sync: auto-sync from DESKTOP-0O8A1RL at 2026-05-20 15:22:14

Author: Mike Swanson Machine: DESKTOP-0O8A1RL Timestamp: 2026-05-20 15:22:14
2026-05-20 15:22:17 -07:00
parent 4c94254477
commit 3d2bcfad55
2 changed files with 294 additions and 0 deletions
--- a/clients/cascades-tucson/session-logs/2026-05-20-session.md
+++ b/clients/cascades-tucson/session-logs/2026-05-20-session.md
@@ -0,0 +1,84 @@
+## User
+- **User:** Mike Swanson (mike)
+- **Machine:** DESKTOP-0O8A1RL
+- **Role:** admin
+- **Session:** 2026-05-20 ~14:40 PT
+
+## Session Summary
+
+Investigated and resolved a website contact form email delivery failure for Cascades of Tucson. The client reported that no contact form submissions had been reaching staff since approximately 4/19/2026 -- coinciding with the M365 mail migration. Investigation confirmed the root cause was an SPF misconfiguration: the cascadestucson.com website is hosted on GoDaddy, and GoDaddy's PHP mail relay (spf-0.secureserver.net IPs) was not authorized in the domain SPF record. With DMARC set to p=quarantine/pct=100, every form submission was being silently quarantined as phishing before reaching staff mailboxes.
+
+The fix was applied directly to the cascadestucson.com DNS zone on the ACG IX nameservers (ns1/ns2.azcomputerguru.com). The SPF record was updated to add GoDaddy's relay include. Additionally, the Cascades M365 tenant was onboarded to the ComputerGuru Security Investigator app suite (previously on old deprecated app only), which enabled quarantine API access. 32 quarantined contact form emails spanning May 5-20 were released to crystal.rodriguez and megan.hiatt. A permanent Exchange transport rule was created to bypass spam/phish filtering for wordpress@cascadestucson.com as a backstop.
+
+A Syncro ticket was created (#32304), billed at 1hr remote labor against the Cascades prepaid block (38.5 hrs available, 37.5 remaining), invoiced, and marked Invoiced. During billing, discovered the Syncro skill rate table has Labor - Remote Business at $150/hr but the correct standard rate is $175/hr. Cascades block rate is distinct from the standard rate -- $175 confirmed as the non-block rate, actual Cascades block rate still TBD.
+
+## Key Decisions
+
+- **cpapi2 for DNS update**: IX nameservers run WHM/cPanel. Used cpapi2 ZoneEdit edit_zone_record API (line 19 in zone) to update the SPF TXT record -- handles serial number bump and BIND reload automatically.
+- **GoDaddy relay include**: Added include:spf-0.secureserver.net (not include:secureserver.net -- the spf-0 subdomain is what GoDaddy's own SPF record references). Confirmed by checking TXT record on secureserver.net directly.
+- **Transport rule as permanent backstop**: SPF fix is correct but external relay scenarios (GoDaddy infrastructure changes, plugin SMTP overrides) could re-break delivery. SetSCL=-1 rule provides a permanent bypass layer.
+- **Security Investigator onboarding**: Done programmatically via onboard-tenant.sh after Cascades admin consented the app. Script assigned Exchange Administrator role to the SP automatically.
+
+## Problems Encountered
+
+- **investigator-exo token had [INFO] prefix in file**: get-token.sh outputs "[INFO] auth=cert" to stdout before the token. Token cached to file included the prefix, causing 400 Bad Request on EXO API calls. Fix: pipe through `grep -v '^\['` to strip info lines.
+- **Get-QuarantineMessage SenderAddress must be array**: Passing as string caused ParameterTransformationException. Fix: wrapped in JSON array.
+- **Release-QuarantineMessage Identity rejects array**: Unlike Get-, Release- requires one Identity at a time (QuarantineMessageIdentity type). Fix: looped 32 individual API calls.
+- **Identity backslashes in JSON**: Quarantine GUIDs contain backslashes (e.g. guid1\guid2). Bash heredoc passed them unescaped. Fix: used `jq -n --arg id` to construct payload with correct escaping.
