claudetools/clients/cascades-tucson/session-logs/2026-06/2026-06-24-howard-carf-technology-plan.md

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Produced a technology-plan deliverable for Cascades of Tucson in response to an email from Ashley Jensen requesting a meeting to review their technology plan. The request enumerated eight areas (hardware & software, communication technology, security for sensitive data, services purchased/contracted, assistive technology, disaster recovery & continuity, malware prevention/virus protection, use of AI). Initial work loaded full Cascades context from the wiki + PROJECT_STATE + the canonical REMAINING-WORK-PLAN, then compiled a first-pass internal technology-plan packet mapped to the eight areas with priorities, gaps, action steps, and timelines.

Mid-session the user established a standing rule: any deliverable going to a client or vendor must be run through the impeccable skill before delivery. Saved this as feedback memory feedback_impeccable_on_outbound (+ MEMORY.md index + errorlog correction). The user then asked to rebuild the reply from updated wiki information, run it through impeccable, and produce a PDF. Re-read the 2026-06-24 wiki recompile which materially changed the picture: CS-SERVER RAID is HEALTHY not degraded (stale flag self-recovered; SSDs now a planned not emergency upgrade; PSU redundancy lost), cloud backup verified running (~576 GB baseline, file-level — image/system-state unconfirmed), 48.25 hrs / 6 open tickets, a new Helpany "Paul" resident radar fall-sensor system (no camera/mic — qualifies as assistive technology), and a revised voice fix (CSC ENT 5 GHz device-island plan replacing the impossible phone-side band lock). Built a polished client-facing PDF via the impeccable skill: loaded ACG's real design tokens from the website project (cream/ink/ amber editorial brand, Barlow Condensed / Lexend / JetBrains Mono), authored a print-clean HTML document organized by the eight areas, and rendered it to PDF with headless Chrome. Audited the result visually via screenshots; tightened spacing (3 pages, clean breaks).

The user then issued a major correction: the technology plan is for CARF accreditation (Commission on Accreditation of Rehabilitation Facilities, Aging Services). Verified the actual CARF Technology and System Plan standard via web research rather than memory — it is one of the five required Section 1 "CARF Plans," must address eight canonical areas (hardware, software, security, confidentiality, backup, assistive technology, disaster recovery, virus protection), must be an action document (per area: current tech + unmet/projected needs + timeline + vendor + estimated/ actual cost + person responsible + target date + completion date), based on needs of persons served/ personnel/stakeholders, aligned to the strategic plan, and reviewed/updated at least annually with dated leadership sign-off. Produced a CARF conformance gap analysis and saved project memory project_cascades_carf_tech_plan. The user chose to gather inputs before building the final plan and to brand it as Cascades' plan (ACG as preparer). Built a CARF intake worksheet pre-filled with known content and flagged input fields.

Finally, per user direction, priced the open items via verified web lookups (M365 Business Premium, enterprise SSD, Windows Home→Pro, Azure Log Analytics retention, R610 PSU, PowerEdge T360, OptiPlex) and recorded a costed table in the worksheet. Surfaced the M365 nuance (31 Premium seats likely already owned/free → potentially $0 relicense). Explained the stale CA exclude-group bug on the "Require MFA for all users" policy in response to a direct question. The user is deploying AV themselves and deferred the backup restore test.

Key Decisions

• impeccable on all outbound deliverables — standing rule saved as durable feedback memory; internal drafts exempt. Rationale: client/vendor-facing artifacts must be polished/on-brand.
• Built the PDF from ACG's actual design tokens, not a generic template — pulled cream/ink/amber editorial brand + Barlow Condensed/Lexend/JetBrains Mono from projects/acg-website-showcase so the document is genuinely on-brand and passes the impeccable slop test.
• Verified CARF requirements via web research rather than memory — a certification deliverable; a missed standard element can fail the survey. Flagged that exact standard citation + review cadence must be confirmed against Cascades' specific Aging Services manual year (2025 vs 2026).
• Reframed ownership: the plan is Cascades' (leadership-adopted), ACG is preparer/IT partner — this is how CARF expects the facility to own its required plans.
• Gather inputs before building the final CARF plan (user choice) — avoids a placeholder-laden doc that reads as unfinished to a surveyor. Built an intake worksheet instead.
• Pricing verified, not estimated (per policy_pricing_verification) — every cost backed by a cited 2026-06-24 web source.
• M365 relicense likely $0 — records show 31 Business Premium seats already owned/free; reassign the suspended-Standard users and drop Standard. $682/mo only applies if the Premium subscription is not actually paid (flagged to verify).
• Deferred the restore test (user) until after AV deployment + the basic open items.

