sync: auto-sync from HOWARD-HOME at 2026-07-06 13:43:09

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-06 13:43:09

.claude/memory/MEMORY.md

@@ -28,6 +28,7 @@
 - [Matomo Analytics](reference_matomo_analytics.md) — Self-hosted analytics at analytics.azcomputerguru.com, site IDs, tracking for all 3 sites.
 - [TickTick Integration](reference_ticktick_integration.md) — OAuth API integration, MCP server, SOPS vault creds, project/task CRUD.
 - [Client Docs Structure](reference_client_docs_structure.md) — clients/<name>/docs/ layout (overview, network, servers, cloud, security, rmm). Template: clients/_client_template/.
+- [Client Wi-Fi Inventory](reference_client_wifi_inventory.md) — Building a fleet Wi-Fi list to connect onsite without asking. Passwords → vault `clients/<slug>/wifi.sops.yaml` (`credentials.<key>_ssid/_password`); readable index → `wiki/reference/client-wifi.md`. `/wifi` importer deferred (structure-only 2026-07-06).
 - [MSP Audit Scripts](reference_msp_audit_scripts.md) — server_audit.ps1 / workstation_audit.ps1 at projects/msp-tools/msp-audit-scripts/.
 - [Pluto Build Server](reference_pluto_build_server.md) — Windows build VM: hostname PLUTO = Unraid VM "Claude-Builder" = 172.16.3.36 (all the same box). MSVC + WiX + Azure Trusted Signing. Drive via /rmm (agent enrolls as PLUTO) when SSH key isn't authorized.
 - [Coord /messages API shape](reference_coord_messages_api_shape.md) — GET /api/coord/messages returns {total,skip,limit,messages[]} NOT a bare array; parse .messages[], strip control chars, read flag may be null.

.claude/memory/reference_client_wifi_inventory.md

@@ -0,0 +1,32 @@
+---
+name: reference_client_wifi_inventory
+description: Where client Wi-Fi networks are recorded so techs connect onsite without asking — vault holds passwords, wiki holds the readable index.
+metadata:
+  type: reference
+---
+
+We are building a fleet-wide client Wi-Fi list so anyone onsite can connect without asking
+for the SSID/password again. Established 2026-07-06 (Howard).
+
+**Split (security-driven):**
+- **Passwords/PSKs → SOPS vault**, `clients/<slug>/wifi.sops.yaml`, one file per client.
+  Per network use `credentials.<key>_ssid`, `credentials.<key>_password`, optional
+  `credentials.<key>_auth` (`<key>` = `staff`/`guest`/`voice`/`warehouse`...). Everything under
+  `credentials:` is encrypted at rest, so the entry is self-contained for an importer. Write it
+  with the `vault` skill's `vault-helper.sh new`/`set` (NEVER paste a Wi-Fi password into chat,
+  a ticket, a session log, or the wiki).
+- **Readable index → wiki**, `wiki/reference/client-wifi.md` (registered in `wiki/index.md`
+  under a new **Reference** section). Client / SSID / band / location / vault-field — NO passwords.
+  It lives under `wiki/reference/` so `/wiki-compile` never clobbers it (compile only touches
+  clients/projects/systems slugs).
+
+**Capture flow onsite:** ask "Wi-Fi name + password? staff vs guest? which should our machines
+use?" → store in vault via vault-helper → add a row to the wiki inventory → `/sync`.
+
+**Importer is DEFERRED** (Howard chose "structure only for now" 2026-07-06). Planned end state:
+a `/wifi import <client>` that reads the vault file, builds a Windows WLAN profile per network
+(`netsh wlan add profile`), and auto-connects. Interim: read the password with
+`vault.sh get-field clients/<slug>/wifi credentials.<key>_password` and connect manually.
+Build the importer/`/wifi` skill once a few real networks exist.
+
+Keep `<slug>` identical to the client's `wiki/clients/<slug>.md` slug so vault + wiki + article line up.

wiki/index.md

@@ -2,6 +2,7 @@
 
 Last updated: 2026-07-06
 Compiled by: HOWARD-HOME/claude-main
+(2026-07-06: added Reference section — client Wi-Fi inventory.)
 
 This wiki is LLM-maintained. Do not edit articles manually — run `/wiki-compile` to update.
 Run `/wiki-lint` to check for stale entries and broken backlinks.
@@ -99,6 +100,14 @@ Run `/wiki-lint` to check for stale entries and broken backlinks.
 |---|---|---|
 | [Tailscale client management](patterns/tailscale-client-management.md) | One tailnet per client (never merge into yours); you hold Admin; enroll devices as tagged nodes via pre-auth keys pushed from GuruRMM ([enroll script](patterns/tailscale-client-enroll.ps1)). Windows subnet-routing reality + "see each other" ACL. | 2026-06-06 |
 
+## Reference
+
+*Manually / skill maintained — NOT produced by `/wiki-compile`.*
+
+| Article | Summary | Maintained |
+|---|---|---|
+| [Client Wi-Fi Inventory](reference/client-wifi.md) | Human-readable index of client Wi-Fi networks (SSID/band/location) so we connect onsite without asking. **Passwords are NOT here** — encrypted in vault `clients/<slug>/wifi.sops.yaml`. Build as discovered. Automated `/wifi` importer planned. | 2026-07-06 |
+
 ---
 