+- **$0 invoice misread**: Invoice posted at $0.00. Confirmed correct -- Cascades has prepaid block, Syncro deducted 1hr by quantity, annotated line "Applied 1.0 Prepay Hours".
+- **Labor Remote Business rate wrong in skill**: Skill table shows $150/hr for product 1190473. Correct standard rate is $175/hr. Initial billing used $150, corrected via update_line_item. Cascades block rate still TBD.
+
+## Configuration Changes
+
+- **Modified:** cascadestucson.com DNS zone on IX (line 19, TXT SPF) -- added include:spf-0.secureserver.net. New serial: 2026052000.
+- **Created:** M365 Exchange transport rule "Allow WordPress contact form - cascadestucson.com" (SetSCL=-1, Enabled) in Cascades tenant.
+- **Onboarded:** Cascades tenant to Security Investigator + Exchange Operator + User Manager + Defender apps via onboard-tenant.sh. All directory roles assigned.
+- **Created:** Syncro ticket #32304 -- Initial Issue + Resolution comments, 1hr timer entry (product 1190473), line item id 42525181 @ $175, invoice #67632. Status: Invoiced.
+
+## Credentials & Secrets
+
+- **Cascades M365 tenant ID:** 207fa277-e9d8-4eb7-ada1-1064d2221498
+- **IX root SSH password:** t4qygLl7{1zJcUj#022W^FBQ>}qYp-Od -- vault: infrastructure/ix-server.sops.yaml credentials.password
+
+## Infrastructure & Servers
+
+- **IX server:** 172.16.3.10 (internal) / 72.194.62.5 (external / ns1.azcomputerguru.com)
+- **cascadestucson.com DNS:** WHM/cPanel on IX. Zone: /var/named/cascadestucson.com.db
+- **cascadestucson.com web hosting:** GoDaddy (A: 198.12.239.76). PHP mail through GoDaddy relay (spf-0.secureserver.net).
+- **Cascades M365:** MX = cascadestucson-com.mail.protection.outlook.com. DMARC p=quarantine/pct=100.
+- **Security Investigator SP (Cascades tenant):** c64ee5c1-a607-46cb-81b8-42de3de98d48
+- **Exchange Operator SP (Cascades tenant):** 1c3bcfe9-6b4b-4273-852c-09d90f9ad146
+
+## Commands & Outputs
+
+```bash
+# SPF record update on IX via cpapi2
+/usr/local/cpanel/bin/cpapi2 --user=cascades ZoneEdit edit_zone_record \
+  domain=cascadestucson.com Line=19 type=TXT name=cascadestucson.com. ttl=300 \
+  txtdata='v=spf1 +a +mx +ip4:72.194.62.5 +include:spf.protection.outlook.com +include:spf-0.secureserver.net -all'
+# newserial=2026052000, status=1
+
+# Tenant onboarding
+bash D:/claudetools/.claude/skills/remediation-tool/scripts/onboard-tenant.sh cascadestucson.com
+# All 5 apps consented, all directory roles assigned [OK]
+
+# Quarantine: 32 messages found from wordpress@cascadestucson.com (May 5-20)
+# All QuarantineTypes: Phish, Released: false
+# Released all 32 via loop -- Released: 32 / Failed: 0
+
+# Transport rule created
+# Name: Allow WordPress contact form - cascadestucson.com, State: Enabled, SetSCL=-1
+```
+
+## Pending / Incomplete Tasks
+
+- **Cascades block rate:** $175/hr is the standard non-block rate. Actual Cascades prepaid block rate not yet confirmed. Required before next billing.
+- **Syncro skill rate table:** Labor - Remote Business (product 1190473) shows $150/hr in .claude/commands/syncro.md -- needs correction to $175/hr (standard) and block-rate note added.
