## User
- **User:** Mike Swanson (mike)
- **Machine:** GURU-5070
- **Role:** admin

## Session Summary

Started as incident response for Valley Wide Plastering: after the weekend G: file-share
migration (SERVER3 → VWP-FILES), the whole office lost G:. Diagnosed via GuruRMM across all
27 VWP agents — the file server (VWP-FILES) was healthy with 0 active SMB sessions, and every
workstation's live G: mapping was a stale persistent `\\192.168.0.20\G-drive` (legacy SERVER3
IP that no longer answers SMB). The GPP drive-map action was "Update", which can't override an
existing persistent drive letter, so the GPO's correct `\\VWP-FILES\G-drive` never applied.
Fixed durably by flipping the `MappedDrives` GPO G: entry to **action=Replace** (+ GPT.ini/AD
versionNumber bump, replicated to PDC + VWP_ADSRVR), then remapped 13 logged-in workstations
live and verified G: accessible. Billed 1.0h warranty on ticket #32418 and emailed the client.

Pivoted to CryoWeave: "mail isn't getting to recipients." Found cryoweave.com is on M365 (not
the IX webserver). SPF already authorized M365 and aligned; the gaps were no DKIM and no DMARC.
Published DMARC (`p=none` → hardened to `p=quarantine`), removed a stale `mail.cryoweave.com`
CNAME pointing at the old Neptune Exchange, onboarded the cryoweave tenant to the ComputerGuru
remediation suite (single-consent link → provision), created an ACG Global-Admin break-glass
`sysadmin@cryoweave.com`, published the M365 DKIM selector CNAMEs and enabled signing (verified
`Status=Valid` and a real Gmail-delivered test showing spf=pass / dkim=pass(d=cryoweave.com) /
dmarc=pass). Stood up a reusable DMARC reporting pipeline: `rua@azcomputerguru.com` shared
mailbox + the cross-domain `_report._dmarc` authorization on azcomputerguru.com's Cloudflare
zone. A message trace showed Greg barely sends via M365 (2 sends/10d, both delivered) — the
real failing mail is likely a non-M365 path (Gmail send-as), which now fails the hardened DMARC.

Built two skills: **discord-dm** (DM org members/channels via the bot — for copy-paste-friendly
delivery of wrapped command lines) and **rmm-search** (flexible, client-scoped machine finder so
queries can't bleed across clients). Then built a fleet-wide **error-logging system**: a canonical
`log-skill-error.sh` helper capturing three categories — execution failures, user **corrections**
of bad assumptions, and preventable **friction** (token-wasting self-inflicted errors). Made it
mandatory in CLAUDE.md + skill-creator, retrofitted ~30 skill scripts (3 parallel sub-agents),
and seeded this session's real corrections + friction. Finished with a memory-dream run that
cross-referenced the new errorlog: merged a true duplicate DM memory I'd just created, corrected
the stale "suite has no Mail.Send" claim, fixed an index dup, and logged a memory-dream defect.

## Key Decisions

- **VWP G: fix = GPP action Replace, not per-machine remap only.** Replace authoritatively
  deletes+recreates G: every refresh, beating leftover persistent `.20` maps for all profiles —
  durable across users/machines. Live remap of logged-in users was the immediate-relief layer.
- **CryoWeave warranty (1.0h) on the migration ticket #32418, customer-visible note.** The outage
  was fallout from our weekend work; logged as warranty, emailed via Syncro (no separate mailbox send).
- **DMARC hardened only to `p=quarantine`, not `p=reject`.** No aggregate-report data yet and an
  unverified non-M365 sender (IX website); quarantine is recoverable. Promote to reject after ~1
  week of clean reports (coord todo `b4b9036e`).
- **DMARC rua → reusable `rua@azcomputerguru.com`, NOT INKY.** INKY is only for INKY-onboarded
  domains. Cross-domain auth needs a per-domain `<domain>._report._dmarc.azcomputerguru.com` record
  (a single `*` wildcard can't match a 2-label reported domain).
- **rmm-search: flexible over faithful.** Per Mike, optimize for first-try correctness (multi-field,
  normalized, subsequence) rather than replicating the UI Omnibox exactly.
- **Error log generalized beyond skills.** Captures corrections + friction too; repeats of documented
  gotchas are the highest-value entries (a rule/memory isn't working). One file, type-tagged, for linting.
- **Retrofit delegated to 3 parallel sub-agents** (disjoint file sets) for speed + consistency;
  coverage verified by grep, not trusted (one agent's "prior pass" claim was misattribution).

## Problems Encountered

- **`is_connected` null fleet-wide** in the RMM API — used `last_seen` recency (<5min) for online state.
- **Fresh-onboard EXO app-only 401** for ~20 min after consent (role/Exchange.ManageAsApp propagation);
  Graph worked immediately. Waited and retried; DKIM/trace then succeeded.
- **GA role assignment 404** right after creating sysadmin@ — new-user directory replication lag; retried, 201.
- **"Suite has no Mail.Send" was wrong** — I read the EXO-audience token's roles; the Exchange Operator
  app has Graph Mail.Send. Mint a Graph-audience token before concluding a permission is missing.
- **memory-dream `--apply-safe` created a duplicate index line** from a false-orphan (keys on `name:`
  slug, not the `(file.md)` link). Removed the dup; logged the defect to errorlog.
- **Friction (logged):** Git-Bash `/tmp` path mismatch, shell env not persisting between Bash calls,
  argv length limit passing large JSON, PowerShell variable case-insensitivity ($guid/$gUid collision).

