diff --git a/archival-memory.md b/archival-memory.md index 711898a..28d02ea 100644 --- a/archival-memory.md +++ b/archival-memory.md @@ -1752,3 +1752,11 @@ _Archived 2026-08-03._ - `[2026-07-15]` **Statusline overhauled** (`~/.claude/statusline-command.sh`) β€” git state / πŸ””πŸ”• monitor-armed / project tag / abs tokens / per-session cost / threshold-colored ctx+rate. _Archived 2026-08-05._ + +## Tried and abandoned (archived) β€” moved 2026-08-12 + +- `[2026-07-01]` **MTP/spec-decode on a SHARED serving model helps single-stream but HURTS moderate-concurrency aggregate + silently ignores `min_p`/`logit_bias`** (qwopus `gen`: N=1 +12%, N=4 βˆ’20%). Reserve for dedicated/interactive deployments. + _Archived 2026-08-12._ + +- `[2026-07-02]` **irv-ml1 `/worktank` ROOT is root-owned β€” lkraven can't write there (irv-ml1 sudo needs a password) β†’ stage model pulls to `/home`.** PIN THE A6000 BY UUID for training (native-CUDA ordering differs vs docker; the 3090 index 0 is usually near-full β†’ OOM). `CUDA_VISIBLE_DEVICES=GPU-`. + _Archived 2026-08-12._ diff --git a/persistent-memory.d/2026-08-11-stonehenge-park.md b/persistent-memory.d/2026-08-11-stonehenge-park.md new file mode 100644 index 0000000..91f9792 --- /dev/null +++ b/persistent-memory.d/2026-08-11-stonehenge-park.md @@ -0,0 +1,28 @@ +`[2026-08-11]` **stonehenge-park β€” new fleet `/park` service repo stood up + designed.** + +**What.** A separate greenfield repo (`~/development/stonehenge-park`, gitea `vh/stonehenge-park`, +pushed) for a self-contained `/park` service: one durable place to park any idea (repo-born OR +personal), find it by search, and have it **actively resurface** (by due-date or staleness) until +acted on β€” so parked ideas stop dying when a repo goes cold. NOT part of eshpfi; this is a pointer. + +**Design (via `/vor-plan`, converged + persisted to `docs/design/`):** four contract-sized units β€” +**U1** core store+API (SQLite+FTS5, slug minting, bearer auth, REST) β€” the tracer, build first; **U2** +scheduler+notifier (in-process; due/stale β†’ statusline `due-count` + althing push to a dedicated +**assistant channel**; keep-surfacing until promote/drop/re-snooze); **U3** `park` CLI (mirrors the +`secret` CLI); **U4** browse UI. `/vor-ui` ran too (U4 brief persisted). + +**Locked decisions (operator):** SQLite, self-contained, ONE container, no external DB ("don't want +to troubleshoot it when a database upgrade happens") β€” a hard `[OPS]` invariant; system-minted +title-derived slugs + short ID (addressable as `park/`); active keep-surfacing resurfacing with +**re-snooze as the anti-nag valve**; bearer key, LAN/WG-internal; host nh3-docker; `/park` **replaces** +the global ROADMAP parking-lot discipline (deferred ideas β†’ `/park`, `source`-tagged; ROADMAP keeps +only the v1 target) as a **fast-follow after v1** incl. migrating existing lots. + +**Deferred (in the plan):** the althing assistant-channel handle **name** (decide at U2 contract +time); staleness threshold + re-push cadence (env-tunable defaults ~30d/~daily); design U2's emit +structured/consumable so a future **mission-control (Ledgerβ†’orchestrator)** can read it β€” park does +NOT build the orchestrator. + +**State.** Pre-seeded for a fresh agent (CLAUDE/persistent-memory/ROADMAP/README + the design docs), +committed (`294ee98`), pushed. Next build task lives in that repo: the **U1 tracer contract** under +the House Code Discipline. Auto-memory candidate not yet written (repo is self-documenting). diff --git a/persistent-memory.d/2026-08-12-secrets-broker.md b/persistent-memory.d/2026-08-12-secrets-broker.md new file mode 100644 index 0000000..796cc25 --- /dev/null +++ b/persistent-memory.d/2026-08-12-secrets-broker.md @@ -0,0 +1,45 @@ +`[2026-08-10β†’12]` **secrets-broker β€” per-box Vaultwarden credential store, SHIPPED + consumer-confirmed.