The never-yet-applied k3s_dns.yml placed 'import /etc/coredns/custom/*.server'
INSIDE the .:53 server block. *.server files hold full server blocks
(arcodange.lab:53 {…}), which only parse at Corefile root — inside a block
CoreDNS dies at startup with "Unknown directive 'arcodange.lab:53'"
(CrashLoopBackOff, cluster DNS fully down; lived it on 2026-07-24 while
restoring the expired *.arcodange.lab certificate).
Also restores the stock 'loadbalance' plugin dropped by the playbook.
Context: cluster CoreDNS forwarded to the node's resolv.conf, which lists the
ISP box's IPv6 RDNSS next to the Pi-holes — NXDOMAIN roulette for *.lab names.
That's what left step-issuer unable to reach ssl-ca.arcodange.lab:8443 and let
the 24h wildcard cert expire this morning. The (fixed) playbook pins .lab
resolution to the Pi-holes via the coredns-custom ConfigMap; applied live on
2026-07-24, wildcard renewed, strict TLS verified on gitea/argocd/grafana.
Co-Authored-By: Claude Fable 5 <[email protected]>
kadans-jobs is the tier-2 (homelab, 24/7) piece of the Kadans topology: a job
queue plus the store of published analysis results, decoupling the product from
the volatile Mac worker.
org: arcodange — the repo does not live under the default arcodange-org.
Digest-based image-updater annotations follow the fleet pattern; the
cluster-wide ImageUpdater CR (namePattern "*", useAnnotations) picks them up,
so there is no per-app CR to maintain. The image is already in the registry.
No postgres/iac/terraform.tfvars entry, on purpose: the façade runs a memory
store in v0, so it needs neither a database nor Vault. That is the runbook's
degraded mode — the DB, the Vault JWT role and the app's own iac/ will land
together with the Postgres store.
Chart realigned on the runbook conventions first, in kadans-jobs#1.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_013ws8L74dVZmp97Wu36fm8j
Co-authored-by: Gabriel Radureau <[email protected]>
Co-committed-by: Gabriel Radureau <[email protected]>
- qa-strategy › Independent verification: with Mistral (vibe -p,
mistral-medium-3.5) and Ornith 35B admitted to verifier duty by verdict
parity (erp#63 evidence, blind-judged), the independent verifier SHOULD be
a different model family than the builder; journal records which family
verified what.
- STATUS: #63✅ (PR erp#69, harness home erp:fleet/harness/), #56✅
(PR erp#68, authored by the Mistral builder bench), #39 built on local
branch (push+PR = operator step), PR-log rows, P3 flipped to in-progress.
Paired with erp#69 (Closes erp#63).
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VRShc4QhLLU73FLHx9vskh
Ajouté par bda53f29 pour « monter les credentials dans le repo-server »,
mais ces values sont passées au chart argocd-image-updater (HelmChart
kube-system) qui n'a pas de clé repoServer : no-op intégral. Le vrai
repo-server ArgoCD est déployé par l'addon k3s et n'a pas besoin de ce
montage — les credentials repo passent par les secrets étiquetés
argocd.argoproj.io/secret-type.
Co-Authored-By: Claude Fable 5 <[email protected]>
Ces champs (commit 7aa789d1) n'existent pas dans le schéma Application
d'ArgoCD : l'API server les élague à l'apply, d'où un diff permanent →
factory OutOfSync en boucle (296 tentatives selfHeal) sur kadans,
telegram-gateway et dance-lessons-coach. L'authentification aux repos
privés passe par un secret repo-creds (label
argocd.argoproj.io/secret-type: repo-creds, url préfixe
https://gitea.arcodange.lab/arcodange) — corrigé côté cluster sur le
secret gitea-credentials existant.
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator direction 2026-07-15: the orchestration layer itself (builder
sessions, cold verifiers) must run on Mistral or hermes+Ornith/MLX too.
The protocol already carries everything in files+issues; new model-fleet
section defines the evidence-gated ladder — verifier roles migrate
first (cross-family refutation is stronger verification), scoped
builders benched on unchanged acceptance gates, Claude default until
the bench says otherwise. D2 row records the direction; spike = erp#63.
Co-Authored-By: Claude Fable 5 <[email protected]>
The resume-protocol fresh-reader test (context-free subagent) passed
on substance (picked erp#38, correct first command, skipped the
human-gated erp#46) and surfaced two doc gaps: milestone due dates
were only on the forge (rule says order by due date), and nothing
arbitrated one-session-one-lane vs orchestrated fan-out. Both fixed;
#54 map entry now mentions the ADC register.
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator ask 2026-07-12: an ADR-equivalent for accounting so method
choices are consistent AND justifiable. Accounting scatters this across
permanence des méthodes (PCG 121-5), the annexe, the organisation doc
(PCG 911-3) and audit position memos; the ADC unifies them as one
lightweight versioned record: MADR-lite + base légale/effective-dates/
annexe-impact fields, immutable once Accepted (supersede = the
permanence principle made structural), fiscal.yaml rules cite their
ADC (écriture → règle → ADC → base légale in four hops), annexe
generated from the register, acceptance human-only. Seeds adc-001..007
from decisions already made this exercice; two new obligation-table
rows (121-5, 911-3); expert-comptable agenda updated.
