sync: auto-sync from HOWARD-HOME at 2026-05-12 12:38:50

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-05-12 12:38:50

session-logs/2026-05-12-session.md

@@ -0,0 +1,230 @@
+# 2026-05-12 — Cascades ticket update posted + Agent OS install for ampipit + 7 standards drafted
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+- **Session span:** 2026-05-12 ~07:00 PT (Cascades ticket update prep) → ~12:30 PT (mid-/discover-standards Shell-out pass, save)
+
+---
+
+## Session Summary
+
+Session opened with a Claude-update-recovery check after Howard had to reinstall Claude Code. Initial context recall pulled the wrong session log (root `session-logs/2026-05-10-session.md` — Mike's radio-show / Discord-bot / Apple-Dev work) and Howard corrected with "we have been working on the cascades phones for the past few days." Re-pulled the actual recent work from `clients/cascades-tucson/session-logs/`, with the 2026-05-11 7-hour Cascades log as the authoritative state: 19 SDM phones enrolled, ALIS SSO end-to-end validated, kiosk tile fix landed, three sign-in interruption layers eliminated, MHS half-screen rendering issue open and gated on Knox OEMConfig.
+
+First substantive work was the Cascades ticket #32214 ("Entra setup") customer-visible update. Last public comment on the ticket was 2026-05-08; the four work days since had accumulated significant progress (kiosk tile fix, SSO validation, fleet rollout). Drafted via Ollama qwen3:14b, tightened by Claude to remove redundancy (Ollama duplicated the ALIS SSO point across two sections), then posted as comment 410494485 with `hidden: false` and `do_not_email: true` matching the 2026-05-08 update pattern.
+
+Second piece of work was installing the Builder Methods Agent OS framework for use with Howard's standalone ampipit Rust project at `C:\ampipit`. Pre-flight: read the install docs, confirmed install paths (`~/agent-os/` base + per-project `agent-os/standards/` + `.claude/commands/agent-os/`), grepped the project-install.sh to verify it does NOT touch `CLAUDE.md` or anything else in the project, confirmed `~/agent-os/` and `C:\ampipit\.claude\commands\` did not exist beforehand. Ran the base clone, then ran the project installer from inside `C:\ampipit`. Post-install verification confirmed ClaudeTools repo was untouched and ampipit's existing `.claude/` contents (OLLAMA.md, COMPLEXITY_ROUTING.md, agents/, settings.json, settings.local.json) were preserved.
+
+Third piece was advising Howard's parallel ampipit Claude Code session through the `/discover-standards` Q&A flow. Recommended Job/Step architecture as the first focus area (highest leverage — foundational pattern everything else obeys, plus high tribal-knowledge density). Picked all four candidate patterns plus the ProgressEvent channel as a fifth. Each standard ran through the full ask-why → draft → confirm → create loop, producing five files under `C:\ampipit\agent-os\standards\job-engine/`. Recommended Shell-out as the second pass. Started: Cmd wrapper and English-locale standards completed and written to disk. Atomic-write and SHA-256-verified-downloads are still in the Q&A loop at save time.
+
+The standards captured the load-bearing tribal contracts of the engine: Step trait fatal-vs-non-fatal semantics, four-level RiskLevel ladder with typed-phrase gating that even `--silent --force` cannot bypass, hard-refusal-except-LoggedInUser-auto-impersonates ExecutionContext rule (with the Elevated-by-default DPAPI silent-failure gotcha), observable-effect idempotency, BinaryAdjacent-default JobAnchor with WinPeRamDisk as explicit non-resumable marker and ADR-025 forbidding LocalProgramData reintroduction, unbounded ProgressEvent channel with raw sender, and Cmd-wrapper-always (never `std::process::Command`).
+
+---
+
+## Key Decisions
+
+- **Used Ollama qwen3:14b for ticket-update drafting, Claude for tightening.** Ollama produced a competent draft but duplicated the "ALIS SSO works end-to-end" point across two paragraphs and double-counted the kiosk-layout fix. Claude rewrote to single-source each point and reorder with the headline win first. Confirms the existing pattern: Ollama drafts, Claude reviews + tightens, user approves before POST.
