claudetools/wiki/clients/scileppi-law.md

---
type: client
name: scileppi-law
display_name: The Law Offices of Chris Scileppi
last_compiled: 2026-07-02
compiled_by: Howard-Home/claude-main
sources:
  - clients/scileppi-law/session-logs/2026-05-07-howard-sylvia-mac-mini-mail-memory.md
  - clients/scileppi-law/session-logs/2026-07/2026-07-01-howard-sylvia-server-mount-nosleep-screenconnect.md
  - clients/scileppi-law/session-logs/2026-07/2026-07-02-howard-scileppi-internet-outage-cox-wan-rca.md
  - clients/scileppi-law/docs/overview.md
  - clients/scileppi-law/docs/issues/log.md
  - clients/scileppi-law/PROJECT_STATE.md
  - session-logs/2026-06/2026-06-16-mike-scileppi-downloads-amt-harness.md
aliases: [scileppi]
---

# The Law Offices of Chris Scileppi

## Overview

- **Business type:** Law firm (small; Apple-leaning user environment).
- **Site:** 115 W Washington Street, Tucson, AZ 85701.
- **Email domain:** scileppilaw.com.
- **Syncro Customer ID:** 9601863.
- **Billing model:** Recurring monthly managed-services agreement (~$481/mo, billed ~12th of the month) **plus** break-fix time-and-materials labor on top. **No prepaid hour block** (`prepay_hours = 0`, verified 2026-07-01).
- **Labor rates:** Remote $150/hr (product 1190473); Onsite $175/hr (product 26118).
- **Managed devices (Syncro assets):** 1.

## Contacts

| Name | Role | Contact | Notes |
|---|---|---|---|
| Andrew Ross | Primary contact | andrew@scileppilaw.com · (520) 449-8446 · mobile (971) 218-6707 | Main point of contact for the firm |
| Chris Scileppi | Owner / attorney | — | Client namesake |
| Sylvia | Employee | — | Primary user of the Mac mini; single local account `sylvia` (uid 501) |

Invoice CC: info@scileppilaw.com.

## Infrastructure

### Workstations

| Asset | Hostname | Model | RAM | Storage | OS | Status |
|---|---|---|---|---|---|---|
| Sylvia's Mac mini | `Mac-mini-2` (formerly `Sylvias-Mini`) | Apple Mac14,3 (M2 base) | 8 GB LPDDR5 (soldered — no upgrade path) | 256 GB SSD (+ external "Sylvia External" drive) | macOS 14.x | In service; enrolled in GuruRMM |

**Current state of the Mac (`Mac-mini-2`, user `sylvia`, on Wi‑Fi `en1` = `192.168.242.154`):**
- **Enrolled in GuruRMM** (agent `1386d9fd-...`) and running the **ScreenConnect** access agent (as of 2026-07-01).
- Apple Mail disabled at System Settings → Internet Accounts (Mail toggle off); Sylvia uses outlook.office.com (webmail) for daily mail — see 2026-05-07 Mail event. Do NOT re-enable Mail (see Anti-Patterns).
- Downloads and large case files are steered **off** the local SSD onto the NAS share (`/Volumes/Data/StorageTemp`) via browser download-location settings + a catch-all LaunchAgent `com.acg.downloads-to-share` (deployed 2026-06-16). 7-day Trash auto-purge (`com.acg.trashcleanup`) also deployed.
- Mounts the NAS `Data` share at `/Volumes/Data` via LaunchAgent `com.acg.mount-server` (RunAtLoad + every 300 s).
- `pmset` set to `sleep 0 / displaysleep 0` (2026-07-01) so idle display-sleep no longer drops the Wi‑Fi link.

> **Machine identity (verify):** the May 2026 record named this unit `Sylvias-Mini` (M2, 8 GB, 256 GB, macOS 14.4.1); by June 2026 it appears in GuruRMM as `Mac-mini-2` (same user `sylvia`, agent `1386d9fd-...`). Treated here as the **same unit renamed + enrolled**, with the 8 GB replacement still pending. Confirm on next onsite whether the 8 GB M2 was ever replaced.