** + +**What.** A per-dev-box credential store over the fleet Vaultwarden (`vaultwarden.phasefinal.com`, +on ana-docker, DB on pfi-postgres, in the pg_dump backup set). The `secret` CLI at eshpfi +`services/secrets-broker/secret` (also installed to `~/.local/bin/secret`, on PATH for all sessions): +`put / get / list / rm / backfill`. Stores into the **`infra-ops` org's Default collection** (org +shared to the operator's primary account, so he sees items too), folder = hostname, item name = +`/`, title-derived slug. Small text β†’ item note; small binary β†’ base64 hidden field; +**>6000 B β†’ a bw attachment** (Vaultwarden caps notes at ~10000 encrypted chars); sha256 + source +metadata fields; idempotent upsert keyed by name. + +**Auth.** Bootstraps from `~/.config/secrets-broker/bootstrap.env` (0600): apikey login +(`BW_CLIENTID`/`BW_CLIENTSECRET`) + master-password unlock (`--passwordenv`) β†’ per-invocation +session. That file is **secrets-zero** (it unlocks the vault, can't live in it) and is excluded from +backfill. + +**Client = `bw`, NOT `rbw`.** rbw was the operator's first choice but its `register` returned an +undebuggable 400 against this Vaultwarden despite valid creds (a direct `client_credentials` grant + +both prelogin paths return 200; rbw emits no HTTP logs). Switched to the official `bw` CLI +(user-prefix npm install) β€” clean unattended flow, full write support (org collections + attachments). + +**Backfill.** Local-only (each box backs up itself; NOT a fleet daemon). Scanned nh3-dev's +`~/development/*/{env.sh,.env}` + `~/.config` credential files, **25 items stored + round-trip +verified** (2 large via attachment). Excludes bootstrap.env / `.example` / `~/AIPA-Data` archives / +cargo noise. + +**Post-launch (jackdaw-dev feedback).** Added **`secret rm `** (bw soft-delete to trash, +recoverable) β€” closes the "no delete path, append-only" gap; and a **new-top-level-namespace warning** +on `put` (stderr, non-blocking) β€” catches a typo'd/missing host prefix at store time. Chose +warn-not-auto-prefix because domain-scoped names (`gitea/…`, `certs/…`) would misfire on auto-prefix. +Deferred edge recorded in the contract: the warning is non-blocking, so a scripted put suppressing +stderr can still mis-namespace β€” add an opt-in `--strict` only if scripted callers appear. + +**Standing directive (now GLOBAL in `~/.claude/CLAUDE.md`):** the vault is the credential source of +truth β€” **`secret put` durable secrets into it AND `secret get` the creds a task needs FROM it** +rather than reading on-disk copies. Dogfooded by pulling the gitea `vh` token from the vault to create +`vh/stonehenge-park`. + +**Deploy shape.** Not a service / no daemon β€” per-box; a new dev box duplicates the stack +(`services/secrets-broker/README.md`): npm-install `bw` to `~/.local`, drop a per-box `bootstrap.env`, +`secret backfill`. Commits: `41359ea` (CLI + contract), `850a197` (backfill 25/25 + attachment + +resilient run), `a249073` (rm + namespace warning), `a1304b7` (deferred-edge contract note). +Consumer-confirmed end-to-end by jackdaw-dev. + +Auto-memory: `reference_secrets_broker_cli`. diff --git a/persistent-memory.md b/persistent-memory.md index c3f2157..e13604f 100644 --- a/persistent-memory.md +++ b/persistent-memory.md @@ -1,6 +1,6 @@ # Persistent memory β€” eshpfi-management -_Last updated: 2026-08-10_ +_Last updated: 2026-08-12_ > **Always check for `/tmp/infra-ops-handoff.md`** β€” if it exists and its > `Written:` stamp is under an hour old, read it (it carries the in-flight @@ -109,9 +109,15 @@ no longer deployed sidecars here. See Recent decisions.) ## Current state / in-flight -_As of 2026-08-10 β€” long session; the dots.tts TTS-engine + LFM2.5 arcs LANDED (full detail per arc in Recent decisions). Genuinely in-flight is thin:_ +_As of 2026-08-12 β€” the secrets-broker + stonehenge-park work LANDED (detail in Recent decisions). NEXT PROJECT queued: **wgtunnel**._ -- **dots.tts is the new fleet RP-TTS engine β€” LIVE + consumer-confirmed.