aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* chore(maint): curate runtime perm drift out of the integrity countCraig Jennings13 hours1-0/+13
| | | | | | Reinstalling the owning packages reset these eight paths and the system re-drifted every one before the next -Qkk read: cupsd rewrites its three conf files mode 600, StateDirectory re-chowns /var/lib/passim on service start, tmpfiles re-groups /var/log/journal inside the reinstall transaction itself, /etc/ssl/private sits hardened below the packaged mode, and the utempter setgid helper carries ownership drift. They would count as integrity findings forever with no action that clears them. All eight are universal Arch runtime behavior, so they ship as qkk_known defaults rather than per-host curation. The utempter entry also silences a content change on that one binary, noted inline and accepted. I installed the TOML on both hosts; integrity now reads zero on each, with the real findings the metric surfaced along the way fixed for real (a stale hyprland.pc on both hosts, and /root sitting world-listable at 755 on velox, restored to the packaged 750).
* fix(guard): allow same-version reinstalls through the live-update hookCraig Jennings14 hours2-15/+128
| | | | | | | | The hypr-live-update-guard hook blocked on target names alone, so a same-version reinstall of hyprland (the maintenance console's integrity REINSTALL, right after a full update) aborted identically to a real upgrade. A pure reinstall writes identical bytes over identical bytes and can't crash the live compositor: the SIGABRT hazard needs the on-disk version to actually change. The guard now compares each target's installed version (pacman -Q) against the sync-db candidate (expac -S %v). Both are read-only queries and safe under the transaction lock, pinned live with db.lck present. Targets that match pass as reinstalls, and the block message lists only the version-changing packages. Unresolvable versions (AUR targets, -U transactions, expac missing) still block conservatively. Verified live on ratio: the previously blocked six-package reinstall ran clean with Hyprland up. The block path is pinned by the test suite (13 tests, four new). I deployed the script to /usr/local/bin on both hosts by hand since the installer only copies it on fresh systems.
* chore(maint): retire cve_min_warn from the thresholdsCraig Jennings15 hours1-3/+3
| | | | The maint probe now grades CVE advisories on actionability (a fixed release exists and isn't installed), not severity, so the severity floor is dead config. The section comment records the retirement. I installed it on both hosts.
* fix(install): mark pacman packages explicit after --needed installCraig Jennings16 hours2-1/+101
| | | | | | pacman --needed skips a package that is already on the system as a dependency and leaves its install reason alone. A declared package can then sit as asdeps, surface as an orphan once its accidental dependent leaves, and get swept away by an orphan cleanup. expac and lm_sensors, both maintenance-console runtime deps, nearly went this way: they were asdeps on both hosts and only survived today's orphan sweep because something still depended on them. pacman_install now marks the package explicit after a successful install. The mark never runs on a failed install, and a mark failure never fails the install. I flipped expac and lm_sensors to explicit on ratio and velox by hand since the installer only runs on fresh systems.
* docs(maint): reword coredump window comment for past-window gradingCraig Jennings17 hours1-1/+4
|
* chore(todo): file retention-repair GUI gap taskCraig Jennings18 hours1-0/+5
|
* fix(maint): add timeline_slack key to the snapshot thresholdsCraig Jennings18 hours1-0/+3
| | | | This pairs with the maint probe change: the snapper grade now warns at summed limits + snapshots.timeline_slack. Slack 2 absorbs the hourly create/:45-cleanup timer gap that kept the card amber most of every hour. I installed it on both hosts.
* fix(maint): raise pacman cache warn threshold to 20GBCraig Jennings18 hours1-1/+2
| | | | | | The 10GB threshold sat below the keep-3 steady state on both hosts (ratio 12.6GB, velox 10.8GB after pruning), so the warning persisted with nothing left to clean. paccache keeps three versions per package and never expires by age, which puts the honest ceiling near 17-19GB. At 20GB the metric stays quiet in steady state but still fires within about two months if the paccache timer dies. I installed it on both hosts and the warning cleared on each.
* chore: health-check updates (workflow note, audit stamp, todo entries)Craig Jennings20 hours3-2/+7
|
* chore: close maintenance-console build, flip spec to IMPLEMENTEDCraig Jennings20 hours2-10/+12
|
* docs: adopt system-health-check workflow and host inventoriesCraig Jennings20 hours6-0/+1948
| | | | | | | | The workflow and the four host capability inventories move here from the home project. System maintenance is archsetup's domain, and this puts the thresholds TOML and both of its consumers in one repo. The workflow's prose severity rules now cite the installed TOML keys, and the TOML wins on disagreement. Inventory paths point at docs/homelab-inventory/. A note routes routine ratio/velox checks to the maint CLI, leaving this workflow for the non-Arch hosts and forensic deep dives. Only the #+HOSTNAME: capability inventories moved (ratio, velox, mybitch, truenas, plus the truenas hardware-specs asset they link). The personal gear records stay in home, and the home-side removal is handed off through its inbox.
