claudetools/clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md

# Cascades of Tucson Technology Plan — built and finalized (client deliverable)

## User
- **User:** Howard Enos (howard)
- **Machine:** Howard-Home
- **Role:** tech

## Session Summary

Built the client-facing Technology Plan for Cascades of Tucson (FY 2026–2027), starting from
the June 2026 CARF-oriented drafts and reconciling them against the wiki (current truth) via a
delegated fact-check. Howard directed a plain, Done / To-do structure per area with an
Action/Owner/Cost/Target table — no fluff, no negative framing of ACG, no CARF-intake blockers
(governance fields left as *[at adoption]* placeholders).

The plan covers the 8 core areas (Hardware, Software, Security/HIPAA, Confidentiality, Backup,
Assistive technology, Disaster recovery, Virus & threat protection) plus supplementary areas
(Communication technology, Services purchased, Use of AI) and a review/revision block. Rendered
as a branded 3-page PDF via headless Chrome from a hand-built HTML using the ACG design tokens
(paper/ink/orange palette, Barlow Condensed / Lexend / JetBrains Mono).

Iterated to final on Howard's live corrections: backup section reworded to plain
Synology-syncs-to-server + online off-site backup (no MSP360/license talk); all "outdated
server" age references removed; offline switches recognized as by-design (wiki updated + errorlog
correction); workstation replacement list expanded from hardware evidence in the March 2026
fleet audit (workstations.md); server power-supply row dropped (unit just not connected);
M365 licensing changed to a right-sizing item (not everyone needs full Office); Synology NAS
repurpose-as-onsite-backup added to area 5; the two remaining legacy-agent machines named
(DESKTOP-TRCIEJA, DESKTOP-F94M8UT); Ashley Jensen's name removed from the document entirely;
CHEF-PC changed from rebuild to full replace (list now 5 + spare); UPS coverage moved to Done
(installed on all switches) and the verify to-do removed. Howard confirmed the "scope and quote
a server refresh project" row stays as written.

Final deliverable: 3-page PDF, no Chrome header/footer, verified visually page-by-page. The
.md (master content), .html (render source), and .pdf are in sync.

## Key Decisions

- Done / To-do per-area structure at Howard's request; positive professional tone, no
  self-criticism of ACG, minimal prose.
- Governance fields (adopted by/date, next review) intentionally left as *[at adoption]*
  placeholders rather than blocking on CARF intake answers.
- Workstation replacement list built strictly from the March 2026 hardware audit evidence
  (Win11 CPU support, RAM, machine age) — no guessed machines.
- Final replacement list (5 + spare): DESKTOP-TRCIEJA (Lupe Sanchez, EOL), ASSISTMAN-PC
  (Meredith Kuhn, i5-6200U cannot run Win11), MDIRECTOR-PC (Shelby Trozzi, 3.9 GB RAM),
  MEMRECEPT-PC (Pentium E5500, oldest in fleet), CHEF-PC (Culinary — Howard upgraded it from
  rebuild to replace), plus spare deployed to a new hire.
- M365: right-size licensing instead of consolidate-everyone-onto-Business-Premium — Howard:
  not everyone needs the full Office license; framed as "reduces monthly cost".
- Synology NAS will be repurposed as the server's ONSITE backup target (off-site online backup
  continues) — added as a 60–90 day Backup to-do.
- Server power supply is NOT a work item (likely just not connected) — removed.
- UPS: installed on all switches — moved to Done in area 7; verify-coverage to-do removed.
- No client staff names in the deliverable (Ashley Jensen removed; masthead now "Attn: Business
  Office"). Note: replacement-list user names (Lupe/Meredith/Shelby) were kept — only Ashley's
  was requested removed.
- "Scope and quote a server refresh project" kept as-is after explaining it to Howard (it means
  produce a formal quote within 90 days, not committed spend; pairs with area 7 server
  redundancy).

## Problems Encountered

- Headless Chrome render intermittently no-ops on first invocation after taskkill (exit path
  produces no PDF, or leaves the stale file untouched — caught once by identical byte size +
  old timestamp). Fix: retry the same command; verify freshness by timestamp/byte-size change
  before trusting the output.
- First render in the earlier segment had Chrome's default header/footer — fixed with
  `--no-pdf-header-footer` (kept in all subsequent renders).
- PDF text-extraction check (zlib streams) found nothing — text is drawn with subset-encoded
  glyphs; verification must be visual (Read the PDF) not grep-based.
- `pdftoppm` not available on this machine — Read the PDF without the pages param instead.
- Wiki article too large to Read directly (~70k tokens) — fact-check delegated to an Explore
  agent with an itemized claim checklist.

