Measured fixes, one line each, from the review of everything that landed on
2026-10-20 (issue #60). Each page keeps its own facts; nothing was moved.
- inventory/index, index: the census blurb says what the page actually covers
(tracked-vs-box-only per file), not "all userspace configuration"
- dotfiles-deploy: the wallpaper re-fetch recipe resolves the CDN URL through
the wallhaven API — /w/<id> answers text/html, so curl -L never yields a
JPEG; description widened to the whole page, tools/index blurb matched
- okf-maintenance: the link example and the mistake bullet now agree with
okf-spec, which RECOMMENDS absolute bundle paths (they said the opposite)
- decisions/index: the unlisted-page gate is kb-coverage.py, not kb-lint
- AGENTS.md: the three skill-config subsections are pointers again; the pages
own issue tracker, labels and domain docs
- swayidle-lock.service: Description names what the unit does (arms the idle
lock over noctalia-shell IPC); suspend belongs to noctalia's inhibitor
- common.pkgs: git-lfs re-justified by the tracked .gitattributes filter
contract; the swayidle comment drops its lid-policy claim
The gate scanned only `*.md *.yml *.yaml *.json *.toml *.sh *.ts *.js`. A
`postgres.env`, a `.container` quadlet, an `.ini`, or an extension-less dotfile
— exactly the shapes the dotfiles tier is made of — was never read at all.
Discovered while deciding what else belongs in `dotfiles/`: `~/.config`
carries `containers/systemd/postgres.env` with a real `POSTGRES_PASSWORD`,
which the ignore list did not cover either (`git check-ignore` says so: `.env`
does not match `postgres.env`).
Token SHAPES now scan the entire staged diff, every file type; bcrypt hashes
and `Authorization: Basic` headers joined the shape list. Credential
ASSIGNMENTS are scanned in non-prose files only — the auto-learned memory tier
is prose *about* credentials (7 such hits measured on the tracked tree), and a
gate that fires there gets overridden until it means nothing. Markdown keeps
shape detection, which is what it had before.
Three invariants, each pinned by a test in tests/secret-gate.bats (13 tests,
black-box: the hook is copied into a scratch repo and git itself runs it):
- Fail closed. The first version of this rewrite passed `-I` to `git diff`,
which is not valid there; the empty file list made every secret commit sail
through, and a blind gate looks exactly like a clean tree. If the hook cannot
read the staged diff it now refuses the commit.
- Only ADDED lines can leak. The gate refused the redaction commit in this
branch because the diff still carried the removed password — a gate that
blocks the removal of a secret holds the leak hostage.
- Path-valued variables (`…_FILE=`, `…_PATH=`) and placeholder/indirected
values are not secrets, so the gate stays worth listening to.
`.gitignore` quarantines `*.env` at any name, and gains the theme-media rule
whose untracking lands in the next commit. `AGENTS.md` states the new contract.
Refs #40
The Matt Pocock engineering skills (triage, to-tickets, to-spec, research,
implement) assume per-repo config for three things: where work items live, what
the triage label vocabulary is, and where domain docs sit. Nothing here declared
any of them, so every skill run re-guessed.
Frank's decisions, 2026-10-20: Gitea on Dankclaw as the tracker (no gh, no tea on
any box, so it is recorded as prose — auth via a 600 curl config, the endpoint
table, the 404-on-empty-token / form-encoded-merge / empty-200-on-merge traps,
and the AGENTS.md laws a skill must not renegotiate); the canonical triage label
vocabulary kept as-is, with the five labels created on the tracker (the repo had
zero, so nothing collides); single-context domain docs.
The configuration moved out of the skill's default docs/agents/ and into the one
knowledge base this repo allows: three pages under omp-docs/skills/, an empty
omp-docs/decisions/ carrying the ADR format rule, an "## Agent skills" pointer
block in AGENTS.md, index entries, and a log entry. The glossary is deliberately
not created — every candidate term already has an owner in system/, core/ or
skills/, and a term list that paraphrases them is a second owner of facts already
written down. Known cost: re-running setup-matt-pocock-skills will not recognise
omp-docs/skills/* and will offer to recreate docs/agents/; the AGENTS.md pointer
is what stops that.
