diff --git a/REPORT.md b/REPORT.md index db5715f..6887868 100644 --- a/REPORT.md +++ b/REPORT.md @@ -2,167 +2,193 @@ > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md). -## Website refresh before the Facebook tester-recruitment post — 2026-07-18 +## CC workflow migrated from the Windows workstation to DooPlex — 2026-07-19 -**Scope:** `website/` only · **Commits:** `be2fc50`, `d2fd935` (pushed to `main`, live via git-sync) -· **Source of truth for every claim:** `documentation/architecture/00-capability-map.md` (verified -2026-07-16, plus the 2026-07-18 N100 rehearsal rows). +Claude Code now runs natively on **DooPlex (192.168.0.180, Debian 13, `kisfenyo`)**, working directly +in `/mnt/5_hdd/felhom.eu/git/`. Builds are local commands; felhom-pve is one `ssh` hop; +`kubectl` is local. The Windows workstation can stay powered off. Docs/skills adapted in all four +repos, non-versioned assets migrated, environment wired and verified end-to-end. + +**Not a code change** — no Go source, no `build.sh`, no ArgoCD/GitOps rule was touched. Only *where +the commands are typed from*. --- -### 1. Audit table — every factual claim, verdict, map row +### 1. Part 0 inventory -Map references are section letters from the capability map. "—" = no map row exists, which is -itself the finding. +| Asset | Class | Disposition | +|---|---|---| +| Repo docs (`CLAUDE.md`, `CONTEXT.md`, `REUSE.md`, runbooks, `README.md`) ×4 repos | versioned | adapted in place, pushed (§2) | +| `felhom.eu/skills/*` (4 skills — build-deploy, ui-design, testing, app-catalog) | versioned | adapted; installed on DooPlex as symlinks | +| `felhom.eu/scripts/install_skills.py` | versioned | made cross-platform (POSIX symlink / Windows junction) | +| `E:\git\CLAUDE.md` (workspace root, in no repo) | portable | ported → `/mnt/5_hdd/felhom.eu/git/CLAUDE.md` **and** versioned copy at `documentation/runbooks/workspace-CLAUDE.md` (verified byte-identical) | +| `~/.claude/settings.json` | portable | adapted → DooPlex (§5) | +| `E:\git\.claude\settings.local.json` (workspace-scoped) | portable | **folded into** the user settings; every entry was a Windows `$SSH`/path one-off with no Linux meaning | +| **Project memory — 119 files, 672 KB** (`~/.claude/projects/E--git/memory/`) | portable | **migrated** → `/mnt/5_hdd/felhom.eu/git/.claude-memory/`, surfaced via `~/.claude/projects/-mnt-5-hdd-felhom-eu-git/memory` symlink. *Not anticipated by the spec* — flagged per its "migrate by the same rules" clause | +| `~/.claude/skills/*` (Windows junctions) | versioned source | recreated on DooPlex as POSIX symlinks by the fixed installer | +| Per-repo `.claude/settings.local.json` | — | **none exist** (checked all repos) | +| `~/.claude/CLAUDE.md` | — | **does not exist** on the Windows side; nothing to merge | +| Session history, `~/.claude.json`, `history.jsonl`, `shell-snapshots/`, `file-history/` | not portable | path-keyed / machine-local — **not copied**, accepted loss | +| Stray workspace files (`felhom-agent-0.2x.0.bin` ×4, `felhom-opsign.exe`, `longhorn-faulted-diagnosis-*.md`, `prompt_template.txt`) | not portable | build leftovers/scratch — **not copied**; left on Windows | +| Non-felhom repos (`jarr`, `recipe-importer`, `revfulop-calendar`, `sparkyfitness-export`, `misc-scripts`) | out of scope | untouched | -#### index.html +### 2. Commits pushed -| # | Claim (before) | Verdict | Map