# 2026-07-01 — /self-check run + skill-registry description trim (GREEN)

## User
- **User:** Mike Swanson (mike)
- **Machine:** GURU-5070
- **Role:** admin

## Session Summary

Ran `/self-check` (the fleet-conformance probe) on GURU-5070. The deterministic probe graded
AMBER: 83 PASS, 1 WARN, 0 FAIL, 35 INFO against provisional manifest 1.0.0. The single warning
was `harness.registry_budget` — the sum of all repo SKILL.md frontmatter `description:` fields
was 15,658 chars against the 10,500 budget (35 skills), i.e. registry bloat taxing every
session's context load.

Ran both semantic passes the skill mandates on a full check. Pass 1 (rogue-memory
contradiction vs identity.json/settings): clean. The one suspect — `feedback_ollama_tier0_routing.md`
headlining qwen3:14b while this box's identity.json sets `prose_model: qwen3:8b` — self-resolves:
the memory body instructs reading `prose_model` from identity.json and documents that 12 GB boxes
like GURU-5070 get 8b (its Python example hardcoding 'qwen3:14b' is cosmetic only).
Pass 2 (command-vs-standard): `time-entry-protocol.md` still defers to `/syncro` as SSOT and both
agree add_line_item is normal billing with timers outlier-only — no drift.

Mike asked to trim the descriptions and re-publish. Measured with the probe's own awk logic
(frontmatter-only, description block until next top-level key). Trimmed 23 skills' descriptions
from multi-paragraph essays to single ~250-290 char lines, keeping distinctive trigger keywords
and gating notes. Before cutting, verified every load-bearing fact (tenant IDs, endpoints,
communityId 622, azcomp4587, B2 accountId, cmdkey/SYSTEM gotchas, SQLX_OFFLINE, etc.) already
exists in each SKILL.md body — nothing lost, only deduplicated. Registry total: 15,658 -> 9,786
chars (~700 headroom).

Copied the 23 trimmed SKILL.md files to `~/.claude/skills/` so the repo-vs-global duplicate
check stays "identical" rather than flipping to divergent-WARN. Re-ran with `--publish`:
**Grade GREEN** (84 PASS / 0 WARN / 0 FAIL / 35 INFO), census published to coord as component
`selfcheck_GURU-5070 = GREEN`.

## Key Decisions

- Trimmed descriptions in-place with a Python script implementing the probe's exact awk
  counting logic (frontmatter description block only), rather than eyeballing — the first
  naive measurement (whole-file grab) wildly overcounted and would have led to wrong targets.
- Kept distinctive trigger keywords in every trimmed description (skill routing depends on
  them); moved nothing that wasn't already duplicated in the SKILL.md body.
- Verified body coverage of load-bearing facts (grep per key fact) BEFORE deleting them from
  frontmatter, instead of blindly relocating text.
- Trimmed 4 extra skills (mailprotector, rmm-audit, remediation-tool, gitea) beyond the
  minimum needed, to build ~700 chars of headroom so the next added skill doesn't re-trip
  the WARN.
- Synced trimmed files to `~/.claude/skills/` immediately to avoid creating repo/global
  divergence (the "same skill, different behavior" failure the duplicates check exists for).
- Semantic memory pass: judged from MEMORY.md index one-liners + targeted file reads instead
  of opening all ~200 memory files; only opened the one genuine suspect.

## Problems Encountered

- Initial description measurement (awk over whole file with `head -50`) gave ~80k total vs the
  probe's 15,658 — the probe counts ONLY the frontmatter description block between the `---`
  markers. Resolved by reading `check_harness_smoke()` in
  `.claude/skills/self-check/scripts/self-check.sh` and reusing its exact awk.
- First trim pass landed at 10,272/10,500 — technically passing but with only ~230 chars
  headroom. Trimmed 4 more skills to reach 9,786.

