rdmbair15m5-20260820-1838-claude-config-cleanup-and-fleet-normalization

Cut always-loaded Claude context ~52% on this host, fixed a plugin hook that had failed silently at every session start for two weeks, and normalized Claude config + ~/CLAUDE.md across all five Macs.

• Host: rdmbair15m5 (Apple M5 MacBook Air, macOS 27.0) — not rdmbair13m5, which the old fleet report mislabeled as "report origin"
• When: 2026-08-20, 17:41 – 18:38 EDT
• Agent: claude-code/rdmbair15m5/doctor-fleet-consistency (Claude Code 2.1.237)
• Scope: rdmbair15m5 (extensions), all 5 hosts (memory files, settings, coordination)
• Backups: ~/.claude/backups/doctor-20260820-175709/ and ~/.claude/backups/doctor-clean-20260820-183004/; remotes also ~/.claude/backups/CLAUDE.md.retired-20260820
• Check-in: ~/.agent-coordination/checkins/claude-code-doctor-fleet.json (synced to all 5)

1. Context reduction (rdmbair15m5)

¹ Enabled plugins' skills + agents measured together after cleanup. All figures est. (chars ÷ 4).

Plugins disabled (17) — ~/.claude/settings.json, enabledPlugins: false

frontend-design, agent-sdk-dev, claude-code-setup, claude-md-management, code-review, code-modernization, commit-commands, code-simplifier, cwc-makers, feature-dev, math-olympiad, mcp-server-dev, playground, plugin-dev, pr-review-toolkit, skill-creator (all @claude-plugins-official) + andrej-karpathy-skills@karpathy-skills. All had 0 lifetime uses and 0 transcript hits across a 21-day / 24-transcript window.

Kept: superpowers (232 uses), hookify (1,941), learning-output-style (229), explanatory-output-style (229), ralph-loop (39).

Skills disabled (7) — skillOverrides: "off"

agents-sdk, durable-objects, sandbox-sdk, turnstile-spin, web-perf, cloudflare-one-migrations, cloudflare-email-service. Kept: cloudflare, wrangler, workers-best-practices, cloudflare-one — also zero-use, but active Cloudflare DNS/cert work is on record.

Undo: flip any enabledPlugins entry back to true / drop its skillOverrides key, or use /plugin.

2. ~/CLAUDE.md retired on all five hosts

Its content was 100% duplicated or stale:

• fleet-dev-update v2.5 (4,097 chars) — byte-identical copy also in ~/.claude/CLAUDE.md
• claude-doctor-baseline v1 (5,711 chars) — byte-identical copy also in ~/.claude/CLAUDE.md
• 08-15 fleet report, lines 1–151 (8,902 chars) — derivable version tables, already wrong within 5 days (brew 6.0.17 → actual 6.0.18; go1.26.6 → actual 1.26.7)

~/.claude/CLAUDE.md loads in every project; ~/CLAUDE.md loaded only under ~. The global file strictly dominates, so retiring the local one loses nothing anywhere.

Three non-derivable facts were migrated into the doctor block first, then a guard verified all five required strings were present before any deletion:

1. rdmbair15m5 has 0 valid code-signing identities (security find-identity -v -p codesigning). Team ZU2882L4HT + three com.eastcoastscience.RDWorkbench profiles are cached and valid to Aug 2027, but no cert/private key exists locally and none is backed up. Simulator work is fine; device runs, notarization, and App Store submission are blocked until an Xcode sign-in.
2. xcode-select -p can lie — read ground truth as env -u DEVELOPER_DIR xcode-select -p.
3. The host-label warning (relative labels name the generating host).

Undo: cp ~/.claude/backups/doctor-clean-20260820-183004/CLAUDE.md ~/CLAUDE.md

3. Broken plugin hook — silent for two weeks

superpowers ships hooks/run-hook.cmd mode 644, and its hooks.json invokes that wrapper directly, so every SessionStart failed with exit 126 / Permission denied — 10 recorded failures, most recent 2026-08-20T21:41:31Z. Nothing surfaced at normal verbosity.

chmod +x ~/.claude/plugins/cache/claude-plugins-official/superpowers/6.1.1/hooks/run-hook.cmd

Verified by invoking it exactly as hooks.json does: exit 0, 3,414 bytes of additionalContext that had been dropped. Zero failures since.