### File server (NAS)

| Asset | Hostname | Address | Type | Storage | Shares |
|---|---|---|---|---|---|
| Office file server | `SL-SERVER` | `192.168.242.5` | Synology NAS (netatalk cedarview build; no systemd) | btrfs `/volume1` (`/dev/mapper/cachedev_0`), 25 TB pool | `Data` at `/volume1/Data` (AFP 548 + SMB 445/139) |

- Enrolled in GuruRMM (agent `0186e9d5-...`, reported os_type linux).
- Resolves reliably as **`SL-SERVER.local`**. The AFP-service Bonjour name `SL-SERVER._afpovertcp._tcp.local` is **unreliable after NAS reboots** (Synology stops advertising it) — always mount by `SL-SERVER.local`.

### Network gear (UniFi — full cloud-managed stack)

Scileppi is an **all-UniFi site, cloud-managed under ACG's Ubiquiti account** (owner `mike@azcomputerguru.com`). It is **NOT** on the self-hosted [[uos-server]] controller (`172.16.3.29`) — do not look for it there; reach it via the **UniFi Site Manager cloud API** (`https://api.ui.com`) or `unifi.ui.com`.

| Device | Role | Model | Address | FW | Notes |
|---|---|---|---|---|---|
| `UCG-Scileppi` | Gateway / router | UniFi **Cloud Gateway Ultra** (UDRULT) | LAN `192.168.242.1` · WAN `184.183.92.165` | 5.1.19 (UniFi OS 5.1.117 / Network 10.4.57) | WAN on `eth4` port 5, 2.5 GbE. MAC `1c:6a:1b:4b:14:xx` (LAN bridge shows locally-administered `1e:6a:1b:…` in ARP — normal for UniFi OS). Adopted 2025-10-20. |
| `USW Pro Max 16 PoE` | Core switch | USW-Pro-Max-16-PoE | `192.168.242.199` | 7.4.1 | |
| `File Room` | Access point | UniFi AP | `192.168.242.121` | 6.8.2 | |
| `Sylvia Desk` | Access point | UniFi AP | `192.168.242.10` | 6.8.2 | |

- **Cloud host id (Site Manager):** `1C6A1B4B14DD0000000008CE3561000000000946A4750000000067C563E4:1543906151` · **siteId** `68f6f0d89dda23444538a492`.
- **Access / creds:** use vault **`services/unifi-site-manager`** (`X-API-KEY` header vs `https://api.ui.com`). ⚠ The other entry **`infrastructure/unifi-site-manager-api` is stale (returns 401)** — do not use it. Owner account: `mike@azcomputerguru.com`.
- **Useful cloud endpoints:** `/v1/hosts/<id>` (device detail incl. `reportedState.wans` + `internetIssues5min`), `/v1/devices?hostIds[]=<id>` (per-device `startupTime`/`status`/`firmwareStatus`), `/ea/isp-metrics/5m?beginTimestamp=&endTimestamp=` (per-5-min WAN latency / packet-loss / downtime; range must be within the last 24h and 5-min aligned).

### Replacement Mac (planned — status verify)

- **Target spec:** M4 Mac mini, 16 GB minimum, 24 GB preferred; 256 GB SSD sufficient (512 GB optional). Quote pending as of last update.
- **Migration plan:** Migration Assistant over wired Ethernet/Thunderbolt, then reconfigure Mail with Download Attachments = None.