row / evidence | +Windows batch (the last Windows pushes): + +| Repo | Commit | Content | +|---|---|---| +| felhom-controller | `ac7323dc9a` | docs: migrate workflow to DooPlex-local execution | +| felhom-agent | `d81fddc7b1` | docs: migrate workflow to DooPlex-local execution | +| felhom.eu | `ee48a48288` | docs: migrate workflow to DooPlex-local execution | +| felhom-controller | `29eda5d86e` | docs(runbook): e2e live-drive commands are DooPlex-local | +| felhom.eu | `29b2b8ad7c` | docs: DooPlex-local commands in PROMPT-TEMPLATE + manual-build runbook | +| app-catalog-felhom.eu | `34d50a33ac` | docs: migrate workflow to DooPlex-local execution | + +Pushed **from DooPlex** (the new-home proof): + +| Repo | Commit | Content | +|---|---|---| +| felhom-controller | `2fcae041ae` | chore: mark `build-samba-image.sh` executable (mode-only) | +| felhom.eu | `a868e3585a` | docs: DooPlex is the canonical CC environment (CONTEXT.md) + iso scripts executable | +| felhom.eu | `fa8c0d5972` | docs(workspace): record the migrated project-memory location | + +**Final HEADs, all four trees clean on DooPlex:** felhom-controller `29eda5d86e`, felhom-agent +`d81fddc7b1`, felhom.eu `29b2b8ad7c`, app-catalog-felhom.eu `34d50a33ac`. + +### 3. Grep-hit counts (env-specific references in live docs) + +Scope: `*.md` + `*.py`, excluding `CHANGELOG.md`, `REPORT*.md`, and the historical +`documentation/{audits,tests,pilot}/` (history is history). + +| Repo | Before | After | Remaining — all intentional | |---|---|---|---| -| 1 | „45+ alkalmazás" | **FIX → 53** | §B *Deploy an app from the catalog* PROVEN-LIVE; real count = 53 `*.felhom.yml` in `app-catalog-felhom.eu/templates/` | -| 2 | „Felhő Felügyelő" (tech tile) | **FIX → „Vezérlőpult"** | Naming ruling; controller login page + R-11 draft both say vezérlőpult | -| 3 | „Kubernetes / Üzleti szintű rendelkezésre állás" tile | **CUT** | — (no customer-facing k8s row; also a bare availability promise) | -| 4 | og:image → `/assets/og-image.png` | **FIX (was a 404)** | File never existed; only `.svg` did. Generated 1200×630 | -| 5 | og:title / og:description (generic pitch) | **FIX** | Rewritten to one honest map-traceable sentence | -| 6 | Hero CTA „Érdekel →" | **FIX** | Retargeted to `#zart-teszt` (the post's landing intent) | -| 7 | Fényképek / dokumentumok / média a saját gépeden | **ADD** | §E Phone photo backup PROVEN-LIVE (6D); §E Documents/OCR PROVEN-LIVE (CAMPAIGN-6C 4P-1) | -| 8 | Hálózati megosztás — Windows Intéző + Mac Finder | **ADD** | §E *Files from Windows Explorer / Mac Finder (SMB server)* **PROVEN-LIVE**; Explorer leg passed 2026-07-18 | -| 9 | Kétszintű automatikus mentés (helyi + titkosított távoli) | **ADD** | §C Tier-2 PROVEN-LIVE (CAMPAIGN-6E P-TIER2); §C Offsite restic PROVEN-LIVE (6D); shares ride both tiers (R-7b, ctrl 0.145.0) | -| 10 | Helyreállítási kód, amit csak az ügyfél ismer | **ADD** | §A *Escrow ceremony … operator zero-knowledge* **PROVEN-LIVE**; wizard first live firing 2026-07-18 | -| 11 | Távoli felügyelet + automatikus frissítés | **ADD** | §G Controller self-update PROVEN-LIVE (demo); §G Publish train floor lift proven on a fresh install (5 s, unattended); §F metrics/monitoring IMPLEMENTED | -| 12 | Internetkimaradáskor a LAN-on minden működik | **ADD (plain wording)** | §E *LAN access when internet is down* **IMPLEMENTED** — allowed as a feature per the governing rule. **Caveat in §5.