## Configuration Changes

Modified (frontmatter description trimmed to one line; body untouched), in BOTH
`.claude/skills/<name>/SKILL.md` and `~/.claude/skills/<name>/SKILL.md`:

- agy, alis, b2, bitdefender, coord, datto-edr, discord-dm, drive-map, frontend-design,
  gitea, grok, gururmm-build, mailprotector, onboard365, packetdial, remediation-tool,
  rmm-audit, rmm-search, screenconnect, synology, unifi-wifi, vault, yealink-ymcs
  (23 skills)

Created:
- `session-logs/2026-07/2026-07-01-mike-self-check-skill-desc-trim.md` (this log)

Scratch (session temp dir, not in repo): `trim_descs.py` (the trim script).

## Credentials & Secrets

None surfaced, created, or rotated.

## Infrastructure & Servers

- Coord API `http://172.16.3.30:8001` — reachable; census published as component
  `selfcheck_GURU-5070`, state GREEN.
- Capability tier: ollama_local (Ollama 0.30.11 at localhost:11434, fallback Beast
  100.101.122.4:11434, prose_model qwen3:8b). cargo/node/gh/op present; docker absent
  (capability off, expected).

## Commands & Outputs

- Probe: `SELFCHECK_TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)" bash .claude/skills/self-check/scripts/self-check.sh report` -> AMBER, sole WARN `harness.registry_budget` (15658 > 10500).
- Per-skill budget measurement: probe's awk (frontmatter `description:` block, stop at next
  `^[A-Za-z0-9_-]+:` or closing `---`), summed over `.claude/skills/*/SKILL.md`.
- Re-run + publish: `... self-check.sh --publish` -> GREEN, `[OK] Published census to coord: component selfcheck_GURU-5070 = GREEN`.

## Pending / Incomplete Tasks

- The 23 trimmed SKILL.md files sync fleet-wide with this /save's commit; other machines
  re-run `/self-check` after pulling to clear their own registry_budget WARN and republish.
- Baseline manifest still provisional (1.0.0): 25 skills + 4 commands report as census
  candidates — ratification of `baseline/manifest.json` (via fanout + aggregate) still ahead.
- Standing INFO: 27 commands + 35 skills duplicated repo vs `~/.claude` (identical today;
  probe flags divergence if it happens). Docker absent — deliberate.

## Reference Information

- Probe engine: `.claude/skills/self-check/scripts/self-check.sh` (budget logic in
  `check_harness_smoke()`, ~line 588).
- Baseline: `.claude/skills/self-check/baseline/manifest.json` — `harness.registry_desc_budget_chars: 10500`;
  `command_standard_links` has one pair (syncro-billing: `.claude/standards/syncro/time-entry-protocol.md`
  must defer to `/syncro`) — verified intact and non-contradictory.
- Registry description totals: before 15,658 / after 9,786 (budget 10,500).
- Semantic pass artifacts checked: `.claude/memory/feedback_ollama_tier0_routing.md`,
  `.claude/standards/syncro/time-entry-protocol.md`, `.claude/commands/syncro.md`.

## Update: 15:48 PT — errorlog analysis + five harness improvements

### Session Summary

Mike asked for an analysis of the ClaudeTools harness based on usage + errorlog.md.
Full-log analysis (391 entries, 2026-06-14..07-01: 93 friction / 44 corrections / 250 exec):
40% of volume was two skills' machine-generated noise (bitdefender 111, synology 45);
top repeat refs proved two documented rules not sticking (feedback_windows_quote_stripping
9x, feedback_tmp_path_windows 6x); no linter existed for the corpus. Delivered a ranked
improvement list, then implemented five items across two rounds on Mike's go.

Round 1: (a) log-skill-error.sh same-day DEDUP — identical date+machine+skill+message
bumps a trailing " (xN)" counter instead of appending a duplicate line; (b) fixed the
machine-name bug — helper read `.machine_name // .hostname` from identity.json but the
real field is `.machine`, so it always fell back to raw hostname (the Howard-Home vs
HOWARD-HOME case-drift cause); (c) verified gz.py (bitdefender) already carries the
expected-error suppression (_should_log_error + GZ_SUPPRESS_ERRORLOG + OID validation)
— no work needed; (d) errorlog.md header documents the (xN) convention.

