From db88f76aeac163403f8c7ce6e5491f769743f254 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Thu, 15 Oct 2026 01:40:02 -0700 Subject: [PATCH] feat(albok): /srv/nemi/vault, a pulled clone of Prime's notes (vh/VuongKB) for Nemi's vault source (gate 1) Prime keeps his notes at /home/lkraven/kb and syncs them with git (gitea vh/VuongKB), so Nemi's read-only copy is a fresh clone, pulled fast-forward-only hourly at :50 by a lkraven user timer, ahead of the ~:01 walk. As a clone it holds only tracked notes (129 md outside dot-dirs). The untracked Muninn output in the working copy (main/, fiction/) stays out. Readable from lkraven's user manager, where Nemi runs. --- configs/nemi-vault/nemi-vault-pull.service | 9 +++++++++ configs/nemi-vault/nemi-vault-pull.timer | 8 ++++++++ persistent-memory.md | 2 +- servers/nh3-dev/README.md | 11 +++++++++++ 4 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 configs/nemi-vault/nemi-vault-pull.service create mode 100644 configs/nemi-vault/nemi-vault-pull.timer diff --git a/configs/nemi-vault/nemi-vault-pull.service b/configs/nemi-vault/nemi-vault-pull.service new file mode 100644 index 0000000..bf1aac6 --- /dev/null +++ b/configs/nemi-vault/nemi-vault-pull.service @@ -0,0 +1,9 @@ +# eshpfi configs/nemi-vault (infra-ops, 2026-10-14): keeps /srv/nemi/vault, the read-only copy of Prime's notes +# (gitea vh/VuongKB, which he syncs with git), current for Nemi's `vault` source (albok unit 4.4 ruling 6). +# A lkraven USER unit: the clone uses lkraven's gitea SSH key. Fast-forward only: the copy is never written to, +# so a non-ff (a force-push upstream) fails loudly here instead of being papered over. +[Unit] +Description=Pull Prime's notes (vh/VuongKB) into /srv/nemi/vault for Nemi +[Service] +Type=oneshot +ExecStart=/usr/bin/git -C /srv/nemi/vault pull --ff-only --quiet diff --git a/configs/nemi-vault/nemi-vault-pull.timer b/configs/nemi-vault/nemi-vault-pull.timer new file mode 100644 index 0000000..383ac77 --- /dev/null +++ b/configs/nemi-vault/nemi-vault-pull.timer @@ -0,0 +1,8 @@ +# Hourly at :50, ahead of albok-nemi.timer's walk at ~:01. +[Unit] +Description=Hourly pull of Prime's notes for Nemi +[Timer] +OnCalendar=*-*-* *:50:00 +Persistent=true +[Install] +WantedBy=timers.target diff --git a/persistent-memory.md b/persistent-memory.md index 5d5d164..84ed87e 100644 --- a/persistent-memory.md +++ b/persistent-memory.md @@ -123,7 +123,7 @@ _As of 2026-10-14 ~0005 PT. The newest subsection is first; older subsections ca - **Nothing is mid-action.** No ops-log claims held. eshpfi `main` is pushed through `d1192ca` (infra-ops has STANDING push on main since 2026-10-13, CLAUDE.md § Working rules); this snapshot's commit follows and is pushed. ⚠ The working tree and index are shared with infra-hermes, albok-dev and subagents: commit with `git commit -- ` and read `git log origin/main..main` before pushing. `graphify-out/GRAPH_REPORT.md` stays modified on purpose. - **SVOS: main `33a7077` (v0.0.13+2: kernel 0.0.13, interface 0.0.5 with briefs, postoffice 0.0.3, UI 0.0.18) since 2026-10-14 1108–1111; config_gen `33f001f4e2dbc7dc`, apps up 7.** ⚠ Lesson (paid 10-14): a manifest revision whose verbs change is HELD for the owner, and the app reads DOWN (`refused wrong-revision`) until Prime approves its card (15-min expiry). Roll such apps only while he is at the board, and the post-office bridge last (held, it carries no Miranda mail). The interface unit needs the drop-in `svos-interface.service.d/20-artifact-host.conf` (`SVOS_ARTIFACT_HOST=nh3-svos`), and the briefs mapping host must equal it. Before that, kernel 0.0.12 (`d95078c`, 0416) on top of v0.0.11 (452a592, U15 task seats slice 1). The `hermes` runtime is the only task-capable one (one-off `hermes -z`, `process = "python3"`, no `--yolo`: Prime's call); its old argv is in `instance.toml.pre-hermes-task`. Earlier: v0.0.11 is live on nh3-svos (schema 13, config_gen `5ade279d2fb2dd1c`, apps up 7) and nh3-dev (`/opt/svos/current → releases/452a592`; svos-terminal 0.0.4 runs from it). svos-dev accepted it. The task command is ruled with svos (Prime, 2026-10-14): infra-ops edits runtimes only at svos-dev's ask. `GET /tasks` as Prime is his acceptance check. Static-only interface releases since: UI 0.0.14 `89dad7a`, 0.0.15 `7f95e54` (the web build carried into 452a592). ⚠ Process→release map: nh3-svos kernel + local apps run `33a7077`; on nh3-dev svos-postoffice runs `33a7077`, svos-terminal `452a592`; svos-miranda runs `adc862e`, svos-agent still runs `dc241f8` (check `/proc//maps` before deleting any release dir). Rollback material: nh3-svos `/var/lib/svos/backup/pre-452a592/` (schema-12 DB + config tar), `instance.toml.pre-452a592`, `instance.toml.pre-a171`; nh3-dev `terminal.toml.pre-452a592`. U13 history and the static-release chain: → `persistent-memory.d/2026-10-11-u13-cutover-executed.md`. Phase R (24 h soak, High Seat removal) is highseat-dev's. After the soak: nh3-svos releases `6c6abbe`, `a737a06`, `b588510`, `afab123`, `adc862e` and nh3-dev `/opt/svos/releases/afab123` can go once no process maps them. - **Decision seat = h2o-lightning-4b (production, Prime 1805 10-13: fix forward, no INC fallback).