/etc/modprobe.d/nvidia-workarounds.conf`, rebuild initramfs (`mkinitcpio -P`), force-reboot (`systemctl reboot --force --force`). Note: force reboot kills active SSH sessions mid-flight.
|
||||
# Environment & Repository
|
||||
- **Home/Repo**: `/home/dank` → `/home/dank/.omp` (command center)
|
||||
- **Branch/Deploy**: `main` synced with `origin/main`. Deploy via `~/.omp/scripts/deploy.sh` (stow-style dotfiles/<pkg>/<path>).
|
||||
- **Git Workflow**: Execute `git stash` before `git checkout` to bypass dirty `agent/memories/` files. PRs branch from `pr/fix-*`.
|
||||
- **Secrets**: `GITEA_TOKEN` extracted to `~/.config/environment.d/secrets.env` (0600). .zshrc has guarded source stub.
|
||||
- **Gitea**: UI at `http://dankclaw:3000`, API resolves to `192.168.0.143:3000`. Repo: `dank/command-center`.
|
||||
|
||||
# Model Configuration & Inference
|
||||
- Config Files (Edit in lock-step):
|
||||
- Source: `~/.pi/agent/models.json`
|
||||
- Import/Generation: `~/.omp/agent/models.yml` (co-located with `models.db` WAL/SHM files)
|
||||
- Provider Layout:
|
||||
- `llamacpp (dankserver)` @ `http://192.168.0.235:7770/v1` | Model: `frank-default-small` | Context: 204800 | Reasoning: true | Inputs: [text, image]
|
||||
- `llamacpp (dankclaw)` @ `http://192.168.0.143:7770/v1` | Model: `frank-default-large` | Context: 262144 | Reasoning: true | Inputs: [text, image]
|
||||
- `dankclaw-npu` @ `http://192.168.0.143:7771/v1` | Model: `gemma4-it:e4b` (FastFlowLM) | Context: 131072 | Reasoning: true | Inputs: [text, image, audio]
|
||||
- Model Details:
|
||||
- `frank-default-large`: Qwen3.8-Flash-Next Uncensored ROCmFP4 STRIX_LEAN (177B params, 56B MoE, ~98.3GB GGUF across 3 shards). Uses `--spec-type ngram-mod` speculative decoding (MTP head stripped). Vision enabled via `mmproj` (~866M). Docs updated in `/home/dank/.pi/agent/docs/pi/models.md` (commit `eda2edb`).
|
||||
- Context Sizing: Uses Ki-style multiples (e.g., 200k = 204800). Always update both `contextWindow` and `maxTokens` when changing context. Config-only changes apply on next read; no cache flush required.
|
||||
- NPU Image Constraint: FLM decoder strictly rejects WebP. Convert WebP to PNG/JPEG upstream before sending to the FLM endpoint.
|
||||
- Non-message token overhead: ~17301 tokens per context window.
|
||||
# Model Configuration
|
||||
- **Files**: `~/.pi/agent/models.json` (source of truth) ↔ `~/.omp/agent/models.yml` (imported/generated). Edit in lock-step to prevent overwrite on regeneration.
|
||||
- **Context Sizing**: Ki-style (×1024). e.g., 200k = 204800. Update both `contextWindow` and `maxTokens` simultaneously.
|
||||
- **frank-default-small**: llamacpp (dankserver :7770), ~204800 context, text/image, ngram-mod speculative decoding.
|
||||
- **frank-default-large**: llamacpp (dankclaw :7770), Qwen3.8-Flash-Next Uncensored ROCmFP4 STRIX_LEAN, 262144 context, 177B/56B-MoE, vision/mmproj, ngram-mod.
|
||||
- **Docs**: `~/.pi/agent/docs/pi/models.md` updated. Port migrated to 7770. MTP head stripped; use `ngram-mod` wording.
|
||||
|
||||
# Git & Gitea Workflow
|
||||
- Gitea UI: `http://dankclaw:3000` (IP: 192.168.0.143:3000). API may return IP, but UI resolves best via hostname.
|
||||
- Repository: `dank/command-center`
|
||||
- PR Workflow: Branch `pr/fix-models` -> PR #1. Single commit, clean history.