* feat(install): install maintenance thresholds and enable maint timersCraig Jennings20 hours2-1/+75
| | | | | | | | The maint console and the system-health-check workflow grade against ~/.config/archsetup/maintenance-thresholds.toml, but nothing installed it. A fresh install got a working maint CLI and no thresholds file. user_customizations now installs the shipped TOML from the cloned repo. A re-run refreshes it, and the user layer in ~/.config/maint/ is never touched, so a reinstall can't eat curation. It also enables maint-scan.timer and maint-net-scan.timer through wants-symlinks (systemctl --user has no session bus during install, the syncthing idiom). Timer enablement is hyprland-only because the units live in that stow tier. The install lists gain the runtime tools the probes call but nothing carried: expac, lm_sensors, fwupd.
* chore: close build Phase 12 in todo, file zfs DKMS image bugCraig Jennings21 hours1-2/+5
|
* test(maint): add VM and nspawn remedy scenario harnessCraig Jennings21 hours13-1/+1138
| | | | | | Nine break/fix/assert scenarios run the real maint fix inside the test VM. The runner batches non-conflicting scenarios into one VM boot, restores the snapshot only between groups, and leaves the base image pristine afterwards. A systemd-nspawn fast lane runs the pacman-level group against a cached pacstrap rootfs in seconds. The plan layer validates the scenario contract without a VM and carries a 19-test unit suite. make test-maint wires the VM lane in. The zfs lane is filtered but unexercised: the FS_PROFILE=zfs base image fails to build (ZFS DKMS module not found on linux-lts 6.18). The failure is tracked in the todo.
* chore: log maint refactor sweep in todoCraig Jennings21 hours1-0/+3
|
* chore: close build Phase 11b in todoCraig Jennings22 hours1-2/+3
|
* chore: close build Phase 11, add fidelity phase 11bCraig Jennings23 hours2-2/+9
|
* chore: close build Phase 10 in todoCraig Jennings24 hours1-2/+3
|
* chore: close build Phase 9 in todoCraig Jennings25 hours1-2/+3
|
* chore: log build Phase 9a in todoCraig Jennings25 hours1-1/+4
|
* chore: close build Phase 8 in todoCraig Jennings26 hours1-2/+3
|
* chore: close build Phase 7 in todoCraig Jennings27 hours1-2/+2
|
* chore: close build Phase 6 in todoCraig Jennings27 hours1-2/+2
|
* feat: Phase 6 threshold keys (update guard, session-critical, quarterly)Craig Jennings27 hours1-0/+24
| | | | [updates] guard_patterns is the live-update guard's pattern set (mesa/hyprland/wayland runtime plus both hosts' vulkan drivers); [curation.session_critical] is the KILL lever's denylist; timeline_quarterly completes the snapper set-config key set.
* chore: close build Phase 5 in todoCraig Jennings28 hours1-2/+2
|
* feat: Phase 5 threshold keys (network, backups, services)Craig Jennings28 hours1-0/+8
|
* feat: Phase 4 threshold keys (logs, memory, power)Craig Jennings28 hours2-2/+14
|
* feat: Phase 3 threshold keys, arch-audit dep, btrfs scrub timerCraig Jennings29 hours3-2/+39
| | | | | | The thresholds TOML gains packages.keyring_warn_days, the [security] cve_min_warn floor, [systemd] expected_timers_extra, and two curation tables: kept_orphans (deliberate keeps the orphan count skips) and qkk_known (fnmatch paths for -Qkk mismatches that are config knowledge, like the resolver symlink and the pacman-contrib file this script edits itself). The installer now pulls arch-audit (the console's CVE source) and enables btrfs-scrub@-.timer on btrfs installs. Ratio had the scrub timer enabled out-of-band, so a fresh install would have warned "missing" forever on the console's maintenance-timers check. The todo Phase 3 task closes as a dated log entry.
* feat: storage threshold keys + close build Phase 2Craig Jennings30 hours2-2/+8
| | | | The TOML gains the Phase 2 storage bands (btrfs unallocated floor, SMART wear/temp, fstrim staleness, top-consumers scan knobs). Collectors shipped in dotfiles; installed copies refreshed on ratio and velox.