• Only the directly-invoked wrapper needs +x; scripts it launches via exec bash "$SCRIPT_DIR/$NAME" do not.
• A plugin update re-extracts and may drop the bit again.
• /Users/rich is a symlink to /Users/richh — a /Users/rich/... path in a hook error is a red herring, not the bug.

4. Fleet config normalization (all 5 hosts)

• Agent-comms baseline keys (remoteControlAtStartup, crossSessionInbound, inputNeededNotifEnabled, agentPushNotifEnabled, model: opus[1m], verbose) were already identical — normalized by peer agent claude-code/rdmpw3265m/dev-update-fleet-fix at 17:57.
• rdmpw3265m migrated off the claude-code (stable) cask onto claude-code@latest during the update run, so the fleet is now uniform on one channel. It was the lone stable-cask host at 2.1.228.
• installMethod is null on all five — Homebrew has no value for that field. Detect the channel from the resolved binary path's /Caskroom/<cask>/ segment, never from settings.

permissions.defaultMode — do not script it

bypassPermissions is intended (owner-confirmed). A live Claude session writes its own mode back to ~/.claude/settings.json, and Claude runs continuously on every host, so any scripted fleet change is re-asserted within minutes. Observed: a fleet-wide set to auto reverted on all five without any sync job; on the next pass every host reported "already bypassPermissions".

Misleading symptoms that are not a rogue agent: the value changing on untouched hosts; one host flipping between two reads seconds apart (rdmsm4x did); the change appearing fleet-wide and simultaneous. Read defaultMode as an observation of live session state, never as owned config.

5. dev_update.zsh fleet run

Verified byte-identical first (sha256 2dd7fab797371a42, v2.6) to avoid racing the shared-write file, then launched on all five under nohup caffeinate.

• 4 hosts: "Everything is up to date — no action required!"
• rdmbair13m5 stalled. mas upgrade shells out to sudo; with no TTY over SSH it blocked at the password prompt and would have sat for the full 1800 s timeout. Killed the chain while still at the prompt (nothing downloaded), re-ran with --no-mas, completed in 26 s.
  • Outstanding: Paste 6.6.7→6.6.8 and Usage 2.16.15→2.16.16 need an interactive mas upgrade there, or NOPASSWD sudo for mas.
  • brew doctor: unlinked ruby keg — a known/handled condition; do not run brew link ruby.

6. Latent footgun fixed

~/.claude/CLAUDE.md had <!-- BEGIN mac_fleet_library_updates_081526 --> with no matching END. Any idempotent strip-and-reappend keyed on that marker pair would have deleted everything to EOF. END marker added; all four pairs now balance.

This actually bit during the session: an awk block-extract ran to EOF and mis-measured the block as 10,877 chars (real size ~700). A truncated ~/CLAUDE.md was briefly propagated as a result and was rebuilt from backups within minutes.

7. Health checks with no findings

• Install: single Homebrew cask, no npm-global package, no ~/.claude/local, no native launcher. All settings-cascade files parse. No managed policy anywhere.
• Agents/skills: 0 user agents; 27 plugin agents with no name collisions; all 11 user SKILL.md frontmatter blocks parse.
• Hooks: 1,960 runs, zero timeouts. PreToolUse:Bash ~84 ms avg, PostToolUse:Bash ~46 ms, SessionStart ~105 ms — all far under the 2 s / 10 s thresholds.
• Version: 2.1.237 = latest for the claude-code@latest cask.
• Denied read-only commands: 3 denials in-window, all user-rejected one-offs, all state-changing. No allow-rules minted. Across the wider fleet scan, all 41 denials were state-changing (sudo rm -rf, docker volume rm, curl -X DELETE, scp, nmap).

8. Outstanding / owner action

1. Rotate the UDM root password found in cleartext inside a transcript on rdmpw3275m. ~/.claude/projects/**/*.jsonl stores tool calls verbatim and is a plaintext secrets surface; transcripts are not retroactively sanitized. Per CLAUDE.md §3, read secrets from ~/.secrets/global.env or Keychain at runtime instead of embedding them in a command line.
2. rdmbair13m5: run mas upgrade interactively (2 pending App Store updates).

9. Files touched