Problems Encountered

• Headless Chrome PDF render returned exit 2 / appeared to no-op — lingering Chrome processes held the profile; a second render produced a byte-identical PDF (stale). Resolved by taskkill //F //IM chrome.exe //T, deleting the target PDF, and re-rendering with a wait loop; confirmed fresh output by byte-size change. The exit-2 on screenshot commands is a Chrome shutdown quirk — the output file is still written; verify by ls not exit code.
• --user-data-dir cleanup failed ("Device or resource busy") — Chrome still running when the rm ran. Avoid unique-UDD + immediate rm; let the default render path complete instead.
• Stale wiki facts in the first-pass packet — the 2026-06-23 packet had CS-SERVER "critical", 48.75 hrs / 0 tickets, no Helpany. Marked it [SUPERSEDED] pointing at the PDF + REMAINING-WORK-PLAN rather than deleting, to preserve history without leaving contradictory facts.

Configuration Changes

Created:

• clients/cascades-tucson/docs/proposals/2026-technology-plan-review.md — first-pass internal packet (later marked SUPERSEDED).
• clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-06-24.html — client-facing PDF source (ACG editorial brand, 8 areas).
• clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-06-24.pdf — rendered PDF (3 pages, Letter, ~294 KB).
• clients/cascades-tucson/docs/proposals/carf-technology-plan-intake.md — CARF Technology & System Plan input worksheet (governance header, needs basis, strategic alignment, 8 areas in CARF action format, Part 5 evidence status, Part 6 verified cost estimates).
• .claude/memory/feedback_impeccable_on_outbound.md — run impeccable on outbound deliverables.
• .claude/memory/project_cascades_carf_tech_plan.md — the tech plan is a CARF deliverable.

Modified:

• .claude/memory/MEMORY.md — added index lines for the two new memories (impeccable-on-outbound, cascades CARF tech plan).
• errorlog.md — one --correction entry (process/client-deliverables: gate outbound through impeccable).

Credentials & Secrets

None discovered, created, or rotated this session. (The exposed Synology Cloud Signin Portal credential remains an open rotation item — vault clients/cascades-tucson/synology-signin-portal, historically committed plaintext at vault commit 1fbc0e1; not actioned this session.)

Infrastructure & Servers

• CS-SERVER 192.168.2.254 (clients reach SMB at 192.168.2.248; .254 is the Hyper-V vEthernet NIC). Dell PowerEdge R610, Service Tag 9MQFTK1. RAID HEALTHY per live OMSA (both mirrors Ok, 5 disks Online, 1:0:4 = global hot spare). PSU redundancy LOST (one PSU not delivering). Cloud backup (MSP360/CloudBerry) verified running 2026-06-24, ~576 GB baseline, file-level (image/system-state unconfirmed).
• M365 tenant cascadestucson.com, Tenant ID 207fa277-e9d8-4eb7-ada1-1064d2221498. 34 Business Premium (SPB) seats enabled / 31 free; Business Standard SUSPENDED with 31 users still assigned.
• CA policy "Require MFA for all users" (id 7e87a1c7...) — excludeGroups incorrectly set to SG-Caregivers-Pilot (0674f0bc...); should be live SG-Caregivers (8b8d9222...). Must fix before caregiver go-live; harmless now (caregivers test-scoped).
• Helpany "Paul" resident radar fall/motion sensors (Sedimentum backend), WPA2-only, 5 GHz-capable, on SSID CSC ENT (key Ftfd85710#), rolling out floor-by-floor. No camera/mic.
• Billing: 48.25 prepaid hrs (live Syncro 2026-06-24); 6 open tickets (#32194, #32230, #32254, #32319, #32342, #32370). Syncro customer ID 20149445.

