command-center/agent/managed-skills/serverappconfigs-inventory-audit/SKILL.md

name, description

name	description
serverappconfigs-inventory-audit	Audit serverAppConfigs for duplicated fleet-service definitions: the 10 hand-copied inventory sites, the live-vs-repo drift census commands, and the known staleness checks.

serverAppConfigs inventory / duplication audit

Use when asked "where can we refactor or share resources", "why is X defined twice", or when adding a service and the edit sites must be enumerated. Read-only audit; changes come later.

The inventory is hand-copied ten times (2026-10-13 census)

Truth	Path	Shape
order graph	scripts/deploy-plan.py SERVICE_ORDER	45 names
per-host allow-sets	scripts/deploy-plan.py DANKCLAW_/DANKSERVER_/FRANKBOOK_SERVICES	3 sets
path→service	scripts/deploy-plan.py services_for_path	~30 branches + 6 in-branch name whitelists
target:service gate	scripts/deploy-remote.sh service_is_allowed	case "$TARGET:$service" pairs
dispatcher	scripts/deploy-remote.sh deploy_service	30 branches
test selector	scripts/test-changed.sh	~40 path globs
probes	shared/homepage/services.json	35 entries (probe, url, docs, icon)
scrape jobs	shared/prometheus/prometheus.yml	11 jobs
vhosts	dankclaw/Caddyfile	public vhost + http://:8017 post-auth handler per guarded service
DNS	dankclaw/pihole/addn-hosts	30 records

Adding one service touches all ten. Any audit that enumerates services must cross-check all ten, not one.

Census commands

Live-vs-repo container drift (catches host-only units with no git provenance):

ssh dankclaw 'podman ps --format "{{.Names}}"' | sort > /tmp/live.txt
grep -h '^ContainerName=' dankclaw/*/*/*.container | sed 's/ContainerName=//' | sort > /tmp/repo.txt
comm -23 /tmp/live.txt /tmp/repo.txt   # live, not in repo
comm -13 /tmp/live.txt /tmp/repo.txt   # in repo, not running

systemd-<network> in the live list is podman's netns infra container — benign. A real hit: ntfy (2026-10-11) existed only as ~/.config/containers/systemd/ntfy.container with restart=no.

Other probes, all cheap and all producing findings on 2026-10-13:

# stateful stores and whether probes can reach them
grep -n 'PublishPort' dankclaw/**/quadlet/*postgres* dankserver/**/quadlet/*{mariadb,redis}*
# dead scripts: zero refs outside docs
for f in scripts/*.sh; do grep -rl "$(basename $f)" . | grep -v serverAppConfigs-docs | grep -q . || echo "$f"; done
# shared paths that no longer exist
for p in dankclaw/frank-dragoon dankclaw/compose.yaml dankserver/Caddyfile; do [ -e "$p" ] || echo "STALE $p"; done
# memory footprint, to kill the "saves RAM" argument
ssh dankclaw 'podman stats --no-stream --format "{{.Name}} {{.MemUsage}}" postgres gitea-postgres authentik-postgres'

Known-stale items to re-verify each audit

• deploy-plan.py: DANKSERVER_SERVICES still lists the six *arr services (they live on FrankBook-Pro); maps scripts/qwen-sharp-v22.4.0.jinja (retired runtime) to frank-dragoon; has no rule for scripts/qwen38-froggeric-v22.5.jinja, the live frank-archon template — editing it deploys nothing.
• test-changed.sh: cases for dankclaw/frank-dragoon/*, dankclaw/compose.yaml, dankserver/Caddyfile match nothing.
• AGENTS.md runbook index lists frank-archon's retired runbook as active while the endpoint section names the current one; frank-archon's shape is written in three places in that file.
• shared/homepage/dankserver.services.json: zero references; deploy_homepage copies six named files and it is not one of them.
• scripts/hf-fetch.sh: superseded by scripts/hfget.sh, no callers.
• Undeclared shared networks: 15 units attach to dankclaw_default, 6 to dankserver_appnet; no .network file in the repo defines either.
• dankserver/compose.yaml defines six containers whose names are owned by quadlet units, with diverged volume paths; deploy_compose_service refuses to act on it and compose_validity.bats checks YAML shape only.
• frank-zealot.service Restart=on-failure violates the law frank_archon_unit.bats states (clean engine exit reads as success, so on-failure never fires); the zealot seam greps ^Restart= and passes.
• render_caddyfile / deploy_homepage write fixed /tmp filenames as dank, then run_privileged cp them into root-owned paths.

Report shape

Table the duplication with counts (occurrences + path:line), label DUE vs DIVERGENT-intentional, then a ranked priority table (lines removed / risk). Ground "saves RAM" claims in measured RSS — two postgres containers measured 37 MiB and 325 MiB, so the prize is the operational surface (unit, secret, health gate, deploy entry, backup), not memory.