Major billing gap identified:
- 39 tickets closed/invoiced today
- 31 have ZERO time logged (00:00:00)
- Many marked 'Invoiced' but sent with no time
- Detailed list provided for review and correction
Sombra RMM enrollment: no billing needed per Mike
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Ticket #32225 exists but has no time logged
- Today's GuruRMM enrollment work is unbilled
- Needs either ticket update or new ticket creation
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Both servers were already patched (11.110.0.97 and 11.134.0.20) via
daily auto-update. IOC scan found 16 flagged sessions across both
plus 4 uncommented SSH keys on IX.
Critical remediation:
- Forensic evidence preserved before any deletion
- 4 uncommented SSH keys removed from IX (server-side backup retained)
- 16 flagged sessions purged across both servers
- Root passwords rotated via chpasswd
- New WHM API tokens created; 3 stale transfer-* tokens revoked
- Vault entries + 1Password Infrastructure items updated
Forensic deep-dive verdict: patch held. All 7 actual CVE exploit
attempts (botnet IPs hitting /json-api/version) returned HTTP 403.
The "multi-line pass" IOC hits on user sessions were false positives.
Unidentified 76.18.103.222 root session traced to routine SSL
maintenance (zero sensitive endpoints touched).
Skill hardening:
- Added MANDATORY service-token directive to .claude/commands/1password.md
enforcing OP_SERVICE_ACCOUNT_TOKEN from SOPS for all op CLI calls
- Per Mike: memory files alone don't reliably bind agent behavior;
baking governance into skill content loaded at moment of use.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Howard is cleared to proceed with Path A (Graph API role assignment) for
Cascades CA Administrator fix.
Also communicated new approval workflow:
- General tools: Howard can modify OR Claude can execute with Howard/Mike approval
- Projects: require Mike approval, features→roadmap, bugs→bug list
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Synced with Gitea, reviewed 14 commits from GURU-BEAST-ROG:
- Radio show audio processing (Tara voice profile, Q&A extraction, 4090 benchmark)
- Cascades client work (Howard - HIPAA remediation, Entra Connect staging)
- Valleywide client init (app modernization project)
Note detected: Co-host name 'Tom' needs correction in radio show profiles.
Session type: Sync and context review only, no active development.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Appended update to 2026-04-24 session log covering the font change
investigation. Checked bash startup files, Windows Terminal settings,
registry console keys, raw PowerShell output bytes, and installed
fonts. No root cause found — user will report next real-time
occurrence for definitive diagnosis.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add local rate table (pulled 2026-04-24) for all 7 labor products; always
set price_retail explicitly — Syncro API does not auto-apply product rates
- Replace vault-based key fetch with inline case block on identity.json user;
both Mike and Howard keys included for correct per-user attribution
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Comprehensive emergency response documentation:
- Complete timeline from 0935 arrival to 1115 handoff
- All 4 servers documented with current status
- HP ProLiant: NVRAM resolved, iLO pending
- Dell VWP-QBS: Boot issue resolved
- XenServer: OFFLINE (CRITICAL - Server3 VM down)
- 4th server: Appears fine
Work status:
- Timer running (~1h40m so far)
- Switching to laptop to continue
- XenServer restoration is highest priority
Created comprehensive session log:
- session-logs/2026-04-22-valleywide-power-outage-emergency-response.md
- Complete status, timeline, next steps, recommendations
- Ready for laptop continuation
All changes synced to Gitea for seamless handoff.
Machine: Mikes-MacBook-Air.local
Timestamp: 2026-04-22 11:05:39
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Complete vault and SOPS setup on Mac from scratch. Fixed critical
get-token.sh bugs (variable collision + directory depth), validated
vault sync from Windows, tested all 5 tiers.
Key accomplishments:
- Installed SOPS 3.12.2 + age 1.3.1 via Homebrew
- Configured age private key and SOPS environment
- Cloned vault repository with 6 SOPS files
- Fixed vault.sh line endings (CRLF → LF)
- Token acquisition working: 4/5 tiers (defender not consented)
- Created comprehensive VAULT-SETUP-GUIDE.md (522 lines)
- Removed guru-rmm submodule auto-update from sync script
Remediation-tool now portable across Mac/Windows. Ready for Howard setup.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Decommissioned cloudflared tunnel, migrated 9 services to direct CF proxy,
removed ~22 stale pfSense rules and 22 unused aliases.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- clients/glaztech/session-logs/2026-04-20-session.md: Exchange Online
transport rule created to bypass DMARC for clearcutglass.com
- session-logs/2026-04-20-session.md: update with 12:55 work
- .claude/commands/syncro.md: fix billing workflow — comment endpoint
silently drops time fields; use timer_entry endpoint instead
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extract Ollama docs and PROJECT_STATE locking protocol to on-demand
reference files. Trim Work Mode to detection table only. Remove verbose
anti-pattern examples and credential encryption details.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rewrote get-token.sh: tiered app system (investigator/exchange-op/user-manager/tenant-admin/defender)
- Updated SKILL.md, command, gotchas, checklist, graph-endpoints for new app suite
- Cascades breach check: mailbox clean, inbound phishing received by John, DMARC gap noted
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Created comprehensive show prep using breaking news from April 9-18, 2026:
- Artemis II post-flight news conference (April 16)
- IonQ quantum 'Holy Grail' breakthrough (April 14)
- 90% cancer detection from stool samples via AI (April 9)
- Stanford AI Index 2026 findings
- RAM shortage hitting consumers today
Replaced recycled CES content with current, timely stories.
