gitpush.sh exported ONLY_PATHS only at the push step, so every repo hook gating on it ran whole-tree - and inherited a stale value when the caller had one

OPS-284 agent-ops Done high

sh.git cutover: pre-flip residency audit on WHEY - which git-ignored in-tree files the symlink flip would lose

OPS-280 agent-ops Done high ↳ OPS-158

wi needs a cheap blocked-reason projection: no command prints blockedReason for a SET of rows, so triaging stale blockers costs thousands of tokens per row

OPS-227 agent-ops Done high

gitdeploy.sh: background live-version poll at 4 and 8 minutes

OPS-178 agent-ops Done high ↳ OPS-173

Bump AFTER the gate passes, and revert the bump on any failure

OPS-175 agent-ops Done high ↳ OPS-173

Extract gitpush-core.sh: selection, Agent: trailer, secret gate, merge-on-reject

OPS-174 agent-ops Done high ↳ OPS-173

rclone shared Google Drive client_id is being retired during 2026 - both gdrive backup legs expire with it, scope fleet-wide unmeasured

OPS-252 agent-ops Done high

Secret-hygiene gate is on 1 of ~10 commit paths - absent from gitpush.sh, the fleet-mandated one

OPS-172 agent-ops Done high ↳ OPS-156

gitmerge.sh newest-wins silently RESURRECTS deleted files - any removal is undone by the next merge from an un-pulled host

OPS-171 agent-ops Done high ↳ OPS-156

Move kpi-web off whey to venus + audit whey for other host-role violations

OPS-139 agent-ops Done high

Agents running outside tmux are silently uncoverable by the actuator: no statusline to read, no pane to keystroke, no alert (pm-llmmsgsrv-cc at 76.4% uncovered right now)

OPS-125 agent-ops Done high

Persist-marker latch: PRE-COMPACT PERSIST re-asks an agent that already replied DONE-NO-DELTA (4 confirmations, needs agent_state migration + cross-rail state)

OPS-115 agent-ops Done high

grep in a Claude Code shell is ugrep --ignore-files: every recursive credential census done with it is a FALSE NEGATIVE

OPS-239 agent-ops Done high

STATUSLINE_RE sub-1k parse records 743 tokens as 743k and would fire a /compact on a near-empty agent

OPS-229 agent-ops Done high

Remove the local production build from every .gitpush-pre.sh - lint and typecheck stay, Vercel builds

OPS-221 agent-ops Done high

llmmsg-srv wire envelope: cut per-message overhead - measured ~170 tokens of envelope per delivered DM, and every buffered message is charged twice

OPS-228 agent-ops Done high

scan-context.py footer skip-list rotted again: every venus claude pane reads BUSY while idle (21/21 measured)

OPS-226 agent-ops Done high

PM-liveness watchdog: monitor-context detects a PM-less ARO, alerts the host nw relay (NOT Elazar - elazar_unreachable)

OPS-55 agent-ops Done high ↳ OPS-54

Drop clamav-scan.timer cadence biweekly->monthly on venus

OPS-99 agent-ops Done high ↳ OPS-97

cc-context-monitor THRESH_*/ROLE_CAP: keep as a per-model COST budget, do not raise toward window fractions (closed, no code change)

OPS-53 agent-ops Done high

gitpush.sh releases the push-gate lock its CALLER took - nested acquire, single unconditional release, gate free while the agent still believes it holds it

OPS-210 agent-ops Done high

Two mba-l lanes run two different copies of gitdeploydev.sh - one from an untracked sh-old/

OPS-186 agent-ops Done high ↳ OPS-173

MovilBA decoupling: the fork was asked for and never landed - gates the retirement stub

OPS-183 agent-ops Done high ↳ OPS-173

Duplicate infra agents ca/cc audit: keep vs dormant

OPS-153 agent-ops Done high ↳ KPI-45

context-monitor.sh compact-ladder: window-relative tiers replace host-wide absolute constants

OPS-133 agent-ops Done high

memory-lint §12/§9 vs global CLAUDE.md: per-agent identity + dates in memory/ — Elazar decision