|
||||
- Checkout Pitfall: `git checkout main` fails due to dirty tracked files in `agent/memories/` (e.g., `learned.md`).
|
||||
- Resolution: Execute `git stash` before `git checkout`. Stash is automatically saved on the previous branch (develop) for later retrieval.
|
||||
# Packages & Shell
|
||||
- **Shell**: Zsh + `cachyos-zsh-config`. `powerlevel10k-zsh` skipped (inert symlink due to dual sourcing).
|
||||
- **UI/Compositor**: `niri` (Wayland). Default browser: Firefox (`xdg-settings`). Cursor: `capitaine-cursors` @ 48px in `~/.config/niri/cfg/misc.kdl`. Reload via `niri-msg reload` or `kill -SIGUSR1`.
|
||||
- **Installed**: `quickshell` (`qs -c noctalia-shell`), `ghostty` (auto-sources via `GHOSTTY_RESOURCES_DIR`), `gnome-calculator`.
|
||||
|
||||
# Migration & Tools (Pi → OMP)
|
||||
- `~/.pi/agent/SYSTEM.md` migrated to `~/.omp/agent/APPEND_SYSTEM.md` (8.4KB). New sessions pick up APPEND automatically.
|
||||
- `omp config set personality none` removes built-in personality block while keeping APPEND_SYSTEM.md intact.
|
||||
- Tool Mappings: `subagent` → `task`. Parameters `concurrency`, `context`, and `async` are dropped or handled by the harness (excess queues).
|
||||
- Skills: Auto-discovered from `~/.claude/skills`. Syntax: `/skill:grilling`, `/skill:tdd`. `skills.enableSkillCommands` defaults to true.
|
||||
- References: `okf-spec.md` points to pi-tree (`~/.pi/agent/docs/references/`); consider copying to `~/.omp` for full ownership. `omp://` provides 130+ docs. Use `skill://find-skills` for discovery.
|
||||
- Persona: 'Comrade Chief Designer' (Soviet-themed humor, friendly, concise).
|
||||
- Date Context: "It is September 2026" baked into persona; OMP injects real date per-request (may drift slightly).
|
||||
# NPU & Hardware
|
||||
- **NPU**: Dankclaw NPU (`gemma4-it:e4b`, FastFlowLM) at `http://192.168.0.143:7771/v1`.
|
||||
- **Image Constraint**: FLM strictly rejects WebP ('Unsupported image format'). Convert upstream to PNG/JPEG.
|
||||
- **Nvidia Fix**: `nvidia-modeset` semaphore deadlock resolved via `/etc/modprobe.d/nvidia-workarounds.conf`, `mkinitcpio -P`, force-reboot.
|
||||
|
||||
# OMP & Agent Migration
|
||||
- **Migration**: pi-agent → OMP harness. `SYSTEM.md` → `APPEND_SYSTEM.md` (Comrade Chief Designer persona). `omp config set personality none` removes built-in block.
|
||||
- **Tools**: `subagent` → `task`. `concurrency`, `context`, `async` params dropped/managed by harness.
|
||||
- **Skills**: Auto-discovered from `~/.claude/skills`. Harness docs via `omp://`.
|
||||
- **State**: `main` 6 ahead of origin; push pending. `agent/managed-skills/*` auto-learn.
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
- blank@blankpad (CachyOS, Arch-like) deployment COMPLETED 2026-09-09 (supersedes earlier "pending action awaiting user go-ahead" note): full-replica rsync of /home/dank/.omp/ → /home/blank/.omp/ (.git included; push to Gitea NOT required for this transport) followed by deploy.sh sync on blankpad. SSH was initially blocked there by firewall default-drop (timeout, not refuse) and opened only after the user started sshd locally — expect that blocker pattern again for new fleet hosts. Host facts verified at deploy time: login shell fish; niri runs as niri --session reading the repo-symlinked config.kdl; installed binaries include noctalia CLI (its keybinds override package uses noctalia msg ..., NOT canonical qs -c noctalia-shell ipc call), alacritty, firefox, nautilus, fish, zsh, shelly-notifications; MISSING: qs/quickshell, ghostty, gnome-calculator — canonical keybinds relying on those are silent no-ops if deployed there. ~/.p10k.zsh on blankpad is an inert repo symlink until powerlevel10k-zsh is installed and sourced. zz-blankpad override package (display/keybinds/misc/rules/autostart/.zshrc) is tracked in the repo; deploy.sh's target derivation must strip the nested base-package segment for zz-* packages or overrides land on phantom paths like $HOME/niri/.config/...