Commands & Outputs

• ACG brand tokens: projects/acg-website-showcase/css/styles.css — paper #F7F3EB, ink #2A2521, accent #F2922E / accent-ink #BD5A00, good #4F7A3F; fonts Barlow Condensed (display) / Lexend (body) / JetBrains Mono (mono); since 2001; radius 0–2px.
• PDF render (working invocation): taskkill //F //IM chrome.exe //T then "/c/Program Files/Google/Chrome/Application/chrome.exe" --headless --disable-gpu --no-sandbox --virtual-time-budget=8000 --print-to-pdf="OUT.pdf" "file:///ABS/IN.html" — wait-loop on file existence; verify by byte-size change, not exit code.
• Page count check: python -c "import re; d=open(r'OUT.pdf','rb').read(); print(re.findall(rb'/Count\s+(\d+)', d)[:1])" → 3 pages.
• impeccable context loader returned hasProduct:false / hasDesign:false — proceeded with brand register + manually-pulled ACG tokens (did not run full teach for a one-off).

Pending / Incomplete Tasks

CARF technology plan — awaiting inputs from Cascades/ACG before building the final PDF:

• CARF program + manual year (Aging Services 2025 vs 2026) for exact standard citation.
• Plan owner (Cascades), approver (ED name), adoption + annual-review dates.
• Top 2–3 strategic goals (for the strategic-alignment paragraph).
• Per-area responsible person + target/completion dates.
• Resident assistive-technology inventory (biggest gap): nurse-call/pendant, assistive listening, adaptive devices, resident/guest WiFi for telehealth — beyond Helpany.

Basic open items proposed (awaiting user go-ahead; items 1–4 touch production):

1. Fix CA exclude-group on MFA-all-users policy (SG-Caregivers-Pilot → SG-Caregivers).
2. Rotate exposed Synology sign-in credential.
3. Clean stale AD object DESKTOP-1ISF081.
4. Re-enable 3 AM AP auto-upgrade.
5. (Safe, doc-only) Package dated security risk assessment + draft written DR/BC plan w/ RTO/RPO.

Other:

• User (Mike) deploying managed AV across all devices, incl. CS-SERVER + remove legacy Datto agents.
• Backup restore test deferred until after AV + basic items; confirm backup is image/system-state.
• Verify whether the 34 M365 Business Premium seats are a paid subscription ($0 relicense vs $682/mo).
• Offered to pull the live CA policy to confirm exclude list (incl. break-glass/GDAP) before changing.

Reference Information

• Deliverables: clients/cascades-tucson/docs/proposals/ (cascades-technology-plan-2026-06-24.pdf/.html, carf-technology-plan-intake.md, 2026-technology-plan-review.md [SUPERSEDED]).
• Canonical execution plan: clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md.
• Current truth: wiki/clients/cascades-tucson.md (compiled 2026-06-24).
• Pricing sources (2026-06-24): M365 Business Premium $22/user/mo (microsoft.com/microsoft-365/business/microsoft-365-plans-and-pricing); Samsung PM893 480 GB ~$160–175 (marigoldsystems.com); Win 11 Home→Pro ~$99 (learn.microsoft.com); Azure Log Analytics $2.30/GB ingest + ~$0.10/GB/mo retention + ~$0.02/GB/mo archive (learn.microsoft.com/azure/azure- monitor/logs/cost-logs); R610 717W PSU refurb ~$99 (flagshiptech.com); Dell PowerEdge T360 from ~$1,900 (dell.com); OptiPlex i5/16 GB business desktop (dell.com).
• CARF: Technology and System Plan = one of five required Section 1 "CARF Plans"; Aging Services Standards Manual (carf.org). 8 canonical areas + action-document fields + annual review.