#0043: the case-insensitive username policy is live and verified end to end —
present in the ConfigMap, mounted in the worker, applied by authentik on its own,
and bound to the prompt stage. It reads only prompt_data, since the stage runs
anonymously and that is exactly what the previous system policies died on.
#0044 turns out to be largely solved already, which the issue could not know: the
ESS chart hangs config and secret hashes on the pod template as labels, so MAS and
the other chart components do roll out on change, and coturn has its own annotation
bump driven by the rotation job. What remains are three services whose secrets
change rarely and deliberately — recommending against adding a controller for that.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Eight commits from the past two days carry the wrong author identity, made in an
agent session that set user.email by hand in fresh clones — an hour after that
same session wrote the canonical identity into AGENTS.md.
sorb's call is to fix them with the next history pass rather than force-pushing
two repos over eight commits. The issue exists anyway because gruppenpruefung
reports them on every run: without a recorded reason the next session starts
'repairing' them, or worse gets used to red findings, which is exactly what
happened with the TargetDown noise in #0002 the same morning.
Notes the structural prevention too — an includeIf block setting the identity for
group clones — since writing the rule down demonstrably did not prevent breaking it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Declaring threadnet-wiki as a component took the check from 23 to 72 findings,
46 of them Wiki.js git-storage commits. Those are the same class ADR-0009 already
exempted for the rotation bot — written without a human present, so attributing
them to a person would be wrong — but the exemption held exactly one name.
Matching is on the address rather than the display name on purpose: the Wiki.js
account shows up as 'Administrator', which is far too generic to silence findings
with. Down to 25, and the checks that should still fire do: eight non-canonical
commits remain, all of them mine from the past two days.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The cluster was running coturn 4.10.0 while :latest pointed at 4.17.2, which is
the concrete harm the issue describes: nobody knew what ran, a reschedule would
have jumped seven minor versions unannounced, and the CVE scan was measuring a
moving target. Now pinned to 4.17.2 and verified beyond 'the pod is up' — a STUN
binding request from the public internet succeeds and the server reports the
caller's external address, so the relay path itself is proven.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The group check flagged four undeclared projects. Two are real components and are
now declared, both deliberately without a mirror: threadnet-wiki because its
content flows the other way (Wiki.js to Gitea, canonized to git.lab — a mirror
back would close the loop and overwrite edits), and notfallhandbuch per ADR-0016.
The other two are cleanup rather than declaration: project 42 'wiki' looks like a
superseded first attempt, dead since 2026-08-12, and 43 is already marked for
deletion. Declaring either would misrepresent them — the phase enum has no state
for 'abandoned'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
All five components now carry the pointer the check looks for, verified by
gruppenpruefung.py dropping from 27 to 23 findings — exactly the four pointer
findings. Each AGENTS.md carries only what is specific and easy to get wrong
there: for the forks, that the README is upstream material describing something
else entirely; for thread-net-git, that its small compose file hosts the Flux
source; for threadnet-operating, the two lessons this session paid for.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
W4 point 4 closed with gitops 60aaf0e: the lab WireGuard config now has a repo
home. The root CA turned out to already have one (ci/lab-ca-chain.crt is exactly
the aXionLabs chain), so that half of the point was quietly already met.
All eight now carry a named resolution with a reference, two of them as their own
ADRs, honouring this issue's own rule of documenting rather than silently fixing.
The only thing left is the rotation, which is dated follow-up work in #0015 rather
than an open contradiction.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sorb's call: rotate everything once at acceptance rather than piecemeal now.
That is the lower-risk order — the mirror credential is still unidentifiable and
the mirrors feed the Flux source, so four separate revocations would mean four
separate ways to break it silently. The inventory and the ordering stay valid, so
the later rotation is execution rather than analysis.
Recorded what the deferral accepts rather than leaving it implicit: the exposed
WireGuard key and PATs stay valid, five never-used tokens remain (one with
manage_runner and k8s), and 'acceptance' is not a dated milestone — which is
exactly how security work rots. The existing due date stays as a review anchor,
not a rotation deadline.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Inventoried the 24 git.lab PATs by metadata only — last_used_at separates
'needed' from 'lying around': four are in active use, five are active but never
used at all (one with manage_runner and k8s scope), and several names exist twice
because a replacement was created without revoking the old one. All six push
mirrors are healthy, but GitLab masks both parts of the mirror URL, so the
credential remains unidentifiable — and it is a Gitea token, which the PAT list
cannot answer for. Hence the ordering: set a dedicated mirror credential first,
revoke second. The revocations themselves are sorb's; from here a never-used
token is indistinguishable from a staged one.
W5 resolved: the secrets rule now has a bootstrap exception, since on a headless
host it was only satisfiable by violating it. W4 splits — point 5 is #0015 (plus
the WG key, which no token inventory covers), point 4 is demonstrably undone.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Corrects only the split-DNS line of ADR-0004 (frozen once accepted, hence a
separate ADR). Rather than documenting 'four zones exist', it measures what each
one does: ~lab and ~axionlabs.de resolve names that exist only internally or
differently (git.lab, and ca.axionlabs.de as real split-horizon to the step-ca),
~axion1337.de carries the internal-only git.axion1337.de, and ~lab.de carries
nothing at all while routing a foreign public domain through the lab resolver —
so it goes.
This also answers the audit's rollback option: reverting to ~lab alone would have
broken internal CA and git resolution. The purpose was never written down, which
is why rolling back would have been blind.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Queried the lab resolver directly from inside the lab VLAN and compared every
record type against the public view: A, MX, TXT, CNAME, subdomains that exist
only publicly, plus records created and deleted yesterday. Not a single
divergence — the UDM holds no zone of its own and forwards live; the aa flag it
sets is a UniFi quirk and was what made the hypothesis look plausible.
That disproves the risk I asserted earlier in this issue, where I called the
pinned ACME resolvers 'load-bearing'. They are good practice, not a safety net
against W1, and the claim stood as fact for an hour. Corrected in place.
W1 is therefore documentation-only. What remains is that the purpose of the three
extra zones is recorded nowhere, which is why a blind rollback is the worse option.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
W8 is moot: sorb confirms UDM SSH was disabled long ago.
W1 turns out to interact with #0007, which did not exist when the audit was
written. CFGMON routes ~axion1337.de to the lab resolver, and Traefik's DNS-01
renewal verifies TXT propagation — had it used the system resolver, that check
would ask the UDM and might never see the challenge record, failing renewal
silently until the certificates expire. It does not, because the config pins
public resolvers explicitly; that line is load-bearing rather than cosmetic and
is now documented as such. What the UDM actually answers for the zone remains
unverified, with the commands to check it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
W2 was already covered — the ping trap lives in the textbloecke, and the firewall
exception is conditional. W3 fixed: cfgmon.md listed the runner as running though
it was dismantled on 2026-08-01; row removed and, rather than leaving the open
question, the page now states that the service table is current state while the
sections below are history. W6: addendum practice had proven itself twice but was
undefined, so the AAR template now makes it a rule — append-only and dated, so the
original mistake stays readable. W7: ADR-0009 unified the identities but AGENTS.md
only said 'canonical author identity' without naming it; now spelled out.
