docs/specs/policy-core/ — folders+inheritance gate spec for the policy redesign (#7).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Points to cdc87d2 (server: fix cross-site agent duplication on re-enrollment).
Needs build + deploy by Mike/Howard before the dedup deletes are run.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New /datto-edr skill — standalone CLI for the Datto EDR REST API (azcomp4587,
rebranded Infocyte HUNT, raw-token LoopBack). Live-verified reads across the whole
MSP fleet: orgs/sites/agents/detections/sweep + deploy-cmd. Scan/isolate gated
behind --confirm (shape-verified, not run against prod). Token vaulted at
msp-tools/datto-edr.sops.yaml.
Also: reference_syncro_rmm_api_gui_only memory (Syncro RMM policy mgmt is
GUI-only) and the guru-rmm submodule pointer bump (Feature 6 EDR research).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate Howard's AMPIPIT toolkit into the fleet as a private Gitea
submodule (azcomputerguru/ampipit), matching the guru-rmm pattern.
Full history (49 commits + tags) pushed to Gitea and verified before
integration. Tracks main.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pin was stale at 2e469f1b (~30 commits behind main). Advances to current origin/main
which includes the universal self-detecting installer (Feature 9, v0.6.71) and upstream work.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New MSP tool — single-assessor consult intake. Stack: PHP + MySQL on the IX cPanel
host, gated by Cloudflare Access (only mike@azcomputerguru.com; app re-checks the
Cf-Access-Authenticated-User-Email header).
- app/questions.json — risk-ordered question framework (9 sections); each field tagged
source=syncro/rmm/scan/ask so the consult asks only what a human knows and the
post-meeting scan fills the technical reality.
- app/index.php — wizard UI: Syncro phone lookup -> prefill, section rail with live
progress, importance-colored question cards, in-meeting 365/Google consent links,
review + export.
- app/api.php — Syncro lookup-by-phone, save/load/list, consent-URL generation (reuses
the read-only Security Investigator app bfbc12a4-...), HTML export.
- app/schema.sql, config.sample.php, DEPLOY.md, README.md.
Consent links let the client approve read-only 365/Google access during the consult so
the audit scan runs afterward. Read-only by design (reads Syncro, generates consent; no
tenant writes).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Inventory NUL/jsonb reject (7 Windows agents) + update scanner dropping
non-Windows binaries (macOS/Linux agents never offered updates). Both
ROOT-CAUSED from the 2026-06-12 fleet log-analysis reconciliation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two sweeps:
1. .30 is a PHYSICAL box (Lenovo ThinkCentre M83, Ubuntu 26.04), not a Jupiter
VM — the VM was decommissioned 2026-06-12. Fixed inventory tables and the
gururmm-build system page (overview, index, jupiter, gururmm-build,
POWER_FAILURE_RUNBOOK).
2. Windows build chain: Beast (GURU-BEAST-ROG, tailnet 100.101.122.4, i9-14900K)
is PRIMARY; Pluto (172.16.3.36) is FALLBACK. Verified against build-windows.sh
(`attempt_build beast || attempt_build pluto`). Fixed overview, index,
projects/gururmm (build-host table + flow + host detail), systems/pluto, and
the reference_pluto_build_server memory.
Submodule advanced: build-pipeline doc comments corrected to match.
