command-center/omp-docs/log.md

type, title, description, tags, timestamp

type	title	description	tags	timestamp
changelog	Bundle Change Log	Chronological update history for the OKF knowledge bundle.	okf maintenance changelog	2026-10-21

Bundle Change Log

Entry law (since 2026-10-19): one dated entry = what changed + the durable lesson, a few lines. Full incident narratives are recoverable from git (git log --follow omp-docs/log.md); knowledge that outlives an entry lives on its concept page, linked here. Never re-expand an entry in place.

This is the bundle's only work log; references/okf-spec.md owns the one-log rule and scripts/kb-lint.sh enforces it. A law that a concept page already owns is not restated here — entry, then pointer. That is what the 2026-10-21 audit pass did to the newest twelve entries: the facts stayed, the duplicates went, git log --follow keeps the long form.

2026-10-21

the audit grows an advisory table, and corrects three of its own numbers

omp-docs/reports/fleet-security-audit-2026-10-21.html folds in the two per-host vulnerability passes (reports/vuln-dankclaw.md, reports/vuln-dankserver.md): the "Advisory cross-reference (in progress)" section is now the full matrix and the header links the working files. Three figures fell to re-probing — the mutable-tag census (17 → 19 Dankclaw manifests / 17 unique references, +4 on Dankserver; the vuln pass's 24 also counts rolling release tags as mutable), the OpenSSH advisory count (0 → 5 unpatched CVEs; the first query omitted the version epoch, 10.2p1 for 1:10.2p1, and OSV answers 0 vulns rather than "unknown"), and the Plex version ("12.1.0" is Jellyfin's — podman exec plex cat /build_version reports 1.43.5.11029-6bf8af3f0-ls329).

Laws: an empty OSV response is not a clean bill — verify the query shape against the distro tracker before writing "0 advisories"; and a version quoted from a subagent gets re-probed before it enters a report, this being the second mis-attribution the audit caught.

reviewing a day of work, and finding checks that lie

Two-axis review (Standards / Spec) of 51 commits, 30 findings, on fix/60-review-findings. Refs #60, merged PR #61. The findings were one shape: a check that reports confidence it did not earn.

• A guard that loses half its condition when a tool is missing must refuse, not narrow — pcie-probe.sh measured beside a live endpoint while its own LAW said not to (tools/pcie-probe.md).
• A deployer that prints ENABLE for a unit systemd refuses to enable (live-sync.service has no [Install]; its timer arms it) reports a belief, not an outcome, and walking *.service only left the heartbeat unarmed on a rebuilt box (tools/dotfiles-deploy.md).
• A gate handed git's quoted path reads an empty diff and passes. Fail closed means -z (.githooks/pre-commit, tests/secret-gate.bats).

Two laws no other page owns: a stub that echoes its environment instead of its argument cannot see the bug — the probe suite asserted the mask was set and never read what the tool passed, so per-card bandwidth stayed unobtainable; and a name is data — split it, never let the shell expand it (remote-job.sh status globbed its own arguments, so job x* was reported as whatever matched in the caller's directory: tools/remote-job.md).

The heartbeat's three missed ticks were this gate firing on a managed skill that documents the vendor's all-zeros placeholder id: prose about credentials is the machine tier, and a gate that blocks it gets worked around — the workaround is the hole. Placeholder judgement reads the matched token and what follows it (a fixed quantifier truncates EXAMPLE to EXA), never the whole line. ALLOW_SECRETS stays the only override.

The rest of #60 was claims the machine had stopped honouring: .gitignore and deploy.sh's exclusion list drifted apart, .gitattributes justified installing git-lfs for wallpapers that same week's diff untracked, and the one-log rule had four owners. A coverage claim names what was measured; a tool justified by dead config cannot survive the config.

an effort map folding against rejections that never existed

Refs #62. agent/models.yml rewrote minimal→low, high→xhigh, max→xhigh for frank-dragoon to dodge 400s the engine does not send — flash-server's own error names its allow-list and the harness passes an unmapped level through verbatim, so the fold only asked for a different thinking budget than the caller named. The map is identity now, and reasoningDisableMode: none-effort was added because the default disable mode does not disable: :off still sends reasoning_effort: "minimal" and pays for a canned thinking block. Contract owner: pi/models.md. Law: a claim about what the harness sends is worth exactly its last capture — settle it through a logging proxy, not by reading config. The same pass restored the three pre-callsign model ids the 2026-10-08 rename had overwritten inside its own explanatory comments.

