Creative ideas + design notes
Commits with substantial prose (≥120 chars) — the rationale behind each move.
808d749 · 2026-09-14 · TK-11648: negative test drives the REAL backup script via a plist-safe seam
The guard-copy test proved the guard LOGIC but stayed green if the shipped
script's guard was reverted. Add a BACKUP_TEST_MODE seam (SRC/DEST/HENRY/DATA
env overrides, mount-guard relaxed, heartbeat output redirected so it can't
poison the live fleet-health latest.json) and an end-to-end negative test that
runs backup-repos-to-henry.sh itself against a hollow-.git fixture and asserts
it writes NO wrong-repo bundle + reports WARN. Verified the assertion goes RED
when the guard is neutralized (TK-11431 amdt 3).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnGVNUxnQfxpU1vfZmZFv3
9603008 · 2026-09-14 · TK-11648: identity guard so backup never bundles the WRONG repo (false-green)
backup-repos-to-henry.sh guarded only that .git EXISTS and that the bundle
passes 'git bundle verify' — which proves a VALID history, not THIS repo's.
A present-but-hollow child .git makes 'git bundle create --all' walk UP to
the ~/Projects meta-repo and bundle THAT under the child's name: a valid
bundle of the wrong repo, so the ONLY off-machine copy (no-remotes rule) is
silently worthless while the run reads PASS. Confirmed: animals.bundle was a
1.6G copy of the meta-repo (HEAD resolved as a meta-repo commit).
FIX: assert 'git -C $repodir rev-parse --show-toplevel' == $repodir before
bundling; a mismatch is a FAIL, never a silent wrong bundle. Ships a NEGATIVE
test (test-backup-identity-guard.sh, per TK-11431 amdt 3): injects a hollow
child .git, proves the fault reproduces, the guard FAILs it, and a valid repo
still PASSes. Test PASS.
AUDIT (read-only, 1207 bundles): 3 mislabeled — animals (source .git since
REPAIRED, self-heals on next run), govarbitrage.gutted-1789157670 + japan-enrich
(hollow .git, need repair; guard now FAILs them instead of mislabeling). Repair
drafted to pending-approval (judgment work; gitify rule = don't re-init a .git).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UVgEj4WxSqB62ieGpgrixR
e6b27ef · 2026-09-10 · daemon-health: watch the repo-bundle belt, not just the two DB mirrors
backup-repos-to-henry.sh has always written a PASS/WARN/FAIL verdict to
data/repo-backup-latest.json, but nothing ever read it. A silently-dead bundler
emitted zero alerts - the exact shape of the 12-day pg_dump death this skill
exists to prevent.
That belt now matters more: as of today it is the ONLY off-machine copy of
~/.claude (452 skill definitions) and its 73 nested skill repos.
Adds a third check with three failure modes:
FAIL last run > 36h ago (daily job + one missed run of slack)
WARN bundler self-reported WARN/FAIL, or repos failed
FAIL bundler PASSed but dotclaude.bundle is ABSENT - freshness alone is not
proof the thing you care about is in the set
Verdict joins the existing rollup, so it reaches fleet-health-rollup and
dw-canary-meta-watchdog via the skill's data/latest.json.
Note the macOS trap: parses a trailing-Z UTC stamp as LOCAL time,
producing a future epoch and a NEGATIVE age that silently passes the staleness
test. Fixed with -u and a negative clamp; caught by negative-testing rather
than by reading the code.
Negative-tested: 40h stale -> FAIL, bundler WARN -> WARN, healthy -> PASS.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
7d6456f · 2026-09-10 · backup-repos-to-henry: cover ~/.claude and its 73 nested skill repos
The source glob was $HOME/Projects/*/.git, so ~/.claude was missed entirely by
path - leaving 452 skill definitions with NO off-machine copy of any kind. A
full audit found nothing else covered them either: Time Machine has no
destination configured, no launchd job writes ~/.claude, and rclone/iCloud/
Syncthing/cron are all absent or dead. The only off-machine artifact was a
6-month-stale MD-only zip.