Round 2: (e) NEW skill `errorlog-dream` (.claude/skills/errorlog-dream/) — the linter the
log was waiting for; sibling of memory-dream: reports top contexts, repeat refs, cross-day
noise clusters, [RESOLVED] entries, machine drift, archive candidates; PROPOSED section
with [STRENGTHEN?]/[SUPPRESS?]/[ARCHIVE?]; --apply-archive rotates >60-day entries to
errorlog-archive/YYYY-MM.md; fixture selftest green; live run reproduces the manual
analysis. (f) vault.sh get-field null guard (D:/vault repo) — a missing field made yq
print literal "null" (4 chars) which callers consumed as a real credential (both
wrong-4-char-value incidents); now errors exit 1 and prints the entry's key paths.
(g) Discord hardening — post-bot-alert.sh: payload via stdin not argv (argv encoding
layer mangled non-ASCII into 50109) + >1900-char truncation; discord-dm.sh: lossless
newline-aware chunking into <=1900-char sequential messages (50035 fix that preserves
long content); live DM test to Mike with em-dash/smart-quotes/arrow passed.

Round 3 (Mike: "keep going with the EncodedCommand wrapper and /tmp hook"):
(h) NEW .claude/scripts/ps-encoded.sh — encode <file|-> prints a paste-safe
powershell -EncodedCommand one-liner (ScreenConnect/plink); rmm <agent-uuid> <file>
dispatches via GuruRMM as command_type=shell (single quote-free base64 token) with
timeout_seconds + optional --user-session, then polls /api/commands/{id}; size guards
(warn 4KB / refuse 6KB encoded, --force) encode the ~7KB agent body limit. Verified:
byte-exact roundtrip; live powershell exec with embedded quotes and UNC \\ intact
(len=21 test). Strengthened feedback_windows_quote_stripping memory + MEMORY.md index
+ /rmm command doc (new "Quote-safe dispatch" section) to lead with the wrapper.
(i) NEW .claude/hooks/block-tmp-path.sh PreToolUse hook — blocks Bash WRITES to /tmp
on Windows only (redirects, tee, -o/--output, cp/mv/mktemp targets; reads and quoted
mentions pass); wired as second PreToolUse Bash hook in settings.json and added to
baseline manifest (required_hook_files + required_settings_hooks) so self-check
enforces fleet-wide. Effective for NEW sessions.

Self-check re-run: caught my own /rmm doc edit as repo-vs-global divergence (WARN),
reconciled, published GREEN (86 pass / 0 warn) to coord.

### Key Decisions

- Dedup window = same calendar day (identical full line), not a rolling 24h — deterministic,
  no timestamps needed, matches the (xN) display convention.
- errorlog-dream mirrors memory-dream's posture exactly: read-only default, one additive/
  rotational mutation (--apply-archive), judgment stays in PROPOSED for the operator.
- ps-encoded.sh dispatches as command_type=shell (cmd.exe) not powershell — avoids a
  nested powershell-in-powershell spawn; the base64 token traverses cmd.exe unparsed.
- Scripts for ps-encoded MUST be authored with the Write tool — Git-bash heredocs
  collapse \\ to \ even single-quoted (proved by od during testing; documented in the
  memory + /rmm doc).
- /tmp hook is Windows-gated (uname MINGW/MSYS/CYGWIN) so shared settings.json does not
  block Mac/Linux machines where /tmp is one real directory.
- vault get-field lists KEY PATHS only (never values) on failure — no secret leakage in
  the error path.
- discord-dm chunks add NO markers so the receiver can copy-paste chunks back together
  verbatim; post-bot-alert truncates instead (alerts are one-liners by contract).

### Problems Encountered

- Test harness bugs, not production bugs: jq --rawfile with /dev/stdin fails on Windows
  jq (no /proc) — rebuilt test events with jq -n --arg; cmd.exe /c from Git-bash had /c
  MSYS-converted to C:\ opening an interactive cmd (2-min timeout) — used powershell.exe
  directly. Both logged to errorlog as [friction].
- selftest fixture initially put both "old" entries in the same month — spread to d(95)/
  d(65) to exercise the month-split path.
- cp/mv /tmp pattern missed line-start cp (required leading whitespace) — anchored with
  (^|[[:space:]]|;|\|).
- The UNC backslash "loss" during wrapper testing was the Git-bash heredoc collapsing \\
  BEFORE encoding (od-verified) — wrapper itself byte-exact; became the Write-tool
  authoring rule.