Also closes a verification gap found on the way: kb-lint.bats only ever points
the linter at fixtures, so a page with no frontmatter or an index that stops
listing a file passes the suite silently. Two tests now run the linter and the
coverage checker against the shipped omp-docs/ tree.
Refs #18
First dogfooding round stamped the build worktree instead of the session's
own working directory (the value the paired session id resolves to). Rule
now says so explicitly. Refs #11
Every agent-opened issue/PR body ends with cwd + omp session id so machine
filed artifacts trace back to the box and session that produced them - the
live-sync daemon and filing agents make 'who/what wrote this' a real
question now. Mirrored in dank/serverAppConfigs by its own PR.
Refs #11
Operator decision at review: 15 min is aggressive for config churn; hourly
keeps the stale-window acceptable (<=1 h) with a fifth of the wakeups.
Timer unit, tier law, and failure-table wording aligned.
The checkout IS the deployment and symlinks make live state (memories,
auto-learned skills, agent config, desktop settings) dirty tracked files
continuously; no commit law covered machine churn, so it accumulated
unpushed for weeks — one disk held the only copy of ~61 managed skills,
a settings fix stayed local-only, and dirty trees refused merges.
scripts/live-sync.sh (systemd user timer, ~15 min) commits ONLY the
allowlisted machine/desktop-live tiers with hooks armed, merges
origin/main, pushes, and reaps wt/* worktrees older than 7 days. Task
dirt outside the allowlist is never staged; conflicts abort and alert
via ntfy; branch guard refuses off main; never --no-verify, never force.
Black-box contract pinned by tests/live-sync.bats (9 tests, suite 36/36).
Refs #11
Trunk-based SDLC gains the delivery habit: xdg-open the PR URL the moment
it's filed (mirrors dank/serverAppConfigs step 6, riding their PR #6).
Changelog entry added.
Single-dev repo: develop bought nothing and cost a back-merge every
release. New law: branch off freshest origin/main per work item, PRs
target main directly, --no-ff merges kept, tags vX.Y.Z straight on main.
No release branches, no back-merges. Changelog entry added.
Census against serverAppConfigs-docs + read-only ssh probes on both boxes
(2026-10-18). Corrections to OURS, flags only for THEIRS:
- Hardware drift: RTX 3090 moved dankserver->dankclaw 2026-09; dankserver
now 2x Radeon AI PRO R9700 (Ryzen 7 7700X stays), 246 GiB RAM, no swap;
dankclaw 121 GiB RAM + 64 GiB swap. Served: frank-archon radiance TP=2
(:7770 dankserver), frank-dragoon halogen NATIVE v2 (:7770 dankclaw
iGPU), frank-zealot llama.cpp PrismML Ternary-Bonsai-2-27B PQ2_0
(:7771 dankclaw, 3090). Kernel 7.0.0-38 both; dankclaw :7770 no auth.
- Gitea: gitea-caddy quadlet retired (fleet Caddy fronts the domain);
data tree moved to /home/dank/Containers/gitea/ (2026-09-01 standard),
/opt/gitea is a do-not-use leftover; LAN IP + live domain.
- pi-era pages (core/settings, pi/models + role tables) demarcated as
ARCHIVE with banners; llama-cpp fleet note modernized.
- AGENTS.md machine-facts table corrected (it still routed prod warnings
at frank-default-large).
Their-side staleness flagged in the changelog entry for the operator,
not edited: OMP Harness thresholdPercent 70 (live is 95), Ubuntu 24.04
OS table, 2026-09-03 stack mapping, superseded pi-KB backlink.
Refs #5
Imports the Git Workflow / Testing law from dank/serverAppConfigs: pull+clean tree, atomic early commits, bats+secret gate as commit precondition, push on green, imperative messages with Refs #N.
AGENTS.md: the reader-preamble and the machine-facts table row no longer name
the sold client box; the row survives as the 'Dev workstation' class with its
two load-bearing facts (mainline llama.cpp build path, repo at ~/.omp).
README.md: same for the fleet table row and the 'primary host' sentence.
Deliberately untouched, because the name is load-bearing in both:
- scripts/install.sh:97 — the '--host' case list; --host <name> must still
accept this hostname.
- packages/dankware.pkgs:1 — install.sh resolves packages/$HOST.pkgs from
$(hostname) (line 25/44), so the manifest FILENAME is the lookup key.
Renaming it breaks package provisioning on this host.
Frank