OPS-52 agent-ops Done high

memory-budget Layer 1: gdrive-canonical 'Memory Budget' directive + footprint-check threshold (thread 3); incl. maintainer-agents.md memory-lint ownership section (thread 4)

OPS-48 agent-ops Done high

Actuator tiers must be per-agent-window: scale absolute gates (HARD_NUDGE_K/HARD_COMPACT_K, quarantine) by each agent's own CLAUDE_CODE_AUTO_COMPACT_WINDOW instead of assuming one fleet window

OPS-128 agent-ops Done high

AUDIT dropbox-orphan-sweep.sh (registry row 116): what it deletes, how it fails

OPS-127 agent-ops Done high

cc-context-monitor last_turn() v2.14 residual stale-read: agent force-compacted 'for no reason' every other session. Verified 2026-06-09 nw-whey-cc reported 184k while live /context=63.6k (3x phantom). last_turn (~line 312) reads transcript's last usage block = summarizer's pre-compact cache_read until next real turn; compact_boundary reverse-walk skip has a hole (boundary outside TAIL_BYTES, or pre-compact reading sampled in the gap before boundary written). Fix: gate actuator on LIVE window occupancy, not stale transcript estimate. NOT a cap problem - do NOT bump nw ROLE_CAP (Elazar explicit). Recurring user-facing churn.

OPS-11 agent-ops Done high

tick.py execute() is sequential: one slow agent blinds the whole roster and delays post-nudge escalation (2.5min measured)

OPS-106 agent-ops Done high

Post-compact state is structurally unmeasurable: 0k filter hides landed compacts, so compact_unverified fires on successes

OPS-112 agent-ops Done high

No regression guard on the idle classifier: a ghost-vs-typed inversion caused a silent fleet-wide coverage outage

OPS-123 agent-ops Done high

Stuck-busy agents leave coverage silently: unsubmitted prompt text pins idle=false, 14h measured uncovered, no alert

OPS-116 agent-ops Done high

abr:ss attribution false-negative: fast responders fail the text_in_pane visibility test

OPS-121 agent-ops Done high

nudge_pending_since consumed on decide, not on confirmed exec: an aborted escalation can shut all four triggers

OPS-108 agent-ops Done high

hub_send.py marker path was __file__-relative: correct only because the unit names the symlink, and it reported landed registrations as failures

OPS-114 agent-ops Done high

Idle prefetch used the 50% growth floor and compacted agents with 35pt of headroom (coder-pluto-cc at 51.2%)

OPS-113 agent-ops Done high

Idle-path compact runaway: NULL growth baseline made every above-floor agent perpetually eligible (pm-terra-cc 8x in a morning)

OPS-111 agent-ops Done high

db-size-monitor.service failing exit-127 daily (orphaned script)

OPS-104 agent-ops Done high

Fix rkhunter duplicate timers on venus + drop cadence weekly->monthly

OPS-98 agent-ops Done high ↳ OPS-97

nw-agent launcher template: haiku + --effort low + autoCompact + loop self-monitor rule

OPS-37 agent-ops Done high

bwi Tier 1 enhancements: add guard, mine banner, rot, status notify, evolutiva doc

OPS-38 agent-ops Done high

Pin hub registrations for cc-context-monitor-{whey,venus,lezama}

OPS-44 agent-ops Done high

v2.7 over-cap remediation: parked over-cap agent still in its AROs gets woken into a full-context read-turn by every ARO fan-out (~30-60s) — park does NOT stop the burn. Fix: over-cap sequence becomes ss -> DM handoff to PM -> aro_leave ALL AROs -> idle. Edits: v2.6 over-cap DM text in cc-context-monitor.sh (bin-whey-cc) + wind-down line in global directive (nw-whey-cc). Fresh bin-whey-cc takes alongside thread 2

OPS-50 agent-ops Done high

chat-duo: render origin_aro-tagged messages in their ARO room, stop spawning a room per DM

OPS-56 agent-ops Done high ↳ OPS-54

whey gdrive-bisync broken (aborting every ~30s, 'cannot find prior Path1/Path2 listings') since ~2026-05-16: evolutiva/venus/odaia backups local-only in /gdrive, not reaching Google Drive; needs rclone --resync recovery (path2/local-wins) on Elazar GO

