13 prompts recovered verbatim from the session transcript (they had been spawned inline without being
saved first) + new O (DIY WireGuard design), P (login-layer alternatives), MP-15a density scan,
MP-15 v2 hybrid picker, MP-15 v1 (superseded, never spawned), wireguard/W1_build_prep. README indexes
the new project subfolders. Rule added to playbook_background_agent_prompts: save first, then spawn.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
N1 prompt rewritten to a fully-containerized two-peer NET_ADMIN relay test
(no host install; teardown-to-baseline) with the owner-command relay
(pause-for-sudo/browser) protocol wired in. Design doc §7 gains the v2 +
v2b live-run handoffs: control plane + OIDC verified, relay is
architecturally non-cloudflare (rel://relay:33080), Authelia OIDC solved
via CORS + management UseIDToken; remaining gap = NetBird instance-setup
(name-claim) hang.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- config/prompts: D API/RapidAPI, E KDP, F Etsy — viability + marketing plan
agents (no social media, no cold outreach, opt-in only, 0 cap)
- context.md: 00:10 current-value block; credits corrected to $38.55
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X9iCzmxK2zbb8H1Ld3f8AN
- research/github-aup-lead-pipeline.md: verbatim AUP §7 + ToS §H, why the
lead_pull → Brevo pipeline is the named act, what stays legal
- decisions: 23:55 entry; INDEX row; context.md credit figure corrected to 8.55
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X9iCzmxK2zbb8H1Ld3f8AN
- research/infrastructure-synthesis.md: reload infra corpus, fold in the
local-AI-coding-stack research, reconcile vs prior decisions (no reversals;
LifeOS is the one new open item; most of it is Horizon B)
- record confirmed July->Sept reality: still Pro (Max not upgraded), move done,
server-01 offline, Tailscale/Voice unblocked, Boring Burger partnership reset,
digital businesses start 2026-09-14
- INDEX + context.md updated to point at the synthesis and next-session deferred work
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X9iCzmxK2zbb8H1Ld3f8AN
- Dedicated directory for research on current/future Claude & Claude Code
usage, the decisions that follow, and config/implementation work
- .claude/context.md (auto-injected here), README, research/INDEX.md,
decisions/DECISIONS.md, config/ convention
- Moved local-ai-coding-stack-research.md into research/
- Live homelab config (settings.json, /opt/appdata/docker/.claude hooks+skills)
stays authoritative in place; memory not migrated
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X9iCzmxK2zbb8H1Ld3f8AN
The CURRENT STATE block asserted P3 was code-complete-but-undeployed with the tier-0
breaker hole open in production. Both are now false, and this file is injected verbatim
every session, so a dead claim here re-asserts itself with today's authority.
Records what replaced it: deployed both hosts at 005c214; tier 4 done by refusing (and
why making it autonomous would delete the security model); the tier-1 undo defect as the
real remaining work; the measured Incus asymmetry; the per-host-values-in-a-shared-file
bug class; and the user's decision to resume next week rather than run agents during
business development.
Refs #146, #173, #187, #192.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Agent-Sudo went live on both hosts tonight (005c214 in the boilerplates repo). This
records what "done" actually means and what is left, since dedicated time on this ends
today and the rest has to run via background agents.
Corrects the goal: tier 4 is human-only BY DESIGN (D-CB7) — the daemon unit env holds
SUDO_MD_VERIFY_ENFORCE, so a system that can restart its own daemon can disarm its own
gate. "Handling tier 4" means refusing it, which is done and verified. Real remaining
scope is tiers 1-3.
Records the measured Incus asymmetry (server-01 has it, primary does not), which makes
tier 2 on primary an open design question rather than a task; the tier-1 scoped-undo
defect (app.py:244 hardcodes tier 3 while REQUIRES_UNDO_TIERS is (1,3)); and the
per-host-values-in-a-shared-tracked-file bug class that bit twice in one directory.
secrets-proxy is deliberately scoped as investigate-then-plan: it exited gracefully and
nobody knows why, so S1 answers that before anyone writes S2.
Refs #128, #146, #149, #150, #173, #191, projects id=187.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- agent_sudo_design_decisions.md: D-CB5 (3 tier-3 fails / 15min sliding / per-host),
D-CB6 (append-only breaker log, state always replayed — tamper-EVIDENT beats
tamper-PROOF when the daemon is root), D-CB7 (Set B host_override in code),
D-CB8 (which tier-4 sources latch), D-CB9 (trip escalation). Each with rationale,
rejected alternatives, and accepted costs.