+
+- **Posted ticket comment with `do_not_email: true` matching the 2026-05-08 pattern.** Mike's last update used the same suppression; consistency means no surprise inbox bounces for Cascades while project is mid-rollout. Customer-visible (`hidden: false`) so the contact can read it when they look at the ticket portal.
+
+- **Verified Agent OS install footprint by reading project-install.sh before running.** Grepped for `.claude`, `standards`, `commands`, `CLAUDE.md`, `cp`, `mkdir` to confirm writes are scoped to exactly three locations. Standards docs were sparse on the interactive-prompt list, so script inspection was the only reliable way to know what the user would face. Found the script only writes to `$PROJECT_DIR/agent-os/standards/` and `$PROJECT_DIR/.claude/commands/agent-os/`, and the only interactive prompt fires when an existing `standards/` folder is being overwritten — no prompt at all on first install.
+
+- **Installed Agent OS for `C:\ampipit` not `C:\claudetools`.** Howard explicitly asked for a project-scoped install that wouldn't touch ClaudeTools. ampipit is its own directory outside the ClaudeTools tree, with its own `.claude/`. Clean separation: ClaudeTools' shared agents/skills/commands stay shared via Gitea, ampipit's Agent OS standards stay local and project-specific.
+
+- **Recommended Job/Step area first for /discover-standards.** Highest leverage of the four proposed areas because every other piece of code obeys this contract. Picking it first means later areas (error handling, shell-out, profile) inherit the foundational vocabulary already documented.
+
+- **Picked the strictest stance for IrreversibleDestructive bypass: never, not even with `--silent --force`.** For an MSP disk-touching tool, accidental wipes are unrecoverable. Typed phrase via answer file preserves automation while keeping the operator's intent durable on disk. Cheaper to type a phrase than to recover a customer disk.
+
+- **Captured "Elevated-by-default is the most common new-step mistake" in the ExecutionContext standard.** Silent DPAPI failure is exactly the failure mode standards exist to prevent — code compiles, runs, returns wrong data, nobody notices until a customer reports it. The standard now warns explicitly.
+
+- **Documented ProgressEvent channel as a separate standard rather than folding into step-trait.md.** The channel rules (unbounded, send failure non-fatal, no async, raw sender never wrapped) are non-obvious enough to deserve their own page; merging would have buried them under the Step-trait contract.
+
+- **English-locale standard scoped to "DISM today, document the extension pattern" rather than pre-flagging all Microsoft binaries.** Pre-flagging tools that don't accept `/English` would cause spurious errors; the documented extension pattern lets future contributors add tools as locale issues surface.
+
+---
+
+## Problems Encountered
+
+- **Initial context recall pulled the wrong session log.** Read `session-logs/2026-05-10-session.md` (Mike's radio-show/Discord-bot session) first because the root `session-logs/` listing showed it as most recent. Howard caught it: "that is not right, we have been working on the cascades phones for the past few days." Real recent work lived in `clients/cascades-tucson/session-logs/` (2026-05-11 the most recent). Root listing's most-recent file is often stale during client-focused weeks because client work goes under `clients/<slug>/session-logs/` per the file-placement guide. Fix: always check `clients/*/session-logs/` and `projects/*/session-logs/` in addition to root before claiming "most recent work" context.
+
+- **Agent OS install docs did not enumerate interactive prompts.** WebFetch summary said "the documentation does not list specific interactive prompts." Recovered by grepping `project-install.sh` directly for `read -p` and inspecting the surrounding context. Found the only prompt is the standards-folder-overwrite warning, which doesn't fire on first install. Lesson: install-script docs are often incomplete; reading the script is faster than testing-and-recovering.
+
+---
+
+## Configuration Changes
+
+### Files modified (ClaudeTools repo)
+
+- `session-logs/2026-05-12-session.md` — NEW (this file)
+
+### Files created (outside ClaudeTools repo)
+
+- `C:\Users\Howard\agent-os\` — Builder Methods Agent OS base install (cloned from `https://github.com/buildermethods/agent-os.git`, `.git` removed). Contains `scripts/`, `profiles/default/`, `commands/agent-os/`, `config.yml`.
