---
name: reference_client_wifi_inventory
description: Where client Wi-Fi networks are recorded so techs connect onsite without asking — vault holds passwords, wiki holds the readable index.
metadata:
  type: reference
---

We are building a fleet-wide client Wi-Fi list so anyone onsite can connect without asking
for the SSID/password again. Established 2026-07-06 (Howard).

**Split (security-driven):**
- **Passwords/PSKs → SOPS vault**, `clients/<slug>/wifi.sops.yaml`, one file per client.
  Per network use `credentials.<key>_ssid`, `credentials.<key>_password`, optional
  `credentials.<key>_auth` (`<key>` = `staff`/`guest`/`voice`/`warehouse`...). Everything under
  `credentials:` is encrypted at rest, so the entry is self-contained for an importer. Write it
  with the `vault` skill's `vault-helper.sh new`/`set` (NEVER paste a Wi-Fi password into chat,
  a ticket, a session log, or the wiki).
- **Readable index → wiki**, `wiki/reference/client-wifi.md` (registered in `wiki/index.md`
  under a new **Reference** section). Client / SSID / band / location / vault-field — NO passwords.
  It lives under `wiki/reference/` so `/wiki-compile` never clobbers it (compile only touches
  clients/projects/systems slugs).

**Capture flow onsite:** ask "Wi-Fi name + password? staff vs guest? which should our machines
use?" → store in vault via vault-helper → add a row to the wiki inventory → `/sync`.

**Importer is DEFERRED** (Howard chose "structure only for now" 2026-07-06). Planned end state:
a `/wifi import <client>` that reads the vault file, builds a Windows WLAN profile per network
(`netsh wlan add profile`), and auto-connects. Interim: read the password with
`vault.sh get-field clients/<slug>/wifi credentials.<key>_password` and connect manually.
Build the importer/`/wifi` skill once a few real networks exist.

Keep `<slug>` identical to the client's `wiki/clients/<slug>.md` slug so vault + wiki + article line up.