### Configuration Changes

Created:
- .claude/skills/errorlog-dream/{SKILL.md, scripts/errorlog_dream.py, scripts/selftest.py}
  (+ copies in ~/.claude/skills/errorlog-dream/)
- .claude/scripts/ps-encoded.sh
- .claude/hooks/block-tmp-path.sh (exec bit set via git update-index --chmod=+x)

Modified:
- .claude/scripts/log-skill-error.sh (dedup pass + .machine field fix + doc header)
- errorlog.md (header documents (xN); 2 new friction entries from testing)
- D:/vault/scripts/vault.sh (get-field null guard + key-path listing) [vault repo]
- .claude/scripts/post-bot-alert.sh (stdin payload + truncation)
- .claude/scripts/discord-dm.sh (chunking loop)
- .claude/memory/feedback_windows_quote_stripping.md (+ mechanical-fix headline)
- .claude/memory/MEMORY.md (index line updated for the same memory)
- .claude/commands/rmm.md (+ Quote-safe dispatch section; synced to ~/.claude/commands/)
- .claude/settings.json (second PreToolUse Bash hook: block-tmp-path.sh)
- .claude/skills/self-check/baseline/manifest.json (required_hook_files +
  required_settings_hooks += block-tmp-path)

### Credentials & Secrets

None created/rotated. vault get-field behavior change: missing/null field now exits 1
with a key-path listing (keys only, values never printed).

### Commands & Outputs

- Lint the log: `bash .claude/scripts/py.sh .claude/skills/errorlog-dream/scripts/errorlog_dream.py [--apply-archive]`
- Quote-safe PS dispatch: `bash .claude/scripts/ps-encoded.sh rmm <agent-uuid> script.ps1 --timeout 120 [--user-session]`
  / paste one-liner: `... encode script.ps1`
- Selftests: errorlog-dream selftest.py all-pass; discord chunker lossless (3-chunk +
  hard-split); /tmp hook 11-case matrix + grok decision JSON; EncodedCommand len=21 UNC proof.
- Final: self-check GREEN 86/0/0 published (selfcheck_GURU-5070).

### Pending / Incomplete Tasks

- Remaining from the improvement list: backend health cache (agy/grok/rmm/coord chronic
  failures — skip retries when a backend is known-down) and Syncro preflight gates in the
  skill script (priority format, product_category null check, prepay detail-GET, unbilled
  line-item check before invoice).
- Howard-Home env checks (websocket-client, ff.py daemon, tailscale backend state) as
  self-check capability checks — proposed, not built.
- Other machines: pull + rerun /self-check (new hook enforced), and their identity.json
  case drift (HOWARD-HOME vs Howard-Home) normalizes automatically via the .machine fix.
- errorlog-dream --apply-archive has nothing to rotate until entries age past 60 days
  (log starts 2026-06-14).

### Reference Information

- New skill: .claude/skills/errorlog-dream/ ; wrapper: .claude/scripts/ps-encoded.sh ;
  hook: .claude/hooks/block-tmp-path.sh
- Errorlog stats at analysis time: 391 entries, top contexts bitdefender 111 / synology 45 /
  rmm 30; repeat refs quote-stripping 9x, tmp-path 6x; machines Howard-Home 256 / GURU-5070 116.
- RMM dispatch shape: POST $RMM/api/agents/{id}/command {command_type, command,
  timeout_seconds[, context]}; poll GET $RMM/api/commands/{command_id}.
- Discord test message id 1522005953896120494 (mike DM, non-ASCII survival test).

