Agents running outside tmux are silently uncoverable by the actuator: no statusline to read, no pane to keystroke, no alert (pm-llmmsgsrv-cc at 76.4% uncovered right now)

OPS-125 agent-ops Backlog high

Persist-marker latch: PRE-COMPACT PERSIST re-asks an agent that already replied DONE-NO-DELTA (4 confirmations, needs agent_state migration + cross-rail state)

OPS-115 agent-ops Backlog high

cc-context-monitor over-cap caps are stale — false alarms fleet-wide. THRESH_OPUS=160k/HAIKU=100k/SONNET=135k are ~80% of the OLD ~200k-class windows. Fleet now runs claude-opus-4-7[1m] = 1M-token window; a 268k session is 27% full, not over cap. Transcript model string lacks the [1m] marker so monitor can't auto-detect window size. Fix: bin-whey-cc updates THRESH_* in cc-context-monitor.sh to real values per Elazar's decision (true-window fraction vs. relabelled cost-budget). All of 2026-05-21's over-cap wind-downs were triggered by this false cap.

OPS-53 agent-ops Blocked high

Global PreToolUse enforcement hook: deny non-llmmsg-srv-team agents Edit/Write to /opt/llmmsg-srv/{hub,bridge,scripts/lib}/** + deny Bash curl/http to hub privileged endpoints (extend existing PATH-script-block hook). Elazar approved ship - recurring: agents edit hub code/curl API instead of MCP tools.

OPS-79 agent-ops Backlog high

lezama host-dark recurrence: root-cause + harden against full-dark (2nd occurrence; died 2026-06-01 18:03 ART, clean cliff)

OPS-80 agent-ops Backlog high

└─ Reboot forensics: journalctl -b -1 -k (panic trace=crash / empty=power loss) + full -b -1 (OOM?), dmesg|tail-50, df -h, last -x reboot, smartctl -a

OPS-81 agent-ops Backlog high

└─ Validate the installed recovery software (failed twice): identify unit, check prior-boot status+journal (fired/tried/failed?), confirm dead-kernel/power is below userland scope; validate reverse-tunnel health EXTERNALLY from whey, never trust the ssh_r_active self-report flag

OPS-82 agent-ops Backlog high

└─ Root-cause-gated remediation (after forensics): OOM->add swap + tune vm.overcommit_memory; disk-full->monitor cron + notify-elazar; kernel panic->enable kdump for post-mortem

OPS-85 agent-ops Blocked

backup-whey.service: NOPASSWD sudo for cryptsetup+mount in /etc/sudoers.d/backup-whey (failing since run #23 2026-05-08T14:22 - sudo prompts for rob pw under systemd no-tty); owner: os-whey-cc-w

OPS-32 agent-ops Backlog high

dbcaba backup gaps: dev backup targets wrong db + gdrive backup-mirror broke 2026-05-16 (dbcaba has no auto-backup today)

OPS-76 agent-ops Backlog high

Plugin hygiene v2 - rollout completion (lezama + deferred items)

OPS-58 agent-ops In progress high

└─ Plugin hygiene v2 - lezama host portion: telegram uninstall + host-global lean flip + movilba per-agent enables (see parent 459)

OPS-59 agent-ops Backlog high

eq backend unbuilt: hub.mjs has no /eq_* routes + no elazar_questions table — eq CLI POSTs to non-existent endpoints (/eq_ls returns not_found). chat-duo Pending panel reads elazar_questions, so no Elazar question can ever surface. Implement hub-side /eq_add /eq_ls /eq_show /eq_answer /eq_dismiss /eq_stale + elazar_questions schema per eq-spec.md

OPS-49 agent-ops Backlog high

llmmsg-srv roster & PM resilience: pruneStale soft-offline, offline buffering, PM re-election

OPS-54 agent-ops In progress high

└─ PM-liveness watchdog: cc-context-monitor detects a PM-less ARO, DMs Elazar

OPS-55 agent-ops Blocked high

memory-budget over-budget warning: route shared-file footprint breaches to project PM with escalation chain

OPS-57 agent-ops Backlog high

Agent name parsing: forbid dashes inside role/project (single-token parts only)

OPS-72 agent-ops Backlog high

attach-tmux.sh nests tmux/stacks extra login shell on switch-client path (recurring, 'fixed 5x')

OPS-10 agent-ops Backlog high

Recover lost 2026-05-26 evolutiva-commons patch: §Shared MD Flow + §Versioning + §Boundaries B1/B4/B5 — check llmmsg message DB for original content

OPS-12 agent-ops Backlog high

scrp- convention migration: fleet-wide rename + aro:hosts-status creation (coordinated pass, bin-whey-cc coordinates)

OPS-21 agent-ops Backlog high

Sensitive-files backup to backupYes LUKS USB (whey-state-backup.sh) — maintainer nw-whey-cc. DONE: restarted timer (dead since 06-17 reboot, 9d gap) + added ~/.local/bin/.llmmsg-env+.agent-name coverage (v1.1.0, verified). OPEN/Elazar: exclude ltm.md from gdrive leg (holds creds); mars.env NOPASSWD read-rule; off-whey LUKS keyfile+passphrase (SPOF).

