memory: snapshot for /clear — secrets-broker + stonehenge-park landed; wgtunnel queued next
Current state rewritten to session-end: secrets-broker LIVE (secret CLI + 25-item backfill + rm/warn), stonehenge-park /park service repo stood up (vor-plan+vor-ui), dots-tts extracted to tts-stack; NEXT PROJECT = wgtunnel (WireGuard over a plane's wifi). Two detail files added; 2 oldest T&A entries archived. Handoff written to /tmp/infra-ops-handoff.md for the post-clear pickup.
This commit is contained in:
@@ -1752,3 +1752,11 @@ _Archived 2026-08-03._
|
||||
|
||||
- `[2026-07-15]` **Statusline overhauled** (`~/.claude/statusline-command.sh`) — git state / 🔔🔕 monitor-armed / project tag / abs tokens / per-session cost / threshold-colored ctx+rate.
|
||||
_Archived 2026-08-05._
|
||||
|
||||
## Tried and abandoned (archived) — moved 2026-08-12
|
||||
|
||||
- `[2026-07-01]` **MTP/spec-decode on a SHARED serving model helps single-stream but HURTS moderate-concurrency aggregate + silently ignores `min_p`/`logit_bias`** (qwopus `gen`: N=1 +12%, N=4 −20%). Reserve for dedicated/interactive deployments.
|
||||
_Archived 2026-08-12._
|
||||
|
||||
- `[2026-07-02]` **irv-ml1 `/worktank` ROOT is root-owned — lkraven can't write there (irv-ml1 sudo needs a password) → stage model pulls to `/home`.** PIN THE A6000 BY UUID for training (native-CUDA ordering differs vs docker; the 3090 index 0 is usually near-full → OOM). `CUDA_VISIBLE_DEVICES=GPU-<uuid>`.
|
||||
_Archived 2026-08-12._
|
||||
|
||||
@@ -0,0 +1,28 @@
|
||||
`[2026-08-11]` **stonehenge-park — new fleet `/park` service repo stood up + designed.**
|
||||
|
||||
**What.** A separate greenfield repo (`~/development/stonehenge-park`, gitea `vh/stonehenge-park`,
|
||||
pushed) for a self-contained `/park` service: one durable place to park any idea (repo-born OR
|
||||
personal), find it by search, and have it **actively resurface** (by due-date or staleness) until
|
||||
acted on — so parked ideas stop dying when a repo goes cold. NOT part of eshpfi; this is a pointer.
|
||||
|
||||
**Design (via `/vor-plan`, converged + persisted to `docs/design/`):** four contract-sized units —
|
||||
**U1** core store+API (SQLite+FTS5, slug minting, bearer auth, REST) — the tracer, build first; **U2**
|
||||
scheduler+notifier (in-process; due/stale → statusline `due-count` + althing push to a dedicated
|
||||
**assistant channel**; keep-surfacing until promote/drop/re-snooze); **U3** `park` CLI (mirrors the
|
||||
`secret` CLI); **U4** browse UI. `/vor-ui` ran too (U4 brief persisted).
|
||||
|
||||
**Locked decisions (operator):** SQLite, self-contained, ONE container, no external DB ("don't want
|
||||
to troubleshoot it when a database upgrade happens") — a hard `[OPS]` invariant; system-minted
|
||||
title-derived slugs + short ID (addressable as `park/<slug>`); active keep-surfacing resurfacing with
|
||||
**re-snooze as the anti-nag valve**; bearer key, LAN/WG-internal; host nh3-docker; `/park` **replaces**
|
||||
the global ROADMAP parking-lot discipline (deferred ideas → `/park`, `source`-tagged; ROADMAP keeps
|
||||
only the v1 target) as a **fast-follow after v1** incl. migrating existing lots.
|
||||
|
||||
**Deferred (in the plan):** the althing assistant-channel handle **name** (decide at U2 contract
|
||||
time); staleness threshold + re-push cadence (env-tunable defaults ~30d/~daily); design U2's emit
|
||||
structured/consumable so a future **mission-control (Ledger→orchestrator)** can read it — park does
|
||||
NOT build the orchestrator.
