refactor: move tree under homelab/, add alma10 hardening and kickstart docs

- restructure boot/kickstarts/scripts/docs into homelab/ - docs: alma9->10 breaking changes, CIS hardening, kickstart changes - add find_cron_entries.sh helper and codex running memory notes Co-Authored-By: Claude Fable 5 <[email protected]>
2026-10-16 23:02:03 -04:00 · 2026-07-06 22:35:07 -04:00
1 parent c44e450fb4
commit 6d398b826a
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=/usr/local/valherun/pxe_boot_alma
+WATCH_ROOT=/tmp/probe-stage-watch
+SUP_ROOT="$WATCH_ROOT/supervisor"
+LOCK_FILE="$SUP_ROOT/claude.lock"
+RUN_LOG="$SUP_ROOT/claude-runs.log"
+PROMPT_FILE="$SUP_ROOT/claude-prompt.txt"
+LAST_MSG_FILE="$SUP_ROOT/claude-last-message.txt"
+STDOUT_FILE="$SUP_ROOT/claude-stdout.txt"
+LATEST_FILE="$WATCH_ROOT/latest-summary.txt"
+STATE_FILE="$WATCH_ROOT/state.env"
+FAIL_LOG="$WATCH_ROOT/failures.md"
+MEMORY_FILE="$ROOT/codex-running-memory.md"
+TRIAGE_FILE="$WATCH_ROOT/needs-triage.env"
+CLAUDE_BIN="${CLAUDE_BIN:-/home/valherun/.local/bin/claude}"
+export PATH="/home/valherun/.local/bin:$PATH"
+
+mkdir -p "$SUP_ROOT"
+
+timestamp() {
+  date '+%F %T'
+}
+
+latest_attempt_dir() {
+  find "$WATCH_ROOT" -maxdepth 1 -type d -name '20*-attempt-*' | sort | tail -n 1
+}
+
+print_triage_status() {
+  if [[ -f "$TRIAGE_FILE" ]]; then
+    cat "$TRIAGE_FILE"
+    return
+  fi
+
+  if [[ -f "$STATE_FILE" ]]; then
+    # shellcheck disable=SC1090
+    source "$STATE_FILE"
+  fi
+
+  echo "no active triage request"
+  echo "watcher_phase='${CURRENT_PHASE:-unknown}'"
+  echo "watcher_detail='${CURRENT_DETAIL:-}'"
+}
+
+{
+  flock -n 9 || exit 0
+
+  attempt_dir="$(latest_attempt_dir || true)"
+  {
+    echo "You are a failure triage and repair assistant for a PXE/kickstart harness."
+    echo "Diagnose likely root cause from the latest failure."
+    echo "When the cause is clear and the fix is small and safe, edit files directly."
+    echo "Prefer the smallest safe mitigation."
+    echo "Update $MEMORY_FILE with a short bullet when you learn or fix something important."
+    echo "Do not remove scripts permanently from the repo."
+    echo
+    echo "Time: $(timestamp)"
+    echo
+    echo "Watcher summary:"
+    [[ -f "$LATEST_FILE" ]] && cat "$LATEST_FILE"
+    echo
+    echo "Watcher state:"
+    [[ -f "$STATE_FILE" ]] && cat "$STATE_FILE"
+    echo
+    echo "Triage request:"
+    print_triage_status
+    echo
+    echo "Failure ledger tail:"
+    [[ -f "$FAIL_LOG" ]] && tail -n 40 "$FAIL_LOG"
+    echo
+    echo "Running memory tail:"
+    [[ -f "$MEMORY_FILE" ]] && tail -n 80 "$MEMORY_FILE"
+    echo
+    echo "Latest attempt dir: ${attempt_dir:-missing}"
+    if [[ -n "${attempt_dir:-}" ]]; then
+      echo
+      echo "Latest attempt log:"
+      sed -n '1,240p' "$attempt_dir/attempt.log" 2>/dev/null || true
+      echo
+      echo "Latest attempt files:"
+      find "$attempt_dir" -maxdepth 1 -type f | sort
+      echo
+      [[ -f "$attempt_dir/stage-meta.txt" ]] && { echo "stage-meta:"; cat "$attempt_dir/stage-meta.txt"; echo; }
+      [[ -f "$attempt_dir/included-scripts.txt" ]] && { echo "included-scripts:"; cat "$attempt_dir/included-scripts.txt"; echo; }
+      [[ -f "$attempt_dir/boot.log" ]] && { echo "boot.log tail:"; tail -n 200 "$attempt_dir/boot.log"; echo; }
+      [[ -f "$attempt_dir/ks-post.log" ]] && { echo "ks-post.log tail:"; tail -n 200 "$attempt_dir/ks-post.log"; echo; }
+    fi
+    echo
+    echo "Reply with concise findings ordered by confidence. Include: likely cause, most suspicious files/lines, what you changed if you edited anything, minimal safe mitigation, and whether to retry immediately or wait for a repo fix."
+  } > "$PROMPT_FILE"
+
+  echo "[$(timestamp)] claude-supervisor start" >> "$RUN_LOG"
+  if "$CLAUDE_BIN" -p --dangerously-skip-permissions \
+      --allowedTools 'Read,Edit,Bash(grep:*),Bash(sed:*),Bash(cat:*),Bash(head:*),Bash(tail:*),Bash(rg:*),Bash(ls:*),Bash(git status:*),Bash(git diff:*)' \
+      < "$PROMPT_FILE" > "$STDOUT_FILE" 2>&1; then
+    cp "$STDOUT_FILE" "$LAST_MSG_FILE"
+    status="ok"
+  else
+    status="failed"
+  fi
+
+  {
+    echo "[$(timestamp)] claude-supervisor status=$status"
+    echo "--- last message ---"
+    cat "$LAST_MSG_FILE" 2>/dev/null || true
+    echo
+  } >> "$RUN_LOG"
+
+} 9>"$LOCK_FILE"