File: projects/radio-show/episodes/2026-04-18-tech-that-makes-life-fun/show-prep-fresh.html
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixed Cascades pfSense password in vault (a6A6c6fe→Th1nk3r^99, moved from
dataforth to cascades-tucson). Ollama exposed via Tailscale for Howard
(100.92.127.64:11434, firewall restricted to 100.0.0.0/8). Reviewed
Howard's first full day of work on shared system.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
589G OwnCloud data moved from cache SSD to disk7 array (2h49m rsync).
Cache dropped from 82% to 34%. MariaDB + Discourse recovered and running
7h+ healthy. Share config changed to no-cache permanently.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Jupiter cache drive at 99% BTRFS data allocation — MariaDB + Discourse
crash-looping. Root cause: 589G OwnCloud data stuck on cache (mover
blocked by active SMB session from OwnCloud VM). Migration in progress
(rsync cache->array disk7, ~90% at time of commit). Also fixed /mode
command to acknowledge /color is user-invokable only.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Appended afternoon work: MSI installer MVP, Len's Auto Brokerage test
client, Uranus server docs, multi-user identity system, onboarding guide,
bootstrap package, audit gap fixes (GrepAI/Ollama/MCP/settings), and
generic /import command for folder ingestion.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Enhance /save and /sync slash commands to attribute commits by author
so Mike and Howard can see at a glance what the other person did.
- sync.sh: loads identity.json, shows incoming/outgoing commits with
author + age before pull/push, groups by author in final summary
- sync.md: describes the new output format + conflict attribution
- save.md: pre-commit Change Summary block + post-commit Summary
Motivation: repo is now shared across team, `git log` alone made it
hard to see "when did Howard change that?" without hunting.
Diagnosed azcomputerguru.com 521 errors: Cox's BGP route to specific
Cloudflare origin-pull prefixes (162.158.0.0/16, 172.64.0.0/13,
173.245.48.0/20, 141.101.64.0/18) is broken from 72.194.62.0/29.
Confirmed by TCP probe matrix from pfSense WAN, traceroute latency
comparison, and state-table showing 0 inbound CF connections while
direct-internet traffic still reached origin.
Deployed Cloudflare Tunnel 'acg-origin' on Jupiter Unraid as a
Docker container. Routes 4 proxied hostnames (azcomputerguru.com,
analytics., community., radio.) through the tunnel with HTTPS
backend to IX 172.16.3.10:443 with per-ingress SNI matching. All
4 hostnames return 200 OK through CF edge after the cutover.
Repo hygiene:
- Merged clients/ix-server/ into clients/internal-infrastructure/
(IX is internal infra, not a paying-client account). Git detected
the session-log files as renames so history is preserved. Updated
4 stale path references in 2 files.
- Moved cox-bgp ticket draft out of projects/dataforth-dos/ (wrong
project) to clients/internal-infrastructure/vendor-tickets/.
- Relocated tunnel-setup helper scripts from
projects/dataforth-dos/datasheet-pipeline/implementation/ to
clients/internal-infrastructure/scripts/cloudflared-tunnel-setup/.
Deleted superseded/abandoned login attempts. Sanitized hardcoded
Jupiter/pfSense SSH passwords to pull from SOPS vault at runtime;
Cloudflare token reads from env var (tokens still in 1Password,
vault entry is metadata-only).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Created show prep for April 5, 11, and 18, 2026
- HTML versions with clickable links for April 11 and 18
- IX server WordPress security scan (87 sites, 0 compromised)
- Local network scanning for Yealink devices
- Domain controller batch logon rights guidance
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
New integration with TickTick API for project/task management:
- OAuth 2.0 auth flow (mcp-servers/ticktick/ticktick_auth.py)
- MCP server with 9 tools for Claude Code (ticktick_mcp.py)
- FastAPI service with SOPS vault credentials (api/services/ticktick_service.py)
- JWT-protected REST router at /api/ticktick/ (api/routers/ticktick.py)
- Credentials stored in SOPS vault (services/ticktick.sops.yaml)
Dev project tracking (hybrid TickTick + DB):
- New dev_projects table migration (14 columns, status index)
- TickTick "Dev Projects" list for mobile visibility
- First project seeded: TickTick Integration (linked both sides)
Security: .tokens.json gitignored, token file permissions restricted,
HTML-escaped OAuth callback, SOPS vault (not env vars) for secrets.
Also: Installed Tailscale on ACG-5070 for office network access.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Built exact-match TXT formatter from QuickBASIC source (SCM5B, 8B, DSCA, DSCT, SCM7B)
- Spec parser for 10 binary DAT files (1470+ models)
- Work order report importer (33K WOs, 63K test lines)
- On-demand PDF generation, styled HTML view
- Archived 500K pre-2026 For_Web files into year subfolders
- Created domain service account (INTRANET\svc_testdatadb)
- Generated 73/73 Quatronix customer datasheets
- Added STAGE + Reports auto-import to sync script
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