+
+## Reference Information
+
+- Syncro ticket #32304: https://computerguru.syncromsp.com/tickets/110680368
+- Syncro invoice #67632
+- Cascades M365 quarantine portal: https://security.microsoft.com/quarantine
+- Cascades Entra admin: https://entra.microsoft.com/#@cascadestucson.com
+- Live SPF: v=spf1 a mx ip4:72.194.62.5 include:spf.protection.outlook.com include:spf-0.secureserver.net -all
--- a/session-logs/2026-05-20-session.md
+++ b/session-logs/2026-05-20-session.md
@@ -645,3 +645,213 @@ py D:/claudetools/.claude/tmp/flarum_search_insert.py
 - Forum post #2 (WordPress search): https://community.azcomputerguru.com/d/9-wordpress-discourage-search-engines-setting-how-7-production-sites-lost-their-indexing
 - Flarum s9e XML format reference: `.claude/commands/forum-post.md` (Markdown → s9e XML Converter section)
 - forum-post skill: `.claude/commands/forum-post.md`
+
+---
+
+## Update: 14:34 PT -- Flarum forum posts + WordPress search audit + /forum-post skill
+
+### User
+- **User:** Mike Swanson (mike)
+- **Machine:** DESKTOP-0O8A1RL
+- **Role:** admin
+
+### Session Summary
+
+Posted two technical articles to community.azcomputerguru.com via paramiko SSH + PHP PDO inserts into the Flarum database. The Flarum posting workflow had to be developed from scratch this session -- the forum's Cloudflare Bot Fight Mode blocks external API calls, and the local curl from IX returns empty due to an HTTP->HTTPS redirect issue on the vhost. The only working approach: SSH to IX, build a PHP script with PDO inserts, SFTP upload to /tmp/, execute via SSH channel, parse output for Discussion ID and Post ID.
+
+First post was the OneDrive KFM folder redirection article (continued from prior context). The Flarum s9e TextFormatter XML format had to be reverse-engineered from existing posts -- content is not stored as raw markdown but as a custom XML dialect with start/end marker wrappers inside each formatting element. A Python converter was written to translate markdown to this format. The first insert failed with a foreign key constraint because posts.discussion_id references discussions.id -- reordering to insert discussion first (post refs are nullable at creation), then post, then UPDATE the discussion to set first_post_id/last_post_id resolved it.
+
+After the OneDrive article was posted, ran a server-wide WordPress search indexing audit across the IX cPanel server. Found 194 wp-config.php files; 18 sites had blog_public=0 (search discouraged). Of those, 7 were confirmed production sites whose owners were unaware. Fixed 13 sites (updated blog_public to 1), skipped forms.bestmassageintucson.com which is intentionally not indexed. The WordPress search audit findings were then written up as a second forum article and posted via the same paramiko workflow.
+
+Converted the entire Flarum posting workflow into a reusable /forum-post skill at .claude/commands/forum-post.md. The skill covers all four phases: gather inputs (title, content, tag), preview, execute (paramiko SSH -> SFTP upload PHP -> execute -> parse output), and report. Includes the complete Python md_to_s9e converter, PHP insert template with proper discussion-first ordering, error handling table, and hard rule to not verify via curl/browser. Added the command to CLAUDE.md commands table.
+
+### Key Decisions
+
+- **paramiko over curl/API**: Cloudflare blocks external Flarum API calls; localhost curl on IX has redirect issues. Only working path is SSH->PHP->PDO. Canonical approach now documented in the skill.
+- **Python .replace() not f-strings for PHP template substitution**: XML content contains curly braces; Python f-strings would try to expand them, causing KeyError. Used .replace() with %%PLACEHOLDER%% markers throughout.
+- **PHP nowdoc for XML content**: PHP heredoc with closing marker at column 0 -- no escaping needed for XML special characters inside.
+- **Discussion-first insert order**: Flarum posts.discussion_id has a FK constraint. Insert discussion with NULL post refs, then post, then UPDATE discussion. Template hardcodes this order.
+- **bestmassage skip**: forms.bestmassageintucson.com is intentionally noindexed (contact form subdomain) -- excluded from bulk fix.