|
||||
- blankpad is a fleet machine reached only as blank@blankpad.local (mDNS FQDN; bare hostname does not resolve from Dankware; 192.168.0.83). As of 2026-09-09 it runs the command-center deployment at /home/blank/.omp with host-specific divergence preserved as tracked override package dotfiles/zz-blankpad/: its own display.kdl output layout (not Dankware's DP/eDP rig), autostart/keybinds targeting the bare noctalia CLI instead of qs -c noctalia-shell ipc call, misc.kdl without renderD129, rules.kdl without the Noctalia floating-window rule, and blank's own minimal .zshrc. Its login shell is fish. Initial blocker (port 22 drop-not-refuse = sshd down or firewall default-drop) was fixed same day by user locally; if SSH drops again on blankpad, suspect firewall default-drop first, not auth.
|
||||
- blankpad (user blank) is fleet member at 192.168.0.83, reachable ONLY via mDNS FQDN blankpad.local — bare hostname does not resolve from Dankware. As of 2026-09-09 its SSH was unreachable from the LAN segment: ping fine (~1 ms, wired) but TCP 22 and alt ports (2222/8022/22222/10022) all TIMEOUT = firewall default-drop or sshd down; drop-not-refuse distinguishes this from sshd-listening-but-auth-failing. Pending action awaiting user go-ahead: deploy command-center to blank@blankpad via full-replica rsync of /home/dank/.omp/ (incl .git so core.hooksPath stays armed pre-push) → deploy.sh --check review → sync; transport deliberately chosen over clone-from-Gitea because main was 6 commits ahead of origin/main and push is reserved as a user-only trigger. Note: origin remote on Dankware embeds the Gitea token in plaintext URL — keep it off other machines' .git/config by using rsync as transport. _(context: User asked to set up the dotfiles/command-center deployment on blank@blankpad with a password credential; SSH entry point unreachable from this segment, so work was staged and handed back with exact unblock steps (systemctl enable --now sshd + firewalld internal-zone ssh service).)_
|
||||
- The FLM (FastFlowLM) service on Dankclaw (gemma4-it:e4b, port 7771) only supports PNG and JPEG/JPG image formats. WebP images are rejected with "Unsupported image format, skipping this image." The data URL formats it expects are data:image/png;base64, data:image/jpeg;base64, and data:image/jpg;base64. To use WebP screenshots with the NPU, convert them to PNG first. Verified 2026-08-30: a WebP screenshot (1024x576, 71K) was rejected while the same content as PNG was correctly identified by the vision model. _(context: Dankclaw NPU (FLM, gemma4-it:e4b, port 7771) — image format support investigation)_
|
||||
- When configuring dankclaw-npu (FLM NPU endpoint on port 7771) in models.json, the model entry must include a thinkingLevelMap field. The other two providers (dankserver, dankclaw) have it; if absent, schema validation fails. Pattern: {"thinkingLevelMap": {"max": "xhigh"}}. Also verify gemma4-it:e4b model ID is registered and .xclbin kernel symlink exists under /home/dank/.config/flm/xclbins/. _(context: Dankclaw NPU endpoint (dankclaw-npu provider, port 7771) had a schema error because gemma4-it:e4b was missing thinkingLevelMap. Fixed by adding it to both models.json and models.yml. The FLM NPU serves 34 models in its registry; gemma4-it:e4b is the currently wired model.)_
|
||||
- Dankclaw NPU serves 34 FLM (FastFlowLM) models on port 7771. Only one is wired in models.json (gemma4-it:e4b) but all 34 are registered and available via per-request model routing without restart. Known behavior: single-lane NPU queues FIFO, per-request model switch costs ~7–11s wall for 4B-class reload. Common pitfall: some registered tags fail if .xclbin kernel pack symlink is missing under /home/dank/.config/flm/xclbins/ (fix: ln -s /opt/fastflowlm/share/flm/xclbins/PackName). Registry probe: curl http://192.168.0.143:7771/v1/models.