Nested skill repos are bundled INDIVIDUALLY because the parent repo records
them as gitlinks - a parent-only bundle captures a 1-line pointer and none of
their content. 73 skills are affected.
Bundle names are namespaced (dotclaude, dotclaude-skill-<name>) so they cannot
collide with a ~/Projects repo of the same basename.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1256a2d · 2026-08-17 · backup-daemon-health: credit the user belt via its verified success log (fix false FAIL)
launchd runs/exit-code resets to 0 on reload/reboot and shows '(never exited)',
so the canary false-FAILed after the Aug pm2-fracture reboots even though the
user LaunchAgent wrote a verified Henry copy nightly. Now credit a belt when its
own log shows a recent '[Henry] PASS: <prefix>_' (stricter than exit code —
validates the outcome; anti-stale guard preserved via log-mtime recency).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
4228153 · 2026-08-15 · pull-dw-dump: retry remote-dump SSH discovery on transient failure (TK-10547)
A single 03:55 ssh timeout to Kamatera lost a full day's dw_unified backup and
hard-FAILed the run (the canary correctly caught it 8/15). Add 4 attempts with
15/30/60s backoff so a momentary network/SSH blip auto-recovers instead of
costing a day of backup. Read-only, idempotent (rsync skip-if-complete).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3c61bc3 · 2026-08-15 · daemon-health: accept single-belt operation as PASS (Steve 8/15, TK-10547)
Steve accepted the user belt as the primary; the root belt (Option B) stays
down pending a flaky system-domain FDA grant on the ad-hoc-signed nas-backup-sh.
One belt down now = PASS (data safe) instead of WARN. Real-danger cases stay
loud FAIL: BOTH belts down, or Henry missing/stale. REQUIRE_BOTH_BELTS=1
restores strict degraded-redundancy WARNs if the root belt is ever fixed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
4a447c8 · 2026-08-14 · daemon-health: belt-and-suspenders model (Steve ruled 8/14 'Both', TK-10547)
Check BOTH redundant writers per DB — the -root SYSTEM daemon (Option B,
durable, needs FDA on /usr/local/bin/nas-backup-sh) AND the gui/ USER agent
(Option C, homebrew bash, proven writing). Verdict is outcome-based on Henry
freshness: both writers healthy + fresh = PASS; exactly one belt down = WARN
(degraded redundancy, data safe); both down or Henry missing/stale = FAIL.
Current reality = WARN until the FDA grant brings the root belt up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
d3111b7 · 2026-08-14 · Henry mirror: switch to USER LaunchAgents via homebrew bash (real fix, TK-10547)
Root cause: the root daemons' signed launcher /usr/local/bin/nas-backup-sh is
TCC-denied on the /Volumes/Henry external volume, so the nightly [ -w ] test
failed and the mirror silently skipped for 5 nights (Aug 9-13). NOT an FDA-on-
/bin/bash issue as the ticket assumed.
Fix (empirically verified): the mirror runs fine as USER LaunchAgents launched
via /opt/homebrew/bin/bash (non-SIP, holds the volume grant — the loaded
backup-daemon-health agent reads Henry through it hourly). Swapped the dw_unified
user plist to homebrew bash to match the already-swapped realestate one; both
enabled+bootstrapped, kickstart-verified writing [Henry] rsync ok. daemon-health
repointed to watch the user agents in gui/ domain with Henry-freshness as the
authoritative signal. Canary now PASS.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
17bd6ce · 2026-08-07 · chore(nas): commit root-daemon installer scripts (TK-10323 artifacts, session close)
gitleaks false positive: KEY=id_ed25519_wallco_20260530 is the SSH key FILENAME,
not key material — no secret in these scripts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fb2f00f · 2026-08-07 · docs(nas): add DW-Backups activation checklist (root-context autofs, not Finder mount)
Cleanup 2/2 from TK-10323: the NAS 2TB share isn't racked yet, so mounting
can't be scripted today. Documents the copy-paste activation steps for when it
arrives, and flags the root-vs-user mount gotcha — the nightly runs as a root
LaunchDaemon so a per-user Finder SMB mount won't be seen; use autofs (Path B).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>