+- **Unique /tmp filename per run**: flarum_post_timestamp.php prevents collision if skill is run concurrently; always cleaned up after execution.
+
+### Problems Encountered
+
+- **FK constraint on posts.discussion_id**: First insert attempt failed with SQLSTATE[23000]: 1452 Cannot add or update a child row. Fix: reorder inserts -- discussion first, then post, then UPDATE.
+- **PHP exit 255 no output**: display_errors was off by default. Added ini_set to PHP script to surface the FK error.
+- **Shell quoting in WP-config scan**: Bash-based scan with nested quotes got empty blog_public values for all sites. Fix: Python + paramiko SFTP to read files directly, parse with regex.
+- **Python f-string curly brace conflict**: Initial PHP template using f-strings caused KeyError on XML content curly braces. Fix: switched to .replace() with %%PLACEHOLDER%% markers.
+- **Flarum admin detection**: users table has no is_admin column. Admin status is in group_user table (group_id=1 = Admin). user_id=1 (MikeSwanson) confirmed admin.
+- **Chrome extension disconnected throughout**: Could not visually verify forum posts. Both posts confirmed via DB output only.
+
+### Configuration Changes
+
+- **Created:** .claude/commands/forum-post.md -- Complete /forum-post skill with infrastructure refs, md->s9e converter, PHP template, paramiko pattern, error table
+- **Modified:** .claude/CLAUDE.md -- Added /forum-post to Commands & Skills table
+- **Created (tmp):** .claude/tmp/flarum_do_insert2.py -- Working OneDrive KFM post script
+- **Created (tmp):** .claude/tmp/flarum_search_insert.py -- WordPress search post script
+- **Created (tmp):** .claude/tmp/check_search.py, check_search2.py -- WP audit scripts
+- **Created (tmp):** .claude/tmp/fix_search.py -- Bulk blog_public fix script
+
+### Credentials & Secrets
+
+- **IX SSH root password:** t4qygLl7{1zJcUj#022W^FBQ>}qYp-Od -- vault: infrastructure/ix-server.sops.yaml credentials.password
+- **Flarum DB:** host=localhost (on IX), dbname=azcompu_flarum, user=azcompu_flarum, pass=Fl@rum2026!CGS
+
+### Infrastructure & Servers
+
+- **IX server:** 172.16.3.10 -- root SSH, runs WHM/cPanel, hosts ~95 active WordPress sites + Flarum forum
+- **Flarum forum:** community.azcomputerguru.com -- DB on localhost (IX), admin user_id=1 (MikeSwanson), group_id=1=Admin
+- **WordPress sites:** Under /home/*/public_html/ on IX. 194 wp-config.php files found, ~95 real sites.
+
+### Commands & Outputs
+
+Found 194 wp-config.php files
+
+=== SEARCH DISABLED (blog_public=0): 1 sites ===
+  - https://forms.bestmassageintucson.com (peacefulspirit)
+
+=== SEARCH ENABLED (blog_public=1): 94 sites ===
+  - http://agingwithoutfamily.org (berman)
+  - http://anti-vaxxer.org (antivaxxer)
+  - http://atlantisbevcollc.com (atlantisbevco)
+  - http://azcomputerguru.com (azcomputerguru)
+  - http://azcomputerguru.com (computergurume)
+  - http://beta.ucryo.com (ucryo)
+  - http://bruceexterminating.com (bruceext)
+  - http://clients.azcomputerguru.com/ed2 (azcomputerguru)
+  - http://clients.azcomputerguru.com/express/bratton (azcomputerguru)
+  - http://clients.azcomputerguru.com/express/bratton (azcomputerguru)
+  - http://clients.azcomputerguru.com/express/callentine (azcomputerguru)
+  - http://clients.azcomputerguru.com/express/callentine (azcomputerguru)
+  - http://clients.azcomputerguru.com/express/cheeseman (azcomputerguru)
+  - http://clients.azcomputerguru.com/express/rwc (azcomputerguru)
+  - http://clients.azcomputerguru.com/express/warren (azcomputerguru)
+  - http://clients.azcomputerguru.com/fbr (azcomputerguru)