W1, W4, W5 and W8 need sorb's decision and are written up with what each one
costs if left alone — W8 (root SSH on the gateway) being the sharpest.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The original silences expired on 2026-08-04, so TargetDown had been firing every
4h for eleven days — noise that dulls the very alert path the backup work in
#0030 depends on. New silence is scoped to the two GAME jobs rather than the
alertname alone, so future TargetDowns for anything else still get through, and
it carries an expiry that forces a re-decision if the vSwitch move has not
happened by then. The date is now this issue's de facto deadline, so it also
went into the wartegrund where STATUS surfaces it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Went through the seven imported waiting issues and replaced the generic
'reason is in the GitLab history' placeholder with the real blocker, which
completes #0041. Three of the seven were not merely imprecise but wrong:
- #0025: the deploy had long landed; screenshots confirm 24 aggregated messages
in the security room (limit 29), summing to the known 126 CRITICALs.
- #0014: the A/B/C decision exists as ADR-0008 (option A). Half its open question
is now answered — MATRIX has no docker group at all, so the root-equivalence
does not apply there.
- #0027: the blocking Struktur-Workshop happened on 2026-08-06 and produced three
ADRs, but W1 and W3 were spot-checked and are still unresolved.
The remaining four wait on a named action by sorb. Measured from here: the GAME
exporters are still filtered (and their silences expired on 2026-08-04, so
TargetDown has been firing every 4h since), while CFGMON's 9090/3100 are already
closed from the internet — so #0008 is about making that state deliberate rather
than an acute exposure.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The handover issue still sat in waiting while the deploy had long landed:
ff87cb2 is an ancestor of HEAD (CFGMON now runs e9c13dc), the rules aggregate
per image so the per-CVE flood is structurally impossible, matrix-alerts.py
saves state incrementally inside the send loop, and notifications_failed_total
is 0 across 80 series. The null-receiver kill switch is gone.
Recorded honestly what was not observed: whether aggregated messages actually
arrived in the security room once. Delivery is now permanently monitored via
AlertDeliveryFailing, so a future failure reports itself instead of relying on
someone looking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Records the deployed state: fallback expressions, directory mounts (which proved
themselves on the very next rollout, where a SIGHUP reload was genuinely enough),
and alertmanager now scraped so delivery failures are visible. Also notes the
README correction — delivery had not been muted since gitops#51, and docs saying
otherwise would have made a missing alert look expected.
Left open deliberately: TrivyScanStale has the same missing-series gap but no
natural equivalent to kube_cronjob_created, so it needs a decision rather than a
reflex; and phase A/B of the restore drill still needs a throwaway environment.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Alert rules deployed and verified on CFGMON. Verification surfaced two variants
of the same failure class: a missing time series silences an alert instead of
firing it (fixed with a created-time fallback aggregated via max by, plus an
absent() alert for a vanished CronJob), and a SIGHUP reload that reported success
while serving the old file from a stale inode.
The second one matters most: that trap was already documented in detail, with the
right command and a check, and it still bit — so it was removed structurally
(directory mounts) rather than documented harder.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Monthly restore-drill CronJob (verified before commit) plus the finding that
mattered more: there was no backup alerting at all, so a failed nightly job
would have gone unnoticed. Added BackupJobFailed/BackupNotRunning/
RestoreDrillStale; the last one alerts on the absence of the check itself.
Alert rules still need deploying on CFGMON.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Standing exception to ADR-0001 (everything is push-mirrored to Gitea). The
handbook necessarily maps the infrastructure, the backup locations and where the
keys are kept; mirroring it onto the internet-facing host that is itself one of
the covered failure cases would hand a post-compromise attacker their next step.
Confidentiality over availability, with a local clone closing the availability
gap. Records the rejected alternatives so the question does not reopen.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Not mirroring it is deliberate: the handbook maps the infrastructure, backup
locations and where the keys live, so putting it on the internet-facing Gitea
hands an attacker the roadmap once the stack is compromised. My earlier
recommendation only weighed availability and was wrong. Local clone covers the
availability gap. Flagged that this is a standing exception to ADR-0001 and
would warrant its own ADR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The databases are no longer an assumption: notfall.sh stage 3 restored all
three Borg repos into a throwaway postgres inside the pod (synapse 31908 rows,
MAS 16085, authentik 325149, wiki 251), isolated from production and repeatable.
Procedure and tool now live in git.lab/axion1337.chat/notfallhandbuch so an
emergency needs one clone; this repo keeps a pointer. Still open: phase A/B on
an empty host, Synapse media, a repeat cadence, and mirroring that new repo off
git.lab.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Derived from the running system: prerequisites (age key from the vault first),
the three Borg repos with their archive layout, bootstrap order (host/K3s, the
two manual secrets, Flux, kustomization dependencies), data restore and
verification. Lives in git rather than Wiki.js on purpose — the wiki runs on the
cluster being restored.
Two previously undocumented findings: Flux pulls from Gitea rather than git.lab,
so a simultaneous loss of rohana requires repointing gotk-sync first; and
consumers must be scaled down before pg_restore or their startup schema collides.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sorb's call: Gitea on rohana is a push mirror of the canonical git.lab, so a
nightly gitea dump would back up a copy — effort not justified, cron stays off.
Documented the one non-mirror asset for the record: the container registry holds
four images the cluster pulls (incl. threadnet-web and the backup image itself),
which is rebuild time rather than data loss and is covered by #0022/#0033.
For #0030, sorb confirms the age key is also in the password vault, dissolving
the circular dependency found earlier. Noted that the vault is now part of the
restore path and must lead the procedure.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cluster-side backups are healthier than assumed: three nightly Borg jobs to a
Hetzner Storage Box, all completing with plausible volumes and working prune
(synapse 199MB/247 files, authentik ~150MB, wikijs 223kB DB-only). No silent
failures.
Critical finding for #0030: the Borg passphrase and SSH key needed to READ those
backups are SOPS-encrypted under a single age key that exists only in the cluster
being backed up and on one laptop — no documented cold copy. Losing both makes all
three repos permanently unreadable. Cold escrow must precede any restore drill.
For #0010 this shrinks the work: the Storage Box + Borg pattern already exists and
is proven, so Gitea needs only its own repo there. The disabled cron (no backups
since 2026-07-30) remains separately urgent.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verified via DoH: _dmarc.axion1337.de is p=reject (sorb changed it), subdomains
inherit reject with sp= absent per RFC 7489, and the noted DKIM gap was a false
alarm — IONOS uses s1-ionos/s2-ionos/s42582890 selectors, all present with valid
keys. Apex SPF left at ~all deliberately: real mail flows over the apex and DMARC
already enforces reject, so -all adds little while risking silent send breakage.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ftp.axion1337.de deleted and verified (NXDOMAIN). All four DNS hygiene issues
from today's batch (#0001, #0003, #0005, plus #0007 earlier) are now closed:
rohana and selendis hardened with Null-MX/SPF -all/DMARC reject, matrix and
www.game removed, ftp removed. Production A/AAAA records untouched throughout.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
matrix.axion1337.de was already removed by sorb independently (platform runs
under .chat), so www.matrix went with it (confirmed NXDOMAIN via two
independent DoH resolvers). www.game deleted through IONOS and verified.