|
||||
|
||||
**State.** Pre-seeded for a fresh agent (CLAUDE/persistent-memory/ROADMAP/README + the design docs),
|
||||
committed (`294ee98`), pushed. Next build task lives in that repo: the **U1 tracer contract** under
|
||||
the House Code Discipline. Auto-memory candidate not yet written (repo is self-documenting).
|
||||
@@ -0,0 +1,45 @@
|
||||
`[2026-08-10→12]` **secrets-broker — per-box Vaultwarden credential store, SHIPPED + consumer-confirmed.**
|
||||
|
||||
**What.** A per-dev-box credential store over the fleet Vaultwarden (`vaultwarden.phasefinal.com`,
|
||||
on ana-docker, DB on pfi-postgres, in the pg_dump backup set). The `secret` CLI at eshpfi
|
||||
`services/secrets-broker/secret` (also installed to `~/.local/bin/secret`, on PATH for all sessions):
|
||||
`put / get / list / rm / backfill`. Stores into the **`infra-ops` org's Default collection** (org
|
||||
shared to the operator's primary account, so he sees items too), folder = hostname, item name =
|
||||
`<host>/<path>`, title-derived slug. Small text → item note; small binary → base64 hidden field;
|
||||
**>6000 B → a bw attachment** (Vaultwarden caps notes at ~10000 encrypted chars); sha256 + source
|
||||
metadata fields; idempotent upsert keyed by name.
|
||||
|
||||
**Auth.** Bootstraps from `~/.config/secrets-broker/bootstrap.env` (0600): apikey login
|
||||
(`BW_CLIENTID`/`BW_CLIENTSECRET`) + master-password unlock (`--passwordenv`) → per-invocation
|
||||
session. That file is **secrets-zero** (it unlocks the vault, can't live in it) and is excluded from
|
||||
backfill.
|
||||
|
||||
**Client = `bw`, NOT `rbw`.** rbw was the operator's first choice but its `register` returned an
|
||||
undebuggable 400 against this Vaultwarden despite valid creds (a direct `client_credentials` grant +
|
||||
both prelogin paths return 200; rbw emits no HTTP logs). Switched to the official `bw` CLI
|
||||
(user-prefix npm install) — clean unattended flow, full write support (org collections + attachments).
|
||||
|
||||
**Backfill.** Local-only (each box backs up itself; NOT a fleet daemon). Scanned nh3-dev's
|
||||
`~/development/*/{env.sh,.env}` + `~/.config` credential files, **25 items stored + round-trip
|
||||
verified** (2 large via attachment). Excludes bootstrap.env / `.example` / `~/AIPA-Data` archives /
|
||||
cargo noise.
|
||||
|
||||
**Post-launch (jackdaw-dev feedback).** Added **`secret rm <name>`** (bw soft-delete to trash,
|
||||
recoverable) — closes the "no delete path, append-only" gap; and a **new-top-level-namespace warning**
|
||||
on `put` (stderr, non-blocking) — catches a typo'd/missing host prefix at store time. Chose
|
||||
warn-not-auto-prefix because domain-scoped names (`gitea/…`, `certs/…`) would misfire on auto-prefix.
|
||||
Deferred edge recorded in the contract: the warning is non-blocking, so a scripted put suppressing
|
||||
stderr can still mis-namespace — add an opt-in `--strict` only if scripted callers appear.
|
||||
|
||||
**Standing directive (now GLOBAL in `~/.claude/CLAUDE.md`):** the vault is the credential source of
|
||||
truth — **`secret put` durable secrets into it AND `secret get` the creds a task needs FROM it**
|
||||
rather than reading on-disk copies. Dogfooded by pulling the gitea `vh` token from the vault to create
|
||||
`vh/stonehenge-park`.
|
||||
|
||||
**Deploy shape.** Not a service / no daemon — per-box; a new dev box duplicates the stack
|
||||
(`services/secrets-broker/README.md`): npm-install `bw` to `~/.local`, drop a per-box `bootstrap.env`,
|
||||
`secret backfill`. Commits: `41359ea` (CLI + contract), `850a197` (backfill 25/25 + attachment +
|
||||
resilient run), `a249073` (rm + namespace warning), `a1304b7` (deferred-edge contract note).