+  - http://clients.azcomputerguru.com/framework (azcomputerguru)
+  - http://clients.azcomputerguru.com/rp (azcomputerguru)
+  - http://clients.computerguru.me/ps/wprebuild (computergurume)
+  - http://clients.computerguru.me/template (computergurume)
+  - http://cryoweave.com (cryoweave)
+  - http://danaise.com/ (danaise)
+  - http://dev.computerguru.me (computergurume)
+  - http://dev.computerguru.me/acg (computergurume)
+  - http://dev.computerguru.me/cdx (computergurume)
+  - http://dev.computerguru.me/guru-framework (computergurume)
+  - http://dev.computerguru.me/gurushow/ (computergurume)
+  - http://dev.computerguru.me/gurushow/ (computergurume)
+  - http://dev.computerguru.me/gurushow/ (computergurume)
+  - http://dev.computerguru.me/gurushow/ (computergurume)
+  - http://dev.computerguru.me/gurushow/ (computergurume)
+  - http://dev.computerguru.me/packetdial/dev (computergurume)
+  - http://dev.tarafulcreations.com (tarafulcreations)
+  - http://drsticken.com (drsticken)
+  - http://express.azcomputerguru.com (azcomputerguru)
+  - http://longtermdisabilitylawyer.co (danaise)
+  - http://northwestpoolcare.com (nwpool)
+  - http://photonicapps.com (photonicapps)
+  - http://rarengineer.com (rarengineer)
+  - http://reliantpump.services/ (farwest)
+  - http://sandbox.computerguru.me/acgsite (computergurume)
+  - http://sandtekomachinery.com (sandtekomachine)
+  - http://sleepapneadisability.com (danaise)
+  - http://soaznewsx.com (voicesofthewest)
+  - http://tarafulcreations.com (tarafulcreations)
+  - http://thriveappraisalservices.com (thrive)
+  - http://tucsonpaintball.net (desertfox)
+  - http://voicesofthewest.net/wp-login.php (voicesofthewest)
+  - http://www.danaise.com (danaise)
+  - http://www.fsgtucson.com (fsgtucson)
+  - http://www.rrs-law.com (rrspc)
+  - http://www.tucsonadobe.com (tucsonadobe)
+  - http://www.veterandisability.lawyer (danaise)
+  - https://acepickupparts.com (acepickupparts)
+  - https://arizonahatters.com (arizonahatters)
+  - https://azcomputerguru.com (azcomputerguru)
+  - https://azcomputerguru.com/testsite (azcomputerguru)
+  - https://azrestaurantsupply.com (azrestaurant)
+  - https://blackswanarchery.com (blackswanarchery)
+  - https://classicsingleaction.com (perkins)
+  - https://classicsingleaction.com (perkins)
+  - https://clients.computerguru.me/azwellbydesign (computergurume)
+  - https://clients.computerguru.me/gentlemansacres (computergurume)
+  - https://clients.computerguru.me/hightechmortgage (computergurume)
+  - https://clients.computerguru.me/ralphs (computergurume)
+  - https://clients.computerguru.me/reliant/dev (computergurume)
+  - https://compoundfunctionalfitness.com (compoundfitness)
+  - https://computerguru.me/acg2024 (computergurume)
+  - https://dev.computerguru.me/acg (computergurume)
+  - https://dev.computerguru.me/acg2025 (computergurume)
+  - https://dev.computerguru.me/acg2025 (computergurume)
+  - https://dev.computerguru.me/acg2025 (computergurume)
+  - https://dev.computerguru.me/acg2025-wp-test (computergurume)
+  - https://ezfastautoglass.com (acepickupparts)
+  - https://ezfastautoglass.com (ezfastautoglass)
+  - https://farwestwell.com (farwest)
+  - https://gentlemansacres.com (gentlemansacres)
+  - https://grabbanddurando.com/ (grabblaw)
+  - https://hightechmortgage.com (hightechmortgage)
+  - https://northwestpoolcare.com (nwpool)
+  - https://outaboundssports.com (outaboundssports)
+  - https://packetdial.com (packetdial)
+  - https://phoenixmanagedservices.com (azcomputerguru)
+  - https://phoenixmanagedservices.com (azcomputerguru)
+  - https://phoenixmanagedservices.com (computergurume)