#0005 down to a single remaining item: ftp.axion1337.de.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Both done step-by-step with sorb through the IONOS panel, externally confirmed
via DoH: rohana (www removed, Null-MX, SPF -all, DMARC reject — was previously
unprotected) and selendis (IONOS Mail service deactivated to unlock MX
deletion, 3 DKIM CNAMEs + www removed, SPF edited in place, Null-MX, DMARC
reject). Service-record lesson noted for the remaining matrix cleanup.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Previous commit set three issues in-progress, tripping the WIP<=2 rule. The
verification is done; the DNS mutations are sorb's to run in IONOS, so #0001
and #0003 move to waiting (with wartegrund) while #0005 drives the batch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verified current axion1337.de zone state via DoH: www.matrix/www.game are
IONOS-default records nothing serves (cluster routes .chat, no matching cert);
rohana is unhardened (no Null-MX/-all/reject) with www.rohana still present;
selendis mail-set untouched; matrix mail-set + autodiscover present; ftp is
IONOS-hosting ballast. Attached a consolidated per-name IONOS action list; the
mutations are sorb's to run in IONOS (no API access from here). Batch in-progress.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cert renewal switched to DNS-01 (IONOS): test issuance validated end-to-end
(LE YR1, valid to 2026-11-12), the shared letsencrypt resolver now renews
rohana/selendis via DNS-01, so the September renewal needs no open port 443.
Syncs the canonical file with the already-closed git.lab tracker issue 7.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Traefik stack is thread-net-git (manual compose deploy on CFGMON). DNS-01 diff
is ready (tlschallenge -> dnschallenge/ionos + IONOS_API_KEY via host .env).
Two human dependencies remain: create the IONOS API key and deploy+verify on
CFGMON (no SSH from here).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Consolidate the 13 findings + learnings from the Wiki.js AAR into
docs/wiki/stolpersteine/wikijs.md (config/deploy, theming, navigation,
locale/timezone incl. the standing fork patch, access control, git-storage),
link it from the wiki index, and set the AAR status to harvested.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Capture the follow-up work in the Wiki.js AAR: locale migration mechanics
(migrateToLocale only patches pages; rebuild tree+index; nav must move to the
new locale), the new-user timezone source (DB column default), API-only wiki
editing, and the standing upstream deviation (startup sed on users.js) with its
upgrade-check anchor. Stumbles 11-13 + a dated Nachtrag section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
#0023 (Docusaurus navbar logo) is moot since Wiki.js replaced Docusaurus
(ADR-0014) -> rejected. #0007 (cert renewal, due 2026-09-28) gets a concrete
plan: pursue DNS-01 (approach B, already recommended) before mid-September,
with the port-opening fallback A as a dated calendar checkpoint.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sidebar links render href=target verbatim, so page targets need a leading
slash; without it they resolve relatively and 404 from any sub-path. Captured
as stumble #10 for forkers; fixed in gitops set_navigation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Wiki.js→Gitea (sorb/ThreadNetWiki) is wired and verified end-to-end (status
operational, page create/delete propagates). Move ADR-0015 to accepted with an
implementation note; mark the git-storage part of #0048 done. Remaining: the
canonize job Gitea→git.lab (needs the target repo decision).
The cluster cannot reach git.lab (deliberate lab-independence), so #0048's
git.lab-repo-as-storage is infeasible. ADR-0015 routes Wiki.js content
cluster→Gitea→canonize to git.lab, reusing the accepted TURN-rotation pattern;
status proposed, pending sorb's ratification and two prerequisites (Gitea repo +
deploy PAT). Note the flagged contradiction on #0048 and the live theming
progress (logo, shared login background, dark default) on #0050. STATUS regen.
wiki.axion1337.chat (public, Let's-Encrypt TLS, native Authentik-OIDC login, no
forward-auth) added to #0048 (ingress/cert pattern) and #0049 (redirect URI, same
URL for user and admin, role decides). Kept out of ADR-0014 deliberately: accepted
ADRs are not edited, and the hostname is a deployment detail, not a new decision.
ADR-0014 records the decision: Wiki.js replaces Docusaurus for the platform wiki
— the only option meeting both hard requirements (per-group abschotten AND
docs-as-code in git). BookStack ruled out (DB-only, no git). Scope excludes
homelab/docs; neckbeard docs stay in management; content in a dedicated wiki repo
(not a branch, not a monorepo). ADR-0007 set to superseded. #0047 resolved
(decided: Wiki.js). Build issues 0048 (deploy + git storage), 0049 (OIDC + roles/
abschottung: admins write, users read-only), 0050 (theming, colours+logo extracted
from homelab/wiki). #0046 becomes the umbrella. STATUS regenerated; all gates green.
#0024 decided: axionwiki.lab (development-time). #0020 decided: stay on
Docusaurus with Authentik forward-auth, not the last word on the surface. Both
closed with the decision recorded. New follow-ups the user asked to keep:
0046 (move the wiki into the ThreadNet Server Suite, M4) and 0047 (re-examine
surface alternatives beyond BookStack afterwards, M2). STATUS regenerated;
validate, gen_status --check, upstream_drift and pruefe_prosa green.
The job got past the git fix but then failed the urllib call to https://git.lab
with CERTIFICATE_VERIFY_FAILED: gruppenpruefung.py uses urllib's default trust,
which in python:3.12-alpine does not include the private aXionLabs CA. Point
SSL_CERT_FILE at the repo's ci/lab-ca-chain.crt (the same chain curl --cacert
uses); Python honours it in the default SSL context. Verified locally: the
context loads the 2 lab CA certs.
gruppenpruefung.py runs 'git log --all' over the sibling clones (line 108) but
its job used python:3.12-alpine with no before_script, so it would hit the same
FileNotFoundError: 'git' as validate did. Dormant only because the job runs on
schedule/web, not push. Add 'apk add git'. The job's API/CA and GITLAB_TOKEN
prerequisites remain tracked separately (management#31).
pruefe_prosa.py shells out to 'git cat-file' to verify cited commit SHAs, but
the python:3.12-alpine image has no git and before_script only installed pyyaml.
The job crashed with FileNotFoundError on every push since the migration
(pipelines #255, #257). Add 'apk add git' to before_script. Verified green in
the same image locally: validate, gen_status --check, upstream_drift and
pruefe_prosa all pass.
Externalises what this session held that the migrated repo did not:
- vision/threadnet.md: the three capabilities that justify the forks beyond
rebranding (AV scanning into encrypted rooms, call-quality defaults with a
client-side-only privacy line, expiring guest access via @concierge).
- issue 0043 (M5): case-insensitive uniqueness in the matrix-invitation prompt
stage — the open residual of ADR-0011.
- issue 0044 (M5): auto-restart consumers on SOPS values-secret change — the
footgun behind the on_conflict fix sitting inactive until a manual restart.
- issue 0045 (M1): report_event.admin_message_md unset — content reports
dead-end with no contact path (verified still open against live config).
- sources/protokolle: the raw apo-call diagnosis history, including the four
ruled-out hypotheses and the harmful DB write, as the source behind the AAR.
STATUS.md regenerated (M5 appears for the first time). validate, gen_status
--check, upstream_drift and pruefe_prosa all green in the CI image.
Frozen handoff record for the upstream repo, English per neckbeard's
own artifact convention: the completed first size-L run (the ADR-0006
v1.0.0 trigger), eleven feedback items each with field evidence and
reference implementations, and a where-to-look table. Issue 0040 now
points at it; go-live item 1 in issue 0042 is ticked off by this push.
