{ "schema_version": "1.0.0", "status": "provisional", "derived_from": "GURU-5070", "derived_at": "2026-06-02", "note": "PROVISIONAL baseline, generated from a single known-good machine. V1 of self-check is a CENSUS tool: every machine probes itself, publishes to the coord API, and we refine this manifest from real fleet data (see baseline/README.md). Do NOT treat 'extra' or 'missing' items as authoritative until the fleet census has confirmed them across machines.", "required_tools": [ { "name": "bash", "why": "hooks, scripts, sync, vault wrapper" }, { "name": "git", "why": "repo + submodules + Gitea sync" }, { "name": "jq", "why": "every hook and coord script parses JSON with jq" }, { "name": "curl", "why": "coord API, vault, RMM, all HTTP calls" }, { "name": "sops", "why": "vault decryption (SOPS)" }, { "name": "age", "why": "SOPS age recipient/decrypt" }, { "name": "ssh", "why": "infra access; must be system OpenSSH" } ], "required_python": { "any_of": ["py", "python3", "python"], "why": "JSON sanitizer in check-messages.sh, identity migration, skill scripts. The resolved command is recorded in identity.json (.python.command)." }, "capability_tools": [ { "name": "ollama", "capability": "ollama_local", "why": "Tier-0 local inference (prose/classification)" }, { "name": "cargo", "capability": "rust_build", "why": "GuruRMM / GuruConnect Rust builds" }, { "name": "node", "capability": "node_build", "why": "dashboard / TS builds" }, { "name": "gh", "capability": "github_cli", "why": "optional GitHub operations" }, { "name": "docker", "capability": "containers", "why": "optional container workflows" }, { "name": "op", "capability": "onepassword_cli","why": "1Password fallback credential access" } ], "required_identity_fields": [ "user", "full_name", "email", "role", "machine", "vault_path", "claudetools_root", "platform", "architecture", "python.command", "ollama.endpoint", "ollama.fallback", "ollama.prose_model" ], "optional_identity_fields": ["coord_api", "last_updated"], "required_scripts": [ ".claude/scripts/vault.sh", ".claude/scripts/sync.sh", ".claude/scripts/sync-memory.sh", ".claude/scripts/check-messages.sh", ".claude/scripts/migrate-identity.sh" ], "grok_recovery_scripts": [ ".claude/scripts/recover_grok_session.py" ], "required_hook_files": [ ".claude/hooks/block-backslash-winpath.sh", ".claude/hooks/post-commit.template" ], "grok_hook_files": [ ".grok/hooks/claudetools.json" ], "required_settings_hooks": [ { "event": "PreToolUse", "matcher": "Bash", "command_contains": "block-backslash-winpath.sh", "why": "blocks garbled backslash Windows-path redirects in Git Bash" }, { "event": "UserPromptSubmit", "matcher": "", "command_contains": "check-messages.sh", "why": "injects unread coord messages + dev-mode locks each prompt" }, { "event": "SessionStart", "matcher": "", "command_contains": "sync-memory.sh", "why": "pulls shared memory at session start" } ], "git": { "remote_host_contains": "git.azcomputerguru.com", "remote_host_internal_ip": "172.16.3.20", "remote_note": "On-network machines should use the internal Gitea IP (172.16.3.20:3000) to bypass NPM SSL-renewal blips; off-network may use the domain. Either is acceptable; a non-ACG remote is a FAIL.", "post_commit_hook_expected": true, "post_commit_hook_note": "HOOKS.md mandates the dev-alerts post-commit hook in the main repo and each initialized submodule. Missing = AMBER (informational; reinstall from .claude/hooks/post-commit.template)." }, "skills": [ "1password", "b2", "bitdefender", "frontend-design", "gc-audit", "impeccable", "memory-dream", "remediation-tool", "rmm-audit", "skill-creator", "stop-slop", "theme-factory", "self-check" ], "commands": [ "1password", "autotask", "checkpoint", "context", "create-spec", "feature-request", "forum-post", "gc-feature-request", "import", "inject-standards", "mailbox", "mode", "recover", "remediation-tool", "rmm", "save", "scc", "shape-spec", "sync", "syncro-emergency-billing", "syncro", "wiki-compile", "wiki-lint", "self-check" ], "connectivity": [ { "name": "coord_api", "url": "http://172.16.3.30:8001/api/coord/status", "required": true, "why": "live coordination source of truth" }, { "name": "claudetools_api","url": "http://172.16.3.30:8001/health", "required": false, "why": "main API health" }, { "name": "gitea_internal", "url": "http://172.16.3.20:3000", "required": false, "why": "internal Gitea (git/API on-network)" } ], "memory": { "note": "Deterministic memory checks: MEMORY.md index exists + no orphaned memory files, plus the contradiction_patterns below. A pattern fires ONLY on machines where identity. == when_equals, so it flags a memory only where it is actually a contradiction for THIS box. Kept empty in V1 to avoid false positives; the real semantic contradiction analysis (memories vs identity.json + settings.json + this manifest) is done by the model per SKILL.md, optionally via Ollama Tier-0.", "pattern_schema": { "when_field": "dotted identity.json path, e.g. python.command", "when_equals": "value that makes the grep a contradiction, e.g. python3", "grep": "ERE matched case-insensitively against memory files", "why": "human explanation shown in the finding" }, "contradiction_patterns": [] }, "capability_rules": { "ollama_local": { "tier0_engine": "local ollama (localhost:11434) for summarize/classify/extract/draft", "detect": "curl localhost:11434/api/tags reachable", "fallback_if_unavailable": "ollama_remote" }, "ollama_remote": { "tier0_engine": "remote ollama via identity.ollama.fallback (Beast over Tailscale)", "detect": "localhost unreachable but identity.ollama.fallback reachable", "fallback_if_unavailable": "ollama_none" }, "ollama_none": { "tier0_engine": "NONE - no Tier-0 path. Route low-stakes prose/classification to Tier-1 (haiku) instead of Ollama. Do NOT block work waiting on Ollama.", "detect": "neither localhost nor fallback reachable", "fallback_if_unavailable": null } } }