|
||||
Consumer-confirmed end-to-end by jackdaw-dev.
|
||||
|
||||
Auto-memory: `reference_secrets_broker_cli`.
|
||||
+17
-13
@@ -1,6 +1,6 @@
|
||||
# Persistent memory — eshpfi-management
|
||||
|
||||
_Last updated: 2026-08-10_
|
||||
_Last updated: 2026-08-12_
|
||||
|
||||
> **Always check for `/tmp/infra-ops-handoff.md`** — if it exists and its
|
||||
> `Written:` stamp is under an hour old, read it (it carries the in-flight
|
||||
@@ -109,9 +109,15 @@ no longer deployed sidecars here. See Recent decisions.)
|
||||
|
||||
## Current state / in-flight
|
||||
|
||||
_As of 2026-08-10 — long session; the dots.tts TTS-engine + LFM2.5 arcs LANDED (full detail per arc in Recent decisions). Genuinely in-flight is thin:_
|
||||
_As of 2026-08-12 — the secrets-broker + stonehenge-park work LANDED (detail in Recent decisions). NEXT PROJECT queued: **wgtunnel**._
|
||||
|
||||
- **dots.tts is the new fleet RP-TTS engine — LIVE + consumer-confirmed.** v3 on irv-ml1:8198 (curly-sanitize + sentence-chunking + clause-break→period pause mapping), ratatoskr migrated + verified clean end-to-end; chatterbox-fast RECLAIMED (:8197 stopped, revive `docker start chatterbox-fast`). ⚠ WATCH: deployed container GPU creeps ~6→14GB/8h (cache accumulation; a redeploy resets it); the **pinned Dockerfile is the only rebuild path** until upstream fixes the phantom `gradio==6.17.0` constraint. Full arc → Recent decisions. **⤳ TTS DEV EXTRACTED to the dedicated `tts-stack` repo (`~/development/tts-stack`, 2026-08-11) — eshpfi `stacks/dots-tts/` is now a POINTER stub, `voices/` MOVED out. Do all TTS work in tts-stack; this session STOOD DOWN TTS dev.**
|
||||
- **⟳ NEXT PROJECT — `wgtunnel`** (queued 2026-08-12, greenfield, not started): a WireGuard tunnel that works while on a plane's wifi. Core challenge = airplane/captive-portal wifi blocks UDP + only allows TCP/443 after portal auth, so plain WG won't traverse → needs **WG-over-TCP/443 obfuscation** (wstunnel / udp-over-tcp / udp2raw / TLS-wrap) + captive-portal handling. Fresh session starts here (likely a `/vor` or `/vor-plan` pass; ask scope + persist location first). Full seed in `/tmp/infra-ops-handoff.md`.
|
||||
|
||||
- **SECRETS-BROKER — LIVE.** Per-box credential store over Vaultwarden; the `secret` CLI (`put/get/list/rm/backfill`) on PATH at `~/.local/bin/secret`, 25 nh3-dev secrets backfilled + verified. Standing directive now global: **vault is the credential source of truth — store in it AND `secret get` creds FROM it.** Detail → Recent decisions `[2026-08-10→12]`.
|
||||
|
||||
- **STONEHENGE-PARK — new fleet repo stood up** (`vh/stonehenge-park`, pushed): a self-contained `/park` service to centrally park + resurface ideas. `/vor-plan` + `/vor-ui` done; build starts at the **U1 tracer contract** (that repo's task, not eshpfi's). Detail → Recent decisions `[2026-08-11]`.
|
||||
|
||||
- **dots.tts — DONE + EXTRACTED.** Was the fleet RP-TTS engine (v3 on irv-ml1:8198); all TTS dev extracted to `~/development/tts-stack` (eshpfi `stacks/dots-tts/` is a POINTER stub, `voices/` moved out). Do TTS work in tts-stack. ⚠ Live container GPU still creeps ~6→14GB/8h (redeploy resets).