Size S under the granted exception - one deliverable, no design
decisions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The design doc closes with its AAR (planned/actual/why/learnings, the
six acceptance criteria checked off 6/6, the session's shakiest calls
named) and moves to docs/design/done/ with status done. Harvest: a
stolpersteine wiki page distilled from the AAR (hex is not a git SHA,
TZ on the git process, python floor, anonymous Gitea negatives,
negative tests, directory links), and the neckbeard feedback list
becomes issue 0040 - a deliberate separate act, per the design's
non-goals. Operational follow-up is issues 0041 (refine imported
wartegrund) and 0042 (go-live: push, first mirror run, CI schedule,
milestone for gitops#61). Final chain green: validate 0/0 over 36 open
issues, gen_status --check current, drift 0, prosa 0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gate 4, slice 5: eight component declarations under docs/components/
(filename = canonical slug, F-008 answered by construction; staged
dormancy of thread-net-git/threadnet-operating finally representable,
game-operating/gameserver as external with their field-test caveats),
five pointer-rollout follow-up issues (0035-0039, ADR-0013),
gruppenpruefung.py joins the stillstandspruefung family (runtime group
list vs declarations, pointer presence, group-wide milestone/priority
duty, issue drift, git hygiene since the 2026-08-07 rule boundary,
bot exception per ADR-0009) with its own scheduled CI job, and
spiegel_issues.py mirrors repo to GitLab (title, state, milestone,
priority, due, status label only - never descriptions, never
backwards, dry-run by default, GitLab-only issues are reported and
never auto-closed).
Verified - all four pattern demos fire (acceptance criterion 5, 4/4):
A) old CLAUDE.md claims M1-M4 while the frozen export knows M5;
B) hygiene over full clone history finds 222 real-clock commits by
own identities (matches the frozen Session-1 numbers per repo);
C) covered in slices 3/4 (five task blocks, now 0);
D) covered in slice 3 (orphaned SHA citations, now resolved/curated).
Live run (read-only): exactly the four missing pointers (F-011) and
gitops#61 without milestone as red findings, zero drift on all 26
mirrored issues, group list consistent. Mirror dry-run plans 7
creations, 0 updates, wrote nothing. Offline chain green: validate
0/0, gen_status --check current, drift 0, prosa 0.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gate 4, slice 4: 26 open management issues imported from live git.lab
(read-only, descriptions included as authorized; GitLab iid = file id,
labels/milestone/priority/due/host/area mapped into frontmatter, the
import aborts instead of inventing a missing milestone or priority).
Two new issues close the F-004 gap where work was really still open
(0033 OVERMIND-01, 0034 CFGMON-11 incl. the plaintext npm-token
rotation); CFGMON-12/13 already route to verified git.lab issues,
MATRIX-05 is done and needs none (agreed with sorb). The three wiki
task blocks now reference their issues, roadmap.md hands all counts to
the generated STATUS.md and states M1-M5 per ADR-0010 (closing F-001
in the canonical prose), pruefe_prosa joins the CI validate job, and
the import protocol under docs/sources/migration/ records every
intervention into imported text.
Verified: validate 0/0 over 29 issue files, gen_status --check current
(distribution line M1 9 - M2 17 - M4 2 plus per-issue milestone and
priority), pruefe_prosa 0 errors with clones and 0 errors/15 unchecked
citations in offline CI mode, drift check green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gate 4, slice 3: verfahren/, hosts/, vision/ and shared/ moved via git
mv - six AARs to docs/aar/ (four harvested by the 2026-08-09 retro,
two open), procedures and host knowledge to docs/wiki/ (admin,
deployment, architecture, new area vision), the retro protocol and the
commit mapping table to docs/sources/ (protokolle/, migration/). New:
the wiki index linking every page, and the mirror-topology page
carrying the why-two-places reasoning verbatim from the old CLAUDE.md
(F-013 preserved). All moved-path references retargeted; the link
checker drove the sweep to zero.
pruefe_prosa.py added (pattern C+D): SHA citations resolve via repo,
mapping table, optional component clones or a curated exemption list
(documented dead Gitea-force-push commits, a vendor-repo tag, an
Authentik uid that is hex but no git SHA, the external neckbeard
reference); wiki task prose without an issue reference errors, with a
visible pragma for deliberate checklists; the dead-tracker denylist
now covers every mirrored repo's retired Gitea tracker (F-005) - two
links re-verified against live GitLab titles and retargeted, five
defused into honest historical citations.
Verified: validate 0/0, gen_status --check current, drift 0. Demo on
the pre-migration state fires 6 findings (3 orphaned SHAs, 3 task
blocks); on the current tree exactly the 3 F-004 task blocks remain -
they turn green in slice 4 when the issues exist, which is why
pruefe_prosa joins CI only then.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gate 4, slice 2: decisions/0001-0011 moved via git mv with schema
frontmatter prepended (status and date taken from each body's own
Status line - 0007 stays proposed, its decision is open in #20; bodies
unchanged except relative links gaining one directory level). The old
scheme's README and template retire - their rules already live in
AGENTS.md section 6 and the neckbeard ADR template. Every reference to
decisions/ across the tree retargeted (root files, not-yet-moved
verfahren/hosts/shared files, design doc and session ADR frontmatter).
Verified: validate 0 errors (11 ported + 2 session ADRs + duplicate-id
guard), gen_status --check current with all 13 ADRs listed, drift
check 0 findings, negative test shows a cloned id 0012 firing the
duplicate check.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Tracer bullet of the migration design (Gate 4, slice 1): pinned v0.1.1
baseline under docs/sources/upstream/ with provenance note, the
Karpathy block moved verbatim to docs/sources/regelwerk/ (standing
rule mapped onto the sources read-only mechanism), AGENTS.md assembled
from the byte-true upstream sections plus the project section 6
(group rules condensed from the old CLAUDE.md), CLAUDE.md reduced to
the upstream pointer, WORKFLOW.md and all four templates copied,
schema.yaml extended (issue milestone/priority/status columns,
component type, wiki area vision - all flagged in the header),
validate.py and gen_status.py forked with marked extensions,
pruefe_upstream_drift.py added, STATUS.md generated, CI gains the
offline validate job, README directory link defused.