** v3 on irv-ml1:8198 (curly-sanitize + sentence-chunking + clause-breakβ†’period pause mapping), ratatoskr migrated + verified clean end-to-end; chatterbox-fast RECLAIMED (:8197 stopped, revive `docker start chatterbox-fast`). ⚠ WATCH: deployed container GPU creeps ~6β†’14GB/8h (cache accumulation; a redeploy resets it); the **pinned Dockerfile is the only rebuild path** until upstream fixes the phantom `gradio==6.17.0` constraint. Full arc β†’ Recent decisions. **β€³ TTS DEV EXTRACTED to the dedicated `tts-stack` repo (`~/development/tts-stack`, 2026-08-11) β€” eshpfi `stacks/dots-tts/` is now a POINTER stub, `voices/` MOVED out. Do all TTS work in tts-stack; this session STOOD DOWN TTS dev.** +- **⟳ NEXT PROJECT β€” `wgtunnel`** (queued 2026-08-12, greenfield, not started): a WireGuard tunnel that works while on a plane's wifi. Core challenge = airplane/captive-portal wifi blocks UDP + only allows TCP/443 after portal auth, so plain WG won't traverse β†’ needs **WG-over-TCP/443 obfuscation** (wstunnel / udp-over-tcp / udp2raw / TLS-wrap) + captive-portal handling. Fresh session starts here (likely a `/vor` or `/vor-plan` pass; ask scope + persist location first). Full seed in `/tmp/infra-ops-handoff.md`. + +- **SECRETS-BROKER β€” LIVE.** Per-box credential store over Vaultwarden; the `secret` CLI (`put/get/list/rm/backfill`) on PATH at `~/.local/bin/secret`, 25 nh3-dev secrets backfilled + verified. Standing directive now global: **vault is the credential source of truth β€” store in it AND `secret get` creds FROM it.** Detail β†’ Recent decisions `[2026-08-10β†’12]`. + +- **STONEHENGE-PARK β€” new fleet repo stood up** (`vh/stonehenge-park`, pushed): a self-contained `/park` service to centrally park + resurface ideas. `/vor-plan` + `/vor-ui` done; build starts at the **U1 tracer contract** (that repo's task, not eshpfi's). Detail β†’ Recent decisions `[2026-08-11]`. + +- **dots.tts β€” DONE + EXTRACTED.** Was the fleet RP-TTS engine (v3 on irv-ml1:8198); all TTS dev extracted to `~/development/tts-stack` (eshpfi `stacks/dots-tts/` is a POINTER stub, `voices/` moved out). Do TTS work in tts-stack. ⚠ Live container GPU still creeps ~6β†’14GB/8h (redeploy resets). - **LFM2.5-2.6b bake-off alias for brokkr β€” DELIVERED, awaiting his bench.** `vllm-lfm25` ana-ml2:8021 + LiteLLM `lfm2.5-2.6b` (deepseek_r1 reasoning-parser, vendor sampling); PRODUCTION-CLEARED (operator completed rc0`), NEVER after a plain operator turn (bounces rc3); spawn `althing-wake-listener` as its OWN `run_in_background` task, **NEVER chained with `&`/`&&`** (orphans it to init β€” bit me this session; reclaim with `althing-cli stop-monitor` then re-arm cleanly). -**eshpfi push state:** `origin/main` well behind β€” this session added ~15 commits (the whole dots.tts engine arc `fca1a54`β†’`0775701`: voices corpus, dots-tts stack, LFM2.5 vllm+litellm, v2 fix, + memory snapshots) on top of prior unpushed work. **Push is the operator's call.** `graphify-out/GRAPH_REPORT.md` churns every commit (ignore); `stacks/heretic2-charrp-reasoning/` UNTRACKED (pre-existing, operator's). +**eshpfi push state:** `origin/main` well behind β€” this session added the dots.tts arc + the **secrets-broker arc** (`41359ea` CLI, `850a197` backfill, `a249073` rm+warn, `a1304b7` contract note) + dots-tts v3/extract (`a80f6e9`/`62672c9`) on top of prior unpushed work. **Push is the operator's call.