## Configuration Changes

New:
- `.claude/scripts/log-skill-error.sh`, `.claude/scripts/discord-dm.sh`, `.claude/scripts/rmm-search.sh`, `.claude/scripts/rmm-search.py`
- `.claude/skills/discord-dm/SKILL.md`, `.claude/skills/rmm-search/SKILL.md`, `.claude/commands/discord-dm.md`, `.claude/commands/rmm-search.md`
- Memories: `feedback_dmarc_rua_inky_onboarded_only.md`, `reference_cloudflare_access.md`, `feedback_rmm_search_skill.md`

Modified:
- `.claude/CLAUDE.md` (error-logging mandate: exec + correction + friction)
- `.claude/skills/skill-creator/SKILL.md` (require log helper in new skills)
- `errorlog.md` (broadened header + seeded corrections/friction/defect entries)
- ~30 skill scripts retrofitted with `log-skill-error.sh` (b2/bitdefender/mailprotector/packetdial/coord py; remediation-tool + onboard365 bash; vault, rmm-auth, post-bot-alert, agy, grok, 1password, run-onboarding-diagnostic)
- Memory cleanup: merged `feedback_dm_wrapped_command_lines.md` → `feedback_dm_wrapping_commands_to_mike.md` (deleted the former); `feedback_365_remediation_tool.md` (Mail.Send + token-audience correction); `MEMORY.md` index fixes
- `.claude/skills/remediation-tool/references/tenants.md` (cryoweave onboarded)

DNS (cryoweave.com zone on IX/whmapi1): added `_dmarc` TXT (p=quarantine), added `selector1/2._domainkey` CNAMEs, removed stale `mail` CNAME. azcomputerguru.com (Cloudflare): added `cryoweave.com._report._dmarc` TXT `v=DMARC1;`.

## Credentials & Secrets

- **sysadmin@cryoweave.com** — ACG-owned Global Admin (break-glass) created in the CryoWeave M365
  tenant. Password VAULTED at `clients/cryoweave/m365-sysadmin.sops.yaml` (field `credentials.password`)
  AND in 1Password "Clients" vault item "CryoWeave - M365 SysAdmin (ACG Global Admin)". No license/mailbox;
  password set to not expire. MFA not yet registered. (Not transcribed here — vault is the source of truth;
  repo never holds plaintext secrets.)
- **rua@azcomputerguru.com** — shared mailbox (DMARC reports) in ACG's M365 tenant; no license; mike@ has FullAccess.
- Cloudflare API: `services/cloudflare.sops.yaml` (`credentials.api_token_full_dns`; zone_id_azcomputerguru `1beb9917c22b54be32e5215df2c227ce`).

## Infrastructure & Servers

- **CryoWeave M365 tenant:** `44705a37-b5d8-4bb1-882d-e18775612ada` (cryoweave.onmicrosoft.com + cryoweave.com). MX → cryoweave-com.mail.protection.outlook.com. DKIM Enabled/Valid (selector1/2). DMARC p=quarantine.
- **azcomputerguru.com tenant:** `ce61461e-81a0-4c84-bb4a-7b354a9a356d`. DNS on Cloudflare.
- **VWP-FILES:** 172.16.9.132 + 192.168.0.20 (dual-homed; .20 = old SERVER3 IP). G: share Everyone:Full. GPO `MappedDrives` GUID `{7D1AAC5B-2E39-4D6C-9248-AEC511E2A86D}`, G: action now R, version 5046272.
- VWP DCs: VWP-DC1 (PDC, 172.16.9.2), VWP_ADSRVR (192.168.0.25). IX webserver 172.16.3.10 / 72.194.62.5.

## Commands & Outputs

- Find machines: `bash .claude/scripts/rmm-search.sh hyperv valleywide` (client-scoped).
- DM Mike: `bash .claude/scripts/discord-dm.sh mike "<link>"`.
- Log an error: `bash .claude/scripts/log-skill-error.sh "<ctx>" "<msg>" [--correction|--friction] [--context "k=v"]`.
- EXO via app: mint Graph token with `computerguru-exchange-operator` client creds (`scope=https://graph.microsoft.com/.default`) for `POST /users/<upn>/sendMail`; `get-token.sh exchange-op` is EXO-audience only.
- Gmail header on the cryoweave test: spf=pass, dkim=pass (header.d=cryoweave.com, s=selector1), dmarc=pass (p=QUARANTINE dis=NONE) — delivered to inbox.

## Pending / Incomplete Tasks

- **Promote cryoweave DMARC to p=reject** after ~1 week of clean reports in rua@ (coord todo `b4b9036e`).
- **Confirm Greg's send path** — message trace shows almost no M365 outbound; likely Gmail send-as (would now fail DMARC). Move him onto the M365 mailbox or have him send a comparison test.
- **Register MFA (or CA-exclude) on sysadmin@cryoweave.com** (break-glass decision).
- **Fix memory-dream false-orphan/duplicate-index detector** (logged in errorlog).
- **WIN-AD-SRVR-2 SYSVOL** convergence for the VWP GPO edit (AD replicated; DFSR was catching up).

## Reference Information

- Syncro ticket #32418 (VWP G-Drive Migration, id 112613439) — 1.0h warranty, Resolved.
- Commits: `73a67870` (error-logging system) → `9960da5f`; `9b9513f6` (memory cleanup) → `55acc7f9`.
- DKIM CNAME targets: `selector1-cryoweave-com._domainkey.cryoweave.w-v1.dkim.mail.microsoft` (+ selector2).
- ComputerGuru apps: Sec Inv `bfbc12a4`, Exchange Operator `b43e7342`, User Manager `64fac46b`, Tenant Admin `709e6eed`.
- GPO backup on VWP-DC1: `C:\Temp\gpo-backup\`.