** The one open margin is the judge's personal-question reading (h2o 18 vs INC 6 on fleet/memory); albok-dev re-fits it forward in small batches on the live seat. -- **albok note intake (Prime 1530 10-13):** gate 2 DONE (wing `personal/inbox`, `/srv/nemi/inbox` on nh3-dev, nemi token `01M4VX207PJ09ZSECASCSZPCFE`). Gate 1 (ruling 6: Prime's Obsidian vault synced onto nh3-dev) is APPROVED by Prime (~2120 10-13: "you may copy the notes") but BLOCKED on where the vault lives: nothing under nh3-dev or esh-nas's shares; asked Prime. Plan: Syncthing receive-only onto nh3-dev, root path to albok-dev (thread `01M4VWV5FEF64EP71W60N6Q1N0`). +- **albok note intake (Prime 1530 10-13):** gate 2 DONE (wing `personal/inbox`, `/srv/nemi/inbox` on nh3-dev, nemi token `01M4VX207PJ09ZSECASCSZPCFE`). Gate 1 (ruling 6) DONE 2026-10-15 0140: Prime's notes are `/home/lkraven/kb` = gitea `vh/VuongKB` (he syncs them with git, not Syncthing), so Nemi's copy is a fresh clone at `/srv/nemi/vault`, pulled hourly at :50 by the lkraven user timer `nemi-vault-pull` (`configs/nemi-vault/`). It holds 129 md outside dot-dirs; the untracked Muninn output (`main/`, `fiction/`) is not in it. Root sent to albok-dev for the vault source + dry run (thread `01M4VWV5FEF64EP71W60N6Q1N0`). Prime says the kb needs cleaning up (its last commit is 2026-04-16). - **Worldtree:** demo was deploying `beba08a4` (albok 4.7 the rest; Worldtree is a pure albok-service HTTP customer) at 2120 10-13. Ours: strip the retired config blocks (providers `library:` + `graph_store:`, defaults `kb_audit:`; NOT defaults `library:`) from each instance config ONLY after that instance runs beba08a4+, demo first (vh/worldtree-instance-configs, deploy-wt-config; thread `01M4WA58P2M001K1420NN72WFM`). Daily memory gate: 10-13 re-run `20261013T160414Z` PASS; worldtree-dev owns the tagger-latch fix. muninn-gate + mimir-inbox are STOPPED (their data at rest kept for albok unit 6). - **satellite-1:** its own key is authorized for infra-ops on esh-nas only (`playbooks/files/infra-ops-satellite-keys`). Waiting on Prime's login test from the satellite and its machine name (the key's comment came through as bare `infra-ops@`). - **fv-ml1: hard hang 10-11 ~0005, self-reset, no record** (pstore/ERST registered and empty, so not a kernel panic). Evidence capture staged: kernel console on ttyS1 from its next boot + nh3-dev user unit `fv-ml1-sol-logger` (`journalctl --user -u fv-ml1-sol-logger`). ⚠ **HOLD** `zroot/ROOT/debian@pre-patch-20261008` (do not destroy) until the cause is known or a clean week passes after the last crash. diff --git a/servers/nh3-dev/README.md b/servers/nh3-dev/README.md index 054f720..a7796de 100644 --- a/servers/nh3-dev/README.md +++ b/servers/nh3-dev/README.md @@ -239,3 +239,14 @@ carries `u:lkraven:rx`. ⚠ lkraven's systemd user manager started before `nemi-drop` existed, so Nemi gets in through those ACL entries for lkraven, NOT through the group. Do not "simplify" them away until lkraven's user manager has restarted. `playbooks/nh3-dev-nemi-inbox.yaml` verifies both paths. + +## `/srv/nemi/vault`: Prime's notes for Nemi (2026-10-15) + +A fresh clone of gitea `vh/VuongKB` (Prime's notes, which he syncs with git; his working copy is `/home/lkraven/kb`, never +touched by this). Nemi's `vault` source walks it into albok's `personal/notes` (unit 4.4 ruling 6). It is read-only by +convention: nothing writes into it but the pull. The lkraven user timer `nemi-vault-pull` (`configs/nemi-vault/`) +runs `git pull --ff-only` hourly at :50, ahead of Nemi's walk at ~:01. A force-push upstream fails the pull loudly +(`systemctl --user status nemi-vault-pull`) and the copy stays as it was. Re-clone it on purpose if that happens. +Because it is a CLONE, it holds only tracked files. The untracked `main/` (Muninn job dirs) and `fiction/` (Muninn +fiction concepts, 2,389 files) in Prime's working copy are deliberately not in it. +