** (Dotfiles + stonehenge-park are SEPARATE repos, both pushed this session.) `graphify-out/GRAPH_REPORT.md` churns every commit (ignore); `stacks/heretic2-charrp-reasoning/` UNTRACKED (pre-existing, operator's). ## Recent decisions +- `[2026-08-10β†’12]` **secrets-broker: per-box Vaultwarden credential store SHIPPED + consumer-confirmed.** `secret` CLI (`put/get/list/rm/backfill`, bw-backed) on `~/.local/bin`; 25 nh3-dev secrets backfilled + round-trip-verified; `rm` + new-namespace warning added post-launch; standing "vault is the credential source of truth" directive now global. β†’ `persistent-memory.d/2026-08-12-secrets-broker.md` + +- `[2026-08-11]` **stonehenge-park: new fleet `/park` service repo stood up + designed (`/vor-plan` + `/vor-ui`).** Self-contained SQLite+FastAPI idea-parking service that actively resurfaces (statusline + althing) so nothing dies in a cold repo; `vh/stonehenge-park` pushed + pre-seeded for a fresh agent; build starts at the U1 tracer contract. β†’ `persistent-memory.d/2026-08-11-stonehenge-park.md` + +- `[2026-08-12]` **Global `~/.claude/CLAUDE.md`: `secret`/vault tool entry + "store in AND pull from the vault" standing directive** (dotfiles `9db703b`, pushed); statusline reset-countdowns + a latent tab-collapse parse-bug fix, now tracked in the dotfiles stow tree. Dogfooded the directive: created `vh/stonehenge-park` pulling the gitea token via `secret get`. (dotfiles + global config, not eshpfi.) + - `[2026-08-11]` **TTS stack extracted to its own repo (`tts-stack`) + eshpfi stood down on TTS dev.** Operator: hand all TTS tuning/dev to a separate agent with a self-contained repo (knowledge + infra access + a live knowledge list), and move the voice corpus in. New repo `~/development/tts-stack` (commit `9ee3288`) carries: dots-tts stack (canonical intent), `voices/` corpus (MOVED out of eshpfi), `KNOWLEDGE.md` (engine landscape + prosody findings + foot-guns), `docs/infrastructure.md` (irv-ml1 access + gated deploy runbook + rollback), CLAUDE/persistent-memory/ROADMAP, `tools/` (pause-probe + Booth render). Followed the **chatterbox-fast precedent**: eshpfi `stacks/dots-tts/` reduced to a POINTER README; the ~15 experimental TTS compose wrappers stay here as reference (catalogued in tts-stack KNOWLEDGE). Blast-radius check: no eshpfi playbook/script reads the canonical corpus (other `voices/` refs = unrelated host paths). **Reverses** the earlier "Corpus home = eshpfi `voices/` (keep-here)" call. ⚠ tts-stack is LOCAL-ONLY until pushed β€” needs a gitea remote (`vh/tts-stack`) + push before the separate agent can clone (operator's call β€” outward-facing + repo-create creds). - `[2026-08-10]` **dots-tts v3 β€” clause-break β†’ period pause mapping.** Operator: v2 "sounds good" but donut won't pause at semicolons/dashes. ROOT CAUSE (measured via a pause-probe A/B β€” synth duration over N runs, non-determinism averaged out): dots' prosody honors a real pause **only for ellipsis (~+0.43s) and period (~+0.3s, capitalization-independent)**; comma/semicolon/colon/dash all run **flat (~+0.03s vs no-punct)**. Two distinct sub-causes: **dashes regressed in v2** (the `β€”`β†’`-` fold made em-dashes read as word-joiners), while **semicolons were NEVER a v2 change** β€” dots ignores them natively, only newly noticeable because v2 made everything else clean. Operator call: ellipsis "too much" β†’ **map `;`, clause `:`, and em-dash `β€”` β†’ period** in `_sanitize` (believable ~0.3s clause break). GUARDS (pinned by 11 unit tests, `stacks/dots-tts/test_sanitize.py`): digit-guarded colon `(?`. - -_107 older entries archived to archival-memory.md._ +_109 older entries archived to archival-memory.md._