## Network

- **Subnet:** `192.168.242.0/24`; gateway/DNS `192.168.242.1` = `UCG-Scileppi` (see Network gear above).
- **NAS:** `SL-SERVER` = `192.168.242.5` (see File server above).
- **Sylvia's Mac mini is on Wi‑Fi (`en1`, `192.168.242.154`)**, not Ethernet. It has an unused wired port — moving to Ethernet is the durable fix for idle network drops (Wi‑Fi drops on display sleep).
- **WAN / ISP:** cable, WAN IP `184.183.92.165`. Carrier is **Cox** (`Cox Business`, **AS22773**, Phoenix) — confirmed by the WAN IP's ASN and by traceroute egress through Cox (`68.105.x`, `72.215.x`). Note: UniFi's ISP auto-detection is flaky here — it has labeled the same circuit both "Cox Business (AS22773)" and, transiently, "Comcast Cable (AS7922)". It's Cox either way; don't trust the UniFi ISP name in isolation.
- **WAN line quality is degraded (2026-07-02):** intermittent WAN packet loss — a minority of 5-min windows show loss, **spiking to ~13%** — on otherwise steady ~22–24 ms latency, plus brief (sub-minute) WAN drops. Worst event on 2026-07-02 was a **~20 s WAN downtime (2 s + 18 s samples) around 04:15–04:20 Phoenix**, with a second blip ~10:45–10:55 that recovered so fast it only left a `not_reported` telemetry gap. This produces intermittent "no internet" flags on the UCG that self-recover; the underlying fix is a **Cox circuit/signal service call**, not UniFi gear. (ISP-metrics counts vary between API pulls because UniFi backfills/recomputes the 5-min series — read the current `/ea/isp-metrics/5m` at diagnosis time rather than a cached number.)

> **Diagnosing a Scileppi internet complaint:** `SL-SERVER` (wired, default route via the UCG) is a live in-site vantage point — its GuruRMM heartbeat is an internet up/down signal, and from it you can `traceroute`/ping to separate LAN vs WAN vs ISP (hop 1 = UCG, hop 2 = Cox CMTS). For the WAN event *timeline*, pull the UCG's `internetIssues5min` + `/ea/isp-metrics/5m` from the cloud API. Note the UCG logs a brief blip that kills its own cloud telemetry as a **`not_reported` gap**, so the console dashboard may **not** graph the most recent drop even though it happened.

## Cloud / M365

- **Mail platform:** Exchange Online / M365; domain **scileppilaw.com**. Sylvia's mailbox accessed via Outlook Web (outlook.office.com); Apple Mail deliberately disabled on the Mac.
- Tenant ID and admin details not yet documented (verify).

## GuruRMM

- **GuruRMM site:** Main Office (`WEST-MEADOW-9025`).
- **Enrolled agents (as of 2026-07-01):**
  - `Mac-mini-2.localdomain` (macOS, Sylvia's Mac) — agent `1386d9fd-ac16-423c-ada0-5abad5b61838`.
  - `SL-SERVER` (Synology, file server) — agent `0186e9d5-e1cc-4603-a81a-adb1f2230702`.
- **Off-LAN access:** the internal RMM API (`172.16.3.30:3001`) and coord API (`:8001`) are LAN-only; from off-net, drive RMM via the public endpoint **`https://rmm.azcomputerguru.com`** (same vault creds; `rmm-auth.sh` hardcodes the internal URL, so authenticate manually against the public host off-LAN).
- **ScreenConnect:** installed on `Mac-mini-2` 2026-07-01 (session `Mac-mini-2`; Company "The Law Offices of Chris Scileppi" / Site "Main Office" / Tag "Mac"). `SL-SERVER` is a headless Synology — **not** a ScreenConnect target.

## Active Projects / Open Items

| Priority | Action | Owner |
|---|---|---|
| P1 | **Cox service ticket OPEN — `HD0000032972890`** (submitted by Winter 2026-07-02) for circuit `184.183.92.165` (Cox Business, AS22773): intermittent connectivity + packet loss, requested Cox check upstream/downstream signal + SNR at the modem/ONT. Awaiting Cox. **Track this ID.** | Winter / Mike |
| P2 | Move `Mac-mini-2` to **wired Ethernet** — durable fix for Wi‑Fi idle drops (`displaysleep 0` is the interim mitigation) | Howard (onsite) |
| P2 | Verify NAS-share auto-mount from a clean login/boot now that the agent uses `SL-SERVER.local` (not exercised from scratch on 2026-07-01) | Howard |
| P2 | Confirm replacement-Mac status (was the 8 GB M2 ever replaced?); if not, spec/quote/order M4 (16/24 GB) | Mike / Howard |
| P3 | On any replacement: Migration Assistant + Mail Download Attachments = None; re-enable Mail only on 16 GB+ hardware | Howard |
| P3 | Historical: Syncro #32262 line item 42350646 ($175 × 1.0) — was held un-invoiced per Mike (verify disposition) | Mike |

