- Deployed radio-show FastAPI redesign (HEAD already at b008b61 with sort fix) to Jupiter; rebuilt radio-archive container.
- Solved Jupiter audio 404 by rsync IX -> Jupiter over LAN (8.09 GB, ~75s @ 108 MB/s); installed Jupiter root pubkey on IX root for passwordless server-to-server access.
- Addressed 6 Note-for-Mike blocks from Howard (Cascades SDM activation root cause, IMC1 AIM SQL diagnosis correction, Sombra/Transwiz patterns, Stamback prepay).
- Restored dead Discord bot (silent since 2026-05-06 reboot); installed as NSSM service ClaudeToolsDiscordBot with auto-restart + log rotation.
- Resolved /sync conflict on memory entry by dropping redundant local commit in favor of Howard's richer feedback_syncro_appointment_owner.md.
- Kicked off Apple Developer Program enrollment (HH5UA87LAH); flagged D&B name mismatch (DUNS 005661506 registered to 'COMPUTER GURU' not 'Arizona Computer Guru LLC') as real blocker; vaulted full sequence at infrastructure/apple-developer-program.sops.yaml in vault repo.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mike's 4/30 audit (surfaced via /sync) flagged that 31 closed tickets had
00:00:00 in Syncro time tracking — bare add_line_item bypasses time entries
and breaks reporting. I had just done the same on today's 3 tickets; Winter
retroactively added time entries. Rewrote the syncro skill (commit ec98c6c)
to make timer_entry -> charge_timer_entry the default and demote bare
add_line_item to a fallback for non-time items only. Disabled the
now-redundant scheduled agent (trig_01CAfvwoQ4nLcKEqbU4UQmSa).
Three tickets billed today: #32225 Sombra ($525 onsite), #32229 Mineralogical
Record ($262.50 emergency), #32214 Cascades Entra (33.5 hrs project labor at $0
debits prepaid block). Hit a real incident on Sombra: rogue comment posted with
content from a different ticket because /tmp resolves differently in the Write
tool (C:/tmp/) vs Git Bash (%LOCALAPPDATA%/Temp/) on Windows. Howard manually
deleted from GUI; subsequent posts used heredoc to avoid the file handoff
entirely. Root cause documented in feedback_tmp_path_windows.md so future
sessions don't trip the same wire. Scheduled remote agent
trig_01CAfvwoQ4nLcKEqbU4UQmSa to update the syncro skill examples 2026-05-02.
Updated Howard's note with correct analysis after Mike's clarification:
BUSINESS RULE (from Mike):
- ALL tickets need time entries (except cancelled)
- Even warranty/free work logs time
- Time tracking separate from billing decisions
FINDINGS:
- Billing: ✅ Working (29 invoices exist, 2 correctly non-billed)
- Time tracking: ❌ Bypassed (all 31 show 00:00:00)
ROOT CAUSE:
- Manual invoice line items used instead of time tracking
- Hours typed in descriptions ("Applied X.0 Prepay Hours")
- Prevents productivity/utilization reporting
Pattern: 20 prepay deductions + 16 direct charges, all via manual
line items. Workflow skips Syncro time tracking system entirely.
Examples included with hours that should have been logged.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Previous commits falsely claimed 31 tickets had no invoices. This was based on
a fundamentally flawed verification script that:
- Used list endpoint instead of individual invoice details
- Failed to check invoice-level ticket_id field
- Had type comparison errors (string vs int)
CORRECTED FACTS:
- 29 out of 31 tickets DO have proper invoices (93.5% success)
- 2 tickets correctly have no invoices (marked Non-Billable)
- #32083 (DAnaise.com): Non-Billable status
- #32022 (Michael Johnson): Cancelled, Non-Billable
NO ACTION REQUIRED - Howard's billing workflow is working correctly.
Sincere apologies for the false alarm. Mike caught the error immediately.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Pattern analysis reveals:
- 31 tickets span March 3 - April 28 (not one-time event)
- Multiple update date clusters (batch processing pattern)
- All missing normal invoice workflow steps
- Tickets changed to 'Invoiced' status without:
* Time entries
* Invoice generation
* Workflow comments
NOT a Claude/API integration issue - Claude doesn't change ticket statuses.
Likely causes:
1. Manual bulk status updates to clear queue
2. Misconfigured Syncro automation/workflow
3. Periodic batch status changes
Urgent: Need to review Syncro automation rules and prevent future revenue loss
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Deep verification performed:
- Checked customer invoice records for all 31 tickets
- ZERO invoices found matching these tickets
- Cascades confirmed to have NO contract (11 tickets affected)
- Example: Kittle #32223 marked 'Invoiced' but no invoice exists
- This is genuine lost revenue, not contract-covered work
Estimated impact: 31 billable tickets with no revenue captured
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Major billing gap identified:
- 39 tickets closed/invoiced today
- 31 have ZERO time logged (00:00:00)
- Many marked 'Invoiced' but sent with no time
- Detailed list provided for review and correction
Sombra RMM enrollment: no billing needed per Mike
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Ticket #32225 exists but has no time logged
- Today's GuruRMM enrollment work is unbilled
- Needs either ticket update or new ticket creation
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Both servers were already patched (11.110.0.97 and 11.134.0.20) via
daily auto-update. IOC scan found 16 flagged sessions across both
plus 4 uncommented SSH keys on IX.
