New /self-check skill: each machine probes its own ClaudeTools harness wiring
(identity.json paths, required tooling, settings.json hooks, skill/command/script
set, vault decrypt, coord/Gitea connectivity, Ollama capability tier) and grades
RED/AMBER/GREEN against a checked-in provisional baseline manifest.
- Capability-tier model: architectural/OS/hardware differences (e.g. no local
Ollama) select a fallback ruleset instead of failing.
- Duplicate detection: flags command/skill names that diverge between the repo
and ~/.claude (the "same /cmd, different behaviour" cross-machine bug);
CRLF-only diffs ignored.
- Memory check: index + orphan detection, plus a model-driven semantic pass for
memories that contradict identity/settings.
- V1 is a census tool: --publish writes a per-machine census to coord
(component selfcheck_<host>); fanout requests the fleet to self-check +
self-remediate + re-publish; aggregate derives the proposed baseline. No
machine ever fixes another.
Reviewed twice by the Code Review Agent; three CRITICAL coord-API bugs and the
CRLF false-WARN found and fixed, verified live against the coord API.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jq -r '.stdout' returns the literal string "null" when the API field is JSON
null, causing the RESULT: grep to fail and fire a false drift alert. Fixes:
- Use `.stdout // empty` so null becomes empty string
- Add FINAL_ST tracking; treat non-terminal status as INFRA-ERROR, not drift
- Increase poll window from 20x4s=80s to 30x4s=120s for slow commands
- Read .stderr and .exit_code; include them in the no-RESULT diagnostic
Live check 2026-06-02: KSTEENBB2025 is PASS (today's alert was a false positive).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Advances the guru-connect pin to pick up the new `channel: stable | beta`
release.yml path (signed beta/test builds) and the roadmap update.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live Sonnet-subagent recompile test inlined real passwords/PSK/RADIUS
secret from a session log into the article; review caught it. Added rule
6b to the synthesis brief: wiki references vault paths only, never raw
secrets (carry-over of values the existing article already discloses is
the only exception).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
First live test of the Sonnet-subagent wiki recompile. Subagent absorbed
the recovered RADIUS log + 2026-05-27 work: added BridgettePSHomeComputer
agent, 3 new Patterns (NPS group membership, rasdial cmdkey, NAT-T key),
2026-05-27 + 2026-06-01 History rows, real Syncro ID 278525. Review step
stripped 3 raw secrets the draft had inlined (back to vault refs) and
verified the Syncro ID against the API; Patterns/History preserved.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Updated GuruRMM submodule to commit 2089e89:
- docs(roadmap): mark BUG-016 and BUG-017 as fixed
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates GuruRMM submodule pointer to commit 30da053:
- BUG-016: StateDirectory=gururmm in systemd template
- BUG-017: OnceLock caching for device_id
Ready for deployment to GURU-KALI for testing.
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