|
||||
|
||||
@@ -1 +1 @@
|
||||
Frank's OMP harness environment on CachyOS/niri Wayland. Dual model config files (`~/.pi/agent/models.json` & `~/.omp/agent/models.yml`) require lock-step editing; context uses Ki-style multiples. `frank-default-small` (dankserver:7770) and `frank-default-large` (dankclaw:7770) run via llama.cpp; large model is Qwen3.8-Flash-Next STRIX_LEAN using ngram-mod speculative decoding. NPU (gemma4-it) on port 7771 strictly requires PNG/JPEG over WebP. Git workflow on `dank/command-center` requires `git stash` before `checkout main` due to dirty `agent/memories/`. NRI Wayland compositor supports hot-reload via `SIGUSR1` or `niri-msg`. Force reboot resolves nvidia-modeset semaphore deadlocks but interrupts SSH.
|
||||
Current repo state (`~/.omp/main`) is authoritative. When editing models, update both `models.json` and `models.yml` in lock-step using Ki-style context (200k = 204800). Use `git stash` before checkout to avoid memory file conflicts. For NPU/FLM tasks, always convert WebP to PNG/JPEG. OMP agents use `APPEND_SYSTEM.md` and `task` tool. Deploy dotfiles with `deploy.sh` (sync/adopt modes); secrets are environment-managed. Niri compositor reloads without full session restart. NPU inference on dankclaw port 7770/7771.
|
||||
|
||||
@@ -1,5 +1,26 @@
|
||||
# Raw Memories
|
||||
|
||||
## 01a088e9-5dc1-767c-9a3d-cc0a8a7ec00f
|
||||
updated_at: 1789026078
|
||||
- **Repository (/home/dank/.omp)**: `main` branch is in sync with `origin/main` (0/0 divergence). `develop` branch has an active stash. Uncommitted work includes: `AGENTS.md` (modified, -83 lines), `agent/config.yml` (modified), `agent/models.yml` (modified), and deleted skills under `agent/memories/**/skills/*`.
|
||||
- **Package Installations (blankpad)**: Installed `quickshell`, `ghostty`, `gnome-calculator`. Dependencies resolved: `gtk4-layer-shell`, `ghostty-shell-integration`, `ghostty-terminfo`, `qt6-wayland`, `cpptrace`, `gtksourceview5`.
|
||||
- **Nuances**:
|
||||
- `quickshell` (`/usr/bin/qs`): Keybindings use `qs -c noctalia-shell`, requiring the shell config to be registered under that client ID.
|
||||
- `ghostty` (`/usr/bin/ghostty`): Zero-config start; auto-sources if `GHOSTTY_RESOURCES_DIR` is set.
|
||||
- `powerlevel10k-zsh` (Skipped): `~/.zshrc` sources `cachyos-zsh-config`, making the deployed `~/.p10k.zsh` symlink inert decoration until sourced.
|
||||
- **Shell**: Zsh with `cachyos-zsh-config`.
|
||||
|
||||
## 01a08864-7ec1-70d0-9225-2f08fcb00986
|
||||
updated_at: 1789003385
|
||||
Repo: ~/.omp (command-center), branch main (6 ahead of origin/main at commit a9127a0).
|
||||
Deploy: ~/.omp/scripts/deploy.sh. Stow-style import into dotfiles/<pkg>/<home-relative path>.
|
||||
Modes: --check (dry report), --adopt (identicals), sync (default: adopt + link new + quarantine divergents to .quarantine/<host>/<ts>/<path>). zz-<hostname> overrides deploy last.
|
||||
Hooks: Arms core.hooksPath=.githooks on deploy; self-gating enabled.
|
||||
Secrets: GITEA_TOKEN moved from .zshrc to untracked ~/.config/environment.d/secrets.env (0600). .zshrc has guarded source stub.
|
||||
Untracked: agent/managed-skills/* (auto-learn), secrets.env (local-only).
|
||||
Target: blank@blankpad (pw: <REDACTED-rotated-2026-09-10>). Setup: git clone + deploy.sh.