** | -| 13 | Visszaállítás, ha baj van | **ADD** | §C Offsite restore PROVEN-LIVE (6D); §C Guest-loss DR PBS restore PROVEN-LIVE (CAMPAIGN-2 T-P9) | -| 14 | „Zárt teszt" section + limitations + CTA | **ADD** | See §2 | +| felhom-controller | 47 | 36 | `CLAUDE.md` 4 + `RUNBOOK-e2e-live-drive.md` 2 = the new "Legacy: Windows workstation" notes; `docs/vscode-ssh-fix.md` 27 = the legacy doc, now carrying a LEGACY banner; **`TASK.md` 3 = see §6** | +| felhom-agent | 4 | 4 | `CLAUDE.md` 3 = new legacy note; `PLAN.md` 1 = historical plan note | +| felhom.eu | 27 | 20 | `CLAUDE.md` 3 + `skills/felhom-build-deploy` 2 + `workspace-CLAUDE.md` 8 = legacy sections; `CONTEXT.md` 2 = the migration note itself; `install_skills.py` 3 = the deliberate Windows branch; `architecture/04` 1 (`sk-ssh-ed25519@openssh.com`) + `break-glass.md` 1 (`/run/sshd`) = **protocol/package names, never environment** | +| app-catalog-felhom.eu | 1 | 0 | — | -#### technologiak.html +**No unadapted live instruction remains.** The one deliberate exception is `felhom-controller/TASK.md` +(§6). Genuinely-platform mentions were left alone by design: `_linux.go`/`_other.go` dev stubs +(`REUSE.md`), `\\FELHOM` shares in Windows Explorer (`controller/README.md`), the `openssh-client` +package in the restic image, and the Windows-grep-multibyte rationale in the gate scripts. -| # | Claim (before) | Verdict | Map row | -|---|---|---|---| -| 15 | „Felhő Felügyelő" ×14 (title, meta desc, keywords, og+twitter desc, JSON-LD, TOC, h2, h3, body, stack layer, hedge ×2) | **FIX → vezérlőpult** | Naming ruling | -| 16 | „45+ app telepíthető" | **FIX → 53** | §B | -| 17 | **Whole Kubernetes section** (h2, „Mi az a Kubernetes?", „Mikor érdemes", k3s vs full-k8s cards) + TOC entry + multi-node hardware tier | **CUT** | — No customer-facing k8s/k3s row exists. k3s is *hub* (operator) infra, not the customer box. Also carried „a szolgáltatás nem állhat le" = an availability promise the task forbids | -| 18 | „Tailscale VPN – biztonságos távoli elérés" | **FIX → WireGuard** | §E *WireGuard base infra always-on* IMPLEMENTED; §E remote access = Cloudflare Tunnel + Traefik PROVEN-LIVE. Tailscale is not what ships | -| 19 | „RAID – adatvédelem" card | **FIX → kétszintű mentés card** | — No RAID row. Shipped model is §C tier-2 second drive + encrypted offsite. Kept the „több lemez ≠ mentés" education | -| 20 | Spec row „4-8 TB (RAID)" | **FIX → „4-8 TB"** | — | -| 21 | „Melyiket válaszd?" referencing the removed multi-node fürt | **FIX** | Consistency with #17 | -| 22 | Hardware price ranges (80k–600k Ft) | **KEEP** | Hardware cost guidance, not a service price or product claim; no map conflict. Flagged in §5 | -| 23 | Docker / Proxmox / reverse proxy / Traefik / UFW | **KEEP** | §E Remote access PROVEN-LIVE; Proxmox is the platform per `proxmox-platform.md` | +### 4. Verification (all from DooPlex, verbatim) -#### gyik.html +``` +=== felhom-controller (controller/) === BUILD+VET OK +=== felhom-agent (root) === BUILD+VET OK +=== felhom.eu (hub/) === BUILD+VET OK -| # | Claim (before) | Verdict | Map row | -|---|---|---|---| -| 24 | „Minden családtag saját fiókot kap, saját bejelentkezéssel" | **FIX (both JSON-LD + visible copies)** | §E *Multiple household users / per-person accounts* = **MISSING** (R-15). Now: apps do have per-person accounts; the **vezérlőpult has one shared household