## Configuration Changes

- [created/edited] `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md`
  — master plan content (final).
- [created/edited] `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html`
  — branded render source (final, in sync with .md).
- [created/rendered] `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf`
  — 3-page deliverable, 400,341 bytes, rendered 2026-07-15 11:14.
- [edited] `clients/cascades-tucson/docs/proposals/carf-technology-plan-intake.md` — backup
  wording plain (Synology syncs to server, server backed up online); MSP360 removed.
- [edited] `wiki/clients/cascades-tucson.md` — offline switches (Switch 4th Floor #2, USW Pro
  Max 16) marked "offline by design — not an issue (Howard, 2026-07-15). Do not flag or
  investigate."
- [appended] `errorlog.md` — `--correction`: assumed offline UniFi switches were an issue;
  correct is offline by design.

## Credentials & Secrets

None touched this session.

## Infrastructure & Servers

- CS-SERVER: EDR covered since 2026-07-13; Datto EDR is the endpoint standard (~35 agents).
- Legacy-agent stragglers: DESKTOP-TRCIEJA (Bitdefender BD_ACTIVE; GravityZone console-only
  uninstall; retires with its hardware replacement) and DESKTOP-F94M8UT (Alma Montt's old
  machine, powered off; BD-aware EDR install queued, fires on power-on).
- Network: UniFi 77 APs / 12 managed switches; pfSense dual-WAN (Cox); UPS now on all switches.
- M365 tenant cascadestucson.com — Business Premium 45 seats enabled; licensing right-size
  planned.

## Commands & Outputs

- PDF render (proven, flaky on first run — retry if no fresh file):
  `"/c/Program Files/Google/Chrome/Application/chrome.exe" --headless --disable-gpu --no-sandbox
  --no-pdf-header-footer --virtual-time-budget=8000 --print-to-pdf="<abs path>.pdf"
  "file:///C:/claudetools/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html"`
- Page count: `py -c "import re;d=open('<pdf>','rb').read();print(max(int(m) for m in
  re.findall(rb'/Count\s+(\d+)',d)))"` → 3.
- Freshness check: compare byte size + mtime after render; identical size/old mtime = stale,
  re-run.

## Pending / Incomplete Tasks

- Deliver the PDF to Cascades (Business Office) — Howard to send.
- Borderline replacement candidates NOT added (offered, not confirmed): ACCT2-PC (i3-1005G1,
  118 GB disk), LAPTOP-DRQ5L558 + LAPTOP-E0STJJE8 (Ryzen 3500U, 6 GB).
- Governance placeholders (*[at adoption]*, adopted-by date, next annual review) to be filled
  when Cascades formally adopts the plan.
- Synology onsite-backup repurpose is now a committed plan item (60–90 days) — actual
  implementation work not started.
- Standing items from 7/14 session remain: Juan Andrade offboarding (7/16 PM), break-glass
  accounts, audit logging build, BAA inventory.

## Reference Information

- Deliverable dir: `clients/cascades-tucson/docs/proposals/`
- Fleet audit source: `clients/cascades-tucson/docs/workstations.md` (March 2026)
- Remaining-work plan: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md`
- Straggler pass log: `clients/cascades-tucson/session-logs/2026-06/2026-06-26-howard-edr-bd-straggler-9am-pass.md`
- Prepaid balance shown in footer: 37.5 hrs as of 2026-07-10

## Update: 12:21 PT — Mike's verification edits applied

Applied all 4 items from Mike's coord message (6c0abc15) per Howard's "fix the cost wording
and update the docs, and do as mike wants":

1. **Area 2 cost correction** — Mike's live Graph check showed the relicensing claim was wrong
   (office staff sit on a SUSPENDED Business Standard sub, no Premium seats). Reworded to
   "new licensing, ~$375–575/mo depending on mix" (net-new spend, not savings).
2. **Area 8 wording** — "every device" -> "every managed, enrolled device (35), including the
   main server (verified live July 2026)". Dropped DESKTOP-F94M8UT from the legacy-agent row
   (already gone from the Datto console); DESKTOP-TRCIEJA remains.
3. **CARF conformance elements added** — standard reference row (CARF Technology and System
   Plan, Aging Services manual Section 1, edition placeholder), "Basis of this plan" section
   (needs of persons served / personnel / stakeholders + strategic alignment), Ashley Jensen
   restored as named plan owner (governance table ONLY — masthead stays "Attn: Business
   Office"; Howard approved via "do as mike wants" after the earlier name-removal request),
   and a Completed column added to all 28 action rows across 8 to-do tables (living-action-
   document format).
4. **Stale docs refreshed** — wiki CS-SERVER line superseded (Datto EDR agent reinstalled,
   agent b41befcf-e418-4d0d-8552-bc7662364d07, verified live; 6/26 removal note no longer
   current) and docs/cloud/m365.md licensing section rewritten to the live Graph numbers
   (SPB 45/41/4, Standard SUSPENDED 30 consumed) + stale "MFA: Not enabled" line fixed.