|
||||
Pending: Push main to origin/main.
|
||||
|
||||
## 01a05602-bf3e-76c3-97a1-38e51673bb86
|
||||
updated_at: 1788165416
|
||||
NPU Provider: dankclaw-npu | http://192.168.0.143:7771/v1 | openai-completions.
|
||||
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
thread_id: 01a08864-7ec1-70d0-9225-2f08fcb00986
|
||||
updated_at: 1789003385
|
||||
|
||||
Dotfiles deployed via ~/.omp/scripts/deploy.sh (stow-style dotfiles/<pkg>/<path>). Modes: --check, --adopt, sync (quarantines divergents). core.hooksPath armed. GITEA_TOKEN extracted to ~/.config/environment.d/secrets.env. main 6 ahead of origin; push pending. Untracked: agent/managed-skills/* & local secrets.env.
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
thread_id: 01a088e9-5dc1-767c-9a3d-cc0a8a7ec00f
|
||||
updated_at: 1789026078
|
||||
|
||||
Reviewed /home/dank/.omp repo: main synced, changes in AGENTS.md/config/models, deleted skills, stash on develop. Installed quickshell, ghostty, gnome-calculator on blankpad; skipped powerlevel10k-zsh (inert in current zshrc).
|
||||
@@ -0,0 +1,5 @@
|
||||
Handle FastFlowLM (FLM) image constraints for NPU inference.
|
||||
- Endpoint: `http://192.168.0.143:7771/v1`
|
||||
- Strict decoder: Accepts only PNG and JPEG/JPG. WebP is rejected.
|
||||
- Workflow: Convert WebP upstream before FLM calls.
|
||||
- Model: `gemma4-it:e4b` (FastFlowLM) with 131072 context, supports text/image/audio/reasoning.
|
||||
@@ -0,0 +1,5 @@
|
||||
#!/bin/bash
|
||||
# Convert WebP to PNG for FLM NPU endpoint
|
||||
for file in *.webp; do
|
||||
magick "$file" "${file%.webp}.png"
|
||||
done
|
||||
@@ -0,0 +1,5 @@
|
||||
Dual-edit model configuration between `~/.pi/agent/models.json` and `~/.omp/agent/models.yml`.
|
||||
- Use Ki-style multiples for context (e.g., 200k → 204800).
|
||||
- Update both `contextWindow` and `maxTokens` simultaneously.
|
||||
- No cache flush required for config-only updates.
|
||||
- Validation: `jq -e '.providers."llamacpp (dankserver)".models[0] | .contextWindow, .maxTokens' ~/.pi/agent/models.json`
|
||||
+1
-2
@@ -1,4 +1,3 @@
|
||||
#!/usr/bin/env bash
|
||||
# Validates model config sync
|
||||
#!/bin/bash
|
||||
jq -e '.providers."llamacpp (dankserver)".models[0] | .contextWindow, .maxTokens' ~/.pi/agent/models.json
|
||||
python3 -c "import yaml; d=yaml.safe_load(open('/home/dank/.omp/agent/models.yml')); m=d['providers']['llamacpp (dankserver)']['models'][0]; print(m['id'], m['contextWindow'], m['maxTokens'])"
|
||||
@@ -1 +0,0 @@
|
||||
Provides operational playbook for niri Wayland compositor. Covers cursor/Browser XDG defaults, SIGUSR1 hot-reload workflow, and nvidia-modeset semaphore deadlock recovery via modprobe config and force-reboot.
|
||||
@@ -1,7 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Hot-reload niri without killing session
|
||||
if pgrep -x niri > /dev/null; then
|
||||
niri-msg reload
|
||||
# Fallback signal method
|
||||
kill -SIGUSR1 $(pgrep niri)
|
||||
fi
|
||||
-3
@@ -1,3 +0,0 @@
|
||||
# /etc/modprobe.d/nvidia-workarounds.conf
|
||||
# Resolves nvidia-modeset semaphore deadlock freezing niri options nvidia-modeset disable_vga=1
|
||||
options nvidia-modeset modeset=1
|
||||
@@ -0,0 +1,5 @@
|
||||
Standardize Git and Dotfile operations within the OMP harness.