OPS-25 agent-ops Backlog high

cc-context-monitor path-B/wind-down DM mis-targeting: db-mars-cc remediation delivered to nw-venus-cc

OPS-9 agent-ops Backlog high

Alert windows that straddle a host reboot are reported as agent faults: no-statusline duration spans downtime the process did not exist for

OPS-126 agent-ops Backlog

context-monitor.sh reports stale ctx for idle whey agents: frozen transcript pins them at >=180k for hours (OPS-11 residual, action gated but read still wrong)

OPS-124 agent-ops Backlog

Commanded /compact does not land: 3 agents measured unverified in one pass, root cause unknown

OPS-107 agent-ops Backlog

Stuck-busy alert has no known-wedged latch: re-fires every 6h forever with no escalate-once path

OPS-122 agent-ops Backlog

Right-size event_log telemetry retention: 7d raw is ~800MB steady state, gates_evaluated JSON is a third of it

OPS-120 agent-ops Backlog

cumulative_usage() lacks the id-dedup token-usage-collect.sh has: my cumulative token numbers overcount streamed turns

OPS-117 agent-ops Backlog

cc-context efficiency report - read-only reporting layer on monitor-context.sqlite (week/day/48h)

OPS-60 agent-ops Backlog

context-monitor.sh 180k nudge DM promises a 220k injection that cannot happen under COMPACT_ACTUATOR=0

OPS-110 agent-ops Backlog

scan-context coverage alarm is permanent noise: Codex audit-*-ca panes have no CC statusline to read

OPS-109 agent-ops Backlog

cc-context-monitor zombie-detector false-positives on reactive-idle agents: rule (turns>=2 && tool_calls==0 -> zombie) can't distinguish a self-armed-wakeup zombie from a reactive agent woken by inbound llmmsg DM that acked + stood down with no tools needed. At 05:00 it flagged audit-venus-cc (benign: empty CronList, zero ScheduleWakeup ever, 100% inbound-DM-driven) -> 2 dup alerts + cross-host investigation. Hits EVERY reactive agent (host nw between alerts, audit agents). Fix (nw-whey suggested): a wake is zombie-suspect only if NOT preceded by an inbound message in the window (self-triggered) AND/OR non-empty CronList; if wake correlates with inbound DM + empty CronList -> reactive-idle, suppress. Hub has inbound-msg timestamps to correlate. Related: OPS-11 last_turn stale-read.

OPS-17 agent-ops Backlog

Scheduled security-scan ownership (rkhunter/clamav) + fleet-wide systemd/cron job registry with heartbeat monitoring on venus

OPS-97 agent-ops Backlog

└─ Drop clamav-scan.timer cadence biweekly->monthly on venus

OPS-99 agent-ops Blocked high

└─ nw-venus-cc takes full ownership of rkhunter+clamav scan units (single accountable maintainer)

OPS-100 agent-ops In progress

pull cc-memory-sweep.sh v1.2 (sh.git 20ce2fe) onto whey + lezama

OPS-71 agent-ops Backlog

cc-context daily digest: delivery channel decision (thread 5) — A fold into 08:00 elazar-pending-digest / B standalone unit+hour / skip

OPS-47 agent-ops Todo

memory-lint scope bug: gitpush pre-hook runs memory-lint.sh with no arg → scans ALL ~/.claude/projects/*/memory dirs → one project's memory hygiene blocks every other project's pushes. Cross-project DoS. Fix: scope to current-project memory dir only (resolve from PWD or .agent-name). Surfaced 2026-05-17 by coder-mars-cc-29923 blocked on llmmsg-srv-cc's dirty memory dir.

OPS-40 agent-ops Backlog

└─ memory-lint A/B/D/E: gitpush-pre.sh per-project scope (arg, not glob) + non-blocking warn-only + drop §11 heading-dup from per-push + never touch CLAUDE.md. Mars+pluto+venus .gitpush-pre.sh mirror. Ratified by Elazar -30088.

OPS-42 agent-ops Backlog high

bisync watchdog: alert when gdrive-bisync.service fails > 2 consecutive runs

OPS-74 agent-ops Backlog

Normalize agent names + folder/.aro/.agent-name layout: fix hyphenated project-names in cc-names, KEEP host suffix -w/-v/-l (it identifies cross-host agents, e.g. proxy-<proj>-cc-w); rename coder->coder01/coderhelp->coder02/db->db01/db2->db02 via claude-mv per-project (agent-driven, not manual); build drift-normalizer script. whey+venus now, lezama later.