|
||||
|
||||
- **LFM2.5-2.6b bake-off alias for brokkr — DELIVERED, awaiting his bench.** `vllm-lfm25` ana-ml2:8021 + LiteLLM `lfm2.5-2.6b` (deepseek_r1 reasoning-parser, vendor sampling); PRODUCTION-CLEARED (operator <USD 10M ruling) but kept OUT of default/fallback routing per brokkr's measurement gate. Peer-side now.
|
||||
|
||||
@@ -127,11 +133,17 @@ _As of 2026-08-10 — long session; the dots.tts TTS-engine + LFM2.5 arcs LANDED
|
||||
|
||||
**althing monitor** ARMED (handle `infra-ops`, task `b1uat4njl`; herald up). ⚠️ Re-arm ONLY after a real FIRE (`<task-notification> completed rc0`), NEVER after a plain operator turn (bounces rc3); spawn `althing-wake-listener` as its OWN `run_in_background` task, **NEVER chained with `&`/`&&`** (orphans it to init — bit me this session; reclaim with `althing-cli stop-monitor` then re-arm cleanly).
|
||||
|
||||
**eshpfi push state:** `origin/main` well behind — this session added ~15 commits (the whole dots.tts engine arc `fca1a54`→`0775701`: voices corpus, dots-tts stack, LFM2.5 vllm+litellm, v2 fix, + memory snapshots) on top of prior unpushed work. **Push is the operator's call.** `graphify-out/GRAPH_REPORT.md` churns every commit (ignore); `stacks/heretic2-charrp-reasoning/` UNTRACKED (pre-existing, operator's).
|
||||
**eshpfi push state:** `origin/main` well behind — this session added the dots.tts arc + the **secrets-broker arc** (`41359ea` CLI, `850a197` backfill, `a249073` rm+warn, `a1304b7` contract note) + dots-tts v3/extract (`a80f6e9`/`62672c9`) on top of prior unpushed work. **Push is the operator's call.** (Dotfiles + stonehenge-park are SEPARATE repos, both pushed this session.) `graphify-out/GRAPH_REPORT.md` churns every commit (ignore); `stacks/heretic2-charrp-reasoning/` UNTRACKED (pre-existing, operator's).
|
||||
|
||||
|
||||
## Recent decisions
|
||||
|
||||
- `[2026-08-10→12]` **secrets-broker: per-box Vaultwarden credential store SHIPPED + consumer-confirmed.** `secret` CLI (`put/get/list/rm/backfill`, bw-backed) on `~/.local/bin`; 25 nh3-dev secrets backfilled + round-trip-verified; `rm` + new-namespace warning added post-launch; standing "vault is the credential source of truth" directive now global. → `persistent-memory.d/2026-08-12-secrets-broker.md`
|
||||
|
||||
- `[2026-08-11]` **stonehenge-park: new fleet `/park` service repo stood up + designed (`/vor-plan` + `/vor-ui`).** Self-contained SQLite+FastAPI idea-parking service that actively resurfaces (statusline + althing) so nothing dies in a cold repo; `vh/stonehenge-park` pushed + pre-seeded for a fresh agent; build starts at the U1 tracer contract. → `persistent-memory.d/2026-08-11-stonehenge-park.md`
|
||||
|
||||
- `[2026-08-12]` **Global `~/.claude/CLAUDE.md`: `secret`/vault tool entry + "store in AND pull from the vault" standing directive** (dotfiles `9db703b`, pushed); statusline reset-countdowns + a latent tab-collapse parse-bug fix, now tracked in the dotfiles stow tree. Dogfooded the directive: created `vh/stonehenge-park` pulling the gitea token via `secret get`. (dotfiles + global config, not eshpfi.)