+- `C:\ampipit\agent-os\standards\index.yml` — empty standards index (default profile ships no preloaded standards)
+- `C:\ampipit\.claude\commands\agent-os\` — 5 Agent OS slash commands installed:
+  - `discover-standards.md`
+  - `index-standards.md`
+  - `inject-standards.md`
+  - `plan-product.md`
+  - `shape-spec.md`
+- `C:\ampipit\agent-os\standards\job-engine\` — 5 standards files from /discover-standards Job/Step pass:
+  - `step-trait.md`
+  - `risk-level.md`
+  - `execution-context.md`
+  - `idempotency.md` (note: filename may vary if standard merged into job-anchor.md)
+  - `job-anchor.md`
+  - `progress-channel.md`
+- `C:\ampipit\agent-os\standards\shell-out\` — 2 standards files from /discover-standards Shell-out pass (in progress):
+  - `cmd-wrapper.md`
+  - `english-locale.md`
+
+### Syncro changes
+
+- Ticket #32214 ("Entra setup", Cascades of Tucson, In Progress) — comment id `410494485` posted at `2026-05-12T07:20:29.730-07:00`. Subject: "Project update 2026-05-11". `hidden: false`, `do_not_email: true`. Customer-visible.
+
+### ClaudeTools repo untouched by Agent OS install
+
+Verified post-install: `C:\claudetools\.claude\commands\` does not contain an `agent-os/` subfolder. No new files in the ClaudeTools tree from the Agent OS install.
+
+---
+
+## Credentials & Secrets
+
+None created or rotated this session. The Syncro API call used Howard's existing per-user key (`Tde5174a6e9e312d14-…`, vaulted at `msp-tools/syncro-howard.sops.yaml`).
+
+---
+
+## Infrastructure & Servers
+
+No infrastructure changes this session. Reference values used:
+
+- **Syncro:** `https://computerguru.syncromsp.com/api/v1` — ticket id `109412123` (number `#32214`)
+- **Cascades tenant:** `207fa277-e9d8-4eb7-ada1-1064d2221498` (referenced in ticket body context, not touched)
+- **Agent OS upstream:** `https://github.com/buildermethods/agent-os.git`
+
+---
+
+## Commands & Outputs
+
+### Syncro ticket update post
+
+```bash
+BASE="https://computerguru.syncromsp.com/api/v1"
+API_KEY="Tde5174a6e9e312d14-…"  # Howard's per-user key
+RESP=$(curl -s -X POST "${BASE}/tickets/109412123/comment?api_key=${API_KEY}" \
+  -H "Content-Type: application/json" \
+  --data-binary @- <<'JSON'
+{
+  "subject": "Project update 2026-05-11",
+  "body": "<b>End-to-end ALIS sign-in is working on the pilot caregiver phone.</b> ...",
+  "hidden": false,
+  "do_not_email": true
+}
+JSON
+)
+echo "$RESP" | jq '{id: .comment.id, subject: .comment.subject, created_at: .comment.created_at}'
+# {"id": 410494485, "subject": "Project update 2026-05-11", "created_at": "2026-05-12T07:20:29.730-07:00"}
+```
+
+### Agent OS base install
+
+```bash
+cd ~ && git clone https://github.com/buildermethods/agent-os.git
+rm -rf ~/agent-os/.git
+ls ~/agent-os/scripts/
+# common-functions.sh  project-install.sh  sync-to-profile.sh
+```
+
+### Agent OS project install (run from C:\ampipit)
+
+```bash
+cd /c/ampipit && ~/agent-os/scripts/project-install.sh
+# === Agent OS Project Installation ===
+# Configuration:
+#   Profile: default
+#   Commands only: false
+# Creating project structure...
+# Installed 5 commands to .claude/commands/agent-os/
+# Agent OS installed successfully!
