rdmsm4x-changelog-20260822-1746-devdataroo-status-site

rdmsm4x — dev.dataroo.net becomes the canonical status site

2026-08-22, 17:22–17:50 EDT · rdmsm4x

Moved project status reporting off Claude Artifacts and onto Rich's own infrastructure, because an Artifact needs Claude auth to view, cannot be regenerated by a cron job, and its retention is not his to control. Added private device-authenticated access, a filterable near-realtime dashboard, and a five-minute scheduled publisher.

What changed

Publishing rule (`~/dev/apps/CLAUDE.md` §10)

Rewritten. Dashboards must now be self-contained HTML5 with zero external dependencies — no CDN, no Google Fonts, no remote scripts — and must publish to dev.dataroo.net, not to a vendor platform. Artifacts are demoted to a transient preview. Also specifies the main page must be the dashboard itself, project chips must filter charts/counters/stream together, and proven-vs-unproven must be encoded structurally. Records "no taglines."

Generator (new)

File	Role
`~/dev/scripts/gen_site.py`	generates index, 9 product pages, fleet page, `data/status.json`
`~/dev/data/products.json`	curated per-product facts, lifted out of code so status edits need no code change
`~/dev/scripts/fleet_status.zsh`	read-only 6-host SSH probe, 5s connect timeout, emits JSON
`~/dev/scripts/publish_site.zsh`	launchd entry point; rate-limits the fleet probe to 1×/15min

Also removed the Google Fonts <link> from the older gen_dashboard.py, which violated the new zero-dependency rule.

Site

Main page: counters, a hand-drawn SVG commit-activity chart (30 days, stacked by project, read from git log), per-project evidence-balance bars, Airtable-style neon project chips, view tabs (Everything / Open / Blockers / Completed / Audit trail / Log trail), text filter, and a 157-event unified stream. Chips drive all three views simultaneously.
Nine product pages with a live git strip and four evidence columns.
Fleet page; DevSort page carries fleet reach and the technique/blind-spot breakdown.
Polls data/status.json every 30s; data is also inlined so the page works from file://.
The existing 35 MB wiki was archived, not overwritten, to wiki/archive/.

Access

wiki-server published on host port 8787. tailscale serve terminates TLS at rdmsm4x-1.kangaroo-kitefin.ts.net.
Public dev.dataroo.net keeps basic auth; password reset to a bcrypt hash for user richh.
iCloud sign-in cannot authenticate a web server — there is no such mechanism, and Sign in with Apple is an OAuth flow needing a service config and a click. Tailscale device identity is the thing that actually does what was asked.

Scheduled

com.eastcoastscience.devsite launchd agent, StartInterval 300, RunAtLoad. Verified running, exit 0, log at ~/dev/data/publish.log.

agy

Statusline support confirmed (/statusline <command>, 158 refs in the binary). Pointed at the same ~/.claude/statusline.sh on all six hosts — one canonical statusline.
Global rules added to ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md: agy as a standing second opinion with --teamwork-preview, and quota-exhaustion handling — agy is advisory, never load-bearing; a halted agy call must never stall a deliverable.

Verification

node --check on the extracted dashboard JS: parses clean.
Every getElementById target exists in the HTML.
Headless DOM harness executed the real render path: 6 counters, 10 chart bars, 9 balance rows, 157 events. Filtering RTTy-only narrowed all three views; view=blocked returned only blocked rows; deselecting everything produced the empty state.
Zero external URLs in generated output.
Live: dev.dataroo.net 401 without credentials, 200 with; /p/rtty.html 200; /data/status.json 200; LAN :8787 200 without auth.
Fleet probe: 6/6 hosts reachable.

Bug found and fixed during verification

With every project deselected the stream was not empty — site log events bypassed the project filter. Fixed by making the log trail a first-class filterable chip rather than an exemption.

Undo

~/dataroo.net/docker-compose.yml.bak-*, .htpasswd.bak-*
~/.claude/CLAUDE.md.bak-*, ~/.codex/AGENTS.md.bak-*
~/.gemini/antigravity-cli/settings.json.bak-20260822-1745 (all hosts)
launchctl bootout gui/$(id -u)/com.eastcoastscience.devsite
tailscale serve --https=443 off
Prior wiki content intact in ~/dataroo.net/wiki/archive/

Owner actions outstanding

Rotate the Cloudflare Global API Key — found in cleartext, ~12 times, in ~/.gemini/antigravity-cli/settings.json on every host agy has run on. A Global Key cannot be scoped. Replace with a token scoped to Zone:DNS:Edit on dataroo.net.
Rotate Firecrawl key, GoDaddy key/secret, UDM root password — all pasted into chat.
tailscale set --accept-dns=true if the MagicDNS hostname should resolve. Not done unilaterally — it changes system-wide resolution and DNS is a separate workstream.
Apple Note for this changelog is pending — this session is not an Aqua desktop session, so notes_changelog.zsh refuses by design.