## Key Events / History

### 2026-07-02 — Site "no internet" reports → root-caused to the Cox WAN line (not a device)

Reported: USG "reports no internet"; intermittent drops + users unable to reach the server; "another laptop" also affected. **Root cause: WAN/ISP (Cox) line quality — no equipment fault.**

- **Gateway did NOT reboot/crash:** `UCG-Scileppi` `startupTime` = 2026-06-24 (up 8 days); all four UniFi devices (UCG, USW Pro Max 16, both APs) online. `SL-SERVER` uptime 1 day (its own Jul-01 reboot), no LAN link flaps.
- **In-site verification (from `SL-SERVER`, wired):** gateway, `8.8.8.8`, `1.1.1.1`, Cox resolver all 0% loss; 20-ping sustained 0% loss; traceroute clean end-to-end through Cox (hop 2 `10.68.48.1` → `68.105.x`/`72.215.x` → Google, ~30 ms); DNS fine. So no live outage at check time — the reported drops had already recovered.
- **WAN telemetry (UCG cloud API):** `internetIssues5min` shows a brief WAN-downtime + packet-loss cluster ~03:50–04:25 (Phoenix, `wan_downtime` flag ~04:15) and a `not_reported` telemetry gap ~10:45–10:55 (the "one it just had that didn't report" — a blip that briefly severed the UCG's own cloud link, so the dashboard didn't graph it). `/ea/isp-metrics/5m` over 24 h: a minority of 5-min windows had WAN packet loss (**spiking to ~13%**) on steady ~22–24 ms latency, and **two downtime samples of 2 s + 18 s at ~04:15–04:20** — i.e. one ~20 s WAN drop, no multi-minute hard outage. (Counts differ between pulls — UniFi backfills the series; the ~20 s downtime and 13% spike were confirmed on a second, independent pull.)
- **ISP:** carrier is **Cox** — `Cox Business`, **AS22773** (WAN `184.183.92.165`; traceroute via Cox). UniFi's ISP name flip-flops (seen as both "Cox Business/AS22773" and "Comcast Cable/AS7922") — it's Cox regardless.
- **Action:** recommended Cox service call for line/signal quality (see Open Items P1). UniFi gear needs no change. Findings DM'd to Winter. Sylvia's Mac Wi-Fi drops are a **separate** issue (display-sleep; fix = Ethernet).
- **Cox ticket submitted (Winter, 2026-07-02): `HD0000032972890`.** Type "Trouble with Service"; Account Alias **115 W WASHINGTON**; Services Affected: Internet & Data — Intermittent Connectivity, Slow Speed/Packet Loss; requested Cox check upstream/downstream signal + SNR at the modem/ONT. Preferred contact: **Guru Admin — Winter or Mike**, callback **520-304-8300**, `admin@azcomputerguru.com`, mornings. (Ticket text quoted the first-pull figures — 90/276 windows, up to 6% — not the later-refined ~13% / ~20 s downtime; verdict and the ask to Cox are unchanged.)
- **Doc/tooling notes:** documented Scileppi's full UniFi layer here (was previously undocumented); flagged stale vault key `infrastructure/unifi-site-manager-api` (401) — use `services/unifi-site-manager`.

### 2026-07-01 — Sylvia "can't connect to server" (dropped drive) + no-sleep + ScreenConnect

**Syncro #32493** (Howard). Reported: mapped drive gone; handled remotely via GuruRMM (public endpoint). 0.5h remote labor logged ($75).