a documented mode the panel never had

The home ultrawide ran at 60 Hz for weeks because desk-1-home.kdl asked for 3440x1440@239.999 and the panel advertises @239.998. One character: niri matches mode strings verbatim, does not round, and a mode it cannot find does not fail — it falls back to the EDID preferred mode, 60 Hz, on every connector drop. The page that owns the file documented the same phantom mode, so every reader trusted it. Laws, triage table and probes: tools/niri/displays.md. Durable: a number in a page is a claim, not a measurement — mode strings, refresh rates and tool availability were wrong on several pages at once (wlr-randr listed as installed while pacman -Qs wlr matches nothing). Read the hardware, then destroy the stale copies. A correction is itself a measurement: this entry's first pass published a second wrong hardware fact, with a verified: date stamped on it.

a dedupe sweep, and scouts whose ledgers did not survive contact with the files

Refs #64. Owners moved, not words. The ghostty and Gitea indexes stopped carrying second copies of the pages they route to — Gitea's index restated the container table, the boot-persistence law, the management commands, and the data layout while its own See Also list named the four pages that own them, and an index that restates an operational table becomes the second authority, which is the one that goes stale. The llama.cpp overview handed Docker and the LLAMA_ARG_* rule back to the setup page that had always promised them; the search finish rule has one owner again; fleet hardware and the SearXNG engine count were re-read from the boxes rather than re-derived, and the count is now stated as a size class because it moves weekly.

Two laws no other page owns:

• A scout's ledger is a claim, not a finding. The checkable-false share of the returned rows was large: three pages "missing an H1" that have one; a 215-line omp-docs/AGENTS.md that does not exist; a wikilink-and-wall defect in core/settings.md that a commit from that same morning had already removed; core/subagent-limits.md called superseded while agent/config.yml still carries maxRecursionDepth: 1 and maxRuntimeMs: 1800000 on the very lines the page cites. Nothing entered the diff until it was re-read against the file it accused.
• A ledger written to a file is not delivered. One scout yielded against a zero-byte file; three more wrote their path with the tool-call parameter block embedded in the filename, so their ledgers exist under names no caller can ask for. Ask for the ledger as the yield text, then read it before repeating it.

Fan-out, measured the hard way: seven audit subagents on one local endpoint produced nothing for seventeen minutes. task.maxConcurrency is 2, so five were queued while two thrashed, and proc:// labels a queued task running — which is not the claim it sounds like. Cancelling five let the survivors land within minutes.

One mechanical find worth keeping: a generated See Also block had left five links with empty text (- ](index.md)) across the gitea pages, tools/cachyos.md, and tools/applications.md — rendered, that is a bullet with nothing in it to click, so it reads as a style choice rather than a broken reference. grep -rnE '(^|[ ,])\]\(' finds them in one pass.

The day's three ## 2026-10-21 sections are now one section with four subsections, which is what the spec's one-dated-section-per-day rule always meant; references/okf-maintenance.md says so explicitly now.

2026-10-20 — one work log per bundle

The bundle had two: this page and core/log.md — two entries of pure migration bookkeeping and a conversion date that neither this page nor git agreed with (2026-07-15 there, 2026-01-15 here, git log dates the OKF rebuild 2026-08-28); core/index.md still pointed readers at it, which is how a stale page stays alive. Trashed to omp-docs/core/.AGENTTRASH/. The rule lives in references/okf-spec.md and references/okf-maintenance.md and is gated by scripts/kb-lint.sh; the agent-side duty is agent/APPEND_SYSTEM.md § 1.