+  - https://phxpropane.com (phxpropane)
+  - https://royalweedcontrol.net (royalweedcontrol)
+  - https://themarcgroup.com (themarcgroup)
+  - https://ucryo.com (ucryo)
+  - https://valleydevelopmentcorp.com (zammit)
+  - https://www.bestmassageintucson.com (peacefulspirit)
+  - https://www.gurushow.com (gurushow)
+  - https://www.jrkco.com (jrkco)
+  - https://www.rrs-law.com (rrspc)
+
+=== ERRORS / SKIPPED: 99 ===
+  /home/acepickupparts/public_html/ezfastautoglass.com/wp-content/plugins/duplicator/installer/dup-installer/templates/default/pages-parts/step3/options-tabs/wp-config.php: missing DB credentials
+  /home/acepickupparts/public_html/wp-content/plugins/duplicator/installer/dup-installer/templates/default/pages-parts/step3/options-tabs/wp-config.php: missing DB credentials
+  /home/acg/public_html/fixcomputerviruses.com/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/guruhelp.me/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/gurushow.com/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/airandspace/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/blush/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/busybody/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/express/bowerman/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/express/dehaan/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/express/deserthues/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/express/excavation/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/express/imagesite/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/express/itsgreektome/wp-config.php: blog_public='' (query may have failed)
+  /home/acg/public_html/sandbox/express/patterson/wp-config.php: blog_public='' (query may have failed)
+=== FIXED (0) ===
+
+=== SKIPPED (1) ===
+  SKIPPED: https://forms.bestmassageintucson.com (/home/peacefulspirit/public_html/forms/wp-config.php)
+[INFO] XML length=5661
+[OK] SSH connected
+[OK] Script uploaded to /tmp/flarum_post2.php
+Syntax check rc=0: No syntax errors detected in /tmp/flarum_post2.php
+Run rc=0
+Output: Discussion ID: 10
+Post ID: 9
+Done! URL: https://community.azcomputerguru.com/d/10-onedrive-kfm-fails-after-folder-redirection-migration-heres-whats-actually-going-on
+
+[INFO] XML length=5344
+[OK] SSH connected
+Syntax: No syntax errors detected in /tmp/flarum_search.php
+rc=0
+Discussion ID: 11
+Post ID: 10
+Done! URL: https://community.azcomputerguru.com/d/11-wordpress-discourage-search-engines-setting-how-7-production-sites-lost-their-indexing
+
+### Pending / Incomplete Tasks
+
+- **WebSvr GuruRMM agent**: Blocked -- CentOS 7 glibc 2.17 incompatible with current build targets. Options: x86_64-unknown-linux-musl build target, or skip (WebSvr is legacy/decommission candidate).
+- **IX backup offsite**: No remote transport in WHM. Comet Backup cron exists but binary not in PATH -- non-functional. Needs S3/SFTP/Backblaze destination.
+- **azcomputerguru.com SEO remaining**: Slider Revolution duplicate H1 (manual WP Admin), footer social icons still href='#' (need real URLs from Mike), Google Search Console setup.
+- **Chrome extension**: Remained disconnected all session.
+
+### Reference Information
+
+- Forum post #1 (OneDrive KFM): https://community.azcomputerguru.com/d/8-onedrive-kfm-fails-after-folder-redirection-migration-heres-whats-actually-going-on
+- Forum post #2 (WordPress search): https://community.azcomputerguru.com/d/9-wordpress-discourage-search-engines-setting-how-7-production-sites-lost-their-indexing
+- forum-post skill: .claude/commands/forum-post.md