OPS-77 agent-ops Done high

evolutiva-backup down for mars+pluto: Supabase removed legacy db.<ref>.supabase.co direct hostnames (NXDOMAIN) - DSNs need pooler connection strings

OPS-67 agent-ops Done high

cc-context-monitor: send ss+Enter, wait 60s, then send /compact (not back-to-back)

OPS-20 agent-ops Done high

settings.json PostToolUse push-to-gdrive-canonical silently no-ops: basquetwi.md local edits did NOT propagate up to /gdrive/config/claude-shared/ (canonical stayed mtime May-18), so SessionStart cp re-pulled STALE over the edit. Hook's 'cp ... 2>/dev/null' swallows failures = silent doc drift fleet-wide. Audit why push no-ops + surface failures.

OPS-15 agent-ops Done high

Does mars's .gitpush-pre.sh read ONLY_PATHS? The v5.6 producer shipped fleet-wide; the consumer is per-repo and unchecked

OPS-291 agent-ops Done

Does enamel's .gitpush-pre.sh read ONLY_PATHS? The v5.6 producer shipped fleet-wide; the consumer is per-repo and unchecked

OPS-292 agent-ops Done

gitpushvercelstatus.sh finds no deployments for Mars although Vercel deployed d1053b5

OPS-288 agent-ops Done

Bare rm is a PATH lookup: whey's shim makes test cleanup a silent no-op

OPS-188 agent-ops Done ↳ OPS-173

gitpush.sh becomes a retirement stub naming the chooser doc

OPS-177 agent-ops Done ↳ OPS-173

Retire --infoforllms as a per-session read; the chooser doc replaces it

OPS-184 agent-ops Done ↳ OPS-173

gitpushhtml.sh

OPS-180 agent-ops Done ↳ OPS-173

gitpushreact.sh

OPS-182 agent-ops Done ↳ OPS-173

gitpush split: emit the pushed SHA to a durable reconcilable trace

OPS-189 agent-ops Done ↳ OPS-173

Three reported usability defects: --only separator, shared-tree scope, error banners on working paths

OPS-187 agent-ops Done ↳ OPS-173

gitpushnextjs.sh

OPS-179 agent-ops Done ↳ OPS-173

gitpushrepo.sh: the plain-repo path, or sh.git has no push

OPS-176 agent-ops Done ↳ OPS-173

gitmerge.sh: unrecognised conflict-strategy argument silently falls back to newest-wins

OPS-129 agent-ops Done

scrp-monitor-agent-idle.sh: a non-empty autosuggest implies IDLE, but the BUSY branch ignores it and reports why=no-prompt on a parked pane

OPS-272 agent-ops Done

memlint-sweep.sh --help executes a real sweep, not a usage message

OPS-245 agent-ops Done

scrp-monitor-agent-idle.sh runtime= is name-derived but reads as measured, and its one real cross-check false-signals on stale scrollback

OPS-267 agent-ops Done

agent-attach.test.sh [9]: the sweep is SANDBOXED (finding refuted at HEAD) but its runtime is unbudgeted - measure before touching it

OPS-270 agent-ops Done

gitpush-core.sh OPS-210 guard reads .reacquired; move it onto how_acquired from the /lock 200 - a listing can never answer it

OPS-265 agent-ops Done

jobreg: print REVIEW CLASS EMPTY instead of 0/0, and lead with the unscoped pair

OPS-262 agent-ops Done

codex attribution must resolve at READ time on venus - a stored repair is self-erasing

OPS-268 agent-ops Done

backup-whey-to-ssd.sh: tracked sh.git v1.1.1 is a dead file; backup-whey.service runs /opt/maintenance v2.0 with no pg_dump

OPS-207 agent-ops Done

/lock reacquired:true cannot tell a GRANTED hold from a pre-existing one, so no client can adopt unlock(successor) - MSG-392 blocker

OPS-257 agent-ops Done

gitpush.sh auto-bumps package.json: any version an agent states pre-push is not the version that ships

OPS-246 agent-ops Done

Agents arm sleep/poll to wait for hub replies - fix at the primitive

OPS-249 agent-ops Done

sys-check.sh SYS_CHECK_PG_SKIP_HOSTS defaults to skipping venus, but venus telemetry Postgres answers every probe - establish why before changing it

