# Session - UniFi cloud Site Manager connector (UOS parity), AI-tooling audits + reliability, skill harvest

## User
- **User:** Mike Swanson (mike)
- **Machine:** GURU-5070
- **Role:** admin

## Session Summary

Continuation of the 2026-06-16/17 MSP+harness day. Opened by finishing the Scileppi Mac
downloads redesign and resolving Syncro #32333 (corrected after a hallucinated/no-preview comment;
re-sent accurately, no charge). Then an error-log review drove two harness fixes: a PowerShell-2
guard in `onboarding-diagnostic.ps1` (it was PS3+ only, crashed on Win7/AMT-PC) and a new
`feedback_windows_quote_stripping` memory consolidating the recurring embedded-double-quote bug.

A large block was an RTFM audit of the second-model / Tier-0 skills against their real docs/APIs:
**grok** had a genuine bug (its multi-agent `web_search` was strangled by the wrapper's blanket
`--no-subagents`) - fixed, plus pinned `-m grok-build` for reasoning modes and corrected doc drift;
**gemini (agy)** audited clean (pinned model still valid); **ollama** had a broken endpoint
auto-detect one-liner in OLLAMA.md (urlopen-as-truthiness raises instead of failing over) - fixed.
Harvested 4 MIT skills from obra/superpowers (the Anthropic pdf/mcp-builder/canvas-design/
theme-factory skills are license-restricted - installed those via the official Claude Code
marketplace instead). Curated the ACG brand kit into the website-showcase project and synced to Gitea.

The centerpiece: a UniFi cloud capability. Mike provided a UniFi Site Manager API key. Mapped the
API empirically + via grok/gemini: `api.ui.com/v1/hosts|sites|devices|isp-metrics` gives fleet
inventory + WAN/ISP telemetry, and - the breakthrough - the **cloud CONNECTOR**
(`/v1/connector/consoles/{id}/proxy/network/...`) reaches each console's LOCAL Network API
remotely with the same account key, including the internal `/stat/device|sta` endpoints. That is
**full UOS parity** (per-radio cu_total airtime, per-client RSSI) for ALL 36 ACG consoles, no UOS
server / no LAN/VPN. Built `gw-sitemanager.sh` (fleet/devices/sites/isp/net) and wired the existing
`model-rank`/`optimize-radios` analyses to the connector via `--console` (new `rf-analyze.py`).
Validated against Cascades through the connector - matched the UOS-Mongo figures exactly (75 APs,
2.4GHz util 65-90%/interf 53-78%, all power-down) after fixing a macs[] gotcha (the report endpoint
returns only ~10 of 77 APs unless you POST the MAC list).

Made `neighbor-collect.sh` connector-capable (name map from the cloud) so disable-analysis works on
remote sites. Researched gateway VPN/Teleport: the connector reaches VPN-server config and Teleport
settings; web search found the Teleport invite-link API (`POST /cmd/teleport`). Finally, on Mike's
must-fix directive, properly fixed the web-search bots (diagnosed from raw output): gemini gets
3-retry+backoff for its intermittent empty turns; grok xsearch (which chronically times out on
multi-part queries) now uses streaming-json and auto-falls-back to gemini search.

## Key Decisions

- **Connector internal stat API = the parity path.** The Site Manager API alone is inventory-only;
  the connector proxy to `/proxy/network/api/s/<site>/stat/*` returns the same `ace_stat` depth as
  UOS Mongo. Used that for the `net` command and rf-analyze, giving fleet-wide parity beyond UOS.
- **Left the UOS-Mongo path 100% untouched;** the connector path is purely additive (`--console`
  flag) - "don't lose functionality."
- **Gemini is the reliable web-search engine; grok xsearch is best-effort with gemini fallback.**
  Diagnosed grok's failure as a real multi-agent timeout (xAI-side), so a fallback - not more budget -
  is the right fix.
- **Anthropic skills are NOT vendored** (their LICENSE.txt forbids copying/derivatives/redistribution);
  installed via the official marketplace per-machine instead. Only MIT (obra) skills were committed.
- **Web search >= blind endpoint-probing** (Mike's correction): probing guesses URLs and mostly 404s;
  the searches gave the real leads. Probe only to CONFIRM a search/doc hypothesis; reading our own
  config is fine.

## Problems Encountered

- **#32333 hallucinated comment sent without preview** - logged correction+friction; rewrote
  accurately, previewed, re-sent.
- **grok xsearch returned empty** - root-caused (RTFM): `web_search` = multi-agent model, killed by
  `--no-subagents`. Later found it ALSO times out on heavy queries -> streaming-json + gemini fallback.
- **Cascades connector run showed 10 of 77 APs** - the `/stat/report/*.ap` endpoint defaults to a
  small subset; fixed by POSTing `macs:[<all uap macs>]` (now 75, matching UOS).
- **Teleport "no API" was wrong** - I'd probed wrong paths; the real surface is `/rest/setting/teleport`
  (config) and `POST /cmd/teleport {"cmd":"invite-link"}` (invites), found via gemini + live verify.
- **Repeated empty captures** from mixing backgrounded ask-grok/gemini (`&`+`wait`) with foreground
  work in one Bash call - logged as friction; run AI calls as separate run_in_background tool calls.
- **errorlog rebase conflict** with Howard's auto-sync - resolved by keeping both entries.