2026-10-20 — two instruments rescued from $HOME script sediment

Refs #53. $HOME had accumulated 123 loose scripts (archived to .AGENTTRASH/home-scripts-2026-10-20; ~1.8 GiB of stray audio consolidated into ~/audiosamples). Two were durable instruments and now live in the repo with black-box tests and pages: tools/remote-job — a readiness pattern in a log is not evidence of completion, the pattern can match a header printed before the work starts, and sed -n /x/q exits the moment it matches, tearing down the job it was watching — and tools/pcie-probe — never benchmark beside a live service, never let a tool decide to stop one, and an instrument that segfaults is not an instrument.

2026-10-20 — the secret gate was reading the wrong files, and one credential had already escaped

Found while deciding what else belongs in dotfiles/. The gate whitelisted extensions, so .env, .container, .ini and extension-less dotfiles — the shapes the dotfiles tier is made of — were never read. It now scans the whole staged diff for token shapes and, in non-prose files, for credential assignments, and fails closed when git diff itself errors; the rewrite's first attempt passed an invalid flag to git diff, got an empty file list, and reported success on every commit — which is what a blind gate looks like, and it looks identical to a clean tree. Bcrypt hashes and Basic-auth headers joined the shape list (issue #40) because the audit found a live Caddy basicauth hash, its plaintext password, and the Pi-hole internal password in a tracked auto-learned memory file. Redaction does not un-leak history that every machine has already pulled: both credentials needed rotation. Auto-learned memory is written by a process that has read your terminal, so it is a leak surface and gets gated like any config. Also removed: tracked fiction invisible to deploy.sh (home/dank/.omp/dotfiles/**, .pre-pull-backup/**) and 23 wallpaper JPEGs (80 MiB) riding in every clone. Mechanism: .githooks/pre-commit and its tests; details in dotfiles-deploy and home-config-census. Law no other page owns: systemctl --user enable snapshots an absolute path — enabling from a worktree means the seven-day reap silently kills the unit while is-enabled goes on saying enabled (blankpad-desk-autoswitch.service was dangling that way).

2026-10-20 — engineering skills configured against this KB

setup-matt-pocock-skills ran and its output moved out of the skill's default docs/agents/ into the knowledge base: issue tracker, triage labels, domain docs, and an empty decisions with its format rule. AGENTS.md gained the ## Agent skills pointer block. Law: this repo has one knowledge base, so per-tool configuration is a concept page in omp-docs/ — a second docs/ tree means a second set of index rules, which is where documentation starts disagreeing with itself. Known cost: re-running that setup skill will not recognise omp-docs/skills/* and will offer to recreate docs/agents/; the AGENTS.md pointer is what stops it.

2026-10-19 — dankvoice auto-speak armed at startup

Nothing spoke because the settings file carried no auto key (arming is session-scoped by design) and narration rode only agent_end, a settle that a scheduled continuation skips; fixed upstream in dank/dankvoice#3. Law: silence at session start is a config state — read /say status, then watch pgrep -a pw-play for one player per segment — before blaming the endpoint. Law: whether the harness delivers an event to extensions is settled in minutes by a throwaway probe extension that timestamps turn_end/agent_end, never inferred from audio timing. Details: core/dankvoice.md.

2026-10-19 — LazyVim installed as an NVIM_APPNAME profile

lazyvim had never been installed here: shell history shows the command typed twice and dropped, and ~/.config/nvim held only an orphaned matugen.lua palette nothing loaded. Now the starter lives in dotfiles/lazyvim/ symlinked to ~/.config/lazyvim, a lazyvim zsh function reaches it, and the wallpaper palette applies through RRethy/base16-nvim on ColorScheme. Law: the distribution stays out of ~/.config/nvim so bare nvim keeps working as a vanilla quick-edit editor. Details: tools/neovim.md.

2026-10-19 — dankvoice cut over to the dank/dankvoice package (Refs #34)

Drop-in agent/extensions/dankvoice.ts and its 26-test suite retired; the package carries the behaviour (41/41 black-box suite) and installs with pi install git:. Law: install and prove /say status speaks on a box before pulling the cutover commit — the shared settings file keeps menu state across both transports, so the swap is stateless once installed.

