claudetools/.claude/machines/pluto.md

Machine: Pluto (Claude-Builder)

Hostname: Pluto / Claude-Builder Last Updated: 2026-05-24

---

Identity

Pluto is the Windows build VM for GuruRMM. It is the only machine in the fleet that produces Windows agent binaries and the WiX MSI installer. It is NOT a general-purpose workstation — it has no Claude Code, no vault, no coord API access. Its sole function is to run cargo build for Windows targets when build-windows.sh SSHes in.

---

Hardware & Location

Spec	Value
VM name	Claude-Builder (virsh domain on Jupiter)
Host	Jupiter — Unraid primary, IP 172.16.3.20
VM IP	172.16.3.36
OS	Windows Server 2019 (Standard)
SSH user	Administrator
SSH port	22
SSH auth	Public key, from build server (172.16.3.30)

Pluto is a virsh VM. If it is unreachable from 172.16.3.30 but was recently building, check Jupiter first (virsh list --all on 172.16.3.20) before assuming a crash. SSH from DESKTOP-0O8A1RL and SSH from 172.16.3.30 traverse different network paths — one failing does not imply the other fails.

---

Build Tools

Tool	Path
cargo (Rust stable)	C:\Users\Administrator\.cargo\bin\cargo.exe
rustup	C:\Users\Administrator\.cargo\bin\rustup.exe
WiX 4 (MSI builder)	C:\Users\Administrator\.dotnet\tools\wix.exe
sccache	C:\sccache\ (compiler cache, causes near-instant rebuilds when source unchanged)
Git	standard PATH

sccache note: When agent/ has no code changes (only config bumps), sccache makes the full 5-target cargo run complete in ~1s rather than 3–5 min. This is expected and correct — do not interpret a fast build as a failed build.

---

Repo

Item	Value
Clone path	C:\gururmm
Remote	Gitea: https://azcomputerguru@git.azcomputerguru.com/azcomputerguru/gururmm.git
Branch	main (build-windows.sh pulls latest before building)

---

Build Role in Pipeline

Pluto is invoked by build-windows.sh on the build server (172.16.3.30) via SSH. It is called only when agent/ has changed since the last Windows build (/opt/gururmm/last-built-commit-windows).

What Pluto does (in order):

1. git pull (build-windows.sh does this via SSH before cargo invocations)
2. cargo build --release --target x86_64-pc-windows-msvc     → stable x64
3. cargo build --features debug-agent --target x86_64-pc-windows-msvc  → debug x64
4. cargo build --release --target i686-pc-windows-msvc        → stable x86
5. cargo build --release --target x86_64-pc-windows-msvc (legacy profile) → legacy x64
6. cargo build --release --target i686-pc-windows-msvc (legacy profile)  → legacy x86
7. wix build (WiX 4) → GuruRMM-<version>-x64.msi

All five cargo invocations run sequentially on Pluto. The MSI is built after all binaries complete.

Output artifacts (on Pluto):

Artifact	Pluto path
Agent EXE (x64)	C:\gururmm\target\x86_64-pc-windows-msvc\release\gururmm-agent.exe
Agent EXE (x86)	C:\gururmm\target\i686-pc-windows-msvc\release\gururmm-agent.exe
Tray EXE	C:\gururmm\target\x86_64-pc-windows-msvc\release\gururmm-tray.exe
MSI	C:\gururmm\target\wix\GuruRMM-<version>-x64.msi

build-windows.sh SCPs these from Pluto to the build server's distribution directory (/var/www/gururmm/downloads/) after the build completes.

---

Connection from Build Server

# From 172.16.3.30 (build server), as guru
ssh -o StrictHostKeyChecking=yes \
    -o UserKnownHostsFile=/opt/gururmm/pluto_known_hosts \
    Administrator@172.16.3.36

The known-hosts file at /opt/gururmm/pluto_known_hosts contains three pinned keys (RSA, ECDSA, ED25519) for 172.16.3.36. Never use StrictHostKeyChecking=no for Pluto — it would accept a MITM and inject malicious binaries into the build artifacts.

To update the pinned keys (e.g., after OS reinstall):

ssh-keyscan 172.16.3.36 > /opt/gururmm/pluto_known_hosts

---

Pipeline Context

Script	Role
/opt/gururmm/webhook-handler.py	Receives Gitea webhook on 172.16.3.30:9000, forks build threads
/opt/gururmm/build-shared.sh	Version bump + repo sync; runs once per trigger
/opt/gururmm/build-linux.sh	Linux cargo build; independent of Pluto
/opt/gururmm/build-windows.sh	Invokes Pluto via SSH; handles change gate + artifact copy
/opt/gururmm/build-mac.sh	Stub; no Mac build machine configured

build-linux.sh and build-windows.sh run in parallel threads from webhook-handler.py after build-shared.sh succeeds.

Build logs on 172.16.3.30:

Log	Content
/var/log/gururmm-build-linux.log	Linux build output
/var/log/gururmm-build-windows.log	Windows build + Pluto SSH output (prefixed [PLUTO])
/var/log/gururmm-build-mac.log	Mac stub (minimal)

Change tracking:

File	Tracks
/opt/gururmm/last-built-commit-linux	Last SHA successfully built on Linux
/opt/gururmm/last-built-commit-windows	Last SHA successfully built on Windows (Pluto)
/opt/gururmm/last-built-commit-mac	Last SHA successfully built on Mac (stub)

---

Distribution Directory (on 172.16.3.30)

Active artifacts served via nginx:

/var/www/gururmm/downloads/
  windows/
    amd64/
      GuruRMM-<version>-x64.msi
      gururmm-agent-<version>.exe
      gururmm-tray-<version>.exe   (latest 2 versions kept)
    x86/
      gururmm-agent-<version>.exe

The legacy path /opt/gururmm/updates/windows/amd64/ contains only old artifacts from before the pipeline split (last modified ~Feb 2026). It is NOT the active distribution path — do not check it to assess build freshness.

---

Build Trigger Rules

A build to Pluto is only initiated when:

1. A push to main hits the Gitea webhook
2. build-shared.sh succeeds (version bump + git sync)
3. The diff between the new SHA and last-built-commit-windows includes changes under agent/ (excluding agent/Cargo.lock)

If only server/, dashboard/, or docs changed, Pluto is NOT contacted. The Windows lock file (/var/run/gururmm-build-windows.lock) prevents concurrent builds if a previous run is still active.

---

Capabilities

• Windows cargo builds (stable x64, debug x64, stable x86, legacy x64, legacy x86)
• WiX 4 MSI packaging
• sccache (compiler-level cache, C:\sccache)
• SSH access from 172.16.3.30 (key auth, pinned known-hosts)
• Git (pulls gururmm repo from Gitea)
• Claude Code (not installed)
• SOPS vault (not installed)
• Coord API access (not installed)
• Mac cross-compilation (not configured)

---

Notes

• Do not SSH to Pluto manually to trigger builds. All builds go through the Gitea webhook pipeline. Manual SSH is for diagnostics only.
• If Pluto appears unreachable from DESKTOP: Verify from 172.16.3.30 first. Different network paths. DESKTOP is not on the same LAN segment as Pluto.
• sccache makes short work of rebuild-only pushes. A 1-second Windows build is normal when agent/ source hasn't changed since the last successful build.
• Build history: Pluto has been building GuruRMM Windows agents since at least early 2026. The MSI + EXE artifacts in /var/www/gururmm/downloads/ are authoritative freshness indicators — check their timestamps, not the legacy /opt/gururmm/updates/ path.