# Session Log — 2026-06-02 — Howard laptop: git auth, identity, sync, memory-dream, vault cleanup

## User
- **User:** Howard Enos (howard)
- **Machine:** ACG-TECH03L
- **Role:** tech

## Session Summary

First ClaudeTools session on Howard's laptop (ACG-TECH03L). The machine had no `.claude/identity.json` (gitignored, never recreated on this clone), so `sync.sh` ran as "unknown" and could not reconcile git config. An initial `/sync` pulled and rebased 4 incoming commits cleanly but then failed at the push step and at the `gururmm` submodule clone with `remote: Failed to authenticate user`. Howard separately asked why he kept being prompted for his git password — same root cause.

Diagnosis: Git Credential Manager (`credential.helper = manager`) was configured, but Windows Credential Manager held zero entries for `git.azcomputerguru.com`. Every git operation prompted, the entered credential was rejected by Gitea (password rotated 2026-04-21; account now needs a token), so GCM never got a successful auth to cache — producing an infinite re-prompt loop. Howard provided a working Gitea token, which was primed into GCM via `git credential approve`. The pending auto-sync commit then pushed with no prompt, and the `gururmm` submodule cloned successfully (checked out `faf6b27`).

Rebuilt `identity.json` for this machine (howard / ACG-TECH03L, vault at `D:/vault`, root `C:/claudetools`) and ran `migrate-identity.sh` to populate python/ollama/platform/coord_api fields. A confirmation coord message was sent to Mike (GURU-5070) covering the identity migration + verification check-in and the auth fix. The two satisfied broadcasts (migrate-identity, alert-routing) were marked read.

A second `/sync` then auto-corrected this repo's local git config — it had been set to Howard's personal account (`Howweird` / `howardenos@gmail.com`) — back to `Howard Enos` / `howard@azcomputerguru.com` to match `identity.json`. The vault repo pulled 52 commits and pushed 1; that single pushed commit turned out to be a stray local backup file that a prior auto-sync had swept in.

Ran `/mem-dream` (memory-dream, report-only). It loaded 127 memory files and found 49 orphan files (no index line), 13 broken backlinks, 24 stale referenced paths (mostly legitimate server-side), and 13 proposed merge clusters. Key finding: Mike's consolidation commit `0c00010` ("104 -> 71") is present in the tree and added the new merged files, but the original granular files were never retired — old and new coexist (127 files, not 71), which is why so many files are now orphaned from the index. Per Howard's decision, left the store untouched and pinged Mike to finish the retirements in his consolidation automation rather than re-indexing files he intends to delete. Finally, removed the stray vault `.bak` from the shared repo (kept locally) and added a gitignore rule.

## Key Decisions

- **Primed GCM with a token rather than switching credential helpers.** GCM was already the configured helper and works fine once it has a valid credential to cache; the problem was never the helper, only that no successful auth had ever been stored. Storing via `git credential approve` keeps the secret in Windows DPAPI, not a plaintext file.
- **Rebuilt `identity.json` instead of treating ACG-TECH03L as a brand-new machine.** ACG-TECH03L is already in howard's `known_machines` and git was attributed to Howard — the machine was known, it had only lost its gitignored local identity file. So recreated rather than running full onboarding.
- **Namespaced the session log** (`2026-06-02-howard-laptop-git-auth-and-sync.md`) rather than appending to the existing `2026-06-02-session.md`, which is unrelated Outlook-contacts work from Howard's Howard-Home machine.
- **Did NOT run `memory-dream --apply-safe`.** Appending 49 orphan index lines would re-index files Mike is mid-way through retiring as part of consolidation `0c00010`. Memory consolidation is Mike's automation domain, so handed the duplicate-file cleanup back to him.
- **Untracked the vault `.bak` with `git rm --cached` (kept local) + gitignore.** The file is Howard's local backup; destroying it was unnecessary. A gitignore rule (`*.bak`, `*.LOCAL_BACKUP.*`) prevents `sync.sh`'s `git add -A` from re-committing it.

## Problems Encountered

- **Repeated git password prompts / push + submodule auth failures.** Root cause: no cached Gitea credential and the entered password was being rejected (rotated/needs token), so GCM never cached a success. Resolved by priming GCM with a valid token via `git credential approve`; push and submodule clone then succeeded with no prompt.
- **`sync.sh` reported "identity.json present but unreadable" while the file did not exist.** The file was genuinely absent (`ls`/`cat` confirmed). Recreated it; the warning cleared on the next sync.
- **Local git config drifted to Howard's personal gmail account** (`Howweird` / `howardenos@gmail.com`). The second `sync.sh` reconciled it to `identity.json` automatically once the file existed.
- **Coord message POST returned HTTP 400 / silent `id: None` via curl.** Shell escaping of the multi-line JSON body was malformed. Resolved by posting through a Python `urllib` here-doc (HTTP 201).
- **memory-dream showed 127 files vs the broadcast's claimed 71.** Verified `0c00010` is an ancestor of HEAD and the merged files exist alongside the originals — the consolidation never deleted the source files. Reported to Mike rather than acting.