password** | -| 25 | „Nagyobb rendszereknél RAID konfiguráció **is alkalmazható**" | **KEEP** | Already conditional/on-request; not presented as a shipped product capability | -| 26 | „Jellyfin/Plex — saját Netflix" | **KEEP** | §B catalog deploy PROVEN-LIVE; browser/mobile playback is the app's own function. TV casting handled honestly in the tester block (#14) | -| 27 | Remote access, 3-2-1 backups, updates, power-on-after-outage | **KEEP** | §E, §C, §G rows all IMPLEMENTED or PROVEN-LIVE | +=== kubectl (local) === +NAME READY STATUS RESTARTS AGE +contact-mailer-5bb869b85b-pqtjt 1/1 Running 0 20d +felhom-webpage-69cdbfc47-jm7lv 2/2 Running 2 (9d ago) 18d +filebrowser-59ff87cd88-662kz 1/1 Running 0 38d +hub-6d859c4dff-r5vrx 1/1 Running 0 14h +umami-7cd7f95cd8-89wrn 1/1 Running 1 (38d ago) 42d +umami-db-5fd98f59c5-xhwfr 1/1 Running 0 38d -#### biztonsagimentes.html +=== pve hop === +pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve) -| # | Claim (before) | Verdict | Map row | -|---|---|---|---| -| 28 | „…**azonnal** értesítést kapsz, és mi is" | **FIX** | §F *Health-degradation email* = **IMPLEMENTED**, and the map states this trigger "has never fired an email live in any doc". Softened, plus a line that the closed test is partly to harden this | -| 29 | Helyreállítási kód / zero-knowledge | **ADD** | §A escrow PROVEN-LIVE. States both sides: nobody else can read it, and without the code neither can we | -| 30 | „az egész rendszered … egy új gépre is visszaállítható" | **KEEP** | §C Guest-loss DR PROVEN-LIVE (CAMPAIGN-2 T-P9-DESTROY-RESTORE) | -| 31 | 3-2-1 rule, incremental, scheduled | **KEEP** | §C nightly dumps + tier-2 + offsite, all PROVEN-LIVE | +=== guest 9201 (through the pve hop) === +gitea.dooplex.hu/admin/felhom-controller:0.147.3 Up 2 hours (healthy) -#### alkalmazasok.html / kapcsolat.html +=== claude + skills === +2.1.205 (Claude Code) +felhom-app-catalog felhom-build-deploy felhom-testing felhom-ui-design -| # | Claim (before) | Verdict | Map row | -|---|---|---|---| -| 32 | „45+" ×4 (title, meta desc, og:title, twitter:title) | **FIX → 53** | §B. Page renders 49 cards; catalog holds 53 templates | -| 33 | Contact form → `POST /api/contact` with a stale "TODO: never wired" comment | **KEEP — verified LIVE** | Probed this session: `200 {"message":"Üzeneted sikeresen elküldtük!…"}`. Backend is `manifests/contact-mailer.yaml`. No new backend built | -| 34 | Subject options | **ADD** | New „Zárt teszt — jelentkezem tesztelőnek" → mail subject `Jelentkezés — zárt teszt` | +=== tmux === tmux 3.5a ---- +=== disk headroom === +/dev/sda1 9.1T 2.1T 6.6T 24% /mnt/5_hdd +/dev/sdb1 445G 284G 139G 68% / -### 2. The „Zárt teszt" section (the post's landing target) +=== repo HEADs / cleanliness === +felhom-controller 29eda5d86e dirty=[] +felhom-agent d81fddc7b1 dirty=[] +felhom.eu 29b2b8ad7c dirty=[] +app-catalog-felhom.eu 34d50a33ac dirty=[] -Three cards + CTA: -- **Valódi használat** — the box stays with them, real data, we help with install and migration. -- **Visszajelzés** — what we want back; "I couldn't find this button" is the most valuable report. -- **Ismert korlátok** — stated plainly: **one shared household password** for the vezérlőpult - (§E multi-user MISSING, R-15); **TV-re streamelés hamarosan** (§E DLNA **MISSING**, R-6/R-8); - and "this is a test, expect to find bugs — that's the point". +=== live workspace CLAUDE.md vs versioned copy === IDENTICAL +``` -**CTA wiring:** the audit found the existing contact-mailer live, so per the task the CTA reuses it -— `/kapcsolat?tema=zart-teszt`, which preselects the new subject option (unknown `?tema=` values are -ignored with a console warning). **No mailto fallback needed, no new backend.