2026-10-19 — dankvoice: silence and timeouts, root-caused (Refs #32)

The humanizer's raw fetch omitted chat_template_kwargs.enable_thinking: false, so the Qwen35 hybrid thought instead of answering: 6.9 s of reasoning_content, content: "" — dead air twice, and when it answered inside the window it spoke silence. Root-caused by replaying the exact wire body against the live endpoint. Fix: pin the kwarg, treat empty-content-with-reasoning as failure, fire the menu's test phrase without blocking its handler. Lesson: the harness injects thinking-off for managed roles; raw HTTP callers must set it themselves. core/dankvoice.md.

2026-10-19 — dankvoice: humanized narration, segmented speech, /say menu (Refs #27, #23, #21)

Spoken units are rewritten by the @tiny role under the bundle's speech budgets with mechanical cleanup as fallback; the utterance-splitting state machine synthesizes segments strictly sequentially because agent_end awaiting one whole-answer synthesis hit the harness's 30 s extension-handler timeout — extensions must never await work that can exceed 30 s. /say menu routes output device (wpctl → pw-play --target) with precedence env > settings file > defaults, born from PipeWire's remembered Bluetooth route playing answers into nowhere. The extension exists at all because the harness gates --voice against the bundled Kokoro enum, so frank-tts's cloned voices were unreachable in-TUI. core/dankvoice.md.

2026-10-18 — Noctalia bar layout clobbered by trunk-sync stash, recovered

GUI-built bar customizations existed only in the working tree; a trunk-sync stash-then-drop destroyed them. Recovery: git fsck --lost-found surfaced the dropped stash as a dangling commit, validated in a sandboxed XDG_*_HOME before restore. Lesson: GUI-written config is durable only once committed — the motivation for the heartbeat below. tools/dotfiles-deploy.md.

2026-10-18 — live-sync heartbeat for machine-written paths (Refs #11)

A month of silent divergence in the live checkout proved the checkout-is-deployment model needs a committer: scripts/live-sync.sh + a systemd user timer auto-commits the allowlisted tiers with hooks armed, merges origin/main, pushes, and reaps stale wt/*. Non-allowlist dirt is never staged; conflicts abort and alert. tools/live-sync.md; tier law in AGENTS.md. Same day, two fleet laws into both repos' AGENTS.md: every agent-opened issue or PR body ends with a cwd: + session: footer, so machine-made artifacts trace to the box that spawned them; and xdg-open <PR-URL> the moment a PR opens, so Frank never hunts for it in Gitea.

2026-10-18 — SDLC switched to trunk-based development; extension route closed unmerged

develop retired (single-dev repo): branch off freshest origin/main, PRs target main, --no-ff merges, tags vX.Y.Z on main — law in AGENTS.md § Trunk-based SDLC, managed skill gitflow-back-merge-plumbing marked historical. The operator also closed PR #9 (cwd-scoped before_agent_start extension) in favour of editing each repo's AGENTS.md. Durable finding: every context-file provider (AGENTS.md walk-up, .omp/ dirs, CLAUDE.md) resolves at or below the repo root, so ancestor-scope files can never load; user-level APPEND_SYSTEM.md broadcasts to all sessions.

2026-10-18 — Sibling-vault overlap census; system docs realigned to live ground truth

Census of omp-docs/ vs serverAppConfigs-docs (subagents + live-ssh probes) found four contradicting pairs; ours fixed, theirs flagged for their PR flow. Recorded then: the RTX 3090 moved Dankserver→Dankclaw 2026-09; dankserver is 2× Radeon AI PRO R9700 (the "board swap" story was false); served models per live units. Current state always: /system/index.md.

2026-10-18 — Status line rebuilt on custom segments; full-source audit

core/statusline.md carries the audit log — four first-pass claims were false and corrected against the minified bundle plus a live screenshot matrix (context meter is box/band only; composer.shape routes segment arrays; mode states = Plan/Prewalk/Goal/Vibe/Loop). Bar rebuilt on band + custom segments.