- **Root cause:** `SL-SERVER` (Synology) rebooted ~09:34 local and was slow to bring SMB/AFP back up; while down, the Mac's AFP mount failed (error `-5014`). `/volume1` (25 TB) stayed mounted and healthy — no data risk. Services recovered on their own.
- **Recurring bug found + fixed:** the mount LaunchAgent `com.acg.mount-server` targeted the Bonjour name `afp://SL-SERVER._afpovertcp._tcp.local/Data`, which the Synology stops advertising after a reboot (NORESOLVE), while `SL-SERVER.local` resolves fine. Repointed the agent to `afp://SL-SERVER.local/Data`; retired stale duplicate agent `com.azcomputerguru.mount-slserver`. Backup: `com.acg.mount-server.plist.bak-20260701`.
- **Meta-cause of instability + fixed:** the Mac (Wi‑Fi) had `displaysleep 10`; when the display slept the Wi‑Fi link dropped (system `sleep` was already 0). Set `pmset -a sleep 0 displaysleep 0 womp 1 powernap 1 tcpkeepalive 1`. Long-term: Ethernet.
- **ScreenConnect** installed on `Mac-mini-2` (self-tagged Company/Site/Tag).

### 2026-06-16 — Disk-full remediation + downloads-to-share redesign (Mike)

**Syncro #32333** — resolved no-charge. `Mac-mini-2` had recurring home-folder/disk-full problems. Cleared Trash (358 GB) and Apple Mail cache (~27 GB); deployed a 7-day Trash auto-purge. Redesigned how downloads stay off the local disk: restored local `~/Downloads` (fixed the broken Finder favorite), pointed browsers' download location directly at the share (`/Volumes/Data/StorageTemp`), and deployed a catch-all LaunchAgent `com.acg.downloads-to-share` that moves stray downloads onto the share every 10 min via cross-volume `mv` (never routes to Trash).

### 2026-05-07 — Sylvia's Mac mini: Apple Mail memory exhaustion

**Syncro ticket #32262** (Howard). Status: Resolved (interim).

**Root cause:** Apple Mail's local cache (`~/Library/Mail/V10/`) grew beyond what 8 GB unified RAM can service; Mail's VM footprint exceeded 45 GB on the 8 GB machine, forcing constant swap (~4.4M swapouts in 9 min uptime).

**Diagnosis:** two Envelope Index rebuilds (footprint climbed to 12 GB then 28 GB) conclusively ruled out index corruption — the mailbox itself is too large for 8 GB.

**Interim fix:** force-quit Mail, disabled Mail toggle in System Settings → Internet Accounts, verified no auto-relaunch, moved Sylvia to outlook.office.com webmail.

**Billing artifacts:** ticket #32262; resolution comment 409686752; timer entry 39082403 (3600 s); line item 42350646 ($175.00 × 1.0, non-taxable); invoice — held per Mike (verify).

## Anti-Patterns / Warnings

- [WARNING] **Mount the NAS by `SL-SERVER.local`, never the AFP Bonjour name** `SL-SERVER._afpovertcp._tcp.local` — Synology stops advertising it after a reboot, which silently breaks auto-mount (AFP error `-5014`).
- [WARNING] **The Mac mini is on Wi‑Fi and drops its link when the display sleeps.** Keep `displaysleep 0`; the real fix is wired Ethernet. Idle drops also knock the RMM agent offline, which makes remote work flap.
- [WARNING] **Do NOT re-enable Apple Mail** on the 8 GB Mac. RAM is soldered (no upgrade path) — Mail will immediately reproduce the memory exhaustion. Stays on webmail until replaced with 16 GB+ hardware.
- [WARNING] After migration to a new Mac mini, set Mail → Settings → Accounts → Mail Behaviors → Download Attachments = None; skipping this on a large mailbox reproduces the issue even on 16/24 GB.
- 8 GB M2 Mac mini RAM is soldered and not upgradeable — do not quote a RAM upgrade.
- Keep local downloads/case files off the 256 GB SSD — they belong on the NAS share (`/Volumes/Data`); the `com.acg.downloads-to-share` mover enforces this.

## Backlinks

- `session-logs/2026-05-07-howard-gururmm-macos-installer-and-cf-bot-block.md` — related GuruRMM macOS installer failure (enrollment has since succeeded).
- Skills: `/rmm`, `screenconnect`, `/syncro`.