## Update: 20:06 PT — BirthBio Gmail folder cleanup + Discord bot to Fable 5

### Session Summary

Two client/infra tasks after the harness work. First, BirthBio (birthbiologic.com,
tenant 19a568e8-9e88-413b-9341-cbc224b39145): Mike reported Gmail-import folders named
"INBOX\<FolderName>". Swept all 21 licensed mailboxes via remediation-tool (investigator
tier): the artifact was concentrated in bburgess (30 top-level folders literally named
with flattened label paths like "INBOX/Consultants & Vendors/Kintone", some carrying real
child subtrees, plus 5 [Gmail]/[Imap] leftovers) and one empty [Imap]/Drafts on mster.
ksteen's AATB/EBAA + Fax/Scan + PTO/Payroll Info + Shipping/Couriers and ameneely's
Amnion/Chorion Video are REAL label names containing slashes - left untouched.

Enabler work: Graph v1.0 metadata confirmed a native mailFolder move action; the Exchange
Operator SP holds Graph Mail.ReadWrite in-tenant (verified via appRoleAssignments after
fixing JWT base64url decode + URL-encoding the $filter), but get-token.sh had no
exchange-op-to-Graph tier - added `exchange-op-graph` tier (same app b43e7342, Graph
audience) to the skill permanently. On Mike's YES: created 3 intermediate parents, moved+
renamed all 30 INBOX/ folders into their real hierarchy (subtrees + ~700 items rode along),
renamed [Gmail]/Fire Inspectin -> Fire Inspectin (4 items kept), deleted 4+1 verified-empty
artifacts. 39 actions, 0 failures; both mailboxes verify clean. Report:
clients/birth-biologic/reports/2026-07-01-bburgess-gmail-folder-cleanup.md. Ticket #32451
(the email-migration ticket; #32187 is the SharePoint one) got a public emailed comment
(id 421704524, GET-verified) + [SYNCRO] bot-alert with link.

Second, Mike asked to put "the bot" on Fable 5: the ClaudeTools Discord Bot (NSSM service
ClaudeToolsDiscordBot on GURU-BEAST-ROG, Claude Agent SDK + OAuth subscription, Claude Code
2.1.183). Flipped CLAUDE_MODEL=claude-sonnet-4-6 -> claude-fable-5 in
C:\Users\guru\ClaudeTools\projects\discord-bot\.env via RMM, restarted the service, and
verified the startup log line "Claude model: claude-fable-5" + "Bot is ready". Updated the
repo defaults (bot/config.py + .env.example) in the acg-discord-bot submodule, commit
a35bd1bf pushed to main via the internal Gitea URL (external hostname auth failed - known
GCM shadowing); parent gitlink advances with this /save.

### Key Decisions

- bburgess restructure via Graph folder MOVE (subtree+items intact) not per-message moves;
  verified move action exists in $metadata before proposing.
- Deletes gated on live empty re-verification at execution time; [Gmail]/Fire Inspectin
  renamed in place instead of move+delete (same result, zero item handling).
- Ticket routing: #32451 chosen because Mike's prior email-migration status comments live
  there; #32187 is Datto->SharePoint. Posted public+emailed per Mike's explicit choice.
- Added exchange-op-graph tier to get-token.sh rather than free-handing a token mint -
  skill-first, durable for future mailbox-folder work.
- Discord bot: .env override + service restart for the live change; repo defaults changed
  too so redeploys match. Bot uses Agent SDK/Claude Code runtime, so Fable API quirks
  (always-on thinking, no sampling params, refusal fallbacks) are handled by the runtime.

### Problems Encountered

- exchange-op default token is EXO-audience; decoding roles with plain base64 -d failed
  (JWT base64url) and nearly produced a wrong "no Mail roles" conclusion - fixed decode
  (tr '_-' '/+' + padding) per the errorlog lesson, then read SP appRoleAssignments.
- Graph $filter with unencoded spaces returned empty via curl - use curl -G --data-urlencode.
- [Gmail]/Trash/Insurance seen in the first sweep was already gone at execution (evidently
  Outlook-side cleanup); executor enumerates live so it skipped harmlessly.
- Submodule push to git.azcomputerguru.com failed auth (GCM shadowing) - pushed by explicit
  SHA to internal http://172.16.3.20:3000 and ls-remote verified (a35bd1bf).
- nssm/claude not on SYSTEM PATH via RMM - used Get-Service/Restart-Service and the
  user-profile claude.exe path instead.