* feat: seed maintenance-thresholds.toml + close build Phase 1Craig Jennings30 hours2-2/+89
| | | | | | The TOML carries every severity value the console and the system-health-check workflow grade against (the workflow's hard-won numbers: the 10 GB cache trigger, the 35/60-day scrub bands, the snapper TIMELINE limits from the 2026-05-26 /home lesson) plus the shipped curation defaults. Canonical home is configs/ here. Installer wiring stays Phase 13, so for now the file is hand-copied to ~/.config/archsetup/ on ratio. Phase 1 of the build landed in dotfiles (43a39ac): maint package skeleton, two-layer thresholds engine, capability probe, and the status contract with three pilot collectors, 48 tests. The todo phase task flips to its dated log entry.
* docs: maintenance-console spec to DOING + build decompositionCraig Jennings30 hours2-2/+399
| | | | | | The spec encodes the converged 2026-07-06/07 design as 13 decisions and 13 phases (CLI-first maint package, four-layer test strategy) and carries its full review trail inside, live-verified on ratio. Late calls landed during authoring: the bar glyph replaces custom/sysmon, doubles as the laptop battery display, and keeps the btop scratchpad on right-click. todo.org now carries the build: 13 phase tasks under a SPEC_ID-stamped parent, the manual-testing collector, the flip-to-IMPLEMENTED closer, and the vNext deferral.
* docs: add maintenance console design + interactive prototypesCraig Jennings32 hours11-0/+5679
| | | | | | | | The design doc replaces the install-health framing in system-monitor-design-ideas.org with a maintenance console: dense metric subpanels behind a persistent selector, a doctor that streams into a results wall, determinate remedies only (guard-armed updates, curation lifecycles for noise, listeners, containers, and orphans), rotary band selectors on the tall subpanels, and a CLI-first build with a four-layer test strategy. Every decision is dated in the doc. Prototypes A-E5 keep the exploration path: five divergent layouts converging into E5, a fully interactive simulation whose GOOD/BAD snapshots become the build's test fixtures. todo.org gains the spec-create task, the panel keybinding-family task, and scope notes on the net/bt doctor retrofit.
* docs: PTT waybar-indicator prototypeCraig Jennings2 days1-0/+133
| | | | | | | Design prototype for the push-to-talk bar indicator: an always-present outline tag (account-voice glyph) left of the mic — dim grey when off so the bar never reflows, gold + glow when armed, brighter while transmitting, click-to-toggle. The states and icon were settled against this before wiring it into waybar.
* docs: per-device activity lamp shipped (audio metering option 3)Craig Jennings3 days2-2/+15
| | | | Records Phase 5 of the audio signal-metering spec: a per-device three-state activity lamp on each output/input row, so the panel shows which specific device is carrying audio, not just the default. GUI-only over the per-device state field already in the engine. Adds the live-check to the manual checklist; the per-row live level meter stays the deferred vNext.
* docs: audio-panel signal-metering spec (implemented)Craig Jennings3 days2-8/+268
| | | | Records the signal-metering layer for the audio panel: a three-state activity lamp from the pactl state field, and a windowed peak meter feeding the VU needles, keyed per device so per-device metering stays a later GUI-only change. Two review rounds before build (the first caught a parec sample-rate-vs-update-rate bug verified live); marked implemented across four dotfiles commits. Live-eyeball checks filed as a manual-testing checklist.
* docs: archive shipped panel-bug batch; track system-monitor design captureCraig Jennings3 days2-16/+1023
| | | | todo-cleanup moved the closed instrument-console panel-bug batch (net/bt/audio) to Resolved. Bring the system-monitor design-ideas capture under version control.
* docs(todo): close instrument-console panel bug batch (all 8 shipped)Craig Jennings3 days1-16/+15
|
* docs(todo): file instrument-console panel bugs from inboxCraig Jennings3 days1-0/+17
|
* docs(todo): fix Proton CLI sign-in command (signin, not login)Craig Jennings3 days1-1/+1
|
* fix(wireguard): deactivate imported configs so import never arms a tunnelCraig Jennings3 days1-4/+10
| | | | | | nmcli connection import both sets autoconnect yes and activates the profile immediately. The configs are full-tunnel (AllowedIPs 0.0.0.0/0), so a bare import brings the tunnel up and routes everything through it. Importing a file silently connected a VPN, leaving the machine exiting through Proton. Follow each import's autoconnect-off modify with a connection down, so importing only ever adds inactive profiles.
* fix(wireguard): replace dead Proton configs with a working setCraig Jennings3 days11-109/+59
| | | | | | The seven Proton configs imported April 10 completed the WireGuard handshake but Proton routed no data: DNS and traffic through the tunnel timed out on every server. Fresh configs from the Proton dashboard route data normally. That confirms the old keys were deauthorized account-side, not a local routing, firewall, or NetworkManager fault. Swap in three fresh configs (NL, US-CA, US-TX) and point the panel tunnels manual-test at the new connection names.