|
||||
- Git: `git stash` before `git checkout` to clear dirty `agent/memories/` files.
|
||||
- Deploy: Run `~/.omp/scripts/deploy.sh` with `--check`, `--adopt`, or `sync`.
|
||||
- Secrets: `GITEA_TOKEN` lives in `~/.config/environment.d/secrets.env` (0600).
|
||||
- Branches: Work on feature/PR branches, push to `origin/main` when ready.
|
||||
@@ -0,0 +1,5 @@
|
||||
1. Branch: `pr/fix-models`
|
||||
2. Stash if dirty: `git stash`
|
||||
3. Checkout main: `git checkout main`
|
||||
4. Push & open PR to dank/command-center
|
||||
5. Rebase/merge after CI.
|
||||
@@ -0,0 +1,5 @@
|
||||
#!/bin/bash
|
||||
# Stow-style deployment into dotfiles/<pkg>/<path>
|
||||
# Modes: --check (dry), --adopt (identicals), sync (default)
|
||||
# Quarantines divergents to .quarantine/<host>/<ts>/<path>
|
||||
exec ~/.omp/scripts/deploy.sh "$@"
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
# Fix nvidia-modeset semaphore deadlock with niri
|
||||
nvidia-modeset modeset=1
|
||||
@@ -1 +0,0 @@
|
||||
Git operations tailored for OMP environment. Addresses dirty `agent/memories/` tracking pitfalls, implements stash-before-checkout protocol, and standardizes PR creation in dank/command-center.
|
||||
-8
@@ -1,8 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Safely checkout main in OMP
|
||||
if [ -n "$(git status -s agent/memories/)" ]; then
|
||||
git stash
|
||||
echo "Stashed dirty agent/memories/ files."
|
||||
fi
|
||||
git checkout main
|
||||
git pull origin main
|
||||
-5
@@ -1,5 +0,0 @@
|
||||
# PR Branch Convention
|
||||
- Branch: pr/fix-models
|
||||
- Target: main
|
||||
- Strategy: Single commit, clean history
|
||||
- Workflow: Feature -> PR -> Squash/Merge
|
||||
@@ -1 +0,0 @@
|
||||
Handles dual config synchronization, Ki-style context sizing, and validation for Frank's OMP model definitions. Covers lock-step editing of models.json and models.yml, contextWindow/maxTokens mirroring, and FLM WebP constraints.
|
||||
-4
@@ -1,4 +0,0 @@
|
||||
{
|
||||
"contextWindow": 204800,
|
||||
"maxTokens": 204800
|
||||
}
|
||||
@@ -26,7 +26,7 @@
|
||||
- Frank wants periodic "what did we do" HTML change reports rendered in Firefox (asked 2026-09-01; first one at /home/dank/Reports/serverAppConfigs-24h-2026-09-01.html). Preferred standard: Keep a Changelog 1.1.0 categories (Added/Changed/Fixed/Removed/Security, omit empty) inside a post-change-review skeleton (summary → timeline → categories → code samples → verification → incidents → user actions). Reports are deliverables outside the repo at ~/Reports/ (never tracked; keeps tree clean). Frank reads the report to plan his code-review pass, so include a ready-made git show/git diff command list per theme. _(context: Built a 38 KB self-contained HTML report for serverAppConfigs covering 39 commits/24h; verified render via headless browser screenshot before handing over; opened via firefox --new-tab file:///....)_
|
||||
- Playwright automation of authentik's Lit flow executor (fleet e2e, tests/e2e/lib/login.ts akLogin): a programmatic page.fill races the stage re-render — the Lit web component re-renders right after mount and wipes the input, so the form submits an EMPTY password ("This field is required") even though fill() succeeded. Hardened pattern: fill, VERIFY the value survived (expect the input's value, short retry), submit with Enter (native form path, no button re-render race), and retry the whole stage up to 3 attempts before failing. Two adjacent musts: every login runs in a FRESH browser context (a reused/half-finished context poisons authentik's pending_user stage and hangs the next login), and the browser needs a real Chrome UA (Anubis denies obvious headless UAs); budget 60s assertions for the first Anubis PoW per fresh context (subsequent guarded vhosts skip challenge thanks to COOKIE_DOMAIN solve-once). Conventions documented in serverAppConfigs-docs/Architecture/E2E Suite.md (commit b945dd0). _(context: frank-default e2e suite hardening, 2026-09-01: 10/11 spec flake root-caused to Lit re-render race + Anubis PoW budgets; suite now 17/17 green across setup/standard/admin/guest projects.)_