** +`install_skills.py` was exercised on DooPlex twice: first run created 4 symlinks, second run reported +"already installed" for all 4 with the repo's `skills/*/SKILL.md` intact and the tree clean — +confirming idempotency **and** that the rmtree hazard (§5) does not fire. ---- +**Explicitly NOT validated:** a full image **build → push → deploy** cycle from DooPlex. Nothing +here required a build, and a docs-only change must not push an image. The first real task run on +DooPlex should **treat its build step as a validation step — watch it, do not assume.** The pieces it +depends on are individually proven (local Go toolchain, registry creds already on the host, `ssh +felhom-pve` → `pct exec 9201`), but the composed path has not run end-to-end. -### 3. Files changed +### 5. Notable fixes made along the way -| File | Change | -|---|---| -| `website/index.html` | meta desc, og/twitter block (+width/height/alt), hero CTA, **new „Mit tud a doboz ma?" (8 cards)**, **new „Zárt teszt" section**, 45+→53, 2 tiles retitled | -| `website/technologiak.html` | 14× naming fix, 45+→53, **Kubernetes section + TOC + multi-node tier CUT**, Tailscale→WireGuard, RAID card→two-tier backup, spec row | -| `website/gyik.html` | multi-user answer rewritten in **both** the JSON-LD and the visible accordion | -| `website/biztonsagimentes.html` | new recovery-code block; notification overclaim softened | -| `website/alkalmazasok.html` | 45+→53 ×4 (head only) | -| `website/kapcsolat.html` | new subject option + label mapping + `?tema=` preselect | -| `website/assets/og-image.png` | **NEW** — branded 1200×630 card, generated from the existing logo + v2 tokens via headless Chrome (real brand font, no external assets) | -| `website/CHANGELOG.md` | entry on top | +- **`install_skills.py` had a latent data-loss bug on POSIX.** `remove_existing()` used + `os.rmdir()`, which fails on a symlink-to-directory and fell through to + `shutil.rmtree()` — and rmtree following the symlink would have **deleted the repo's own + `skills/` sources**. Now symlinks are unlinked explicitly before any rmdir/rmtree path is reached, + and existence checks use `os.path.lexists()` so a broken link is replaced rather than ignored. + (Windows never hit this: junctions satisfy `os.rmdir`.) +- **`skipDangerousModePermissionPrompt: true` was deliberately DROPPED** from the DooPlex settings — + it directly contradicts the new production-host guardrail ("do not run CC with permission prompts + disabled on this host"). Everything else portable was kept: `model: opus[1m]`, `effortLevel: high`, + `tui: fullscreen`, `agentPushNotifEnabled`, the three plugins. +- **Permission allowlist rebuilt** (30 rules): Windows one-offs dropped (`$SSH …`, `cygpath`, + `SCP=/c/Windows/…`, `/e/git/…` paths, `dir:*`, `Read(//c/Users/…)`), Linux equivalents added + (`sudo kubectl:*`, `ssh felhom-pve:*`, `python3:*`, `go test:*`, `df:*`). **Also dropped:** the + recipe-site WebFetch domains (`streetkitchen.hu`, `sobors.hu`, `kiskegyed.hu`, `gastrohobbi.hu`), + the jarr/pnpm entries, and assorted malformed