Verified: validate 0 errors 0 warnings (the three pre-existing
directory-link errors are gone), gen_status --check current,
drift check 0 findings, baseline byte-identical to the reference
checkout (10/10 files), four negative tests fire (WIP limit 3x
in-progress, waiting without wartegrund, component slug mismatch,
single-byte drift in WORKFLOW.md). gen_status needs Python >= 3.10
locally (write_text newline) - noted for the design AAR.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reality moved after the Gate-3 approval (flagged by the human, verified
read-only): main gained decisions/0011 plus a new AAR, gitops gained two
commits, and the live backlog shows gitops#61 without a milestone - the
first real break of the 100% milestone discipline. Session ADRs
renumbered to avoid the id collision, counts updated (11 old ADRs, 6
AARs), gruppenpruefung gains the group-wide milestone/priority duty
check backed by that real case. Addendum in the design doc records all
of it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Complete target file map, exact schema extensions, script signatures
without bodies, CI flow, per-check assertions including the four
pattern demonstrations and negative tests, DO NOT CHANGE boundaries,
and the six shakiest calls named.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Amendments decided with the human at the Gate-2 STOP: docs/sources/
gets a by-source-type taxonomy (regelwerk/upstream/protokolle/
migration, proposed by sorb), the pinned v0.1.1 originals become a
byte-compare baseline against silent framework-file rewrites, AGENTS.md
carries the change-only-with-sorb rule forward, and the issue import
may read descriptions via the token (read-only). ADR-0011 and ADR-0012
flipped to accepted.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two-way harvest as mandated by the Session-1 handoff: failure patterns
of both approaches tabled with the mechanism that closes each, all
seven neckbeard gaps dispositioned (plus two new ones found this
session), and the old approach's proven value folded into the target
architecture. Two directional decisions filed as proposed ADRs: issues
live in-repo with GitLab as a deterministically mirrored view (0011),
group rules canonical here with pointer components and a checkable
components artifact (0012). Migration map, check architecture split
offline/runtime, constraints, upstream feedback candidates.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Problem statement built on the four drift patterns from the Session-1
field test, six numeric acceptance criteria, non-goals (no history
rewrite, no push, no component rollout, no forge-state destruction),
announcement paragraph. Gates 2-5 deliberately not pre-filled, per
WORKFLOW.md. Frontmatter validates against neckbeard v0.1.1 schema
with 0 errors for this file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Answers recorded from the Gate 0 questions, asked and confirmed by the
human on 2026-08-11: language de, size-S exception granted, purpose and
audience as stated in the frontmatter. Validated against neckbeard
v0.1.1 schema.yaml (823a08c) with 0 errors, 0 warnings; the framework
files themselves enter this repo only after the two-way harvest mandated
by the Session-1 handoff.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Records on_conflict: fail as standing policy (identity provisioning never links
a new upstream identity to an existing local account), the residual prompt-stage
uniqueness check, and the SOPS-secret-needs-restart rule. Decided by sorb.
The SOPS secret updated via Flux but MAS kept the old config in memory until a
rollout restart. Records committed != deployed != active for the security fix.
Root cause proven end to end: a pre-Authentik account that lost its profiles
row (deactivate clears it, reactivate does not recreate it) crashes the
displayname write path, so it never gets a display name and the Element Call
widget never initialises. Fixed with a cross-checked INSERT; open_id_tokens
went 0 -> 6 and the call joined. Records the ruled-out suspects, what led to
the solution, and the lessons - chief among them: compare old accounts against
freshly provisioned ones, and reproduce in a cleartext room before blaming
crypto. Also notes the account-takeover finding (gitops#61) surfaced along the
way.
Records the refinement decision of 2026-08-09 (M5 created, 14 issues
moved out of M1, dividing line documented). Drafted during the
neckbeard field-test analysis (finding F-001); placement decided by
sorb on 2026-08-10: old scheme, nothing migrated yet.
Eleven findings, two false leads recorded as such (a wrong first diagnosis on #60, a false-clean secret scan caused by a wrong raw path), and the methods that actually surfaced each finding - most came from reading live state (database, ak apply_blueprint, the served config.json) rather than trusting green status.
game-operating got its push mirror today. gameserver (the group's eighth project) still has none - pointed at management#32 instead of duplicating that finding here.
game-operating was made private on Gitea, and the check quietly skipped the mirror comparison. A repo that IS mirrored but whose far side cannot be read is unverified, and unverified must not look like fine. It is now a finding that names the missing GITEA_TOKEN.
While testing that, a second bug surfaced: the header helper built 'Authorization: token: <value>' from a name that already contained the schema, producing a silently invalid header. The Authentik check had the same defect and would have failed the moment a token was added - it never ran, so nobody would have connected the two.
Refs axion1337.chat/management#28, #31
Looks for things that quietly stopped working. Every check mirrors a case that actually happened this month, named in its docstring: a repo that was never mirrored, mirror drift, pipelines with zero jobs, a successful job without artifacts, an npm package too small to contain a build, and Authentik blueprints stuck on error. Nothing is checked on suspicion.
The project list is read from the group at runtime rather than maintained in code - a hardcoded list is exactly where a new repo slips through for years. The first run proved the point by surfacing two projects nobody had in mind.
It aborts when a credential is missing instead of skipping quietly. A check that disables itself reports nothing for years and is indistinguishable from all clear.
Refs axion1337.chat/management#28
Retro 2026-08-09, the first one under the framework. Main finding: six silent failures in nine days - a green pipeline that uploaded nothing, a broken npm package, a blueprint rejected on every run, a working copy tracking the forbidden remote, empty pipelines going red for nothing, and a release build that nearly overwrote a published image. None was found by monitoring; four surfaced by accident while looking for something else.
ADR-0009 documents the commit conventions and the retroactive anonymisation of 251 commits. It is filed after the fact, which is exactly the mistake the ADR duty exists to prevent - stated in the ADR rather than smoothed over.
Also recorded: assigning status:next and reassigning milestones are forbidden to a session acting alone; both happened here in the refinement with sorb, so the rule stands unweakened.
Force-pushing the rewritten tags restarted three release pipelines in ThreadNet-Web. Nothing was overwritten, but only because the protected registry variables were unavailable while the v* tag rule was temporarily removed for the push - docker login died after four seconds.
That was luck rather than planning: with tag protection in place, threadnet-web:v0.4.0 would have been rebuilt from old code against today's dependencies and pushed over the published image. Tracked as ThreadNet-Web#14.
251 verified pairs, reconstructed from the backup branches: every pair had to match on both tree hash and commit message before being accepted, and all 251 did.
This keeps older references resolvable without editing what was written at the time. Rewriting historical issue comments would remove the record of what someone actually wrote, and a lookup table costs nothing by comparison.
The anonymisation rewrite of 2026-08-07 gave every touched commit a new SHA, leaving the references in these documents pointing at objects that no longer exist. The mapping was reconstructed from the backup branches and each pair verified by tree and commit message before substituting.
Prefix lookups were built for lengths 7 to 12 and any ambiguous prefix would have been skipped; none were ambiguous across all 251 pairs.
Applies to every repo in the axion1337.chat group and the ThreadNet services, effective 2026-08-07 (sorb).
Two warnings are part of the rule, not decoration. First: both GIT_AUTHOR_DATE and GIT_COMMITTER_DATE must be set - setting only the author date leaves the committer date in the object, visible via git log --format=%cd and in every web UI. Second: the rule only covers git history. Push times, issue and comment timestamps, pipeline runs and package publishes still carry real times and sit in the same GitLab and on the public Gitea mirror; anyone who genuinely wants no derivable pattern has to address those too.
Zwei veraltete Stellen: der Kopf sagte, Milestones wuerden noch angelegt, der Fuss sagte, der Struktur-Workshop stehe aus - beides ist seit dem 2026-08-06 erledigt.
Neu festgehalten: jedes offene Issue haengt jetzt an genau einem Meilenstein, Verteilung M1 33 / M2 21 / M3 4 / M4 12 von 70. Dazu die offene Frage, ob M1 mit fast der Haelfte zu breit ist - elf der Issues sind zusaetzliche Werkzeuge, keine kaputten Schutzmechanismen. Das gehoert ins Refinement, nicht in eine Session.
Zwei Luecken, die das Board driften liessen. Erstens: 34 Issues trugen ein [HIGH]/[MEDIUM]/[LOW] im Titel, zwei davon mit anderer Aussage als ihr Label - wer nach Titel sortierte, sah etwas anderes als wer nach Label sortierte. Zwei Wahrheiten ueber dieselbe Sache sind schlimmer als eine unvollstaendige.