2026-10-09 — Blankpad DE redesign: desk profiles, keybinds, Handy wiring

Per-desk niri profiles keyed by EDID long name (connector names reshuffle between docks; identity travels) + scripts/desk.sh. niri 26.04 has no hotplug event (OutputConfigChanged is only an ACK per niri-ipc), so the autoswitch daemon diffs output sets on WorkspacesChanged. Keybind cheat sheet generated by scripts/gen-keybinds.sh; noctalia docs corrected to the v5 noctalia msg API. Handy: niri owns autostart; open breaker — frank-secondary answers in reasoning_content with empty content, and Handy cannot send chat_template_kwargs.enable_thinking=false. tools/niri/displays.md, tools/handy.md.

2026-10-09 — Incident: agent sudo-loop tripped pam_faillock, locked out the operator

A subagent retried sudo yay (no TTY) for ~15 min; pam_faillock deny=3 locked user blank, and correct-password sudo then failed, mimicking a password change. Recovery: faillock --user blank --reset. Law: agents never run sudo/yay/pacman/pkexec; root steps go to the operator as exact commands. Skill faillock-sudo-lockout-recovery.

2026-10-09 — Full secret audit of the command-center repo: clean

Five layers (live-value scan across 77 revs/765 blobs, whole object store including dangling, shape triage, entropy ≥4.3, LFS payloads) found no secret in any reachable or dangling object; the quarantine list holds. Fixed hf_token_write 0644→0600. Open gap: the gate lacks hf_/npm_/pypi-/AIza/Stripe/Telegram shapes and basic-auth URLs — widening it is an open decision.

2026-10-09 — Gitea token moved out of every remote URL

Remotes bare; credential in ~/.config/secrets/gitea (0600) behind a global credential.helper store. Trap (git 2.56.0, measured): git credential-store rejects the protocol=/host= block shape the man page shows — the store file must be one URL per line, port included. Verified with GIT_TERMINAL_PROMPT=0. tools/gitea/client-access.md.

2026-10-09 — Working tree reconciled: callsign renames, compaction move, gitignore quarantine

200-entry dirty tree committed as seven atomic units. Harness model ids renamed frank-{medium,large,small} → frank-{archon,dragoon,zealot} — services keep old names on the wire; the engines accept any request model id, so renames are harness-side only. Server-side compaction moved to zealot (threshold 70→85 %). .gitignore quarantine for worktree-keyed memory buckets and runtime dirs. Skill renames are not losses: git renders directory renames as mass delete+add; pre-cutover content intact at 12c5e88.

2026-09-28 — Retired workstation purged from the knowledge base

Sold box: hostname, both LAN addresses, Wi-Fi SSID gone bundle-wide; the knowledge distilled into system/network.md (multi-link resolver law: a static resolver must be pinned on each connection) and tools/niri/displays.md (portrait transforms, the three ways a multi-monitor rig breaks). Hostname stays only where it is a lookup key (install.sh --host, packages/<hostname>.pkgs).

2026-09-01 — Retry backoff and thinking default (pi era)

Pi settings.json: 10 s base retry backoff (10/20/40 s), defaultThinkingLevel: medium (no per-model thinking field exists in models.json).

2026-08-28 — KB rebuilt to OKF v0.1; live-verified fleet facts

omp-docs/ copied from legacy ~/.pi/agent/docs, rebuilt as git-tracked OKF v0.1 (checkout is the deployment); unverifiable claims tagged unverified. Conformance pass promoted concept-in-disguise indexes, stripped index frontmatter, resolved all links; scripts/kb-lint.sh exits 0. Hardware facts were corrected then (3090-on-dankserver since moved — see 2026-10-18). Inventory census recorded under inventory/ for the pruning session.

2026-08-23 — Homepage deployed to production; Caddy KB doc

Homepage live on Dankclaw via scripts/deploy.sh (status checker timer, deployed.js, rendered basicauth hashes, health check). Hard-won Caddy law, now on caddy/caddyfile.md: top-level directives are sorted, so rewrite runs before basicauth and auth matchers saw rewritten paths — serve each page from its own handle block; a handle inline matcher is a single token; a leading @name <directive> parses as a matcher definition. A compose mount change needs a container recreate, not a reload.

2026-08-23 — Homepage design settled (grilling complete)

All 38 open questions answered; full record lives in serverAppConfigs (docs/Infrastructure/Homepage Design Grilling.md). Key deltas: per-service tcp/http probes, 5 s timeout, TUI-style panel grid, no client auto-refresh, git-driven deploy, full TDD. Correction recorded: the Dankserver media stack runs as bare processes, not containers — never probe it as a compose stack.