### Configuration Changes

- .claude/skills/remediation-tool/scripts/get-token.sh: + exchange-op-graph tier (repo +
  ~/.claude copies).
- clients/birth-biologic/reports/2026-07-01-bburgess-gmail-folder-cleanup.md: created.
- BEAST C:\Users\guru\ClaudeTools\projects\discord-bot\.env: CLAUDE_MODEL=claude-fable-5
  (machine-local, not in git).
- projects/discord-bot submodule: bot/config.py default + .env.example -> claude-fable-5
  (commit a35bd1bf, pushed to main; .env.example auth comments also tidied).

### Infrastructure & Servers

- BirthBio tenant 19a568e8-9e88-413b-9341-cbc224b39145; Exchange Operator SP in-tenant
  id bab4699b-32a3-4434-9cad-7a4a08cc4d9e (Graph roles: Mail.ReadWrite,
  MailboxSettings.ReadWrite, User.Read.All, User.RevokeSessions.All, Organization.Read.All).
- Discord bot: GURU-BEAST-ROG (RMM agent 5233d75b-f589-43c4-b96e-cfa75365a78d), NSSM
  service ClaudeToolsDiscordBot, log C:\Users\guru\ClaudeTools\projects\discord-bot\logs\bot.log.

### Commands & Outputs

- Folder executor + read-only mapper in session scratchpad (bb_folder_fix.py /
  bb_folder_map.py); action log bb_actions.json (scratchpad).
- Graph-audience exchange-op token: get-token.sh <tenant> exchange-op-graph.
- Syncro comment POST via jq-file + --data-binary + GET-verify pattern; alert via
  post-bot-alert.sh (new stdin payload path worked in production).

### Pending / Incomplete Tasks

- Watch Fable 5 usage burn on the shared Max subscription (bot + interactive share limits);
  fallback is a one-line .env change to claude-opus-4-8 + service restart.
- BirthBio: ksteen/ameneely slash-named folders are intentional - documented in the report
  so nobody "fixes" them later.

### Reference Information

- Syncro #32451 internal id 112986219, comment 421704524; customer Birth Biologic 17983014.
- Submodule commit a35bd1bf1758ac462abdf05bdd9ee6a1c7b427ee (acg-discord-bot main).
- Bot model verification log lines: 2026-07-01 20:01:07 "Claude model: claude-fable-5".

## Update: 2026-07-02 06:22 PT — CrowdStrike Falcon spec + framework build (Tasks 0-3)

### Session Summary

Continued the CrowdStrike thread. Added the developer.crowdstrike.com API reference to the
RMM_THOUGHTS entry (OAuth2, Sensor Download + Installation Tokens for install, Hosts/RTR/
policy for management), then ran `/shape-spec` to produce a full spec at
projects/msp-tools/guru-rmm/specs/crowdstrike-falcon/ (plan/shape/references/standards).
Mike's shaping input: multi-tenant per-client CIDs from day one; MODULAR — each partner
enables with their own API creds/region; RTR + alert ingestion OUT of scope; creds handled
safely; uniform plugin framework preferred; P1, needs a draft very soon. Design decision:
build CrowdStrike as plugin #1 on a vendor-agnostic integrations framework (generalizes the
proven mspbackups shape) rather than a one-off.

Then implemented the server half, Tasks 0-3, each committed + pushed to guru-rmm main and
VERIFIED green by the pipeline (CI [ci-version-bump] on top of each = successful Linux
server build — the real compile gate; local cargo check is blocked on GURU-5070 by a
missing MSVC linker, logged as friction against reference_guru5070_rust_toolchain):
- Task 1 (8b75274): migration 065 — 5 vendor-agnostic tables (integrations,
  integration_credentials [reuses credentials TEXT/base64 encryptor shape],
  integration_client_mappings, integration_sync_state, integration_agent_links), per-
  partner, all IF NOT EXISTS.
- Task 2 (cac7e1d): IntegrationPlugin trait (axum::async_trait, object-safe) + PluginRegistry
  + credential encrypt/decrypt chokepoint (crypto::Encryptor) + full runtime-sqlx DB layer.
  KEY FINDING: codebase uses RUNTIME sqlx queries, not query! macros -> NO .sqlx regen ever
  needed for this feature.
- Task 3 (6c83a03): generic /api/integrations REST (list/upsert/delete/credentials[encrypt
  chokepoint, GET returns configured-bool only]/test[dispatch to plugin]/mappings/sync-state);
  added registry: Arc<PluginRegistry> to AppState.