+```
+
+### Pre-flight script inspection (verified no CLAUDE.md modification)
+
+```bash
+grep -n -E "\.claude|standards|commands|cp -|mkdir -p" ~/agent-os/scripts/project-install.sh | head -40
+# Confirmed writes only to:
+#   $PROJECT_DIR/agent-os/standards/
+#   $PROJECT_DIR/agent-os/standards/index.yml
+#   $PROJECT_DIR/.claude/commands/agent-os/
+
+grep -n -E "CLAUDE\.md|claude_md" ~/agent-os/scripts/project-install.sh
+# (no output — script does not touch CLAUDE.md)
+```
+
+---
+
+## Pending / Incomplete Tasks
+
+### /discover-standards in flight (ampipit parallel session)
+
+- [ ] Finish Shell-out area: atomic-write standard, sha256-downloads standard (both selected in the candidate-patterns step; Q&A in progress at save time)
+- [ ] Optional: continue to Profile & persistence and Error handling & logging areas in a later session (per Howard's discretion — Job/Step and Shell-out are the load-bearing areas)
+- [ ] Run `/index-standards` once all standards in a pass are written to update `agent-os/standards/index.yml` descriptions
+
+### Cascades (carryover from 2026-05-11 — not new today)
+
+- [ ] **Knox OEMConfig setup** (P1) — fix for MHS half-screen rendering on ~67% of phones
+- [ ] **SSPR portal step** (P1) — Entra → Protection → Password reset → Properties → "Selected" → `SG-SSPR-Eligible` → Save
+- [ ] **ALIS staff record email matching prep** (P1) — for each real caregiver, ALIS staff record's Email field must exactly match Entra UPN before SSO flip
+- [ ] **John Trozzi Workplace Join completion** (P2) — guide John through one-tap re-register
+- [ ] **Z Flip 5 user re-register** (P2) — Mike's session deleted a personal Workplace-Join record; affected user needs 30-second re-register on next sign-in
+- [ ] **4 ghost Intune device records** (P3) — cosmetic cleanup post-wipe
+
+### ampipit (carryover, not part of standards work)
+
+- [ ] ampipit is currently NOT a git repository (no `.git` folder at `C:\ampipit`). If Howard wants version control on the Agent OS standards files (or any of the project), `git init` + first commit needed. Not started this session — out of scope.
+
+---
+
+## Reference Information
+
+### Agent OS
+
+- Install docs: `https://buildermethods.com/agent-os/installation`
+- Upstream repo: `https://github.com/buildermethods/agent-os`
+- Base path: `C:\Users\Howard\agent-os\` (home dir, outside ClaudeTools)
+- Project standards path: `C:\ampipit\agent-os\standards\<folder>\<name>.md`
+- Project commands path: `C:\ampipit\.claude\commands\agent-os\` (5 commands)
+- Profile in use: `default`
+
+### Syncro
+
+- Ticket #32214 ("Entra setup", Cascades of Tucson) — id `109412123`
+  - Last customer-visible comment before today: id `409911490` (2026-05-08, "Project update 2026-05-08", posted by Mike)
+  - This session's comment: id `410494485` (2026-05-12 07:20 PT, "Project update 2026-05-11")
+  - URL: `https://computerguru.syncromsp.com/tickets/109412123`
+
+### ampipit Job/Step standards files (created today)
+
+| Standard | Path |
+|---|---|
+| Step trait fatal-vs-non-fatal | `C:\ampipit\agent-os\standards\job-engine\step-trait.md` |
+| RiskLevel + Confirmation | `C:\ampipit\agent-os\standards\job-engine\risk-level.md` |
+| ExecutionContext gating | `C:\ampipit\agent-os\standards\job-engine\execution-context.md` |
+| JobAnchor placement | `C:\ampipit\agent-os\standards\job-engine\job-anchor.md` |
+| ProgressEvent channel | `C:\ampipit\agent-os\standards\job-engine\progress-channel.md` |
+
+### ampipit Shell-out standards files (in progress today)
+
+| Standard | Path | State |
+|---|---|---|
+| Cmd wrapper (always, never std::process::Command) | `C:\ampipit\agent-os\standards\shell-out\cmd-wrapper.md` | written |
+| English-locale forcing for parseable Microsoft CLI tools | `C:\ampipit\agent-os\standards\shell-out\english-locale.md` | written |
+| Atomic write pattern (.tmp + rename) | `C:\ampipit\agent-os\standards\shell-out\atomic-write.md` | pending |
+| SHA-256-verified downloads | `C:\ampipit\agent-os\standards\shell-out\sha256-downloads.md` | pending |
+
+### Architectural decision records referenced in standards
+
+- **ADR-019** — engine actively transitions into LoggedInUser via WTSQueryUserToken
+- **ADR-025** — LocalProgramData removed; portable mode (binary-adjacent state) is the v1 spec; new JobAnchor variants require ADR amendment