rules (`Bash(1:*)`, `Bash(done)`, `Bash(settings")`) + — all belonged to non-felhom projects that are not migrating. +- **`PROMPT-TEMPLATE.md` §13 contradicted the GitOps rule**: it instructed `kubectl set image` for + hub deploys, which the hub docs explicitly forbid (auto-sync is OFF; imperative changes are + reverted on the next sync). Corrected to the manifest-bump + deliberate-sync method while the + block was being de-SSH'd. +- **Demo PVE host key had changed** on DooPlex (the known N100-reprovision gotcha). The new key was + **verified identical to the one the Windows workstation already trusted** + (`SHA256:bcSDbVzxoLQhOURUDzRGf0zJheU3wyXR4EmQ4NEPuTo`) before being accepted — not blindly + trust-on-first-use. `ssh-keyscan` was avoided (it hangs, per prior findings). -**No CSS, nav, footer, or design changes.** All new markup reuses existing classes -(`.why-grid`, `.why-card`, `.apps-cta`, `.cta-button`) and the existing icon sprite. +### 6. Pending — Viktor ---- +1. **`claude` login (OAuth) — the only blocking step.** Everything else is ready. On DooPlex: + ``` + ssh kisfenyo@192.168.0.180 + tmux new -A -s cc + cd /mnt/5_hdd/felhom.eu/git && claude + ``` + (`~/.local/bin` was appended to `~/.bashrc`; a fresh login shell picks it up.) +2. **Push token: NOT needed.** DooPlex already had a working `credential.helper=store` + + `~/.git-credentials`; four pushes from DooPlex succeeded during this task. Nothing to issue, + nothing written anywhere — the credential stays out-of-band in `~/.git-credentials`. +3. **`felhom-controller/TASK.md` is a stale spec** — it targets **v0.28.0** and the retired + `/opt/docker` compose deploy mechanism, and per the artifact taxonomy a `TASK.md` at a repo root + reads as "implement this". It was left untouched deliberately (not mine to delete). Recommend + deleting or moving it to `documentation/`; it is the last live-looking Windows-command block in + the four repos. +4. **Remote-access preflight**, before relying on this from outside the LAN: verify the SSH path to + DooPlex from that location. Gitea's **web UI is geo-fenced (HU/DE/US)** — CC on DooPlex is + unaffected (it pushes over the LAN), but browser access to Gitea from elsewhere is not. +5. **Windows side is untouched** and remains a stale fallback. Nothing was deleted there. -### 4. Deploy verification (fetched from the live site) +### 7. Observations (out of scope) -- Commits `be2fc50` + `d2fd935` pushed to `main`; git-sync deployed in ~20 s and ~45 s. -- **og tags live on `/`** — `og:title`, `og:description` (honest one-liner), `og:image`, - `og:image:width/height/alt`, `og:locale hu_HU`, `og:site_name`, `twitter:card - summary_large_image`, `twitter:title/description/image`. All verified by `curl`. -- **`og:image` no longer 404s** — `HTTP=200 content-type=image/png bytes=167598`, PNG signature - valid, **dimensions 1200×630** confirmed from the live bytes. -- **Site-wide sweep across all 6 public pages:** `Felhő Felügyelő = 0`, `k3s|kubernetes = 0`, - `45+ = 0`, og-image `200`. -- New sections live: `id="mit-tud"`, `id="zart-teszt"`, `/kapcsolat?tema=zart-teszt`, - `53`, „Hálózati megosztás", „TV-re streamelés hamarosan". -- `/kapcsolat` serves `value="zart-teszt">Zárt teszt — jelentkezem tesztelőnek<`. -- **Gates:** `python scripts/site_gates.py` green (BOM, emoji=0, nav/footer identical, analytics, - no CDN, no legacy tokens, no `