diff --git a/CLAUDE.md b/CLAUDE.md index 729ade8..452c329 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -222,7 +222,7 @@ Observed and standardized across servers: | corviduo-dev | 10.250.50.152 | Anaheim | **Worldtree-team dev VM (PFI-hosted)** — runs the demo + personal + pinned Worldtree deployments vor/asset-engine talk to | `servers/corviduo-dev/README.md` | | nh3-docker | 10.100.50.40 | NH3 (`10.100.0.0/16`) | General-purpose Docker host (non-GPU VM on nh3-pve) | `servers/nh3-docker/README.md` | | nh3-dev | 10.100.10.50 | NH3 | Dev box — fleet sidecars (egress SOCKS5 proxy, ttyd seat, mead-hall, volva) + live Claude Code sessions; not a Docker-stack host | `servers/nh3-dev/README.md` | -| nh3-extdev | 10.100.50.42 | NH3 | Manager / external-dev box (VM on nh3-pve, Debian 13); **sudo-less** infra-ops identity (user-level only, no Docker); successor to retired nh3-ansible | `servers/nh3-extdev/README.md` | +| nh3-extdev | 10.100.50.42 | NH3 | Manager / external-dev box (VM on nh3-pve, Debian 13); infra-ops is user-level and has no Docker, but **does have NOPASSWD sudo** — measured 2026-09-05, `sudo -n whoami` → `root`; this row previously said "sudo-less", which was wrong; successor to retired nh3-ansible | `servers/nh3-extdev/README.md` | | nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` | | nh3-nas | 10.100.50.50 | NH3 | Synology RS2418+ — NFS exports, rest-server-nh3, PBS-NH3 datastore backend | `servers/nh3-nas/README.md` | | pbs-nh3 | 10.100.50.90 | NH3 | Proxmox Backup Server — DR mirror (VM on nh3-pve, NFS datastore on nh3-nas); syncs from pbs-ana | `servers/pbs-nh3/README.md` | diff --git a/persistent-memory.md b/persistent-memory.md index d76072d..123f85f 100644 --- a/persistent-memory.md +++ b/persistent-memory.md @@ -404,6 +404,45 @@ below is a live commitment or a known-open risk._ install. Bind stays `127.0.0.1` deliberately: widening it is a security decision on a personal laptop whose application firewall is off, and not mine to take. +- **sudo hang FIXED in the fork (`30a1f76`), and two wrong shapes are recorded so + nobody retries them.** The command's stdout now goes to a **fifo drained by a + background `cat`**: non-tty (so sudo skips its own PTY), no subshell (so `cd` + and `export` still persist), and relayed live (so `running` + `ssh_peek` + streaming survives). `cmd | cat` was tried first and **broke cwd persistence** — + every pipeline stage runs in a subshell — caught by the existing test. + `cmd > file` would have been non-tty and subshell-free but invisible until the + command ends. ⚠ **Deliberately NO `wait` on the relay**: a sudo child inherits + the fifo's write end, `cat` never sees EOF, and the wait hangs — measured, with + `sudo -n whoami` printing `root` and then wedging the session. Residual risk + stated in the frame: a command's tail can in principle land after its own + marker. ⚠ **Job control off AND the relay brace-wrapped with stderr discarded** — + both needed, because macOS ships bash 3.2 where `set +m` alone still leaked + `[1] 75449` into the parsed stream. Verified live on macOS and Debian: bare sudo + in ~20 ms, state persists, exit codes correct. **`sudo -u ` still + wants `| cat`** — not chased further. + +- **dsh web on `esh-macbook-air` is now a LaunchAgent** (`com.pfi.dsh-web`, + installed 2026-09-05, `runs=1`, `state=running`, pid 76728 on 0.1.2-rc.1). It + was a foreground process in the operator's terminal that died with the window; + it now survives terminal close and reboot with `KeepAlive` + `RunAtLoad` and a + 10 s `ThrottleInterval` so a startup error cannot hot-loop. Logs to + `~/Library/Logs/dsh-web.log`. ⚠ **The plist names the node interpreter + explicitly** — launchd's minimal PATH has no `~/.local/node/bin`, so the + shebang's `env node` fails. ⚠ **0.1.2-rc.1 requires a TOKEN**: bare + `http://127.0.0.1:3080/` now returns 401 and the tokened URL is printed to the + log on each start, so a bookmark from the old version will not work. Bind stays + 127.0.0.1 deliberately. + +- ⚠ **althing tools on nh3-dev are 3.6.0, but the POST OFFICE CONTAINER IS STILL + 3.0.0** (`gitea.phasefinal.com/claude-bot/althing-post-office:3.0.0`, up 7 days + on nh3-docker). forseti: the new handle verbs (`althing-operator delete` / + `retire`, and `declare` from 3.5.0) live in the post office, so they fail with + "no tool named ..." until the container carries 3.6.0. Schema gains + `handles.retired_at` via the idempotent `_ADDED_COLUMNS` path, so the live store + upgrades itself on first start — no manual migration. **Not rebuilt: it is a + fleet-wide bus restart and wants the operator's nod.** It also blocks the + pending `ledger-dev` → `svos-dev` rename, which needs `declare`. + ## Recent decisions - `[2026-09-05]` **A peer's "2.7x serving-stack effect" was a coin flip — the operator rejected it on instinct and the arithmetic backed him.** Each floor was `|b0-b1|` from n=2; the ratio is half-Cauchy, P=0.452. ⚠ The disconfirming evidence sat in brokkr's own sentence, and he named *why*: the claim was his and flattering. → `persistent-memory.d/2026-09-05-floor-claim-n2-retraction.md`