|
||||
|
||||
- `[2026-08-11]` **TTS stack extracted to its own repo (`tts-stack`) + eshpfi stood down on TTS dev.** Operator: hand all TTS tuning/dev to a separate agent with a self-contained repo (knowledge + infra access + a live knowledge list), and move the voice corpus in. New repo `~/development/tts-stack` (commit `9ee3288`) carries: dots-tts stack (canonical intent), `voices/` corpus (MOVED out of eshpfi), `KNOWLEDGE.md` (engine landscape + prosody findings + foot-guns), `docs/infrastructure.md` (irv-ml1 access + gated deploy runbook + rollback), CLAUDE/persistent-memory/ROADMAP, `tools/` (pause-probe + Booth render). Followed the **chatterbox-fast precedent**: eshpfi `stacks/dots-tts/` reduced to a POINTER README; the ~15 experimental TTS compose wrappers stay here as reference (catalogued in tts-stack KNOWLEDGE). Blast-radius check: no eshpfi playbook/script reads the canonical corpus (other `voices/` refs = unrelated host paths). **Reverses** the earlier "Corpus home = eshpfi `voices/` (keep-here)" call. ⚠ tts-stack is LOCAL-ONLY until pushed — needs a gitea remote (`vh/tts-stack`) + push before the separate agent can clone (operator's call — outward-facing + repo-create creds).
|
||||
|
||||
- `[2026-08-10]` **dots-tts v3 — clause-break → period pause mapping.** Operator: v2 "sounds good" but donut won't pause at semicolons/dashes. ROOT CAUSE (measured via a pause-probe A/B — synth duration over N runs, non-determinism averaged out): dots' prosody honors a real pause **only for ellipsis (~+0.43s) and period (~+0.3s, capitalization-independent)**; comma/semicolon/colon/dash all run **flat (~+0.03s vs no-punct)**. Two distinct sub-causes: **dashes regressed in v2** (the `—`→`-` fold made em-dashes read as word-joiners), while **semicolons were NEVER a v2 change** — dots ignores them natively, only newly noticeable because v2 made everything else clean. Operator call: ellipsis "too much" → **map `;`, clause `:`, and em-dash `—` → period** in `_sanitize` (believable ~0.3s clause break). GUARDS (pinned by 11 unit tests, `stacks/dots-tts/test_sanitize.py`): digit-guarded colon `(?<!\d)\s*:\s*(?!\d)` so times `3:45` / ratios `2:1` survive; en-dash `–`→hyphen KEPT (numeric-range `10–20` safety — em-dash breaks, en-dash ranges, different jobs); genuine ellipsis left at full strength (author meant a long pause). Gated deploy (redeploy2 pattern → v3): build → throwaway :8199 test container + **pause-gate** (semicolon sentence must run ≥0.12s longer than baseline; measured **+0.427s**) → only then cut live over. LIVE + healthy `local/dots-tts:v3` on :8198. **rollback = `sed -i 's/^DOTS_TAG=.*/DOTS_TAG=v2/' .env + docker compose up -d dots-tts`** (v2 image retained). Booth `dots-pauses` (A=old-flat / C=ellipsis-too-much / D=live-v3). [[reference_chatterbox_fast_repo]]
|
||||
@@ -306,12 +318,4 @@ _175 older entries archived to archival-memory.md._
|
||||
|
||||
- `[2026-07-04]` LiteLLM (this gateway version) mutates the SHARED deployment config in-place on per-request sampler-param merge → `persistent-memory.d/2026-07-04-litellm-this-gateway-version-mutates-the-shared-deployment.md`
|
||||
|
||||
- `[2026-07-01]` **MTP/spec-decode on a SHARED serving model helps single-stream but HURTS
|
||||
moderate-concurrency aggregate + silently ignores `min_p`/`logit_bias`** (qwopus `gen`: N=1 +12%,
|
||||
N=4 −20%). Reserve for dedicated/interactive deployments.
|
||||
|
||||
- `[2026-07-02]` **irv-ml1 `/worktank` ROOT is root-owned — lkraven can't write there (irv-ml1 sudo
|
||||
needs a password) → stage model pulls to `/home`.** PIN THE A6000 BY UUID for training (native-CUDA
|
||||
ordering differs vs docker; the 3090 index 0 is usually near-full → OOM). `CUDA_VISIBLE_DEVICES=GPU-<uuid>`.
|
||||
|
||||
_107 older entries archived to archival-memory.md._
|
||||
_109 older entries archived to archival-memory.md._
|
||||
|
||||
Reference in New Issue
Block a user