Zweitens: 32 von 70 Issues hingen an keinem Meilenstein und tauchten damit in keiner Roadmap-Ansicht auf. Label und Meilenstein beantworten verschiedene Fragen - wie dringend gegen worauf es einzahlt.
Dazu festgehalten, dass M1-M4 bewusst kein Enddatum haben: sie buendeln, Termindruck steht als Datum am einzelnen Issue.
Die Tabelle behauptete, auch das Logo werde von axion1337.chat referenziert - seit dem Rueckbau stimmt das nicht mehr. Dazu die Begruendung, warum dort kein PNG funktioniert (Authentiks Default ist ein SVG, das sich seiner Box anpasst; ein PNG nimmt Naturgroesse) und der Hinweis, dass eine Auswahl in Authentiks Oberflaeche vom Blueprint ueberschrieben wird.
Refs gitops#55, management#29
Die Namenstabelle hatte zwei Ebenen, jetzt vier: Call-Widget folgt der In-Anwendung-Regel (aXion1337.Chat), die Anmeldeseite bekommt ThreadNet - man meldet sich am Werkzeug an, nicht in der Gemeinschaft.
Neu dokumentiert: das Unsplash-Titelbild samt Lizenzlage, warum die Danksagung bewusst unuebersetzt bleibt (Elements Schluessel steckt in 32 Sprachdateien, 31 nennen deren Fotografen - en/de allein zu aendern haette in 29 Sprachen eine falsche Attribution stehen gelassen), und dass Authentiks Anmeldeseite an genau dieser Bilddatei haengt.
Zwei Ergaenzungen aus dem v0.4.0-Release.
Das Icon-Rezept war unvollstaendig. Es warnte davor, thumbnail() statt resize()
zu nehmen - aber nicht davor, das Motiv nach dem Beschneiden auch mittig zu
setzen. Genau das ging schief: 81 % Breite gefuellt, aber 3 % Rand oben und 40 %
unten, das Motiv klebte an der Oberkante. Faellt in runden und quadratischen
Icon-Slots sofort auf. Das vollstaendige Rezept steht jetzt da, dazu die Liste
aller elf Icon-Artefakte und wie man per Pruefsumme feststellt, ob eines
nachgezogen wurde und ein anderes nicht.
Die Namensgebung ist gespalten: ThreadNet auf Betriebssystem- und PWA-Ebene,
aXion1337.Chat im Client. Das folgt der Leitplanke aus vision/threadnet.md - das
Programm ist das Tool, die Instanz darin die Community. Wer nur eine der beiden
Stellen sieht, haelt es fuer eine Inkonsistenz und zieht es gerade; deshalb steht
jetzt ausdruecklich da, dass es keine ist.
Dazu die Attribution: seit v0.4.0 in Einstellungen -> Hilfe & Info unter der
Client-Version, bewusst NICHT im Kopiertext der Versionsangabe - der landet in
Fehlerberichten, dort ist die Fork-Herkunft nur Rauschen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Die Rezepte in ZONE-01 nannten Werte (Null-MX, v=spf1 -all, p=reject), ohne zu
sagen, wogegen sie schuetzen. Wer sie umsetzt, ohne das zu wissen, kann nicht
erkennen, wann ein Halbfertig-Zustand schlechter ist als der Ausgangszustand -
und genau das ist eingetreten.
Ergaenzt: die vier Mechanismen einzeln (SPF, DKIM, DMARC, Null-MX), was jeder
beantwortet und warum keiner allein reicht. Zwei Punkte, die man kennen muss:
- SPF darf nur EINMAL je Name existieren; ein zweiter Record erzeugt PermError,
und dann pruefen viele Empfaenger gar nicht mehr. Die Haertung schlaegt ins
Gegenteil um.
- DMARC wird vererbt. Fehlt _dmarc.<name>, gilt die Policy des Apex - und die
steht auf p=none. Damit erben ALLE Subdomains 'kein Schutz', egal wie sauber
ihr SPF ist. Der Apex ist damit der groesste Hebel der Zone (ZONE-02), nicht
die Einzelnamen (ZONE-01).
Dazu der gemessene Ist-Stand (DoH, um den Lab-Resolver zu umgehen): Bei rohana
sind MX und SPF geloescht, die Ersatz-Records fehlen. Vorher gab es wenigstens
ein Softfail-SPF, jetzt gar keine Aussage - keine Aussage ist schwaecher als eine
schlechte. Bei selendis ist nur das www weg, der Mail-Satz steht unveraendert.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Vier Entscheidungen aus dem Struktur-Workshop.
Kadenz: Refinement sonntagabends, woechentlich. Sonntag, weil die GitLab-Backups
dort ohnehin laufen und die Woche an der Stelle eine Kante hat. Die Retro light
bekommt bewusst KEINEN eigenen Termin, sondern haengt am ersten Refinement des
Monats - ein monatlicher Extra-Termin im Solo-Betrieb ist ein Termin, der
ausfaellt.
Board-Pflege bei Abwesenheit: Eine Session darf abbilden, aber nicht zusagen.
Erlaubt sind status:wartet, Schliessen, Fristen nachtragen, Issues anlegen;
nicht erlaubt sind status:doing und status:next. Die Trennlinie ist nicht
Vorsicht, sondern Bedeutung - doing und next sagen, was als Naechstes wirklich
passiert, und das entscheidet sorb. Jede Aenderung wird im Issue begruendet.
ADR-0008 zu #14: Agenten-Sessions auf CFGMON laufen root-aequivalent ueber die
docker-Gruppe, und das bleibt so - ausdruecklich. Damit gilt 'sudo mit Passwort'
auf diesem Host nicht als Kontrollmechanismus. Option B haette das Auditproblem
geloest, indem sie den Arbeitsweg entfernt (sudo braucht ein TTY, das eine
Session nicht hat); Option C bleibt Ziel, lohnt aber erst bei einem zweiten
Menschen - ihr Nutzen ist Zuordnung, und im Ein-Personen-Betrieb gibt es
niemanden, gegen den sie schuetzen wuerde. Als ADR und nicht als Absatz in
hosts/cfgmon.md, weil eine Ausnahme nur zu dokumentieren statt sie zu
entscheiden genau der Fehler ist, den die ADR-Pflicht adressiert.
Die im Issue geforderte Vorklaerung - welche Konten sonst in der docker-Gruppe
sind, gilt dasselbe auf MATRIX - ist ausdruecklich als offen vermerkt statt
stillschweigend uebergangen.
Definition of Done: Baustein 4 der Textbausteine IST die kurze DoD fuer
Aenderungen ohne Deploy, statt eines eigenen Dokuments. Ein drittes Dokument
waere die dritte Fassung derselben Regeln und damit die dritte, die driftet.
62 relative Links geprueft, keiner tot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Die Konventionen stehen kanonisch in CLAUDE.md, aber eine Session liest sie nur,
wenn sie dazu aufgefordert wird. Diese fuenf Bloecke sind die Aufforderung:
Session-Start, Host-Session, Deploy-Uebergabe, Abschluss, Entscheidungsvorlage.
Zwei Gestaltungsentscheidungen, beide aus Fehlern dieser Woche:
Die Bausteine VERWEISEN auf die Regeln, statt sie zu wiederholen. Waeren sie
ausgeschrieben, gaebe es eine zweite Fassung, die driftet - genau das ist am
2026-08-02 passiert, als gitops/CLAUDE.md 'keine Gitea-Ausnahme mehr' behauptete,
waehrend management/CLAUDE.md zwei nannte.