OPS-213 agent-ops Done

nw-venus-cc takes full ownership of rkhunter+clamav scan units (single accountable maintainer)

OPS-100 agent-ops Done ↳ OPS-97

wi CLI discarded extra positionals - 'wi event X type --body "..."' stored the literal '--body'

OPS-190 agent-ops Done

gitpushphp.sh

OPS-181 agent-ops Done ↳ OPS-173

Survey lezama for shared-mutable-file contention between agents (incl. CLAUDE.md, commons .md, pm/)

OPS-161 agent-ops Done ↳ OPS-156

Survey venus for shared-mutable-file contention between agents (incl. CLAUDE.md, commons .md, pm/)

OPS-159 agent-ops Done ↳ OPS-156

PATH scripts: never edit in place - bash reads by byte offset as it executes, in-place writes corrupt concurrent runs fleet-wide

OPS-136 agent-ops Done

context-monitor.sh actuator hardening: send-keys nudge transport + composer gate + codex merge

OPS-134 agent-ops Done

cc-context-monitor v2.4: M2 absent-branch hardening

OPS-45 agent-ops Done

Build heartbeat/dead-man's-switch watchdog for registered scheduled jobs

OPS-102 agent-ops Done ↳ OPS-97

Design + build fleet-wide scheduled-job registry (systemd timers + cron.d) on venus

OPS-101 agent-ops Done ↳ OPS-97

Full inventory + sense-check sweep of all current venus systemd timers/cron.d

OPS-103 agent-ops Done ↳ OPS-97

mars-uxpain-relay.service failing exit-1 weekly (origin_aro_not_member)

OPS-105 agent-ops Done

notify-nw helper: report scripts (rkhunter-scan, clamav-scan, gdrive-usage-watchdog) DM the host's nw-<host>-cc via hub POST /send (sender self-registers), so nw agents get security/health reports directly instead of Elazar relaying. Optional --report-file drops full HTML to /var/log/nw-reports/<host>/ with a systemd-tmpfiles.d 3-day GC line. Event-driven: NO haiku poller, NO inbox agent, zero idle cost. Helper lives in ~/.local/bin (bin-whey-cc PATH lane, co-owned); wire into the 3 scripts + bump each version.

OPS-88 agent-ops Done

cc-context-monitor v2.5: cum_turns column (turns/hour + tokens-per-turn)

OPS-46 agent-ops Done

Zombie ca-session detector: scan llmmsg-srv bridge registrations for lastActivityAt > N hours + token totals; canonical example sh-ca-w (~448k tokens, ~21h idle as of 2026-05-09T07:00). Output list + kill recommendation.

OPS-29 agent-ops Done ↳ OPS-26

memory-lint KPI email spam + report-never-clears: batch kpi-enforce emails into one digest; exclude _lint-report.md from its own lint sweep; fix infer_agent misattribution

OPS-66 agent-ops Done

CLAUDE.md instruction drift: stale references to .agent-name-cc in agent startup checklists (fleet-wide sweep)

OPS-75 agent-ops Done ↳ OPS-73

agent-health-watch.{service,timer}: 5min health check (process liveness, model, ARO membership, settings.json drift) + email/push on drift; v1 whey only

OPS-36 agent-ops Done

whey-nw-cc: scheduled open ARO-ask digest for Elazar (hub query → notify-elazar.sh)

OPS-35 agent-ops Done

Inventory systemd units + standalone scripts across hosts (whey/lezama/venus): name, host, owner ccs, function, alert path. Seed: backup units, ccs-context email alerts, defunct llmmsg-srv-kpis.

OPS-27 agent-ops Done ↳ OPS-26

whey-nw-cc: scheduled wi pending --to elazar digest → notify-elazar.sh + chat-duo

OPS-34 agent-ops Done

lezama host-global plugin baseline alignment - disable 8 plugins + uninstall telegram

OPS-64 agent-ops Done

Restore simple llmmsg KPI timer/report: daily compare worst 3 coached agents vs yesterday/week

OPS-33 agent-ops Done

gitpush.sh strict-staging mode: .gitpush-strict repo marker + --only <pathspec> + abort (not prompt) on stray files outside the set; non-strict repos keep add -A. Bump version same commit. Drop+commit marker in sh.git + llmmsg-srv repos.