Co-Authored-By: Claude Fable 5 <[email protected]>
- STATUS resume protocol: milestones ordered by due date, skip
human-gated tops, named entry points (erp#38 / #51 / write-skill
quartet); every issue now carries an Execution footer.
- Backlog map: +erp#59 (T14 split from #48), +erp#60 (T11 loop split
from #54), retitles, post-replay markers.
- D9 meeting capture parked (nice-to-have; calls are iPhone-first).
- prd_check.py preserved from the session scratchpad into scripts/
(the closure protocol references the pattern — now it's runnable).
Co-Authored-By: Claude Fable 5 <[email protected]>
Diarization and Google Calendar sync are both on Hyprnote's free plan,
which satisfies the two operator criteria at once; Meetily (MIT,
diarization in the community core) stays as OSS fallback with sb.py
ICS-matching to compensate its missing calendar sync. Gate: quality
judged on a real bilingual call before the lane is trusted (erp#49).
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator has no Granola account (proprietary, paid, cloud
transcription — misfit with the vault doctrine). The delivery-agents
backlog line now specifies the local transcription lane: Whisper-class
model on the M4 + Ornith summary, as an sb.py job.
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator insight 2026-07-11: the second brain's client dossiers
(01-Projects/Clients/<client>/) are where the back-office fleet meets
the sales chain and the future delivery agents working on client
projects. Knowledge-layer bullet: agent-owned deposit files (never
edits of human notes), each family feeds and reads the dossier
(billing state + contract facts in; dunning tone, contract scope,
new-business sightings out — the KM 4% settlement clause makes
delivery observations a billing input); vault routing doctrine
(local-first) for confidential client content. Backlog updated with
the 2026-07-11 CRM audit facts (propal/contrat/projet modules empty,
KM retainer terms only in WIP JSON — deferred schedule = T06's source
of truth) and the third family (delivery agents; Granola→vault ingest
as an sb.py job; REX → Mode B evidence → CMS).
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator addition to the closure protocol: the QA gate is held by an
independent verifier subagent — context-free, prompted to REFUTE, repo
+ issues + journals as its only inputs; verdict posted on the milestone,
unresolved refutation blocks. New qa-strategy section extends no-self-
grading to POC exit gates and autonomy promotions (verdict attached to
the artifact it gates), mirroring at process level what the pipelines
do at data level (dual extraction, seeded-wrong fixtures).
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator requirement: the resume protocol's twin. A milestone closes
only through an 8-step sweep that OPENS with a QA gate (acceptance
criteria re-verified with evidence, test suites green — golden-set
bars, injection fixtures, linter suites incl. seeded-wrong provenance
FAILs, idempotency replay; catalog status flips backed by proving-
protocol evidence; can't pass QA -> shed scope, don't close) and ENDS
with doc-surface QA (link/anchor check, deprecation grep of the claims
the milestone retired, fresh-reader smoke test by a context-free
subagent). In between: STATUS flip, roadmap re-baseline (diamonds never
move), no-tombstone truth-pass of leaves, AGENTS.md/SKILL.md/guidebook
sweep, outward loop (ADRs, memories, second-brain REX). Reader's half:
trust order live system > code > STATUS > leaves > memories; stale
Last Updated = suspect. Summarized as a house rule in factory
AGENTS.md, canonical checklist in the PRD STATUS.
Co-Authored-By: Claude Fable 5 <[email protected]>
Agents discovering the lab through AGENTS.md now find the decomposed
AI back-office backlog (STATUS map, erp milestones, gateway issues,
factory#22 ADR tracking) and the resume protocol.
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator request 2026-07-11: decompose the PRD into less-high-level,
unambiguous work items. 23 self-contained issues filed (context,
deliverables, acceptance criteria, dependencies, PRD links): erp#38-57
across 6 dated milestones (P1 flagship, P2 e-invoicing hard 09-01,
P3 standing fleet, ledger compliance, P4 money loops, P5 fiscal),
telegram-gateway#1-2 (queue D1 + digest/cards), factory#22 (ADR
tracking for D1/D2/D4/D6/D7). STATUS phase tracker now points each
phase at its milestone; resume protocol for future sessions: pick the
top unblocked issue of the earliest open milestone.
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator requirement (2026-07-11): mechanical measures against
hallucinated values in agent-performed edits. Four deterministic
layers in agent-architecture: (1) no free-text critical fields —
code copies values from validated extraction/bank-feed payloads,
the model never re-types them; (2) provenance anchors per critical
field {source_sha256, raw_excerpt} re-verified by a deterministic
checker against re-extracted source text (locale-normalized);
(3) cross-system corroboration against FRESH bank pulls + arithmetic
/checksum invariants; (4) read-back closes the loop. A failed check
refuses, never repairs. Woven into hub goal, C1 strategy, and QA
write-path (seeded-wrong-value fixtures must FAIL). Proven live:
the books-regularization pack shipped with a standalone
verify-provenance checker — 36 field-level checks green against
source PDFs + fresh Qonto/Wise feeds before the human gate.
