Two defects found while running /wiki-compile, both from tooling assuming
a path instead of resolving it.
1. Plaintext Syncro API keys. Mike's and Howard's live PSA keys were
copy-pasted into three command files, a script, and two catalog docs --
despite both already being vaulted at msp-tools/syncro and
msp-tools/syncro-howard. Replaced with reads from the SOPS vault via a
new sourced helper, .claude/scripts/syncro-env.sh. Write paths fail
closed; read-only paths degrade to skipped enrichment rather than a
wrong key. Per-user mapping is unchanged, so Syncro attribution is too.
2. Hardcoded repo root. wiki-compile/wiki-lint/inject-standards and
gen_b64.py hardcoded D:/claudetools; this machine is C:/claudetools.
syncro.md also read ~/.claude/identity.json before the repo copy -- the
same bug that made remediation-tool's consent-audit report a fully
consented tenant as RED. Root now resolves from the script's own
location, with identity.json claudetools_root as the override.
get-identity.sh had a chicken-and-egg bug: it read ${CLAUDETOOLS_ROOT:-.}
but never set it, so every caller had to already know the root. It now
self-resolves and exports CLAUDETOOLS_ROOT + VAULT_ROOT.
Verified: all three command setup blocks authenticate against live Syncro;
get-identity.sh works from any cwd and honors a pre-set root; gps-rmm
autoenroll resolves its key from the vault. security-review: no findings.
NOTE: both keys remain valid in git history. Rotation in the Syncro portal
is the required follow-up -- this commit does not resolve that exposure.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Extension 109 (Kayla Guerrero) - Phone MAC last 4: 73b7
Extension 117 (Jesse III) - Phone MAC last 4: 6cf5
Documented for device assignment workflow.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Extension 113 (Chris Guerrero) - Phone MAC last 4: 755b
Documented for device assignment workflow.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Extension 106 (Tammy) - Phone MAC last 4: 6a36
Documented for device assignment workflow after second CSV batch.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Extension 103 (Rose Guerrero) - Phone MAC last 4: 5217
Documented for device assignment workflow.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Extension 110 (Ron Winger) - Phone MAC last 4: 6509
Documented for device assignment workflow.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Extension 105 (J.R. Guerrero) - Phone MAC last 4: 7441
Documented for device assignment workflow.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Extension 114 (Ty Fetters) - Phone MAC last 4: 6d01
Documented for device assignment workflow.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Extension 102 (Jesse Sr) - Phone MAC last 4: 7559
Extension 116 (Bart) - Phone MAC last 4: a890
Documented for device assignment workflow.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
CLARIFIED (2026-07-10):
- Extension 117: Jesse III
- Email: jesse@nescoap.com (external domain)
- Similar to ext 114 (Ty@CASARICA.NET - external domain)
- Status: Ready to add to second CSV batch
UPDATED:
- Matched users: 12 -> 13 (Jesse III now matched)
- Unmatched users: 6 -> 5 (removed Jesse III from unmatched list)
- Will be included in second CSV import with other clarified/shared extensions
FILES MODIFIED:
- extension-mapping.md: Updated ext 117 to show jesse@nescoap.com
- PROVISIONING-STATUS.md: Moved ext 117 to clarified section
- README.md: Updated user counts and user summary
CURRENT STATUS:
- 11 users in CSV ready for bulk import (102-116 minus gaps)
- 2 users for separate provisioning (101 Natalya, 117 Jesse III)
- 5 users still need clarification (106, 108, 111, 112, 118)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Removing onmicrosoft.com from M365 usernames needs sifoidak.com verified as a custom
Entra domain, which needs a DNS TXT record at GoDaddy. Mike confirmed ACG has no
registrar access to that account, so UPNs stay on sifoidak.onmicrosoft.com and new
users follow the same convention. Recorded as decided rather than blocked so it is
not re-proposed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sif-oidak was documented as a hybrid AD/M365 environment. It is not: there is no
Entra Connect on either DC, no AD object carries msDS-ConsistencyGuid, and every
M365 user has onPremisesSyncEnabled=null. AD and M365 are disjoint, and email is a
third system entirely (sifoidak.com at GoDaddy; the O365_BUSINESS SKU carries the
EXCHANGE_S_FOUNDATION no-mailbox stub).
That mismatch caused a real failure: Dwayne Ortega had a cloud account only, so he
could not log in to a domain-joined workstation. Created his AD account and recorded
the two-account onboarding rule.
Also documented: printer error 740 (Point-and-Print driver install needs admin,
UAC prompt never surfaces), a GPO pushing the MX-6240N queue from the wrong server,
SIF-SERVER2 confirmed as a backup DC, and refreshed stale laptop agent UUIDs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Confirmed caps were never applied (all uncapped); applied + verified via GuruRMM
- SQLEXPRESS/AIMSQL required IMC\guru impersonation (SYSTEM not sysadmin there)
- WATCH flag through ~2026-07-11: if AIM/perf issues reported, suspect this first; rollback = uncap
- Active Work item marked done
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