 ## Cross-Reference

wiki/reference/client-wifi.md

@@ -0,0 +1,105 @@
+# Client Wi-Fi Inventory
+
+> **MANUALLY / SKILL MAINTAINED — `/wiki-compile` does NOT touch this file** (it only
+> compiles `clients/`, `projects/`, and `systems/` slugs). Edit it directly as networks
+> are discovered.
+>
+> **NO PASSWORDS IN THIS FILE.** Wi-Fi passwords are credentials — they live encrypted in
+> the SOPS vault (`clients/<slug>/wifi.sops.yaml`). This page is the human-readable index
+> of *which* client has *which* networks and *where*; the password column only names the
+> vault path/field, never the value. See [[reference_client_wifi_inventory]].
+
+Purpose: so any of us arriving onsite can connect to a client's Wi-Fi without asking for
+the name/password again. We build this as we go — whenever someone is onsite or touching a
+client network, capture the Wi-Fi and add it here + to the vault.
+
+---
+
+## Inventory
+
+*None captured yet. Add a row per network as you discover them (newest client on top is fine).*
+
+| Client | Network key | SSID | Band | Auth | Location / scope | Vault field | Notes |
+|---|---|---|---|---|---|---|---|
+| _example (delete)_ | `staff` | `Acme-Staff` | 5 | WPA2-PSK | All buildings | `clients/acme/wifi` → `credentials.staff_password` | 6GHz off; staff net only |
+
+Columns:
+- **Network key** — short slug (`staff`, `guest`, `voice`, `warehouse`) that links the
+  wiki row to the vault fields (`<key>_ssid`, `<key>_password`).
+- **Band** — `2.4`, `5`, `6`, or a combo like `2.4/5`.
+- **Auth** — `WPA2-PSK`, `WPA3-SAE`, `WPA2/WPA3`, `open`, `enterprise` (802.1X — note it,
+  those don't import as a simple PSK profile).
+- **Vault field** — the exact path the (future) importer reads. `clients/<slug>/wifi` +
+  `credentials.<key>_password` (and `credentials.<key>_ssid`).
+
+---
+
+## Capture a network (do this onsite)
+
+When you're onsite or working a client's network, ask for the Wi-Fi and record it. What to ask:
+
+> *"What's the Wi-Fi network name (SSID) and password? Is there a separate staff vs guest
+> network? Which one should our machines use when we're onsite?"*
+
+Then store it — **passwords go in the vault via the `vault` skill, never in chat/tickets/this file.**
+
+**First network for a client** (creates the file):
+
+```bash
+bash .claude/skills/vault/scripts/vault-helper.sh new clients/<slug>/wifi \
+  --kind note --name "<Client> Wi-Fi" --tag client --tag wifi \
+  --set staff_ssid="Acme-Staff" --set staff_password="THE_PASSWORD" --set staff_auth="WPA2-PSK"
+```
+
+**Additional networks on an existing client** (guest, voice, warehouse, second site…):
+
+```bash
+bash .claude/skills/vault/scripts/vault-helper.sh set clients/<slug>/wifi \
+  --set guest_ssid="Acme-Guest" --set guest_password="THE_PASSWORD"
+```
+
+Everything under `credentials:` is encrypted at rest (SSID + password both), so the entry is
+self-contained for the importer. Verify + publish:
+
+```bash
+bash .claude/skills/vault/scripts/vault-helper.sh verify clients/<slug>/wifi
+bash .claude/scripts/sync.sh            # or /sync — publishes the vault + wiki
+```
+
+**Then add a row to the Inventory table above** — SSID / band / location for human reference,
+and the vault field. (SSID is duplicated here for readability; the **vault is authoritative**
+for what the importer connects with.)
+
+---
+
+## Connect a machine to a client's Wi-Fi
+
+**Automated importer — PLANNED, not built yet.** The intended end state is a `/wifi import
+<client>` step that reads `clients/<slug>/wifi.sops.yaml`, generates a Windows WLAN profile
+per network, and imports it so you auto-connect. Deferred until we have a few real networks
+worth importing (decision 2026-07-06).
+
+**Interim manual method (Windows)** — read the password from the vault, then import a profile:
+
+```bash
+# 1. Read (vault access required; never paste the value anywhere)
+bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_ssid
+bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_password
+```
+
+Then either type it into the Windows Wi-Fi picker, or script it with `netsh` (build a profile
+XML with `<name>`/`<SSID>` and `<keyMaterial>` = the password, then
+`netsh wlan add profile filename=profile.xml`). Delete the temp XML afterward — it holds the
+plaintext key.
+
+---
+
+## Rules
+
+- **Passwords/PSKs only in the vault.** Never in this file, a session log, a ticket, or chat.
+- **Vault path convention:** `clients/<slug>/wifi.sops.yaml`, fields `credentials.<key>_ssid`
+  / `credentials.<key>_password` / optional `credentials.<key>_auth`.
+- **802.1X / enterprise (RADIUS) networks** don't import as a simple PSK — note the auth
+  method and any account in the vault, but they need a full profile (cert/credential), not a
+  passphrase.
+- Keep the `<slug>` identical to the client's `wiki/clients/<slug>.md` slug so this all lines up.