PDF re-rendered: 4 pages, 433,980 bytes, verified visually page-by-page. Coord reply sent to
Mike (GURU-5070) confirming: id 3c07fd3e-7f93-401d-8d46-339c968552f9.

Files touched this update: proposals .md/.html/.pdf, docs/cloud/m365.md,
wiki/clients/cascades-tucson.md.

## Update: 12:51 PT — Live verification sweep + jodi.ramstack decommission

### Live verification of the tech plan (Howard requested)

Ran 4 parallel read-only verification agents + direct DNS checks against every verifiable
"Done" claim in the plan. Results:

**CONFIRMED live (plan accurate):**
- Email auth: SPF `-all`, DMARC `p=quarantine pct=100`, DKIM selectors published (M365).
- M365: SPB 45/41/4; Standard SUSPENDED 30 consumed. MFA-for-all CA policy enabled;
  caregiver network-block CA policy live (trusted location 72.211.21.217/32 +
  184.191.143.62/32) + 8h sign-in frequency. ALIS SSO SP enabled, active sign-ins today.
- Datto EDR (azcomp4587): 35/35 agents AV-enabled; CS-SERVER heartbeat ~3 min old, defs
  released today. DESKTOP-TRCIEJA active (retires w/ replacement); DESKTOP-F94M8UT gone.
  Stale unchanged: desktop-kqsl232 47d, maintenance-pc 26d.
- UniFi (UOS 172.16.3.29:11443, site va6iba3v): exactly 77 APs (75 online); ~240 networks —
  per-room VLANs 101–631, voice VLAN 30 with exactly 37 clients, staff/guest/mgmt separated.
  Sub-gigabit to-do current: 34 active 100Mb switch ports + 5 APs uplinked at 100Mb
  (APs 122, 145, 204, 236, 240 — highest-impact fixes).
- MSP360: CS-SERVER file backup Success today 07:00 (daily verified).

**Discrepancies found (NOT applied — Howard: "leave the rest alone and do not add"):**
- Switches: controller shows 11 (8 online, 2 offline USL24PB, 1 pending), plan says 12.
- Caregiver policy live since 2026-04-29 (plan says 2026-07-01 — that was another policy's mod date).
- MSP360 image plan last success 2026-07-05 (file plan is the daily one).
- pfSense config vaulted 2026-06-17 point-in-time; Netgate ACB still not enabled.
- Dual-WAN failover: configured/documented, not live-verified (pfSense GUI needed).

**Correction (logged --correction):** verification agent reported Synology-to-server sync as
partial/overstated based on STALE wiki (6/18 Team Folder [PENDING] notes). Howard confirmed
the shared-folder syncs to the server ARE set up. Wiki lines ~487/633 in
wiki/clients/cascades-tucson.md are stale on this point (not yet edited).

### jodi.ramstack decommission (Howard requested)

Via remediation-tool user-manager tier (Graph), user id b7cddbeb-6026-436b-a3aa-67c4be43e3fb:
1. accountEnabled=false (204); 2. revokeSignInSessions (200); 3. removed license
f245ecc8-75af-4f8e-b61f-27d8114de5f3 (suspended Business Standard) (200). Verified:
disabled, assignedLicenses=[].

Shared-mailbox conversion attempted (exchange-op tier, EXO admin API): **no mailbox exists**
— Set-Mailbox/Get-Mailbox -SoftDeletedMailbox/Get-Recipient all NotFound; Graph
mailboxSettings 404 MailboxNotEnabledForRESTAPI. Mailbox was deprovisioned long before today
by the suspended subscription (last sign-in 2025-03-28) — no mail data left in the tenant to
preserve. Account object retained (disabled/unlicensed).

Gotcha hit: `UID` is a readonly bash variable — use another name (JID) in Git-Bash one-liners.

PDF unchanged (4 pages, 433,980 bytes) — Howard sends to Mike.