OPS-78 agent-ops Done

memory-lint C: cron + report-file. Schedule nw-whey-cc (whey projects) + nw-venus-cc (venus) daily 03:00 ART. On hard-fail, write ~/.claude/projects/<slug>/memory/_lint-report.md (NOT DM — survives /clear). Owning agent reads at SessionStart, does LLM cleanup.

OPS-41 agent-ops Done

cc-context-metrics: SQLite token-metrics time series (cc-context-monitor v2.3)

OPS-43 agent-ops Done

cc-context-monitor: fix silent dedup + add process-not-in-roster alert

OPS-68 agent-ops Done

/rtshared low-latency WAN mount: whey:/var/rtshared served to venus+lezama as /rtshared/ over ZeroTier (sshfs or NFS, patient timeouts) for live cross-host editing; keep /gdrive for bulk. GATED on lezama coming online; whey /etc side is ready.

OPS-87 agent-ops Done

VPN work-hours auto-connect: connect-only reconciler (Mon-Fri 09:00-16:00 ART), never disconnects, exponential backoff on failed connect

OPS-89 agent-ops Done

Scrub stale eq / Elazar Pending text from bwi-tool PROJECT canonical docs (MSG-36 followup): /home/rob/Documents/work/pensanta/projects/basquetWi/basquetWiInstructions.md + that project's CLAUDE.md still carry old eq/Pending wording. Not the global-rule SSOT (gdrive is, already fixed) but scrub for consistency. Owner: bwi-tool maintainer.

OPS-16 agent-ops Done

bwi-desweep-roundtrip-test

OPS-96 agent-ops Done

cc-context-monitor FIX#1+#2: idle-sense (last-ASSISTANT-ts not getmtime) + safe-compact REPL-ready marker

OPS-19 agent-ops Done

monitor peer-watchdog: roster-presence→probe-age (post-wave-1 prune-churn fix)

OPS-18 agent-ops Done

Implement scrp-<script_name>-<host> sender naming: notify-elazar.sh + notify-nw.sh derive scrp-$(basename caller, strip ext, - to _)-<host> and stamp it as hub sender + email From-name/subject prefix; rename direct-hub-poster scripts (evolutiva-errscan errscan-whey-cc to scrp-evolutiva_errscan-whey, llmmsg-kpi-report llmmsg-srv-cc fallback to scrp-kpi_report-whey, sweep rest). -cc/-ca reserved for real agents. Convention: agent-conventions.md Script/Automated Sender Naming (Elazar 2026-06-10)

OPS-13 agent-ops Done

applog-listen: catchUp re-pages inflight rows when postAlert fails on reconnect

OPS-92 agent-ops Done

gitpush.sh: three remaining sites parse git's QUOTED path output as usable paths

OPS-130 agent-ops Done low

cc-settings-drift-check: report WHICH settings keys changed, not just how many sessions are stale

OPS-203 agent-ops Done low

BWI-73 live verify: headered bwi close notice must not overwrite client_version

OPS-277 agent-ops Done low

gitpush version-gate suite does not exercise the non-strict call site at :2424

OPS-250 agent-ops Done low

hook comment attributes Grep withholding to bypassPermissions - measured false as a necessary condition, cause unknown

OPS-254 agent-ops Done low

hub lock: a successor grant does not inherit the releasing holder's remaining TTL and no holder-facing surface says so

OPS-247 agent-ops Done low

hub lock: successor is settable only by the holder but no holder-facing response or error advertises it - add it to the 409 and 200 text

OPS-241 agent-ops Done low

api-images: no .gitpush-pre.sh, so php -l is a hand-run habit rather than a gate

OPS-185 agent-ops Done low ↳ OPS-173

Strip stale telegram:false plugin entries from mars/pluto agent configs

OPS-62 agent-ops Done low

Strip stale telegram:false plugin entries from movilba-web agent configs

OPS-63 agent-ops Done low