Und hoechstens acht Zeilen je Block, maschinell geprueft. Der Test ist banal: Wer
zum Kopieren scrollen muss, benutzt es nicht. Der Host-Block musste dafuer zweimal
umgeschrieben werden; die Deploy-/AAR-Zeile ist rausgeflogen und steht jetzt als
Prosa daneben - Prosa muss niemand kopieren.
Die Inhalte sind nicht ausgedacht, sondern die Fehler der Woche: erfundene
Theme-Paletten statt gelesener Quelle, ein Sweep nach dem Pfad statt nach dem
Namen, ein zur Haelfte gelesenes Issue samt uebersehenem Korrekturkommentar, die
.netrc-gegen-PRIVATE-TOKEN-Falle und der Ping, der immer fehlschlaegt.
Pflegeregel dabei: ergaenzt wird ein Baustein, wenn derselbe Fehler ZWEIMAL
passiert ist - nicht vorsorglich. Sonst wachsen sie, bis sie niemand mehr kopiert.
Verlinkt aus CLAUDE.md und verfahren/README.md. 59 relative Links geprueft,
keiner tot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Erster Teil des Struktur-Workshops. Die Entwuerfe vom 2026-08-01 trugen je zwei
offene Fragen; vier davon sind entschieden, die Dokumente sind damit nicht mehr
Entwurf.
axion1337.chat - kontrolliert wachsend: offen fuer Neue, aber jeder Eintritt
wird freigegeben. Das war faktisch schon gebaut (Invite-Workflow, @concierge,
befristete Gast-Accounts) und ist jetzt auch so beschlossen; die Alternativen
haetten entweder den Workflow ueberfluessig gemacht oder Moderationskapazitaet
verlangt, die es nicht gibt.
ThreadNet - die Forks werden oeffentlich, aber erst nach einem History-Audit.
Ausschlaggebend war ein Widerspruch im eigenen Dokument: Das Prinzip
'reproduzierbar fuer Dritte' zahlt sich nur oeffentlich aus, blieben die Forks
privat, waere dauerhaft fuer einen Zweck gebaut worden, den es nicht gibt.
Der Audit ist als Bedingung vermerkt, samt konkretem Fund: Commit 0242238
entfernte ein Klartext-TURN-Secret, das weiter in der Historie steht.
ThreadNet - das Rebranding wird in M4 zu Ende gebracht statt separat terminiert.
Halbfertig ist der schlechteste Zustand: Der Desktop-Client heisst ThreadNet,
der Web-Client zeigt Element.
Homelab - konsolidieren vor ausbauen. Massstab ist nicht 'laeuft es', sondern
'ueberlebt es den Verlust der Maschine'. Mit sorbs Nachtrag, dass die Git-Daten
bereits nach S3 gesichert werden - was den Befund aus #10 entschaerft, aber die
Frage offen laesst, was diese Sicherung nicht umfasst.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Die Stacks sind jetzt unter axion1337.chat/game-operating abgebildet. Der
Bestandseintrag sagt ausdruecklich, dass es ein Abbild und keine Quelle ist und
was ihm noch fehlt - sonst liest sich der Verweis wie eine Zusicherung, die er
nicht einloest.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Der Host ist seit 2026-08-02 im vSwitch (10.0.0.4). Damit liessen sich die
Compose-Definitionen einsehen, und die Ursache von GAME-01 steht fest: In keinem
der beiden Stacks gibt es einen ports:-Block. Coolify haengt alles an sein
eigenes Docker-Netz, auf 9100/8080 des Hosts lauscht nichts. CFGMONs Scrape-Ziele
auf der oeffentlichen IP konnten also nie funktionieren - was zum Befund passt,
dass up == 1 in 45 Tagen Retention nie vorkam. Die Firewall war eine zweite,
unabhaengige Schicht darueber.
Nachgetragen: beide Stacks mit Images, der Hinweis dass sie aus Coolify-Templates
stammen und nur dort existieren, und dass der Umzug nach Git bewusst zurueckgestellt
ist, bis das Matrix-Projekt fertig ist.
Der Host bleibt bewusst nur teil-inventarisiert - er wurde weiterhin nicht
betreten, OS-Stand und Plattenbelegung fehlen. Das steht jetzt explizit da,
statt ihn faelschlich als erfasst auszuweisen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Gegenprobe vom Hausanschluss (178.25.213.70) zur CFGMON-Messung vom 01.08.
(188.245.193.243). Neu und aufschlussreich: Port 22 antwortet meiner Quelle
sofort und laeuft bei CFGMON in einen Timeout.
Zwei Schluesse, die die bisherige Vermutung praezisieren:
- Ein pauschaler Bann von CFGMON ist ausgeschlossen - waere die IP komplett
gesperrt, waeren auch 80/443 von dort tot. Es ist eine portbezogene Regel mit
Quellliste, keine IP-Sperre.
- 8080/9100 sind fuer NIEMANDEN freigegeben, auch nicht fuer den Hausanschluss.
Die Exporter sind also nicht versehentlich fuer CFGMON zu, sondern nirgends
offen.
Damit fehlt keine Ausnahme fuer CFGMON - die Empfehlung aus GAME-01 (Host in den
vSwitch statt oeffentliche Freigabe) traegt weiterhin.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Die letzte Ausnahme von ADR-0002 ist erledigt. Sie bestand, weil CFGMON git.lab
nicht erreichte; mit dem Site-to-Site-Tunnel (ADR-0004) ist der Grund weg.
Umgezogen mit dem Werkzeug der ersten Migration (verfahren/issue-migration/
migrate.py), damit derselbe Fusstext und dieselbe Idempotenz gelten:
- sorb/management#1 (offen) -> management#25
- sorb/management#2 (geschlossen) -> management#26, mit allen 11 Kommentaren
Original-Autor und -Zeitstempel sind erhalten (der Admin-Token darf created_at
setzen); die Gitea-Issues sind geschlossen und verweisen auf ihr Gegenstueck.
Der Gitea-Tracker ist damit leer.
Issue-Vorlage konvertiert statt kopiert: Gitea nutzt YAML-Issue-Forms, GitLab
Markdown-Templates. Die Feld-Begruendungen - der eigentliche Wert der Vorlage,
weil jedes Feld fuer eine real schiefgegangene Uebergabe steht - sind als
Kommentare erhalten. .gitea/ ist entfernt, damit dort keine neuen Uebergaben
mehr angelegt werden koennen.
Nachgezogen: README, roadmap, CLAUDE.md, ADR-0002 (Ausnahme durchgestrichen +
als zurueckgebaut markiert), ADR-0004 (Ernte eingeloest), hosts/overmind.md,
hosts/cfgmon.md, verfahren/README.md, verfahren/deploy-uebergabe.md.
55 relative Links geprueft, keiner tot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
sorb hat das VPN-Thema am 2026-08-02 fuer abgeschlossen und validiert erklaert.
Das Dokument trug das nicht: Es listete unten 'Offene Punkte' mit #11 und #12,
und der abgearbeitete Diagnose-Plan von LABNET-01 stand ohne Kennzeichnung
mitten im Text, als waere er noch zu tun.