Critical remediation:
- Forensic evidence preserved before any deletion
- 4 uncommented SSH keys removed from IX (server-side backup retained)
- 16 flagged sessions purged across both servers
- Root passwords rotated via chpasswd
- New WHM API tokens created; 3 stale transfer-* tokens revoked
- Vault entries + 1Password Infrastructure items updated
Forensic deep-dive verdict: patch held. All 7 actual CVE exploit
attempts (botnet IPs hitting /json-api/version) returned HTTP 403.
The "multi-line pass" IOC hits on user sessions were false positives.
Unidentified 76.18.103.222 root session traced to routine SSL
maintenance (zero sensitive endpoints touched).
Skill hardening:
- Added MANDATORY service-token directive to .claude/commands/1password.md
enforcing OP_SERVICE_ACCOUNT_TOKEN from SOPS for all op CLI calls
- Per Mike: memory files alone don't reliably bind agent behavior;
baking governance into skill content loaded at moment of use.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Howard is cleared to proceed with Path A (Graph API role assignment) for
Cascades CA Administrator fix.
Also communicated new approval workflow:
- General tools: Howard can modify OR Claude can execute with Howard/Mike approval
- Projects: require Mike approval, features→roadmap, bugs→bug list
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Synced with Gitea, reviewed 14 commits from GURU-BEAST-ROG:
- Radio show audio processing (Tara voice profile, Q&A extraction, 4090 benchmark)
- Cascades client work (Howard - HIPAA remediation, Entra Connect staging)
- Valleywide client init (app modernization project)
Note detected: Co-host name 'Tom' needs correction in radio show profiles.
Session type: Sync and context review only, no active development.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Appended update to 2026-04-24 session log covering the font change
investigation. Checked bash startup files, Windows Terminal settings,
registry console keys, raw PowerShell output bytes, and installed
fonts. No root cause found — user will report next real-time
occurrence for definitive diagnosis.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add local rate table (pulled 2026-04-24) for all 7 labor products; always
set price_retail explicitly — Syncro API does not auto-apply product rates
- Replace vault-based key fetch with inline case block on identity.json user;
both Mike and Howard keys included for correct per-user attribution
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Comprehensive emergency response documentation:
- Complete timeline from 0935 arrival to 1115 handoff
- All 4 servers documented with current status
- HP ProLiant: NVRAM resolved, iLO pending
- Dell VWP-QBS: Boot issue resolved
- XenServer: OFFLINE (CRITICAL - Server3 VM down)
- 4th server: Appears fine
Work status:
- Timer running (~1h40m so far)
- Switching to laptop to continue
- XenServer restoration is highest priority
Created comprehensive session log:
- session-logs/2026-04-22-valleywide-power-outage-emergency-response.md
- Complete status, timeline, next steps, recommendations
- Ready for laptop continuation
All changes synced to Gitea for seamless handoff.
Machine: Mikes-MacBook-Air.local
Timestamp: 2026-04-22 11:05:39
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Complete vault and SOPS setup on Mac from scratch. Fixed critical
get-token.sh bugs (variable collision + directory depth), validated
vault sync from Windows, tested all 5 tiers.
Key accomplishments:
- Installed SOPS 3.12.2 + age 1.3.1 via Homebrew
- Configured age private key and SOPS environment
- Cloned vault repository with 6 SOPS files
- Fixed vault.sh line endings (CRLF → LF)
- Token acquisition working: 4/5 tiers (defender not consented)
- Created comprehensive VAULT-SETUP-GUIDE.md (522 lines)
- Removed guru-rmm submodule auto-update from sync script
Remediation-tool now portable across Mac/Windows. Ready for Howard setup.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Decommissioned cloudflared tunnel, migrated 9 services to direct CF proxy,
removed ~22 stale pfSense rules and 22 unused aliases.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- clients/glaztech/session-logs/2026-04-20-session.md: Exchange Online
transport rule created to bypass DMARC for clearcutglass.com
- session-logs/2026-04-20-session.md: update with 12:55 work
- .claude/commands/syncro.md: fix billing workflow — comment endpoint
silently drops time fields; use timer_entry endpoint instead
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extract Ollama docs and PROJECT_STATE locking protocol to on-demand
reference files. Trim Work Mode to detection table only. Remove verbose
anti-pattern examples and credential encryption details.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rewrote get-token.sh: tiered app system (investigator/exchange-op/user-manager/tenant-admin/defender)
- Updated SKILL.md, command, gotchas, checklist, graph-endpoints for new app suite
- Cascades breach check: mailbox clean, inbound phishing received by John, DMARC gap noted
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Created comprehensive show prep using breaking news from April 9-18, 2026:
- Artemis II post-flight news conference (April 16)
- IonQ quantum 'Holy Grail' breakthrough (April 14)
- 90% cancer detection from stool samples via AI (April 9)
- Stanford AI Index 2026 findings
- RAM shortage hitting consumers today
Replaced recycled CES content with current, timely stories.
File: projects/radio-show/episodes/2026-04-18-tech-that-makes-life-fun/show-prep-fresh.html
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixed Cascades pfSense password in vault (a6A6c6fe→Th1nk3r^99, moved from
dataforth to cascades-tucson). Ollama exposed via Tailscale for Howard
(100.92.127.64:11434, firewall restricted to 100.0.0.0/8). Reviewed
Howard's first full day of work on shared system.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
589G OwnCloud data moved from cache SSD to disk7 array (2h49m rsync).
Cache dropped from 82% to 34%. MariaDB + Discourse recovered and running
7h+ healthy. Share config changed to no-cache permanently.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
