rdmsm4x-changelog-20260901-1858-fleet-health-resume-reopen-signing-mem0
rdmsm4x-changelog-20260901-1858-fleet-health-resume-reopen-signing-mem0
Host: rdmsm4x · Session: claude fleet-health-sync-coordination (27c29282) · Window: 2026-09-01 18:23 → 18:57:46 EDT EDT
One line: reopened 46 tickets whose only evidence was a hermetic test suite; finished the ECSProcess→ECS0System migration for real (AINetNode had a shadowing local copy); made two build scripts fail closed on signing; signed the Tyrell bundle from an Aqua session; restored 2 blob-reverted repos and located the revert source (rdmbair15m5); verified mem0 on all 6 hosts and made that a nightly check.
Files touched (commits, all pushed to git.ecs0.net + GitHub, ls-remote MATCH)
issues/2d479b8, b638d89, 804e3c5 — 46 FEAT-20260831 tickets moved resolved→open with evidence comment; ISSUE-20260901-08 (hermetic suite), -11 (updateRoo ad-hoc), -13 (8-app ad-hoc sweep); comments on INCIDENT-20260901-04, FEAT-20260901-42 (my own 'exists nowhere' claim corrected).apps/AINetNoded81030f (local ProcessRunner archived — codex finding), 471b987 (build.sh fails closed on signing; dist/ signed). 31 tests, 0 failures.apps/updateRoo602d555 (build.sh fails closed on signing; dist/ signed; set -e silent-exit fixed). App + dist TeamIdentifier ZU2882L4HT.lib/ecs0libfc80e52 (CLAUDE.md migration record), 90c3c6d (SESSION-STATE.md). Clean tree.fleet/ops58ecc21 — nightly_audit.zsh CHECK 5: mem0 SSH-stdio handshake on every spoke, with positive + negative controls.apps/rooDBworking tree: PermissionsProbe.swift restored to HEAD 9db3147 (snapshot 20260901-183703), build rc=0. Not a commit.apps/rdWORKBENCHworking tree: CLAUDE.md + README.md restored to HEAD b282fd4 (snapshot 20260901-183714).~/dev/PROJECTS.mdupdateRoo row 133→145 tests.~/dev/testssnapshot only (20260901-183747) — 22h-old uncommitted harness rewrite, not mine.apps/Tyrell/.build/Tyrell.appbuilt + signed (Apple Development S65Q255HA8, universal2, minos 15.0, strict verify rc=0, tampered-copy control rc=1). Not deployed: contains the blob-reverted PermissionHealth.swift. Owner claude@rdmpw3265m told twice.- mem0: two memories added (fleet mem0 topology + verification; ProcessRunner canonical + two traps).
Verification evidence
- Hermetic suite: copied to an empty dir with no portfolio → 253/253 PASS in 0.055s. Cited on 46 tickets as app evidence.
- Signing controls (both apps): no-identity shim → rc=1 + refusal; ALLOW_ADHOC_SIGN=1 → rc=0 + warning + 'not set'; real → rc=0 + ZU2882L4HT on every product.
- Revert class: blob identity via agentkit_provenance_check; rdmbair15m5 holds byte-identical old blobs with the exact mtimes now on the hub (7635c26c32db, a75ce00cbce5, 8c72803a37f6). Writer not found in any Claude/codex/agy transcript on either host.
- mem0: initialize→serverInfo through ~/bin/mem0-mcp on 5/5 spokes + hub; search_memories round-trip OK from rdmpw3275m (Intel) and rdmbair15m5; codex + agy registrations present on 5/5. Spokes having no Mem0Local is BY DESIGN.
Undo
- Ticket reopen:
git -C ~/dev/issues revert 2d479b8. - build.sh changes:
git revert 602d555/git revert 471b987. - rooDB / rdWORKBENCH restores:
worktree_snapshot.zshsnapshots named above hold the pre-restore copies. - nightly audit CHECK 5:
git -C ~/dev/fleet/ops revert 58ecc21.
Outstanding owner actions
- Rich: Developer ID Application cert (SEC-20260901-05) — still Apple Development only.
- claude@rdmpw3265m: restore Tyrell PermissionHealth.swift to HEAD, then ping me to re-sign; deploy; fix deploy_fleet.zsh (3-of-5 products, no lipo gate) as tickets.
- 7 remaining ad-hoc-signing apps (ISSUE-20260901-13), one bounded task each.
- Revert writer: needs the write-back watcher with PID capture (TASK-20260901-06); transcripts cannot name a writer that never went through a harness.
No secrets in this file.