OPS-86 agent-ops Backlog

Fleet audit: every agent's cwd has local .agent-name matching registered name

OPS-73 agent-ops Backlog

memlint-cron.sh: replace email escalation with llmmsg DM to host maintainer (nw-{host}-cc)

OPS-70 agent-ops Backlog

Review evolutiva backup policy + space (2h/30d/gdrive, ~1.75GB steady-state; context: WI #509)

OPS-69 agent-ops Backlog

bwi git-sync dead since 2026-05-06: decide whey-only policy vs resume DB commits+pushes to GitHub; venus agents routing through whey meanwhile

OPS-65 agent-ops Backlog

memory-lint compute_footprint over-walks CLAUDE.md chain - ignores claudeMdExcludes

OPS-61 agent-ops Backlog

Stale /compact cron jobs: agents leave CronCreate one-shots from prior sessions (shows as 361d scheduled task on exit). Investigate root cause and implement reliable cleanup — auto-purge stale crons on session start or prevent duplicate creation. Reported repeatedly; needs durable fix.

OPS-93 agent-ops Backlog

db-mba-l/CLAUDE.md: live PROD svc_nextjs password in tracked git file. No rotation (Elazar 2026-06-29). When revisited: git history rewrite or rotation. Also de-bloat 23.6k schema doc → move to docs/ read-on-demand.

OPS-95 agent-ops Backlog

Migrate all whey-hosted maintenance/monitoring to venus: systemd timers, cron jobs, push/pull scripts, and any monitoring that currently runs on whey (bin-whey-cc / nw-whey-cc lanes) must move to venus equivalents. Whey is not 24/7 and must not be depended on for scheduled or continuous ops. Audit all whey services, identify venus gaps, migrate lane by lane. bin-whey-cc becomes contributor/reviewer only; venus agents own runtime.

OPS-94 agent-ops Backlog

Fleet model audit: many agents still pinned Opus 4.7; move to default-tracks-latest (verify default=Opus 4.8 + future models) or pin Opus 4.8; review model choice per agent by role

OPS-8 agent-ops Backlog

db-size-monitor blind to /var/lib: add to scan roots (currently /home/rob /opt /srv /rtshared). The llmmsg-srv hub DB (/var/lib/llmmsg-srv/v2.sqlite 38M live + llmmsg.sqlite 30M dead-v1) never appears in size snapshots - exactly the DB Elazar worries about. Also surfaces probe-table growth (host_probes 32k rows) for retention review.

OPS-1 agent-ops Backlog

attach-tmux.sh: list OFFLINE agents too; selecting one launches its ccs session and attaches you to it

OPS-7 agent-ops Backlog

whey↔lezama global ~/.claude/CLAUDE.md §-level reconcile: lezama missing entire sections whey has (was missing ## Collaborate — added 2026-06-14; also lacks Permission, Communication, others). Audit all 3 hosts' global CLAUDE.md section sets, decide canonical fleet-neutral set, mirror missing sections per-host. Surfaced during the log-review-autonomy global-line rollout.

OPS-14 agent-ops Backlog

cc-context-monitor.timer on venus stalls intermittently (Trigger: n/a, no next fire scheduled) after normal runs — causes ~45min gaps in scrp-context_monitor-venus heartbeat, false DOWN alerts from whey. Observed 4x on 2026-06-21. Root cause unknown (systemd timer drift? service runtime overrun? OnCalendar+Persistent interaction?). Needs bin-whey-cc investigation.

OPS-23 agent-ops Backlog

venus: align scrp- units to bs-mqmr47bwkk4 naming convention

OPS-22 agent-ops Backlog

Rename whey monitor units to bs-mqmr47bwkk4 convention: ctx-monitor-whey.{timer,service}, sender scrp-ctx_monitor-whey, target aro:hosts-status

OPS-24 agent-ops Backlog

Audit odaia agent roster — 15 cwds under ~/Documents/personal/odaia looks too many; consolidate, then properly scope google-workspace MCP per surviving agent (currently re-added to all 15 per-project as a stopgap 2026-06-05).

OPS-90 agent-ops Backlog

Fleet google-workspace real-usage sweep on venus+lezama: grep each host's transcripts for actual mcp__google-workspace__ tool_use (not installs/mentions); add per-project where used. whey done: odaia(heavy), pluto-pm(light), nw-whey(1 gmail).

OPS-91 agent-ops Backlog

Decide and execute: context-monitor.sh --drain path + its timer are undocumented, possibly dead

OPS-119 agent-ops Backlog low

Retire-vs-cutover: context-venus-monitor-alert.sh is a dormant duplicate of the live context-monitor-alert.sh

OPS-118 agent-ops Backlog low