Live probe against frank-archon (212,916-char archive, 8 planted facts):
auto shape 8on22-bw reads back 8/8 recall at 47% of raw-text billed
tokens; both denser grids drop characters. Lands the docs for the paired
live-config changes (thresholdPercent 95->85, imageCountBudget 16) and
records the catalog-only frame-pricing law (radiance ~2,400 tok/frame vs
the harness's blind 5,024 floor).
Refs #81
Every provider in agent/models.yml is a LAN address, so a workstation that
leaves the house has no model at all. Add `openwebui (franksdank.cloud)`:
the already-public OpenWebUI vhost as an OpenAI-compatible provider that
proxies the same engines, with frank-dragoon and frank-zealot rows and the
WAN row as its own compaction target. LAN rows, modelRoles and the speech
runner stay untouched — the door is purely additive.
The key is command-backed (`apiKey: "!cat ~/.config/secrets/openwebui_api_key"`,
mode 600) instead of inline: a literal sk-... in a tracked file is a key in
every agent context on every box that pulls this repo, and the pre-commit
shape gate would block it anyway. Rotate = rewrite the file + restart omp,
because a `!cmd` value is cached for the process lifetime.
Compat blocks copy their LAN twins because the proxy was probed, not assumed
(2026-10-21): streaming SSE carries reasoning_content and tool_calls deltas
plus final usage, image_url content parts reach both vision towers, and
chat_template_kwargs is forwarded — proven on frank-zealot, where
enable_thinking false yields zero reasoning and true a real block.
frank-archon gets no WAN row: OpenWebUI answers 400 "Model not found"
because its picker never published it, so that path is a fleet change.
Verified end-to-end from a scratch HOME whose LAN baseUrls point at a dead
port, so any answer can only have come through the door (text and a real
tool round-trip); `omp models` still lists all four chat providers and the
tts runner, so the file validates. bats 137/137, kb-lint clean.
Docs: omp-docs/core/wan-model-access.md.
Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.
Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.
kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.
A generated See Also pass left `- ](index.md)` style links on the gitea pages, tools/cachyos.md,
and tools/applications.md. Rendered, an empty-text link is a bullet with nothing clickable in it,
so it reads as a formatting quirk and never as the broken reference it is. All five now name the
page they point at and use the absolute bundle path the spec recommends; the grep that finds them
is recorded in the log so the sweep is repeatable.
Refs #64
The day had three `## 2026-10-21` headings — three logs wearing one date, which is the sprawl the
spec's one-dated-section rule exists to prevent. One date now, one `###` per campaign. `okf-maintenance.md`
states the multi-campaign shape explicitly so nobody has to infer it, and names `AGENTS.md` as the
co-owner of the entry law so an editor changes both.
The new entry records what the dedupe sweep actually taught: an index that restates its own
reference pages becomes the stale authority, and a subagent ledger is a claim until it is re-read
against the file it accuses — most rows returned by the audit fan-out were checkably false, and
half the ledgers never arrived at all. `skills/ecosystem.md` gains the `resource:` frontmatter the
bundle's other externally-sourced pages carry.
Refs #64
The intro carried "388 engine entries" from a 2026-10-19 probe; upstream is at 385 today. The
number moves every week, which makes a precise one a liability in a runbook. The page now states
the size class, names `/config` as the only authority for what an instance loads, and keeps the
fleet's live 262 with today's date.
Refs #64
The chezmoi overview was one 488-character sentence-block; the git-crypt mechanism and verdict
lines were the same shape. Reflowed to ~100 columns with no wording lost, so the pages read the
same in an editor as they do rendered.
Refs #64
The overview page carried `docker run` invocations (including a CUDA variant, on a fleet with no
NVIDIA card left in it) and the `LLAMA_ARG_` environment rule, while `setup.md` — the page whose
own intro promises "build instructions, Docker, and systemd deployment" — carried the Compose
example and the same env form in use. Two places to look, one place to be wrong.
`setup.md` now states the env-prefix rule where the flags live (and why units prefer it: one
flag per line is auditable, a forty-flag command line is not), and the overview keeps only the
API surface and the GGUF format, pointing at the sections that absorbed the rest.
Refs #64
Two independent copies of the same law, and each page cited its own numbers. The finish rule —
stop when independent sources agree, when the retrieval budget is spent, or when every claim is
met; report gaps, never invent a source — stood in full in `agentic-search-best-practices.md`
(with the loop caps: 20 steps, re-plan every 4) and again in `research-effectiveness.md` without
them. The operational page owns it; the measurement page keeps the pointer and the one thing
that is its business, which is that unbounded loops are why "infinite re-search" is a named
failure mode.
`tools/gitea/index.md` was a second copy of its own directory: an architecture table, a
management command table, a data-persistence path table and a boot-persistence paragraph, every
one of them a subset of `architecture.md`, `management.md` and `data-persistence.md` — verified
line by line before cutting, including the two facts that looked unique to the index (the
`dns_enabled: false` default network, the `/opt/gitea` leftover) and turn out to be owned
upstream with more detail. The index now answers "which page owns my question" and gives three
one-line orientation facts. Gitea's live version was re-read while I was in there: still 1.27.3.
Refs #64
`tools/ghostty/index.md` had its own Custom Shaders section and its own eight-row default
keybinding table. `configuration.md` owns both, in more detail, and the copies had already
drifted: the index claimed `ctrl+` raises the font size where the reference's appendix lists
`ctrl+=` / `ctrl++`. An index exists to route a reader to the page that owns the fact; a second
summary of the same facts just guarantees two versions that age differently.
What the index keeps is the routing plus the one fact worth having at hand (`ctrl+shift+,`
reloads the config), and the config-syntax "Key Points" — repeatable options, `option = ""`
resets, `?` optional includes — which the reference never states as a set, only per option.
Refs #64
Three pages described the fleet; two of them still described the pre-September arrangement.
Re-read live on 2026-10-21 (`/v1/models`, `systemctl`, `lspci`, `nproc`, `resolvectl`):
- `system/network.md` called Dankclaw the "large inference model" box and Dankserver the
"small" one — that is the topology from before the RTX 3090 moved in September. The served
ids today are `frank-archon` on Dankserver:7770 (the main model) and `frank-dragoon`
(:7770) + `frank-zealot` (:7771) on Dankclaw. The gateway and the DNS pin were re-read too.
- `system/dankserver.md` claimed `frank-medium` is *masked*: the unit file does not exist
(`is-enabled` answers `not-found`), which is a different fact with a different remedy. And it
claimed 8C/16T: this 7700X exposes **8 threads** (`nproc` = 8), so anything sized for 16 is
sized for a machine that is not this one.
- `system/dankclaw.md` transcribed the engine's slot/KV/context math — `2×262,144 slots over
one 524,288 pool, unquantized f16 K+V, MTP off` — while the live unit says `3x200704 slots
over one 602112 pool, f16 K + q8_0 V, MTP armed`, and dragoon's ctx had moved too. That math
belongs to the serverAppConfigs runbook the page already names: the unit's `ExecStart` is a
wrapper script, so any copy here rots on the next engine change. The page now keeps the
contract — id, unit, port, engine family, which GPU, and how to prove it — and disowns the
numbers, with the reason stated so the next agent does not re-transcribe them.
Also recorded, because it is how this audit nearly missed a stopped service: `curl :7770/v1/models`
answered normally while `frank-dragoon.service` sat `inactive` with `Result=exit-code` — the
container is running outside systemd. A serving port is not a healthy unit. (Flagged for Frank
separately; no production unit was touched.)
Refs #64
Frank
dank