Seeded from March MDM session logs + Syncro (customer 33809612) + vault.
Google Workspace shop with ManageEngine MDM (Zoho); documents the
dual-EMM self-enrollment trap resolved 2026-03-24.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a complete PowerShell-based malware scanning toolkit:
- Invoke-GuruScan.ps1: main orchestrator running RKill, AdwCleaner,
Emsisoft, HitmanPro, and ESET in sequence with pre/post cleanup,
whitelist support, ForceRemove blacklist, and -Headless switch
- Invoke-PostRebootCleanup.ps1: post-reboot temp-user session that
shows a fullscreen splash, verifies boot-time cleanup completed,
removes scanner files, and restores the original user login name
- Download-Scanners.ps1: downloads/refreshes scanner EXEs
- Get-ScanSummary.ps1: parses results.json with optional Ollama AI analysis
- Invoke-Remediation.ps1: re-runs scanners in clean mode
Key features: exit-code-based reboot detection, whoami-based user
capture (SYSTEM-safe via quser fallback), domain\user and local
MACHINE\user restore on login screen after cleanup reboot.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
/wiki-compile: new skill that seeds or refreshes wiki client articles
from session logs and live Syncro PSA data.
- Three modes: seed (new article), refresh (surgical update), full (--full flag)
- Syncro enrichment for client targets: customer profile, contacts,
open tickets, recent invoices, asset count
- Ambiguous customer search: pause and ask user to pick
- Customer not found: graceful warn + continue with session logs only
- Syncro is authoritative for all billing fields (hours, rate, contract type)
- Refresh mode: surgical edits only (hours, active tickets, frontmatter)
- Seed/full: Ollama qwen3:14b synthesis; Claude-direct fallback
- Asset count in Profile only — no asset detail tables in wiki
- Commits and pushes after write
/wiki-lint: add Step 6 — Syncro Live-Check
- Pulls live prepay_hours for every client article with a Syncro customer ID
- Auto-fixes stale hours in place; commits fixes in one batch
- Flags articles with open tickets and stale compiled date for review
- Adds Syncro section to lint report output
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Migration 20260526_150000 adds nullable due_at datetime column. Model, schemas
(create/update/response), and sync.sh display updated. Sync output now shows
due:YYYY-MM-DDTHH:MM alongside any todo with a due date.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
New coord_todos table and API endpoints (GET/POST/PUT/DELETE /api/coord/todos)
supporting manual and auto-created items, sub-tasks via parent_id, and inclusive
for_user/for_machine filters (OR-null) for sync/save display. sync.sh Phase 7
now shows pending todos grouped by project after every sync. CLAUDE.md documents
auto-creation behavior for unresolved follow-up. Web/email pricing doc updated:
block time rate clarified, INKY reference removed, dates updated.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Points to main HEAD after merging fix/audit-2-remediation (BUG-002/003/006 fixes).
Feature branch feature/log-finding-dispatch preserved separately.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Per the 2026-05-25 re-audit + Mike's decision (option b): the safe-rollout
promotion gating these docs describe/test is NOT live (update_rollouts /
update_health_metrics written-but-never-read; crash detection dead until the
unmerged BUG-002 fix). Added a [WARNING] STATUS banner to the test plan, verify
script, and the two 'complete' summaries so they aren't trusted as validating a
working feature. Automation is a roadmap Phase-2 item requiring a full re-spec.
Saturn is decommissioned. The GuruRMM build server at 172.16.3.30
is correctly named 'gururmm-build'.
Also fixed wiki standards template that incorrectly listed Neptune
as 172.16.3.30. Neptune is actually the Exchange server at Dataforth
(172.16.3.11), not the GuruRMM build server.
Updated files:
- PHASE_6_TEST_PLAN.md (all Saturn references)
- verify-rollout-system.sh (comments)
- session-logs/2026-05-25-session.md (all Saturn references)
- .claude/specs/wiki-layer/standards.md (Neptune example)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Created comprehensive test plan covering:
- Test 1: Beta-first build workflow
- Test 2: Health monitoring and crash detection
- Test 3: Promotion workflow with health gates
- Test 4: Rollback and force-downgrade
- Test 5: Dashboard UI testing
- Test 6: End-to-end integration testing
Added verification script for Saturn:
- Checks all 5 phases implementation
- Verifies database tables, source files, routes
- Validates build artifacts and service status
- Provides clear pass/fail status
Usage: Run verify-rollout-system.sh on Saturn before Phase 6 testing.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Problem: macOS hostname command returns 'Mikes-MacBook-Air.local' but
coord messages are addressed to 'Mikes-MacBook-Air/claude-main'. Hook
script was querying for wrong session ID, so messages never displayed.
Fix: Strip .local suffix using bash parameter expansion before building
session ID.
Result: Coord messages now display correctly on macOS machines.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
