sync: auto-sync from HOWARD-HOME at 2026-07-06 08:31:47

Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-06 08:31:47
2026-07-06 08:32:15 -07:00
parent f88c7d1739
commit e08f6c534e
2 changed files with 174 additions and 43 deletions
--- a/session-logs/2026-07/2026-07-06-howard-tech03l-pro-upgrade-tailscale-skill.md
+++ b/session-logs/2026-07/2026-07-06-howard-tech03l-pro-upgrade-tailscale-skill.md
@@ -0,0 +1,142 @@
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Two deliverables. First, upgraded ACG-Tech03L (Howard's tech laptop, GuruRMM agent id
+`86d9a24f-8aba-4e85-96c9-0325c1346379`, client "AZ Computer Guru") from Windows 11 Home to a
+permanently-activated Pro-tier edition, entirely over `/rmm` (agent runs as SYSTEM). Second,
+built a new fleet `tailscale` skill that manages an ACG-administered tailnet via the Tailscale
+REST API v2 with admin add/delete rights.
+
+The upgrade ran: probe edition/license state -> flip edition -> reboot -> install MAK + activate
+-> verify. Probe confirmed Windows 11 Home (EditionID Core), build 26200, OEM-Home activated, no
+Windows.old, and no interactive user logged in (safe to reboot). The first edition-flip attempt
+via `DISM /online /Set-Edition:Professional` failed with Error 50 ("Setting an edition is not
+supported with online images") despite Professional appearing in `/Get-TargetEditions`, so I
+pivoted to `changepk.exe /ProductKey <generic Pro>`, which flipped EditionID Core -> Professional
+live and set a pending reboot. Two `shutdown /r /t 15` dispatches returned exit 0 but never
+rebooted the box (silently dropped in the SYSTEM service session; the first also had its `/c
+"comment"` quotes stripped by the RMM->cmd.exe layer). The machine did eventually reboot (LastBoot
+advanced to 12:06 AM local), completing the edition change.
+
+Post-reboot, installing the vaulted MAK `BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K` via `slmgr /ipk` +
+`/ato` activated the machine — but as **Pro for Workstations**, not plain Pro. The MAK, labeled
+"Windows Pro MAK" in the vault, is actually a Pro-for-Workstations MAK; installing it auto-upgraded
+the edition Professional -> ProfessionalWorkstation. Final verified state: EditionID
+ProfessionalWorkstation, "Microsoft Windows 11 Pro for Workstations", 25H2 build 26200.8037,
+`slmgr /xpr` = "permanently activated", VOLUME_MAK channel, key ...HMJ4K. Howard confirmed the
+laptop is activated and working.
+
+The `tailscale` skill was built by a sub-agent (modeled on the screenconnect skill) and
+code-reviewed by reading the full script: SKILL.md + `tailscale-api.sh` + `/tailscale` command.
+It wraps the Tailscale API v2 (devices list/detail/delete/authorize, keys list/create/delete),
+vault-first auth (OAuth client preferred, API-token fallback; secret via stdin, bearer in a 0600
+curl config), every write gated behind `--confirm`, name->id resolution that stops on ambiguous
+match, and `[TAILSCALE]` bot alerts on writes. No-cred paths (`--help`, `status`) were smoke-tested
+locally. The live add/delete verification is blocked: there is no Tailscale API credential in the
+vault or 1Password, and one cannot be minted without Tailscale console access. Work committed and
+pushed (rebased over a fleet auto-sync, errorlog conflict resolved by keeping both sides).
+
+## Key Decisions
+
+- Used `changepk.exe`, not DISM, for the online Home->Pro edition flip after DISM returned Error 50.
+- Delivered all PowerShell to the agent via `-EncodedCommand` (UTF-16LE base64 built with the
+  PowerShell tool, since `iconv` is missing on this machine and broke `ps-encoded.sh`) to dodge the
+  RMM->cmd.exe quote/backslash mangling.
+- Rebooted with the machine unattended (no logged-in user) rather than confirming a reboot window —
+  the upgrade was the explicitly requested work and no live session was at risk.
+- Built + reviewed the tailscale skill without live API calls (no creds), keeping the live add/delete
+  test as a separate blocked task rather than fabricating a credential.
+- Corrected the vault MAK entry's note (Pro -> Pro for Workstations) and captured the whole verified
+  upgrade path as a reference memory, since the gotchas are reusable fleet-wide.
+- Committed only this session's files (explicit `git add`), leaving pre-existing dirty submodule
+  pointers and scratch `.rmm-*.ps1` files untouched.
+
+## Problems Encountered
+
+- **DISM Set-Edition Error 50** — online image edition change unsupported; used `changepk.exe`.
+- **`shutdown /r /t 15` silently dropped** in the SYSTEM session (exit 0, no reboot, twice). The
+  first also failed outright because the `/c "comment"` quotes were stripped (quote-stripping
+  friction). Machine rebooted on its own; documented `Restart-Computer -Force` / `shutdown /r /t 0`
+  as the reliable path for next time. Logged as friction.
+- **`ps-encoded.sh` broke** — `iconv: command not found` on Howard-Home Git Bash. Worked around by
+  encoding UTF-16LE base64 with the PowerShell tool. Logged (encode-empty-output).
+- **Reboot-detection monitor missed the downtime** — a 30s-interval `last_seen` poll never saw a gap
+  because the reboot window was short; `is_connected` is null fleet-wide so it can't be trusted.
