oc-work: local models only on the local key, edits and most commands ask,
loads instructions/work.md. oc-local (also oc, opencode): every model,
defaults to qwen3.8-flash-next-iq3s-med, edits and commands run except
destructive and outward-facing ones. On sctfw004 oc-local presents the work
key. personal.json and work-strict.json removed.
Agents: drop variant, which has no effect on LiteLLM models. dev takes its
permissions from the profile. The read-only agents deny redirects and the
write/exec flags of allowed commands, swap find for fd, and only allow
listing forms of git branch. review defaults to the uncommitted diff.
CLAUDE.md: add the comment, process and shell-tool rules from the laptop's
AGENTS.md, and note that OpenCode reads this file.
taste.md: briefs and feedback for Fall, Skatepark Punks, Lo-fi Beats,
Game Soundtracks, Big Gay Pregame, Pop Italiano, Rap Italiano, Musica
Latina, Ska, Basic Alt-Rock and i still remember myspace. Corrects the
System of a Down note, which recorded a two-song limit he never set.
SKILL.md: downloads stay untagged until the pipeline job runs; the
search preview can differ from what the downloader fetches; Owned
answers can come from compilation-tagged rows.
Measured 2026-09-19. After a reboot, eleven containers reported `Up 9 hours`
with a State.Pid that no longer existed -- ntfy, bitwarden, authelia, gitea,
grafana, prometheus among them. ntfy's healthcheck had failed 539 consecutive
times while podman ps called it up, and it stayed that way overnight because
every ordinary check said yes.
podman-restart.service is Type=oneshot and forks a conmon per container into
its own cgroup. One container failing to create fails the unit, and systemd's
default KillMode=control-group then SIGKILLs every conmon it just started.
conmon is what updates container state, so killed it updates nothing.
Fix applied as ~/config/host/podman-restart-killmode.sh (KillMode=process),
which also carries a --check mode for finding zombies.
⚠ Also records that `kill -0 <pid>` is the wrong liveness test here: the
containers run as root, so as a normal user it fails with EPERM rather than
ESRCH and reports every container dead. That misdiagnosis was made during
this very investigation and read as a total outage for a minute.
The file covered the inference stack in detail and said almost nothing about
the repo it now lives in, so every session rediscovered the same handful of
conventions.
Adds the four hosts with their addresses, roles and package managers --
including that sctfw004 is US-government adjacent and stays on OpenAI and
local models only -- and the five things here that actually cost an hour: the
allowlist .gitignore, and why a new directory being invisible to git is
expected rather than broken; secrets living only in an untracked
~/.secrets.zsh and never in a tracked zshenv; ConditionHost as the guard that
keeps a one-machine timer from firing on all four; and dots / pkg-snapshot as
the maintenance pair, with the deliberate silence of dots --nag explained.
Also notes that ~/.claude/CLAUDE.md is a symlink into this repo, since
editing it silently edits tracked config, and sharpens the .pre-<thing> note:
that convention is for the untracked ~/config and ~/docs trees, where it is
the only backup those files get. Inside a tracked repo git already is the
backup and .gitignore excludes the pattern anyway.
Replaces the previous repo, which had split into two histories that never
met (mainframe on a dead GitLab remote, the laptops on Gitea) with 146
dirty files across three machines and the NAS never enrolled at all.
Branch-per-machine is gone. One main, with host differences expressed as
small files under hosts/<hostname>/ rather than as branches, so there is
nothing to merge. The reconciled zsh layer reduces 15-33 line forks to
1-7 effective lines per host; distro differences (oh-my-zsh prefix,
syntax-highlighting path, fd vs fdfind) are probed in common/ instead.
Fresh history: the old one carried six plaintext credentials, 45 MB of
mail caches, browser caches and vendored binaries. 5,096 tracked files
and 144 MB become 462 files and 2.6 MB. The .gitignore is now an
allowlist, which is what keeps that true.
Root cause of the rot: ~/.local/bin was a symlink to scripts/ with GOPATH
inside it, so every go install wrote into version control (2.2 GB on the
work laptop). PATH now points at the repo instead of the reverse.
Also: Hyprland replaces sway and is sourced in two halves so $browser is
defined before use; singleton automations carry ConditionHost= alongside
host-layer-only placement; ddns moves from cron to a guarded timer;
package manifests and pkg-snapshot/pkg-restore replace the X11-era
install_scripts/; networkmanager-dmenu added to system76 (the binding
always existed, the package never did).
connor
Connor Johnstone