2026-08-22 — vllmScripts merged into serverAppConfigs

Full-history two-parent import; one repo, one checkout per host, one deploy.sh. The plaintext sudo password from old docs was NOT carried over (a bats leak-check guards it); it remains in both repos' history on the LAN Gitea — rotation recommended.

2026-08-21 — Fleet ops: passwordless sudo, Hermes SSH keys

/etc/sudoers.d/dank-nopasswd on both servers (per-command drop-ins remain); dedicated ed25519 key for the Hermes container, verified into all three machines.

2026-08-19 — SearXNG + Gluetun bring-up; pi endpoint re-pointed

searxngBaseUrl moved off the dead .235:8081 to .143:8081; pi caches web-search.json per process, so a new endpoint needs a new session. Durable field notes now on concept pages — agentic-web-research/vpn-routing.md, searxng-tuning.md, engineering/infra/containers.md: manual-WireGuard Proton needs VPN_SERVICE_PROVIDER=custom + the single-peer WIREGUARD_* env names (not protonvpn, not WIREGUARD_PEERS_*); gluetun ships no curl and :8000 is the control server, not health; the limiter's JSON cap is hardcoded Python and pass_ip is the only bypass; rootless podman strips client IPs on published ports, so SearXNG must sit behind Caddy for XFF; the quadlet generator rejects CapAdd=/Device= and generated units enable via [Install] WantedBy=default.target. ComfyUI on gfx1151: build on AMD's ROCm base and filter the torch family out of ComfyUI's requirements or you clobber the gfx1151 kernels.

2026-08-17 — Fleet redo + vLLM tool calling (pi era)

Fleet moved off the pipeline-parallel + NPU topology; Quark W8A8 quant chosen over the Avesed INT8 for clean Qwen3 XML tool calls.

2026-08-16 — Gitea boot-persistence fix (dankclaw)

unattended-upgrades reboot exposed that the compose-era Gitea had no systemd units (~1 h down). Stack rewritten as quadlet (names, systemd-gitea network, linger + WantedBy=default.target, app.ini env-override gotcha, UID 100999 ownership) across tools/gitea/*; podman generate systemd marked deprecated in engineering/infra/containers.md.

2026-08-13 — Pi subagent limits recorded (pi era)

Effective caps: globalConcurrencyLimit 2, parallel.maxTasks 8 / concurrency 4, maxSubagentDepth 2, turnBudget 30; no per-model limit. pi/packages/pi-subagents.md.

2026-08-11 — Engineering research area; agentic web research section

Created engineering/ (SDLC, agent instruction files, stacks, infra, plugins, skills ecosystem, Signal remote) and agentic-web-research/ (8 pages), the latter rewritten on 2025/2026 evidence (SearXNG valkey deployment, real engine defaults, limiter budgets, Gluetun pattern, open-model claim triage, MCP transports). Skills leaderboard replaced with the ranked list from the skills.sh API (zero-based pagination, 200-skill pages). Same pass: 154+ wikilinks resolved, dead external links fixed, MemorySleepMode=deep verified valid (systemd 256+), ASD-STE100 style pass, AGENTS.md created as the system behavior contract.

2026-08-06 — Link fixes; ComfyUI docs; major documentation overhaul

Fixed 15 broken wikilinks (missing frontmatter) + title mismatches → zero broken. Added ComfyUI pages, per-host system docs, pi config tree, tools entries; orphaned root duplicates moved to .AGENTTRASH/.

2026-07-18 — Maintenance tooling

Expanded references/okf-maintenance.md (cross-links, health metrics, troubleshooting); created core/log.md (retired 2026-10-20, above) and .okf/config.yaml.

2026-01-15 — OKF conversion

Docs bundle converted to OKF v0.1; files migrated into core/, tools/, packages/, references/ with frontmatter on all files.

2025-08-05 — Gitea documentation

Added tools/gitea/index.md (topology, management, data persistence) to the tools index — legacy tree, predating the OKF conversion above.