+  Confirmed the reboot via `LastBootUpTime` advancing instead.
+- **MAK produced Pro for Workstations, not Pro** — the vaulted key is a PfW MAK. Acceptable (PfW is a
+  Pro superset, fully activated); corrected the vault label and flagged to Howard.
+
+## Configuration Changes
+
+Created:
+- `.claude/skills/tailscale/SKILL.md`
+- `.claude/skills/tailscale/scripts/tailscale-api.sh`
+- `.claude/commands/tailscale.md`
+- `.claude/memory/reference_windows_edition_upgrade_rmm.md`
+
+Modified:
+- `.claude/memory/MEMORY.md` — index line for the new reference memory.
+- `errorlog.md` — quote-stripping + shutdown-drop friction, PfW-MAK correction, encode-empty friction.
+- Vault `infrastructure/windows-pro-mak.sops.yaml` — corrected note (PfW MAK + verified upgrade path);
+  committed + pushed in the vault repo (D:/vault).
+
+Scratch (not committed): `.rmm-preflight/targeted/setedition/changepk/state/activate/verify.ps1`
+and `.*-b64.txt` were created in the repo root during the RMM work and removed at the end.
+
+## Credentials & Secrets
+
+- **Windows Pro-for-Workstations MAK** — `BP2XJ-CGNYY-7K8TK-GWXXJ-HMJ4K`. Vault:
+  `infrastructure/windows-pro-mak.sops.yaml` (`credentials.product_key`). VOLUME_MAK channel;
+  auto-upgrades a Pro machine to Pro for Workstations. Each activation consumes one MAK count =
+  $99 to the customer (ACG-internal machines: no invoice, still burns a count). ACG-Tech03L
+  consumed one count 2026-07-06.
+- **Generic Windows 11 Pro key** (Microsoft-published, non-secret) — `VK7JG-NPHTM-C97JM-9MPGT-3V66T`.
+  Used with `changepk.exe` to flip edition; never activates on its own (Status 5 Notification).
+- **Tailscale API credential** — DOES NOT EXIST yet. Skill reads `tailscale/api-access.sops.yaml`
+  (not created). Needs an OAuth client (scopes `devices:core` + `auth_keys`) or an API access token.
+
+## Infrastructure & Servers
+
+- **ACG-Tech03L** — Howard's tech laptop. GuruRMM agent id `86d9a24f-8aba-4e85-96c9-0325c1346379`,
+  client "AZ Computer Guru", site "Main Office". Tailnet IP 100.113.45.7 (howard@). Now Windows 11
+  Pro for Workstations 25H2 (26200.8037), permanently activated.
+- **GuruRMM** — `http://172.16.3.30:3001`; creds vault `infrastructure/gururmm-server.sops.yaml`.
+- **Tailscale API** — base `https://api.tailscale.com/api/v2`; OAuth token exchange at `/oauth/token`.
+
+## Commands & Outputs
+
+- Edition flip: `changepk.exe /ProductKey VK7JG-NPHTM-C97JM-9MPGT-3V66T` -> exit 0, EditionID
+  Core -> Professional, CBS RebootPending True.
+- DISM (failed): `Dism /online /Set-Edition:Professional /ProductKey:... /AcceptEula /norestart`
+  -> `Error: 50 Setting an edition is not supported with online images.`
+- Activate: `cscript //nologo slmgr.vbs /ipk BP2XJ-...HMJ4K` -> "Installed product key ...
+  successfully"; `/ato` -> `Error: 0xC004E028` (activation already in progress — benign);
+  `/xpr` -> "Windows(R), ProfessionalWorkstation edition: The machine is permanently activated."
+- Final: EditionID ProfessionalWorkstation | LicenseStatus 1 | Partial HMJ4K | VOLUME_MAK.
+- Skill smoke test: `bash -n tailscale-api.sh` -> parses; `status` (no cred) -> clean `[BLOCKED]`.
+
+## Pending / Incomplete Tasks
+
+- **Tailscale skill live verification (BLOCKED).** Provision a Tailscale API credential into the
+  vault, then run `status` -> `devices` -> `create-key`/`delete-key` -> a device delete to verify
+  end-to-end. Provision (OAuth, preferred):
+  ```
+  bash .claude/skills/vault/scripts/vault-helper.sh new tailscale/api-access.sops.yaml \
+    --kind oauth-client --name "ACG Tailscale API (OAuth client)" \
+    --url https://api.tailscale.com/api/v2 --tag tailscale \
+    --set client_id='<ID>' --set client_secret='<SECRET>' --set tailnet='-'
+  ```
+  OAuth client needs scopes `devices:core` + `auth_keys`. Token variant: `--kind api-key
+  --set api_key='tskey-api-...'`.
+
+## Reference Information
+
+- Commit: `f88c7d1` "tailscale skill (admin add/delete) + verified Windows edition-upgrade procedure".
+- Repo: `git.azcomputerguru.com/azcomputerguru/claudetools` (main).
+- Memory: `.claude/memory/reference_windows_edition_upgrade_rmm.md` — verified Home->Pro/PfW path + gotchas.
+- Wiki pattern: `wiki/patterns/tailscale-client-management.md` — per-client tailnet doctrine.
+- Tailscale API docs: https://tailscale.com/api ; auth keys https://tailscale.com/kb/1085/auth-keys .