Co-Authored-By: Claude Fable 5 <[email protected]>
New agent-catalog.md leaf answering three operator directions:
(1) the document surface agents read is now specified — AGENTS.md
orientation maps, SKILL.md with trigger-carrying descriptions
(Use-when/SKIP-for), atom.yaml registry contracts, thin prompt.md
files (no business rules in prompts — rules live in profile files
and validators), schema'd fiscal.yaml/calendar.yaml with
effective_from dates, [AGENT]/[HUMAN] runbooks, env-var-indirected
.mcp.json; same-change freshness rule extended to the fleet.
(2) hermes's telegram-gateway confirmed as THE human channel when
available (cluster-served cards, email fallback; D1 operator-endorsed).
(3) the categorization to prove: seven agent classes (incl. the
LLM-free deterministic controller) and a T01-T17 assignment matrix
with per-row proof gates and statuses (proven / to-prove / not-built),
re-scored monthly from run journals (fallback rate >20% = wrong cell).
New D8 (fleet code home, leaning erp fleet/).
Co-Authored-By: Claude Fable 5 <[email protected]>
New roadmap.md: mermaid Gantt (validated) putting the six phases on
calendar time from baseline 2026-07-11 — P2 e-invoicing opens the plan
(ADR D4 target 08-14, two-week fallback before the hard 09-01), P1
flagship in parallel (golden set first, A2 earned ~10-09), ledger-
compliance verifications early September (FY-2026 FEC depends on the
accounting-module answer), P3 standing fleet through autumn (sentinel
24/7 ~11-13), P4 money-loop exit over December, P5 riding the fiscal
calendar (acompte 12-15, CA3 switch 01-01, Q1 filing April, CA12 early
May, AG 06-30), P6 e-reporting proven months before 2027-09-01.
Immovable-milestone table, dependency notes, re-baselining rule
(engineering bars slide, diamonds don't — slips shed scope instead).
Wired: hub pointer + leaves row, poc-plan/STATUS backlinks.
Co-Authored-By: Claude Fable 5 <[email protected]>
New compliance.md leaf: French bookkeeping obligations mapped to fleet
mechanisms — inaltérabilité (L.123-22) via an append-only production
ledger grammar (create/validate/pay/avoir, never mutate a validated
document) enforced by a promote-plan compliance linter; FEC (L.47 A
LPF) with quarterly export + Test Compta Demat validation (accounting-
module binding flagged as unverified gap); piste d'audit fiable (289
VII CGI) framed as a by-product of journals + tx-id reco + monthly
packs; retention, numbering, copie fiable; loi anti-fraude scoped out
(B2B-only) with BlockedLog as sandbox-first belt-and-braces.
New Environments section in agent-architecture: prod = the ledger
(grammar-bound), sandbox = disposable iso-prod rehearsal (exempt, never
wired to production third parties); side_effect_class -> environment/
credential mapping; POCs write on sandbox only; evals target fresh
checkpoints; irreversible-by-design features trial on checkpoints.
Woven through hub (goal, requirement, success criteria, leaves table),
T03/T05/T15 guardrails, QA (linter suite, pure-append snapshots, FEC
cadence, PAF evidence framing), C2, POC-1 exit criteria.
Co-Authored-By: Claude Fable 5 <[email protected]>
Operator direction: Qonto is the capital-deposit bank, a DGFiP-registered
PA with e-invoicing included in every plan, and the fleet's richest
existing API integration. POC-6 rewritten from shortlist to validation
spike (reception + business-API pull + GED archival + 2027 e-reporting
path for the KM export invoices); C12 residual now names the vendor-
concentration trade-off; terminology refreshed PDP -> PA (renamed by the
administration in July 2025); 2027-09 milestone clarified (e-reporting
for export invoices; emission only if a French B2B client arrives).
Co-Authored-By: Claude Fable 5 <[email protected]>
The PARA Obsidian vault (arcodange/SecondBrain — git-synced, sb.py
digest/inbox/gitea-ingest jobs on the hermes cron ticker, local Ornith
model, mcp-obsidian access) enters the PRD as a first-class component:
new T17 knowledge capture & retrieval fiche, knowledge-layer section in
the architecture (ERP = book of record, vault = context + institutional
memory, append-only idempotent deposits, trusted-but-stale retrieval),
hermes/Ornith recognized as the resident M4 runtime (D2 leaning, new D7
cluster<->vault access decision), foundation ledger row, diagram +
goals updated (mermaid revalidated, 231 links/anchors re-checked green).
Co-Authored-By: Claude Fable 5 <[email protected]>
New PRD tree vibe/PRD/ai-back-office/ (hub + 6 leaves + STATUS): task
inventory T01-T16 with mode operatoire, atom/contract architecture on
the ADR-0003 write gate, four-tier model fleet (Claude/Mistral/M4/Pi),
12 challenges with mitigations, POC plan with exit criteria, QA
strategy with autonomy promotion gates. Index row + bidirectional
backlinks (erp guidebook, safe-prod PRD).
Co-Authored-By: Claude Fable 5 <[email protected]>
arcodangeandClaude Fable 5