| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
| |
One touch buys exactly one transaction. The maintenance console's forced live update sets the sentinel and clears it afterward, but a caller that dies mid-update would leave the file behind and keep the guard disarmed until reboot. The hook now deletes the sentinel at the moment it honors it, so a missed cleanup costs nothing. The env override is unchanged, and the caller's clear step stays as the belt-and-suspenders for transactions the hook never fires on.
|
| |
|
|
| |
pacman warned filesystem 755 vs package 700 on both hosts: a world-listable private-key directory, not runtime hardening as the previous commit claimed. pacman never resets existing directory permissions, so I chmod'd 700 on ratio and velox and removed the curation entry. Integrity reads an honest zero on both.
|
| |
|
|
|
|
| |
Reinstalling the owning packages reset these eight paths and the system re-drifted every one before the next -Qkk read: cupsd rewrites its three conf files mode 600, StateDirectory re-chowns /var/lib/passim on service start, tmpfiles re-groups /var/log/journal inside the reinstall transaction itself, /etc/ssl/private sits hardened below the packaged mode, and the utempter setgid helper carries ownership drift. They would count as integrity findings forever with no action that clears them.
All eight are universal Arch runtime behavior, so they ship as qkk_known defaults rather than per-host curation. The utempter entry also silences a content change on that one binary, noted inline and accepted. I installed the TOML on both hosts; integrity now reads zero on each, with the real findings the metric surfaced along the way fixed for real (a stale hyprland.pc on both hosts, and /root sitting world-listable at 755 on velox, restored to the packaged 750).
|
| |
|
|
|
|
|
|
| |
The hypr-live-update-guard hook blocked on target names alone, so a same-version reinstall of hyprland (the maintenance console's integrity REINSTALL, right after a full update) aborted identically to a real upgrade. A pure reinstall writes identical bytes over identical bytes and can't crash the live compositor: the SIGABRT hazard needs the on-disk version to actually change.
The guard now compares each target's installed version (pacman -Q) against the sync-db candidate (expac -S %v). Both are read-only queries and safe under the transaction lock, pinned live with db.lck present. Targets that match pass as reinstalls, and the block message lists only the version-changing packages. Unresolvable versions (AUR targets, -U transactions, expac missing) still block conservatively.
Verified live on ratio: the previously blocked six-package reinstall ran clean with Hyprland up. The block path is pinned by the test suite (13 tests, four new). I deployed the script to /usr/local/bin on both hosts by hand since the installer only copies it on fresh systems.
|
| |
|
|
| |
The maint probe now grades CVE advisories on actionability (a fixed release exists and isn't installed), not severity, so the severity floor is dead config. The section comment records the retirement. I installed it on both hosts.
|
| |
|
|
|
|
| |
pacman --needed skips a package that is already on the system as a dependency and leaves its install reason alone. A declared package can then sit as asdeps, surface as an orphan once its accidental dependent leaves, and get swept away by an orphan cleanup. expac and lm_sensors, both maintenance-console runtime deps, nearly went this way: they were asdeps on both hosts and only survived today's orphan sweep because something still depended on them.
pacman_install now marks the package explicit after a successful install. The mark never runs on a failed install, and a mark failure never fails the install. I flipped expac and lm_sensors to explicit on ratio and velox by hand since the installer only runs on fresh systems.
|
| | |
|
| | |
|
| |
|
|
| |
This pairs with the maint probe change: the snapper grade now warns at summed limits + snapshots.timeline_slack. Slack 2 absorbs the hourly create/:45-cleanup timer gap that kept the card amber most of every hour. I installed it on both hosts.
|
| |
|
|
|
|
| |
The 10GB threshold sat below the keep-3 steady state on both hosts (ratio 12.6GB, velox 10.8GB after pruning), so the warning persisted with nothing left to clean. paccache keeps three versions per package and never expires by age, which puts the honest ceiling near 17-19GB. At 20GB the metric stays quiet in steady state but still fires within about two months if the paccache timer dies.
I installed it on both hosts and the warning cleared on each.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
The workflow and the four host capability inventories move here from the home project. System maintenance is archsetup's domain, and this puts the thresholds TOML and both of its consumers in one repo.
The workflow's prose severity rules now cite the installed TOML keys, and the TOML wins on disagreement. Inventory paths point at docs/homelab-inventory/. A note routes routine ratio/velox checks to the maint CLI, leaving this workflow for the non-Arch hosts and forensic deep dives.