|
||||
- Fleet VPN truth (verified 2026-09-01): the gluetun VPN_SERVICE_PROVIDER=custom profile on Dankclaw (endpoint 149.102.254.77:51820) points at a **ProtonVPN Seattle WireGuard server**, NOT a self-run box. Evidence: RDAP via curl -sL https://rdap.org/ip/IP (works when whois is empty) — endpoint IP → CDNEXT-CG-SEA/Datacamp; Dankclaw's tunnel v6 2a07:b944::2:2 → CH-PROTONVPN-20160719; exit IP 149.22.88.19 → CDNEXT-SEA-CG. Full 65535-port scan fingerprint: no SSH anywhere, only silent TLS listeners on 443, 4443–4468, 5995, 7770, 8443 (Proton protocol-stealth port map). Consequences: (1) adding a "peer" is never server admin — it's generating a new WireGuard config in Frank's Proton dashboard; each config = one keypair, Proton has NO BYO pubkey (a locally generated keypair is useless; one was retired to dankclaw ~/.AGENTTRASH/20260901-frankbook-wg-keypair). (2) Two hosts sharing one Proton config make the server bounce the endpoint between them — reusing Dankclaw's config for FrankBook-Pro would kill the Dankclaw tunnel (SearXNG). (3) Mac gate: second dashboard config (e.g. named frankbook) → PrivateKey/Address paste into /home/core/Containers/gluetun/env; server pubkey utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs=, gluetun ignores the .conf DNS line. General technique: identify mystery infra with rdap.org RDAP + nmap port fingerprint before asking the user to administer it. _(context: FrankBook-Pro WG gate investigation, 2026-09-01. Probes: no SSH config aliases on Dankware/Dankclaw, port 22 timeout, full nmap scan, RDAP on 3 IPs. Docs rewritten: serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md "Mac provisioning" section; log.md entry. Repo commits 2d06be8, 3094ffa, f1171b9.)_
|
||||
- When a fleet credential "mystery" arises (auth works/doesn't contradict user memory): (1) assume session-archive images are corrupted — OCR of transcript frames mangles strings while preserving shape (Jellyfin admin password read as "ResFace_3241" instead of "Assface.3241"; the prefix was garbage, the digits were real; the user's own recall had the right prefix but flipped digits). (2) NEVER brute-force a live auth endpoint — pull the stored hash and verify candidates offline: Jellyfin stores it in jellyfin.db (Users table, Password column) as $PBKDF2-SHA512$iterations=210000$salt$hash where salt AND hash are HEX-ENCODED (32 B salt → 64 hex chars, 128-char hash). A parser that assumes base64 silently tests zero candidates — always print back the parsed lengths (saltbytes/hashbytes) and candidate count before concluding "no match". (3) A single matching hash is conclusive; a live POST adds nothing and just logs auth-failure warnings. _(context: Jellyfin 401 mystery on Dankserver, 2026-09-01. User's correction of the corrupted prefix + digit flip; offline hash check vs stored DB hash decided it. Files: serverAppConfigs-docs/Dankserver/Jellyfin.md, serverAppConfigs-docs/log.md (both corrected).)_
|
||||
- When a fleet credential "mystery" arises (auth works/doesn't contradict user memory): (1) assume session-archive images are corrupted — OCR of transcript frames mangles strings while preserving shape (Jellyfin admin password read as "ResFace_3241" instead of "<REDACTED-rotated-2026-09-10>"; the prefix was garbage, the digits were real; the user's own recall had the right prefix but flipped digits). (2) NEVER brute-force a live auth endpoint — pull the stored hash and verify candidates offline: Jellyfin stores it in jellyfin.db (Users table, Password column) as $PBKDF2-SHA512$iterations=210000$salt$hash where salt AND hash are HEX-ENCODED (32 B salt → 64 hex chars, 128-char hash). A parser that assumes base64 silently tests zero candidates — always print back the parsed lengths (saltbytes/hashbytes) and candidate count before concluding "no match". (3) A single matching hash is conclusive; a live POST adds nothing and just logs auth-failure warnings. _(context: Jellyfin 401 mystery on Dankserver, 2026-09-01. User's correction of the corrupted prefix + digit flip; offline hash check vs stored DB hash decided it. Files: serverAppConfigs-docs/Dankserver/Jellyfin.md, serverAppConfigs-docs/log.md (both corrected).)_