## Configuration Changes

New/changed (committed + pushed):
- `.claude/skills/unifi-wifi/scripts/gw-sitemanager.sh` - NEW cloud backend (fleet/host/devices/sites/isp/net/find/raw).
- `.claude/skills/unifi-wifi/scripts/rf-analyze.py` - NEW connector-fed analyzer (rank/optimize).
- `.claude/skills/unifi-wifi/scripts/model-rank.sh`, `optimize-radios.sh` - added `--console [--site]` route.
- `.claude/skills/unifi-wifi/scripts/neighbor-collect.sh` - added `--console [--site]` (connector name map).
- `.claude/skills/unifi-wifi/references/site-manager-api.md` - NEW full catalog (3 tiers + connector + VPN/Teleport).
- `.claude/skills/unifi-wifi/SKILL.md` - Plane 3 (cloud) note.
- `.claude/skills/grok/scripts/ask-grok.sh` - xsearch subagents/yolo fix, grok-build pin, streaming-json + gemini fallback.
- `.claude/skills/grok/SKILL.md` - model/xsearch/fallback notes.
- `.claude/skills/agy/scripts/ask-gemini.sh` - emit_or_fail 3-retry+backoff; version bump.
- `.claude/skills/agy/SKILL.md` - version/verified-date.
- `.claude/OLLAMA.md` - fixed the broken endpoint auto-detect one-liner.
- `.claude/scripts/onboarding-diagnostic.ps1` - PS2 version guard.
- `.claude/skills/{brainstorming,root-cause-tracing,test-driven-development,using-git-worktrees}/` - harvested (MIT).
- `projects/acg-website-showcase/brand-kit/` - curated ACG brand assets (14M).
- Memories: `feedback_windows_quote_stripping`, `feedback_interview_ai_read_docs`,
  `feedback_web_search_over_probing`, `reference_unifi_site_manager_api`.
- `docs/CT_THOUGHTS.md` - Thought 2 (web-search reliability, Fixed).

## Credentials & Secrets

Vaulted this session (via vault-helper, encrypted + pushed to the vault repo):
- `services/unifi-site-manager` - UniFi Site Manager / Cloud API key (account owner mike@azcomputerguru.com).
  Auth header `X-API-KEY`. Grants remote read of all ~36 ACG consoles + the connector deep path.
- `clients/brooklyn-skybar/udm-ssh` - Brooklyn/Skybar UDM root SSH password (root / vav0neb6vnf7FER-gev),
  WAN 67.1.139.219. NOTE: WAN SSH/HTTPS (22/443/8443) is firewalled - reach via the connector, not direct.

## Infrastructure & Servers

- UniFi Site Manager API: base `https://api.ui.com`; connector proxy
  `https://api.ui.com/v1/connector/consoles/{hostId}/proxy/network/...`.
- Brooklyn/Skybar console id `E43883325A01...77EA56D0000000063AA61F7:2109856759`, WAN 67.1.139.219,
  UDM Pro, 31 devices, OpenVPN server enabled (67.1.115.174:1194), WireGuard server (disabled), Teleport enabled.
- "UOS Server" host id `2d6b654d-9b79-4eaa-b2e1-52062a5690ef` (ext 98.181.90.163), 47 sites; Cascades = site `va6iba3v`.
- Ollama (GURU-5070) localhost:11434 v0.30.8; models qwen3:8b/qwen3.6:latest/qwen3:14b/codestral:22b/nomic-embed-text.

## Commands & Outputs

- Cloud fleet: `bash .claude/skills/unifi-wifi/scripts/gw-sitemanager.sh fleet` (36 consoles).
- Deep parity: `... net "Brooklyn/Skybar" radios|clients`; via UOS Server: `... net "UOS Server" --site va6iba3v ...`.
- Analysis on non-UOS: `model-rank.sh --console "<name>" [--site <s>] [days] [band]` / `optimize-radios.sh --console ...`.
- Cascades validated: `model-rank.sh --console "UOS Server" --site va6iba3v 7 ng` -> 75 APs, matched UOS.
- search-bot e2e: grok xsearch timed out (rc=124) -> `[grok xsearch timed out -> answered via gemini search]` -> real answer.

## Pending / Incomplete Tasks

- **On-demand VPN/tunnel for SSH access** (the open thread to continue): a host running Claude (or a
  Linux jump host) brings up the gateway's OpenVPN/WireGuard server config on demand for AP-VLAN reach.
  Solid: OpenVPN server config is readable via connector (`networkconf` x_ca_crt/x_shared_client_crt/
  x_shared_client_key/x_auth_key + WAN + RADIUS `/rest/account`). Open (settle via web search now that
  it works): cleanest per-client `.ovpn`/`.conf` retrieval/download endpoint; WireGuard peer-create flow.
- **Gated `vpn` command** for gw-sitemanager.sh (read VPN/WAN/Teleport; create/modify + Teleport
  invite-gen behind DRY-RUN+confirm) - offered, not built.
- Teleport invite gen (`POST /cmd/teleport {"cmd":"invite-link"}`) - found but NOT fired (write).
- Two observations from the ollama audit: GURU-5070 missing from the OLLAMA.md machine table;
  syncro/feature-request hardcode qwen3:14b/3.6 instead of identity.json prose_model.
- AMT-PC Bitdefender push (Mike, via Syncro).

## Reference Information

- Commits (origin/main this session, newest first): `9b553179` errorlog, `972bade0` search-bot fix,
  earlier: `7e435e31` neighbor-collect connector + VPN/Teleport doc, `47b31dcd` Cascades validation,
  `f987812f` rf-analyze, `6fdc21d9` cloud backend, plus grok/gemini/ollama/skill-harvest/brand-kit commits.
- Catalog: `.claude/skills/unifi-wifi/references/site-manager-api.md`.
- Syncro #32333 (Scileppi) internal id 111242786 - Resolved, no charge.
- Marketplace install for Anthropic skills: `/plugin marketplace add anthropics/skills` then
  `/plugin install document-skills@anthropic-agent-skills` + `example-skills@anthropic-agent-skills`.
