aboutsummaryrefslogtreecommitdiff
path: root/configs/maintenance-thresholds.toml
Commit message (Collapse)AuthorAgeFilesLines
* fix(maint): uncurate /etc/ssl/private — it was a real misconfigHEADmainCraig Jennings1 min.1-1/+3
| | | | pacman warned filesystem 755 vs package 700 on both hosts: a world-listable private-key directory, not runtime hardening as the previous commit claimed. pacman never resets existing directory permissions, so I chmod'd 700 on ratio and velox and removed the curation entry. Integrity reads an honest zero on both.
* chore(maint): curate runtime perm drift out of the integrity countCraig Jennings4 min.1-0/+13
| | | | | | Reinstalling the owning packages reset these eight paths and the system re-drifted every one before the next -Qkk read: cupsd rewrites its three conf files mode 600, StateDirectory re-chowns /var/lib/passim on service start, tmpfiles re-groups /var/log/journal inside the reinstall transaction itself, /etc/ssl/private sits hardened below the packaged mode, and the utempter setgid helper carries ownership drift. They would count as integrity findings forever with no action that clears them. All eight are universal Arch runtime behavior, so they ship as qkk_known defaults rather than per-host curation. The utempter entry also silences a content change on that one binary, noted inline and accepted. I installed the TOML on both hosts; integrity now reads zero on each, with the real findings the metric surfaced along the way fixed for real (a stale hyprland.pc on both hosts, and /root sitting world-listable at 755 on velox, restored to the packaged 750).
* chore(maint): retire cve_min_warn from the thresholdsCraig Jennings84 min.1-3/+3
| | | | The maint probe now grades CVE advisories on actionability (a fixed release exists and isn't installed), not severity, so the severity floor is dead config. The section comment records the retirement. I installed it on both hosts.
* docs(maint): reword coredump window comment for past-window gradingCraig Jennings3 hours1-1/+4
|
* fix(maint): add timeline_slack key to the snapshot thresholdsCraig Jennings5 hours1-0/+3
| | | | This pairs with the maint probe change: the snapper grade now warns at summed limits + snapshots.timeline_slack. Slack 2 absorbs the hourly create/:45-cleanup timer gap that kept the card amber most of every hour. I installed it on both hosts.
* fix(maint): raise pacman cache warn threshold to 20GBCraig Jennings5 hours1-1/+2
| | | | | | The 10GB threshold sat below the keep-3 steady state on both hosts (ratio 12.6GB, velox 10.8GB after pruning), so the warning persisted with nothing left to clean. paccache keeps three versions per package and never expires by age, which puts the honest ceiling near 17-19GB. At 20GB the metric stays quiet in steady state but still fires within about two months if the paccache timer dies. I installed it on both hosts and the warning cleared on each.
* feat: Phase 6 threshold keys (update guard, session-critical, quarterly)Craig Jennings14 hours1-0/+24
| | | | [updates] guard_patterns is the live-update guard's pattern set (mesa/hyprland/wayland runtime plus both hosts' vulkan drivers); [curation.session_critical] is the KILL lever's denylist; timeline_quarterly completes the snapper set-config key set.
* feat: Phase 5 threshold keys (network, backups, services)Craig Jennings15 hours1-0/+8
|
* feat: Phase 4 threshold keys (logs, memory, power)Craig Jennings15 hours1-0/+12
|
* feat: Phase 3 threshold keys, arch-audit dep, btrfs scrub timerCraig Jennings16 hours1-0/+31
| | | | | | The thresholds TOML gains packages.keyring_warn_days, the [security] cve_min_warn floor, [systemd] expected_timers_extra, and two curation tables: kept_orphans (deliberate keeps the orphan count skips) and qkk_known (fnmatch paths for -Qkk mismatches that are config knowledge, like the resolver symlink and the pacman-contrib file this script edits itself). The installer now pulls arch-audit (the console's CVE source) and enables btrfs-scrub@-.timer on btrfs installs. Ratio had the scrub timer enabled out-of-band, so a fresh install would have warned "missing" forever on the console's maintenance-timers check. The todo Phase 3 task closes as a dated log entry.
* feat: storage threshold keys + close build Phase 2Craig Jennings16 hours1-0/+6
| | | | The TOML gains the Phase 2 storage bands (btrfs unallocated floor, SMART wear/temp, fstrim staleness, top-consumers scan knobs). Collectors shipped in dotfiles; installed copies refreshed on ratio and velox.
* feat: seed maintenance-thresholds.toml + close build Phase 1Craig Jennings17 hours1-0/+87
The TOML carries every severity value the console and the system-health-check workflow grade against (the workflow's hard-won numbers: the 10 GB cache trigger, the 35/60-day scrub bands, the snapper TIMELINE limits from the 2026-05-26 /home lesson) plus the shipped curation defaults. Canonical home is configs/ here. Installer wiring stays Phase 13, so for now the file is hand-copied to ~/.config/archsetup/ on ratio. Phase 1 of the build landed in dotfiles (43a39ac): maint package skeleton, two-layer thresholds engine, capability probe, and the status contract with three pilot collectors, 48 tests. The todo phase task flips to its dated log entry.