- agent_prompts.md: add the P3-WIRING prompt. Flags a real NAME COLLISION — the
existing "P3" section is the OLD P3 (Vault AppRole + Timeshift + evaluator, done
as #142); P3 was redefined after D-CB1-D-CB9 were locked. Running the old one
would redo finished work. Today's inline agent prompts were never persisted, which
is why this one is.
- context.md: P3 code complete but UNDEPLOYED — the server-01 tier-0 breaker.log hole
is open in production until DEPLOY_RUNBOOK.md runs. Two verified deploy blockers
(Dockerfile never COPYs circuit_breaker.py/security/; compose has no
/var/lib/agent-sudo mount => breaker resettable by docker restart, the exact D-CB6
bypass). Both were invisible to an 85/85-green suite.
- context.md: MEMORY_DIR answered — do NOT repoint embed_memory_dir.py; its
claude_memories table has no reader. Recall corpus now includes design docs;
context.md stays excluded until #192 prunes it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bake-off is closed — Opus 4.8/medium is the standing default, Sonnet arms
cancelled, per-task logging retired. Cost is no longer a model-selection
input: billing is hard-capped, so Opus's real cost is Pro daily-limit hits,
an accepted trade. Max is the fix, not a downgrade.
Also adds the warning that bit twice in one session: task descriptions and
handoffs decay. #149's "delete the stale playbook" hazard was already done
the night before, and session_handoff.md had been asserting a FALSE
passwordless-sudo alarm plus a DEAD root token as live into every session
for 3 days. Check the artifact before doing the work.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
context.md is injected into every session by the session-start hook, so a
stale one silently misinforms every future conversation. This one still
described the project as N8N Agent Builder work while the actual project has
been Agent-Sudo/CA for weeks, and it survived three end-of-session checklist
runs untouched — the checklist referenced context.md in its git step but
never had a step telling anyone to update it. That gap is now closed.
Adds what the project actually is now, what is live (Agent-Sudo enforcing on
both hosts, CA hook v2.1), the production-vs-sandbox Vault tell that already
caused one near-miss, and the next-session order. Marks the June scheduled
work superseded and fences off the 568 lines of append-only history below it.
The pointer stops the file misinforming; it does not stop it costing 49KB
per session. Pruning tracked as a follow-up.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Records why the v2.0 classifier taxed the user 22 prompts and what changed.
Root cause: v2.0 conflated "contains a redirect character" with "writes
something". `2>&1` is file-descriptor plumbing and `>/dev/null` is a discard —
neither writes. That single mistake caused 16 of the 22 prompts. It was found
by reading ca_decisions.jsonl, not by inspection: the bug was the classifier's
reasoning, so re-reading the code only reproduced it.
v2.1 changes (all evidence-driven, none speculative):
- _SAFE_REDIRECT_RE strips fd plumbing + /dev/null discards before the
redirect check; a redirect to any REAL path still disqualifies, anchored so
`>/dev/nullx` cannot ride the prefix.
- `cd` added to READONLY_ALLOW (no filesystem effect; every other segment must
independently qualify anyway).
- `ssh <host> '<cmd>'` classifies the inner command under identical rules,
depth-limited to one hop.
Verified: 42/42 self-test, e2e ALL PASS, classify() median 0.011ms.
Tier-1 writes deliberately NOT shipped — widen on evidence, not guesses.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- constrained_autonomy_design_decisions.md: D1-D8 locked (hybrid hook
classifier + Agent-Sudo daemon executor, structural classification with
unknown->sandbox, fail-closed, Hermes recovery ladder) + EXECUTION ORDER
with CA-P1a inserted as zero-dependency item 0
- agent_prompts.md shared block: replace "TIER-2 IS BROKEN" with the
corrected root cause (old primary bridge's NTFY endpoint was unreachable;
tier-2 works when the bridge reaches ntfy + user is attended)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- P0 build prompt now does Part A (command_audit schema) + Part B
(read-only audit of all P1-P5 assumptions) + Part C (remediate safe
findings = all of P1: Incus install, host inventories, build-sandbox.sh,
both sandbox mirrors)
- Golden Rule: only remediate read-only or server-01-sandbox findings;
tier-2/manual-auth or prod-touching → batched, never blocked
- Ends with a BUILD READINESS wrap-up so the focused build starts at P2
- P1 section retained as canonical contract reference, marked folded-in
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Backtalk6858