- Banner oben: abgeschlossen und validiert, keine offenen Issues, alles
Folgende ist Bestand und Historie
- Die Abschnittsueberschrift 'Offene Punkte' war schlicht falsch - jetzt
'Zugehoerige Issues - alle geschlossen', mit Tabelle statt Liste
- Der Diagnose-Plan bekommt einen Warnhinweis: abgearbeitet und ueberholt,
steht nur als Beleg der Ursachensuche da
Abgegrenzt: #13 (LABNET-03) und #15 (CFGMON-15) tragen LABNET im Text, gehoeren
aber nicht zum VPN-Thema und bleiben offen - der eine ist der Rueckbau der
Gitea-Ausnahme, der andere Credential-Hygiene, bei der ein Widerruf still einen
Push-Mirror brechen kann. Beides steht jetzt ausdruecklich da, damit die
Abnahme nicht faelschlich auch diese beiden mit einschliesst.
Issues #11 und #16 sind mit Begruendung geschlossen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Die Konsequenz-Zeile sagte, die Gitea-PR-Ausnahme bleibe bestehen und der
CronJob treffe git.lab nur bei eingeschaltetem Tunnel. Ersteres stimmt weiter,
Letzteres ist seit dem Schedule-Job canonize_rotation ohne Bedeutung: Der Job
laeuft im Lab und erreicht Gitea oeffentlich, die Rotation haengt also nicht
mehr am Tunnelzustand.
Nachtrag statt Umschreiben - die Entscheidung von damals war richtig, nur ihre
Folge hat sich geaendert.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Spiegelt gitops-Commit. Zwei Ergaenzungen:
Warum zwei Orte: git.lab haelt die Bauplaene, Gitea eine Kopie, die der Cluster
ohne verfuegbares Lab erreicht - die Produktion darf nicht an einem Host haengen,
der nur im Lab antwortet. Mit ausdruecklicher Warnung, die Flux-Quelle nicht auf
git.lab 'geradezuziehen'.
Die TURN-Ausnahme ist keine Handarbeit mehr: der taegliche CI-Job
canonize_rotation erledigt die Kanonisierung. Rote Pipeline statt Kalendereintrag.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Die Umwidmung ist in ADR-0002, ADR-0005 und dem README beschrieben - die
Verweise darauf hatte ich beim Umbau aber nie nachgezogen. Drei Stellen nannten
weiter den alten Namen, eine davon mit gleich drei falschen Aussagen im Praesens.
overmind.md, 'Repo-Topologie (Kontext)': sprach von '5 gespiegelten Repos' und
'Gitea bleibt: ... Issues, Backlogs (dieses Repo, ungespiegelt)'. Es sind sechs
(die fuenf Produkt-Repos plus management), die Issues liegen seit ADR-0002 auf
git.lab, und dieses Repo wird seit der Umwidmung selbst gespiegelt - es
behauptete also das Gegenteil des heutigen Zustands.
cfgmon.md: zwei Nennungen entschaerft. Beide stehen in Analyse-Abschnitten vom
2026-07-31 und sind als Historie richtig, lasen sich aber wie Gegenwart -
'Explizit nicht rueckbaubar' galt fuer den damaligen Gitea-CI-Rueckbau, nicht auf
Dauer. Datierte Marker statt Umschreiben.
Ausserdem trug der CFGMON-12-Abschnitt eine Liste 'Noch auf Gitea: Issues,
Meilensteine, Wiki', obwohl die Migration am 2026-08-02 mit 62 Issues durch ist.
Ergebnis vorangestellt, der Rest bleibt als Vorher-Stand stehen.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Beide Dokumente beanspruchten schriftlich 'Bestand': das README von homelab/docs
('hier steht, was Bestand hat') und dieses Repo (README: hosts/ und shared/ =
'Bestand + Historie'). Die WireGuard-Tabelle stand entsprechend doppelt, ohne
dass irgendwo stand, welche Fassung gilt - der Zustand, den ADR-0002 fuer Issues
gerade aufgeloest hat.
Die Doppelung ist berechtigt, aber aus einem Grund, der nirgends stand: die
Gruppe homelab hat bewusst keine Mirrors und ist von ausserhalb des Labs nicht
lesbar. Wer ohne Tunnel nachsehen will, welcher Tunnel auf welchem Port liegt,
braucht die Kurzfassung hier. Also nicht entdoppelt, sondern die Rollen benannt:
homelab/docs fuehrt die Soll-Konfiguration und gewinnt bei Widerspruch, dieses
Repo die Historie plus einen bewusst knappen Ueberblick.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
vision/ ist laut README 'eine Vision je Linie' - drei Linien, drei Dateien, alle
als Entwurf fuers Refinement markiert. branding.md ist keine Vision, sondern
Bestand und Historie eines uebergreifenden Themas, also genau das, was shared/
beschreibt (neben lab-netzwerk.md und zone-axion1337.md).
Der Beleg fuer den Fehlgriff steckte im letzten Commit selbst: ich musste die
README-Beschreibung von vision/ um einen Zusatz erweitern, damit die Datei
hineinpasst. Eine Kategorie aufzubohren, damit ein Artefakt hineinpasst, heisst,
dass es in die falsche Kategorie sollte. Die Zeile ist zurueckgebaut.
Ausserdem praezisiert, warum das Dokument in genau diesem Repo liegt: management
ist gespiegelt, homelab/wiki-bookstack nicht - die dortige theme/sorbs-palette.md
ist von ausserhalb des Labs nicht lesbar (CLAUDE.md, Mirror-Geltungsbereich).
Beide Rollen stehen jetzt explizit da.
AAR 2026-08-02: Nachtrag zur Theme-Korrektur. Die Ergebniszeile behauptete '11
neue Themes, Web live' - die Paletten waren aber erfunden. Statt die Historie
umzuschreiben ein datierter Nachtrag mit Verweis in der Zeile. Er schaerft das
Muster aus Abschnitt 4: erfundene Vorlagen erzeugen kein Symptom, an dem man sie
bemerkt - deshalb ist bei Vorlagen die Quelle zu pruefen, nicht nur das Ergebnis.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Bislang lag verstreut, welche Farbe wo gilt: Element-Themes in der gitops-YAML,
Desktop in einer zweiten Kopie, das BookStack-Schema ausschliesslich in einer
Datenbank. Dieses Dokument buendelt es hier, weil das Repo jede
Werkzeugentscheidung ueberlebt - wird BookStack nach ADR-0007 abgeraeumt, bleiben
Marke und Palette bestehen.
Enthaelt die zehn theme-factory-Paletten woertlich, sorbs aus der laufenden
BookStack-Instanz extrahiertes Schema, die Tabelle 'wo was eingestellt ist' und
zwei Fallen: is_dark laesst sich nicht aus den Skill-Beschreibungen ableiten
(nur aus theme-showcase.pdf), und Icons brauchen resize() statt thumbnail().
Nebenbefund, festgehalten weil er die Diskussion aufloest: sorbs von Hand
eingestelltes Schema und die offizielle Sunset-Boulevard-Palette sind bis auf zwei
Ziffern identisch - beide auf demselben Coolors-Satz gelandet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
Ohne Inhalte kein Vergleich - der Importer ist damit Teil des Versuchs, nicht
sein Vorgriff. Ein wiederholter Sync bleibt weiterhin ausgeschlossen. Dazu sorbs
Bestaetigung, dass beide Stacks im Homelab bleiben, bis entschieden ist, ob
ueberhaupt eine der Varianten dauerhaft eingebaut wird.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