Also: restarted the BEAST Discord bot service (came back up on claude-fable-5 21:15). Server
framework (Tasks 1-3) complete + building; next is Task 4 (CrowdStrike client: OAuth2 +
region + Sensor Download/Installation Tokens/Hosts wrappers, test_connection + sync).

### Key Decisions

- Vendor-agnostic framework FIRST (5 generic tables + trait + registry + generic API), so
  SentinelOne/Guardz/etc. are new modules not new schema. Matches Mike's "modular" + the
  roadmap Integrations Center design principle.
- Encrypted-cred columns are TEXT/base64 (matches crypto.rs Encryptor + credentials table),
  NOT BYTEA as references.md loosely wrote.
- Runtime sqlx (no query! macros) -> no .sqlx cache churn; big de-risk.
- Pipeline build is the compile gate (build-pipeline standard); each task pushed by explicit
  SHA + rebased over concurrent CI version-bumps; verified green via the version-bump marker.
- v1 single-partner resolution (SELECT id FROM partners ... LIMIT 1) like mspbackups; schema
  carries partner_id everywhere for later multi-partner scoping.
- Containment/lift is the one management WRITE kept in v1 scope; RTR + alerts deferred.

### Problems Encountered

- Local cargo check blocked: no MSVC link.exe on GURU-5070 (vcvars64.bat not found under VS
  roots) — env, not code. Used the pipeline (Linux) as the gate; logged friction.
- JWT roles decode: exchange-op earlier task needed base64url (tr _- /+ + pad); noted.
- Repeated non-fast-forward pushes from CI [ci-version-bump] commits landing between my
  pushes — rebased onto origin/main each time and pushed by SHA.

### Configuration Changes

- projects/msp-tools/guru-rmm (submodule, main):
  - specs/crowdstrike-falcon/{plan,shape,references,standards}.md (new, dd646f6)
  - server/migrations/065_integrations_framework.sql (new)
  - server/src/db/integrations.rs (new), server/src/db/mod.rs (+pub mod)
  - server/src/integrations/mod.rs (new), server/src/main.rs (mod + AppState.registry)
  - server/src/api/integrations.rs (new), server/src/api/mod.rs (+pub mod + routes)
  - docs/RMM_THOUGHTS.md (+CrowdStrike thought + API reference)
- errorlog.md: +1 friction (MSVC linker).

### Commands & Outputs

- Spec commit dd646f6; Task1 8b75274; Task2 cac7e1d; Task3 6c83a03 (all guru-rmm main,
  pipeline-green via ci-version-bump).
- Push pattern: commit -> git rebase origin/main -> git push origin <sha>:refs/heads/main
  -> git ls-remote verify; poll origin/main for ci-version-bump = build OK.

### Pending / Incomplete Tasks

- Task 4: server/src/integrations/crowdstrike/{mod,client}.rs — OAuth2 client-credentials +
  region base URL map (US-1/US-2/EU-1/US-GOV), Sensor Download + Installation Tokens + Hosts
  wrappers; implement test_connection + sync.
- Task 5: register CrowdStrikePlugin in PluginRegistry::build() + sync worker in main.rs.
- Task 6: deploy job (migration 066) + agent-side install (Task 7, Win first).
- Task 8: dashboard (Integrations page + Falcon panels). Task 9: e2e verification.
- Parent gitlink for guru-rmm still lagging; advance on a later /sync if desired.

### Reference Information

- Spec dir: projects/msp-tools/guru-rmm/specs/crowdstrike-falcon/ (plan.md = source of truth,
  [DONE] markers per task).
- CrowdStrike API: developer.crowdstrike.com/api-reference (OAuth2 client creds; Sensor
  Download 13 ops, Installation Tokens 9, Hosts 10, Host Group 9; regional base URLs).
- guru-rmm main after Task 3 + CI bump: ea148e4.