live: heartbeat sync 2026-10-18T16:47:59-07:00 (Refs #11)

agent/managed-skills/serverappconfigs-inventory-audit/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: serverappconfigs-inventory-audit
+description: "Audit serverAppConfigs for duplicated fleet-service definitions: the 10 hand-copied inventory sites, the live-vs-repo drift census commands, and the known staleness checks."
+---
+
+# serverAppConfigs inventory / duplication audit
+
+Use when asked "where can we refactor or share resources", "why is X defined twice", or when adding a service and the edit sites must be enumerated. Read-only audit; changes come later.
+
+## The inventory is hand-copied ten times (2026-10-13 census)
+
+| Truth | Path | Shape |
+|---|---|---|
+order graph | `scripts/deploy-plan.py` `SERVICE_ORDER` | 45 names |
+per-host allow-sets | `scripts/deploy-plan.py` `DANKCLAW_/DANKSERVER_/FRANKBOOK_SERVICES` | 3 sets |
+path→service | `scripts/deploy-plan.py` `services_for_path` | ~30 branches + 6 in-branch name whitelists |
+target:service gate | `scripts/deploy-remote.sh` `service_is_allowed` | `case "$TARGET:$service"` pairs |
+dispatcher | `scripts/deploy-remote.sh` `deploy_service` | 30 branches |
+test selector | `scripts/test-changed.sh` | ~40 path globs |
+probes | `shared/homepage/services.json` | 35 entries (probe, url, docs, icon) |
+scrape jobs | `shared/prometheus/prometheus.yml` | 11 jobs |
+vhosts | `dankclaw/Caddyfile` | public vhost + `http://:8017` post-auth handler per guarded service |
+DNS | `dankclaw/pihole/addn-hosts` | 30 records |
+
+Adding one service touches all ten. Any audit that enumerates services must cross-check all ten, not one.
+
+## Census commands
+
+Live-vs-repo container drift (catches host-only units with no git provenance):
+
+```bash
+ssh dankclaw 'podman ps --format "{{.Names}}"' | sort > /tmp/live.txt
+grep -h '^ContainerName=' dankclaw/*/*/*.container | sed 's/ContainerName=//' | sort > /tmp/repo.txt
+comm -23 /tmp/live.txt /tmp/repo.txt   # live, not in repo
+comm -13 /tmp/live.txt /tmp/repo.txt   # in repo, not running
+```
+
+`systemd-<network>` in the live list is podman's netns infra container — benign. A real hit: `ntfy` (2026-10-11) existed only as `~/.config/containers/systemd/ntfy.container` with `restart=no`.
+
+Other probes, all cheap and all producing findings on 2026-10-13:
+
+```bash
+# stateful stores and whether probes can reach them
+grep -n 'PublishPort' dankclaw/**/quadlet/*postgres* dankserver/**/quadlet/*{mariadb,redis}*
+# dead scripts: zero refs outside docs
+for f in scripts/*.sh; do grep -rl "$(basename $f)" . | grep -v serverAppConfigs-docs | grep -q . || echo "$f"; done
+# shared paths that no longer exist
+for p in dankclaw/frank-dragoon dankclaw/compose.yaml dankserver/Caddyfile; do [ -e "$p" ] || echo "STALE $p"; done
+# memory footprint, to kill the "saves RAM" argument
+ssh dankclaw 'podman stats --no-stream --format "{{.Name}} {{.MemUsage}}" postgres gitea-postgres authentik-postgres'
+```
+
+## Known-stale items to re-verify each audit
+
+- `deploy-plan.py`: `DANKSERVER_SERVICES` still lists the six *arr services (they live on FrankBook-Pro); maps `scripts/qwen-sharp-v22.4.0.jinja` (retired runtime) to frank-dragoon; has **no** rule for `scripts/qwen38-froggeric-v22.5.jinja`, the live frank-archon template — editing it deploys nothing.
+- `test-changed.sh`: cases for `dankclaw/frank-dragoon/*`, `dankclaw/compose.yaml`, `dankserver/Caddyfile` match nothing.
+- `AGENTS.md` runbook index lists frank-archon's **retired** runbook as active while the endpoint section names the current one; frank-archon's shape is written in three places in that file.
+- `shared/homepage/dankserver.services.json`: zero references; `deploy_homepage` copies six named files and it is not one of them.
+- `scripts/hf-fetch.sh`: superseded by `scripts/hfget.sh`, no callers.
+- Undeclared shared networks: 15 units attach to `dankclaw_default`, 6 to `dankserver_appnet`; no `.network` file in the repo defines either.
+- `dankserver/compose.yaml` defines six containers whose names are owned by quadlet units, with diverged volume paths; `deploy_compose_service` refuses to act on it and `compose_validity.bats` checks YAML shape only.
+- `frank-zealot.service` `Restart=on-failure` violates the law `frank_archon_unit.bats` states (clean engine exit reads as success, so on-failure never fires); the zealot seam greps `^Restart=` and passes.
+- `render_caddyfile` / `deploy_homepage` write fixed `/tmp` filenames as `dank`, then `run_privileged cp` them into root-owned paths.
+
+## Report shape
+
+Table the duplication with counts (occurrences + path:line), label DUE vs DIVERGENT-intentional, then a ranked priority table (lines removed / risk). Ground "saves RAM" claims in measured RSS — two postgres containers measured 37 MiB and 325 MiB, so the prize is the operational surface (unit, secret, health gate, deploy entry, backup), not memory.