Only the #+HOSTNAME: capability inventories moved (ratio, velox, mybitch, truenas, plus the truenas hardware-specs asset they link). The personal gear records stay in home, and the home-side removal is handed off through its inbox.
|
| |
|
|
|
|
|
|
| |
The maint console and the system-health-check workflow grade against ~/.config/archsetup/maintenance-thresholds.toml, but nothing installed it. A fresh install got a working maint CLI and no thresholds file.
user_customizations now installs the shipped TOML from the cloned repo. A re-run refreshes it, and the user layer in ~/.config/maint/ is never touched, so a reinstall can't eat curation. It also enables maint-scan.timer and maint-net-scan.timer through wants-symlinks (systemctl --user has no session bus during install, the syncthing idiom). Timer enablement is hyprland-only because the units live in that stow tier.
The install lists gain the runtime tools the probes call but nothing carried: expac, lm_sensors, fwupd.
|
| | |
|
| |
|
|
|
|
| |
Nine break/fix/assert scenarios run the real maint fix inside the test VM. The runner batches non-conflicting scenarios into one VM boot, restores the snapshot only between groups, and leaves the base image pristine afterwards. A systemd-nspawn fast lane runs the pacman-level group against a cached pacstrap rootfs in seconds. The plan layer validates the scenario contract without a VM and carries a 19-test unit suite. make test-maint wires the VM lane in.
The zfs lane is filtered but unexercised: the FS_PROFILE=zfs base image fails to build (ZFS DKMS module not found on linux-lts 6.18). The failure is tracked in the todo.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
[updates] guard_patterns is the live-update guard's pattern set (mesa/hyprland/wayland runtime plus both hosts' vulkan drivers); [curation.session_critical] is the KILL lever's denylist; timeline_quarterly completes the snapper set-config key set.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
The thresholds TOML gains packages.keyring_warn_days, the [security] cve_min_warn floor, [systemd] expected_timers_extra, and two curation tables: kept_orphans (deliberate keeps the orphan count skips) and qkk_known (fnmatch paths for -Qkk mismatches that are config knowledge, like the resolver symlink and the pacman-contrib file this script edits itself).
The installer now pulls arch-audit (the console's CVE source) and enables btrfs-scrub@-.timer on btrfs installs. Ratio had the scrub timer enabled out-of-band, so a fresh install would have warned "missing" forever on the console's maintenance-timers check. The todo Phase 3 task closes as a dated log entry.
|
| |
|
|
| |
The TOML gains the Phase 2 storage bands (btrfs unallocated floor, SMART wear/temp, fstrim staleness, top-consumers scan knobs). Collectors shipped in dotfiles; installed copies refreshed on ratio and velox.
|
| |
|
|
|
|
| |
The TOML carries every severity value the console and the system-health-check workflow grade against (the workflow's hard-won numbers: the 10 GB cache trigger, the 35/60-day scrub bands, the snapper TIMELINE limits from the 2026-05-26 /home lesson) plus the shipped curation defaults. Canonical home is configs/ here. Installer wiring stays Phase 13, so for now the file is hand-copied to ~/.config/archsetup/ on ratio.
Phase 1 of the build landed in dotfiles (43a39ac): maint package skeleton, two-layer thresholds engine, capability probe, and the status contract with three pilot collectors, 48 tests. The todo phase task flips to its dated log entry.
|
| |
|
|
|
|
| |
The spec encodes the converged 2026-07-06/07 design as 13 decisions and 13 phases (CLI-first maint package, four-layer test strategy) and carries its full review trail inside, live-verified on ratio. Late calls landed during authoring: the bar glyph replaces custom/sysmon, doubles as the laptop battery display, and keeps the btop scratchpad on right-click.
todo.org now carries the build: 13 phase tasks under a SPEC_ID-stamped parent, the manual-testing collector, the flip-to-IMPLEMENTED closer, and the vNext deferral.
|
| |
|
|
|
|
|
|
| |
The design doc replaces the install-health framing in system-monitor-design-ideas.org with a maintenance console: dense metric subpanels behind a persistent selector, a doctor that streams into a results wall, determinate remedies only (guard-armed updates, curation lifecycles for noise, listeners, containers, and orphans), rotary band selectors on the tall subpanels, and a CLI-first build with a four-layer test strategy. Every decision is dated in the doc.