|
||||
- Rootless podman UID mapping on Dankclaw/Dankserver is CONTINUOUS, not offset: container uid N → host uid 100000 + N - 1 (dank subuid 100000:65536; container 0 → 1000, container 1 → 100000, container 1000 → 100999). Never compute host uid as 100000+N. Before chowning a bind root for a non-root image, read the real mapping from any throwaway container: podman run --rm image cat /proc/self/uid_map ("ID-inside ID-outside range" lines). A wrong chown gives EACCES crash-loops (quadlet auto-restart, container never persists; podman logs empty because --rm). Verified 2026-09-01 with seerr-team/seerr (in-image node uid 1000 → chown 100999 fixed it). _(context: Seerr first boot on Dankclaw crash-looped with EACCES mkdir /app/config/logs after chown 101000; /proc/self/uid_map showed "1 100000 65536" ⇒ container 1000 → host 100999. Second off-by-one incident on this fleet (postgres 100069 arithmetic was the first).)_
|
||||
- Two pitfalls from the 2026-09-01 frankbook/dankserver session: (1) zsh (default login shell on Dankware AND dankserver) expands =word at the start of an unquoted word to the command's path — so echo ==FOO== inside an ssh command fails with zsh:1: =FOO== not found. Quote echo arguments (echo "==FOO==") or use printf in any command line destined for zsh. (2) qBittorrent ≥ 4.2 ignores a plaintext WebUI\Password in qBittorrent.conf — it must be @ByteArray(salt:hash) from PBKDF2-HMAC-SHA512 (100000 iterations, 16-byte salt, 64-byte key, both base64). Also when the WebUI is reached through a port forwarder that preserves the LAN Host header (e.g. socat), set HostHeaderValidation=false and ServerDomains=* or qB rejects the request. Reference implementation: VM_SEED heredoc in deploy_frankbook_stack, scripts/deploy-remote.sh. _(context: frankbook-pro *arr bring-up + dankserver cutover verification, serverAppConfigs repo)_
|
||||
- FreeToken v0.1.2 on qwen3_5_moe loads ONLY modelopt-style quant configs: block-fp8 (quant_method "fp8" + weight_scale_inv, the Huihui/official-Qwen format) works; every compressed-tensors FP8 checkpoint fails. Two live-verified failure modes (2026-09-01, Dankserver): (1) compressed-tensors per-channel (Ornith-1.5-35B-A3B-FP8) aborts at expert-source resolution — ValueError "Missing MoE expert source layers: {'gate_up': ...}" because expert tensors don't follow mlp.experts.{N}.gate_proj/up_proj/down_proj naming; (2) compressed-tensors block-fp8 128×128 (HauhauCS-Aggressive-fp8) resolves experts but _dequant_fp8_weight multiplies weight × weight_scale directly, so [out/128, in/128] block scales don't broadcast → RuntimeError shape mismatch (tensor a 2048 vs b ...). Both exit cleanly at load (~37 GB fits RAM, no swap-thrash). Before swapping any model onto FreeToken, check config.json quant_method/weight_scale shape; a "healthy after ~6s" from deploy.sh proves nothing (health gate passes while the doomed worker is still starting) — verify via journal Uvicorn startup + a real completion. Evidence: serverAppConfigs-docs/LLM/free[REDACTED].md Quantization Compatibility table. _(context: frank-default-small model-swap attempts on Dankserver, 2026-09-01: Ornith FP8 and HauhauCS FP8 both failed to load on FreeToken v0.1.2; reverted to batsclamp Huihui FP8 (commit 4d5bea4), docs commit fe34f04.)_
|
||||
|
||||
Reference in New Issue
Block a user