## Configuration Changes

- Created `C:/claudetools/.claude/identity.json` (gitignored, machine-local) — howard / ACG-TECH03L / vault `D:/vault` / root `C:/claudetools`; then `migrate-identity.sh` added `python.command=py`, `ollama.endpoint=http://100.101.122.4:11434`, `ollama.prose_model=qwen3:14b`, `platform=windows`, `architecture=amd64`, `coord_api=http://172.16.3.30:8001`.
- Reconciled local git config: `user.name=Howard Enos`, `user.email=howard@azcomputerguru.com` (was `Howweird` / `howardenos@gmail.com`).
- Stored Gitea credential for `git.azcomputerguru.com` (user `howard`) in Windows Credential Manager via GCM.
- `D:/vault/.gitignore` — added `*.bak` and `*.LOCAL_BACKUP.*` under a new "Local-only backups" section.
- Deleted from vault repo (kept on disk): `clients/cascades-tucson/pfsense-firewall.LOCAL_BACKUP.sops.yaml.bak`.
- Report written: `.claude/memory/_reports/2026-06-02-1147-dream.md`.

## Credentials & Secrets

- Gitea HTTPS access for `git.azcomputerguru.com` is via account `howard` using a personal access token (rotated 2026-04-21; account password no longer accepted for git-over-HTTPS). The token is now cached in this laptop's Windows Credential Manager (DPAPI). Howard's Gitea credential of record lives in his 1Password, not the SOPS vault.

## Infrastructure & Servers

- Coord API: `http://172.16.3.30:8001/api/coord` (no auth).
- Ollama (this machine): remote Beast via Tailscale at `http://100.101.122.4:11434`, prose model `qwen3:14b`.
- Gitea: `git.azcomputerguru.com` (office Cox IP NAT'd via NPM; not behind Cloudflare).
- Vault repo: `D:/vault` on this machine.

## Commands & Outputs

- Prime credential: `printf "protocol=https\nhost=git.azcomputerguru.com\nusername=howard\npassword=<token>\n\n" | git credential approve`
- Verify: `printf "protocol=https\nhost=git.azcomputerguru.com\nusername=howard\n\n" | git credential fill` → returned the stored password.
- `GIT_TERMINAL_PROMPT=0 git push origin main` → `9b82bce..0f6c05a main -> main` (no prompt — confirms cache works).
- `git submodule update --init projects/msp-tools/guru-rmm` → checked out `faf6b27` (heads/main).
- `git merge-base --is-ancestor 0c00010 HEAD` → present in HEAD.
- Coord POST that worked: Python `urllib` here-doc → HTTP 201.

## Pending / Incomplete Tasks

- **Memory store duplicates (Mike's domain):** consolidation `0c00010` left old + new files coexisting (127 vs 71). Mike (GURU-5070) was messaged to finish retiring the originals. 49 orphan index lines and 13 merge clusters remain unresolved by design.
- **Billing (parked at Howard's request):** three uninvoiced Syncro tickets totaling $5,239.99 — #109035475 (Cascades, $127.49, resolved), #109836123 (Dataforth, $87.50, resolved), #109412123 (Cascades Entra setup, $5,025.00, in progress since May 1). Most context is on Howard's desktop; revisit later.
- **Cascades wiki review** (`wiki/clients/cascades-tucson.md`) still awaiting Howard's onsite-context pass (coord message from DESKTOP-0O8A1RL, 05-24).
- 13 broken backlinks and 1 stale dated fact (`radio_show_no_cohost_named_tom.md`, 2012) noted in the dream report for later cleanup.

## Reference Information

- Coord messages sent: `9573ca5c` (identity migration + verification confirm), `b07a0aad` (memory-dream duplicate-files report) — both to `GURU-5070/claude-main`.
- Coord messages marked read: `1d93052f` (migrate-identity broadcast), `bafae411` (alert-routing).
- Commits: ClaudeTools auto-sync `0f6c05a` (pushed `9b82bce..0f6c05a`); vault `27c0986` (pushed `5e3e031..27c0986`).
- gururmm submodule pin: `faf6b274562da8f2de98c38980b3e21fcaf29c7c`.
- Memory dream report: `.claude/memory/_reports/2026-06-02-1147-dream.md`.