Prototypes A-E5 keep the exploration path: five divergent layouts converging into E5, a fully interactive simulation whose GOOD/BAD snapshots become the build's test fixtures.
todo.org gains the spec-create task, the panel keybinding-family task, and scope notes on the net/bt doctor retrofit.
|
| |
|
|
|
|
|
| |
Design prototype for the push-to-talk bar indicator: an always-present outline
tag (account-voice glyph) left of the mic — dim grey when off so the bar never
reflows, gold + glow when armed, brighter while transmitting, click-to-toggle.
The states and icon were settled against this before wiring it into waybar.
|
| |
|
|
| |
Records Phase 5 of the audio signal-metering spec: a per-device three-state activity lamp on each output/input row, so the panel shows which specific device is carrying audio, not just the default. GUI-only over the per-device state field already in the engine. Adds the live-check to the manual checklist; the per-row live level meter stays the deferred vNext.
|
| |
|
|
| |
Records the signal-metering layer for the audio panel: a three-state activity lamp from the pactl state field, and a windowed peak meter feeding the VU needles, keyed per device so per-device metering stays a later GUI-only change. Two review rounds before build (the first caught a parec sample-rate-vs-update-rate bug verified live); marked implemented across four dotfiles commits. Live-eyeball checks filed as a manual-testing checklist.
|
| |
|
|
| |
todo-cleanup moved the closed instrument-console panel-bug batch (net/bt/audio) to Resolved. Bring the system-monitor design-ideas capture under version control.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
nmcli connection import both sets autoconnect yes and activates the profile immediately. The configs are full-tunnel (AllowedIPs 0.0.0.0/0), so a bare import brings the tunnel up and routes everything through it. Importing a file silently connected a VPN, leaving the machine exiting through Proton.
Follow each import's autoconnect-off modify with a connection down, so importing only ever adds inactive profiles.
|
| |
|
|
|
|
| |
The seven Proton configs imported April 10 completed the WireGuard handshake but Proton routed no data: DNS and traffic through the tunnel timed out on every server. Fresh configs from the Proton dashboard route data normally. That confirms the old keys were deauthorized account-side, not a local routing, firewall, or NetworkManager fault.
Swap in three fresh configs (NL, US-CA, US-TX) and point the panel tunnels manual-test at the new connection names.
|
| |
|
|
| |
The wrap archive pass relocated finished DONE/CANCELLED tasks out of Open Work — six into the Resolved section, four into the task archive — including the timer GTK panel now that the redesign shipped and its live testing settled.
|
| |
|
|
|
|
| |
The timer-panel UI/UX redesign built and shipped to dotfiles across five phased commits. This captures the archsetup-side records.
The three design prototypes (the three-directions study, the hero-rack iteration, and the final) land under docs/prototypes, which the spec's Prototype iterations section links. The spec flips DOING to IMPLEMENTED with a history line summarizing the build. The manual-testing checklist is rebuilt around the redesigned panel (repeat timers, recurring alarms with snooze and a ringing state, the configurable pomodoro cycle, the stopwatch sweep dial, locked presets, and bar-tooltip parity), and the two obsolete fuzzel-dialog tests are marked superseded. A dated entry under the closed feature task records the redesign.
|
| |
|
|
|
|
| |
tests filed
The timer GTK panel built and shipped to dotfiles (4 commits). Flipped the spec to IMPLEMENTED, closed the Timer GTK panel task, and filed the live-verification checklist (bar-opens-panel, create/validate, fire-time sort, pause/cancel/promote, stopwatch lap/stop/save, 10-cap + live countdown) under Manual testing and validation.
|
| |
|
|
| |
Craig directed the build. Consolidated the four resolved decisions with his cj input from the sibling timer-module spec: GTK app in the instrument-console look, a queue/output-wall auto-sorted by fire time, stopwatch lap/stop with saveable runs, notify integration, 5/25-min configurable defaults, up to 10 timers, and widget-gallery elements. wtimer stays the engine; the bar's fuzzel creation flow retires and the module opens the panel.
|
| |
|
|
| |
Craig's 2026-07-04 roam input on the panel's open "few other things" question: it gathers the mouse/trackpad, no-sleep, and auto-dim toggles and adds a wallpaper manager (where the displaced waypaper lands) with its own depth — multiple source directories, persistent switching, and a sunup/sundown day-night pair. Flagged that the wallpaper piece may warrant its own sub-spec.
|
| |
|
|
| |
Two follow-ups from the 2026-07-04 net-panel/audio speedrun: a driver-health diagnostic tier for the net panel (the "adapter present but wedged" case beyond no-hardware), and replacing the waybar collapse triangle with a glyph that matches the instrument-console look (an aesthetic call, options to bring Craig first).
|
