sync: auto-sync from HOWARD-HOME at 2026-07-06 13:43:09

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-06 13:43:09

.claude/memory/MEMORY.md

@@ -28,6 +28,7 @@
 - [Matomo Analytics](reference_matomo_analytics.md) — Self-hosted analytics at analytics.azcomputerguru.com, site IDs, tracking for all 3 sites.
 - [TickTick Integration](reference_ticktick_integration.md) — OAuth API integration, MCP server, SOPS vault creds, project/task CRUD.
 - [Client Docs Structure](reference_client_docs_structure.md) — clients/<name>/docs/ layout (overview, network, servers, cloud, security, rmm). Template: clients/_client_template/.
+- [Client Wi-Fi Inventory](reference_client_wifi_inventory.md) — Building a fleet Wi-Fi list to connect onsite without asking. Passwords → vault `clients/<slug>/wifi.sops.yaml` (`credentials.<key>_ssid/_password`); readable index → `wiki/reference/client-wifi.md`. `/wifi` importer deferred (structure-only 2026-07-06).
 - [MSP Audit Scripts](reference_msp_audit_scripts.md) — server_audit.ps1 / workstation_audit.ps1 at projects/msp-tools/msp-audit-scripts/.
 - [Pluto Build Server](reference_pluto_build_server.md) — Windows build VM: hostname PLUTO = Unraid VM "Claude-Builder" = 172.16.3.36 (all the same box). MSVC + WiX + Azure Trusted Signing. Drive via /rmm (agent enrolls as PLUTO) when SSH key isn't authorized.
 - [Coord /messages API shape](reference_coord_messages_api_shape.md) — GET /api/coord/messages returns {total,skip,limit,messages[]} NOT a bare array; parse .messages[], strip control chars, read flag may be null.

.claude/memory/reference_client_wifi_inventory.md

@@ -0,0 +1,32 @@
+---
+name: reference_client_wifi_inventory
+description: Where client Wi-Fi networks are recorded so techs connect onsite without asking — vault holds passwords, wiki holds the readable index.
+metadata:
+  type: reference
+---
+
+We are building a fleet-wide client Wi-Fi list so anyone onsite can connect without asking
+for the SSID/password again. Established 2026-07-06 (Howard).
+
+**Split (security-driven):**
+- **Passwords/PSKs → SOPS vault**, `clients/<slug>/wifi.sops.yaml`, one file per client.
+  Per network use `credentials.<key>_ssid`, `credentials.<key>_password`, optional
+  `credentials.<key>_auth` (`<key>` = `staff`/`guest`/`voice`/`warehouse`...). Everything under
+  `credentials:` is encrypted at rest, so the entry is self-contained for an importer. Write it
+  with the `vault` skill's `vault-helper.sh new`/`set` (NEVER paste a Wi-Fi password into chat,
+  a ticket, a session log, or the wiki).
+- **Readable index → wiki**, `wiki/reference/client-wifi.md` (registered in `wiki/index.md`
+  under a new **Reference** section). Client / SSID / band / location / vault-field — NO passwords.
+  It lives under `wiki/reference/` so `/wiki-compile` never clobbers it (compile only touches
+  clients/projects/systems slugs).
+
+**Capture flow onsite:** ask "Wi-Fi name + password? staff vs guest? which should our machines
+use?" → store in vault via vault-helper → add a row to the wiki inventory → `/sync`.
+
+**Importer is DEFERRED** (Howard chose "structure only for now" 2026-07-06). Planned end state:
+a `/wifi import <client>` that reads the vault file, builds a Windows WLAN profile per network
+(`netsh wlan add profile`), and auto-connects. Interim: read the password with
+`vault.sh get-field clients/<slug>/wifi credentials.<key>_password` and connect manually.
+Build the importer/`/wifi` skill once a few real networks exist.
+
+Keep `<slug>` identical to the client's `wiki/clients/<slug>.md` slug so vault + wiki + article line up.