Frank
27da5cd9ec
Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.
Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.
kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.
2.7 KiB
Command Center Knowledge Base
System configuration knowledge base for Frank's fleet (Dankclaw, Dankserver, and the client workstations) and the agent tooling that runs on it. Every concept has its own file; every directory index links its complete contents. Format: OKF v0.1 — a directory of markdown files with YAML frontmatter (see references/okf-spec.md).
Verification discipline: facts carry verified: stamps when probed against the
live fleet, and an unverified tag where a claim could not be checked on
2026-08-28. Trust stamped facts over memory; re-verify before acting on
unverified ones.
System
Hardware, OS, and network of the three-box fleet — verified against live probes on 2026-08-28.
Caddy
The reverse proxy fronting every service on both servers (Podman Quadlet, Porkbun DNS-01, hot reload).
Gitea and tooling
Installed software: Gitea, llama.cpp, niri, ghostty, tmux, ComfyUI, CachyOS, skills tooling — each with its verified operational facts.
Pi-era agent setup
The legacy pi agent configuration (~/.pi era): settings, models, packages,
skills. Kept for reference; the live harness is OMP under ~/.omp.
Skills tooling
The Agent Skills standard, the skills CLI, this fleet's store wiring, and
the registries — for the live OMP harness. Pi-era packages are archived under
Pi-era agent setup.
Core config
The live agent configuration itself: settings, models, AGENTS.md conventions.
Engineering references
Practice notes: SDLC, languages, infra tooling (Terraform, K8s, containers).
Research
Decision-support research: agentic web tooling, chezmoi evaluation, secrets-for-agents. Research docs inform decisions; they are not facts yet.
Agentic web research
Self-hosted web-agent stack research: SearXNG tuning, VPN routing, agentic search practices, open models, MCP.
Inventory
Per-file tracked-vs-box-only census of ~/.config on blankpad — the input for the
dotfiles pruning/adoption session.
Decisions
Architecture decision records — the choices that are no longer up for debate, with what was rejected and why. Currently empty; the format rule is in its index.
Reports
Audits and vulnerability passes kept as dated artifacts — the 2026-10-21 fleet security audit with its per-host vuln pages, and the 2026-09-28 sleep/wake investigation.
Change history
Chronological update history of this bundle — incident lessons land here first, then settle into concept pages.