* chore(todo): archive completed waybar and timer tasksCraig Jennings3 days2-82/+76
| | | | The wrap archive pass relocated finished DONE/CANCELLED tasks out of Open Work — six into the Resolved section, four into the task archive — including the timer GTK panel now that the redesign shipped and its live testing settled.
* docs(timer): record the shipped redesign and flip spec to IMPLEMENTEDCraig Jennings4 days5-90/+1987
| | | | | | The timer-panel UI/UX redesign built and shipped to dotfiles across five phased commits. This captures the archsetup-side records. The three design prototypes (the three-directions study, the hero-rack iteration, and the final) land under docs/prototypes, which the spec's Prototype iterations section links. The spec flips DOING to IMPLEMENTED with a history line summarizing the build. The manual-testing checklist is rebuilt around the redesigned panel (repeat timers, recurring alarms with snooze and a ringing state, the configurable pomodoro cycle, the stopwatch sweep dial, locked presets, and bar-tooltip parity), and the two obsolete fuzzel-dialog tests are marked superseded. A dated entry under the closed feature task records the redesign.
* docs(todo): timer panel shipped — spec IMPLEMENTED, task closed, manual ↵Craig Jennings4 days2-9/+41
| | | | | | tests filed The timer GTK panel built and shipped to dotfiles (4 commits). Flipped the spec to IMPLEMENTED, closed the Timer GTK panel task, and filed the live-verification checklist (bar-opens-panel, create/validate, fire-time sort, pause/cancel/promote, stopwatch lap/stop/save, 10-cap + live countdown) under Manual testing and validation.
* docs(spec): timer panel to DOING, fold in the cj-comment build scopeCraig Jennings4 days1-2/+23
| | | | Craig directed the build. Consolidated the four resolved decisions with his cj input from the sibling timer-module spec: GTK app in the instrument-console look, a queue/output-wall auto-sorted by fire time, stopwatch lap/stop with saveable runs, notify integration, 5/25-min configurable defaults, up to 10 timers, and widget-gallery elements. wtimer stays the engine; the bar's fuzzel creation flow retires and the module opens the panel.
* docs(spec): fold the wallpaper-manager input into desktop-settings scopeCraig Jennings4 days1-0/+7
| | | | Craig's 2026-07-04 roam input on the panel's open "few other things" question: it gathers the mouse/trackpad, no-sleep, and auto-dim toggles and adds a wallpaper manager (where the displaced waypaper lands) with its own depth — multiple source directories, persistent switching, and a sunup/sundown day-night pair. Flagged that the wallpaper piece may warrant its own sub-spec.
* chore(todo): file driver-health and collapse-glyph follow-upsCraig Jennings4 days1-0/+12
| | | | Two follow-ups from the 2026-07-04 net-panel/audio speedrun: a driver-health diagnostic tier for the net panel (the "adapter present but wedged" case beyond no-hardware), and replacing the waybar collapse triangle with a glyph that matches the instrument-console look (an aesthetic call, options to bring Craig first).
* test(vm): collect network evidence before failing in pre-flight diagnosticsCraig Jennings4 days2-22/+289
| | | | run_network_diagnostics tested HTTP before DNS and returned on the first failure, so a DNS failure surfaced as a generic "no internet" and the IP/route/resolver evidence was never reached. It now collects read-only facts first (ip -brief addr, default route, resolv.conf) and prints them regardless of outcome, runs every check, and reports all failures together in a summary. Generic checks (DNS, egress, TLS) are split from Arch-specific ones (mirror, AUR) so a DNS failure is named as DNS, not a mirror problem. Raw fact output is saved to the results dir when one is set.
* docs: gather panel design prototypes into docs/prototypes/Craig Jennings4 days10-7/+1365
| | | | | | I gathered all five self-contained HTML/CSS design prototypes into one home: the instrument-console pair (moved from assets/), plus the net-panel rescan, sound panel, widget gallery, and waybar redesign (moved out of working/). Added a README index and updated every inbound link: build summary, the instrument-console and audio specs, and todo.org. Also fixed a broken link the earlier sort left in the build summary. It still pointed at the instrument-console spec's old docs/design/ path after the move to docs/specs/.
* docs(spec): restore faceplate design edits to desktop-settings specCraig Jennings4 days1-4/+25
| | | | The specs were sorted into docs/specs/ on another machine, from a copy of this one that predated the 2026-07-03 panel-family design discussion. That lost the faceplate refinements. I re-applied them: the instrument-console faceplate aesthetic in place of the plain palette note, the audio/bt Kin row, a dated Status line, and the still-open "few other things" scoping question. The four decisions that pass resolved stay closed. Only the question it never addressed comes back.