The redirect (>> /var/log/x.log) fails before the command runs when the target
is root-owned/absent; job dies with zero output. Caused backups #18/#19 + IDS
#22 outages. Diagnose via redirect-target owner; fix with chown + logrotate create.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
devops.security: #16 remediated (freshclam + clamscan, no resident clamd); 5/6
VMs done incl CDE; proxy EXCLUDED (957MB, install OOM d it -> hard reboot).
platform.gotchas: check VM RAM before installing memory-heavy tools.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
First pass had a partial view. Backups are 3 layers (Swift dumps + encrypted
off-cluster borg to DLX + Cinder snapshots), not just pg_dumpall — #15 (DR)
resolved, #13/#14 re-scoped. Security has iptables auto-block (security-monitor)
+ AIDE FIM — #17 re-scoped; ClamAV (#16) remains the one real gap.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The activeteller agent module now emits two connectivity-recovery events
(hiveops-agent#68) that drive incident auto-close. Adds them to the event lists
(internal + claude), bumps the count 9→11, and corrects the SymXchange behaviour
in architect.md: the connection-error streak resets (and IAT_CORE_RECOVERED fires)
on the next message header, not on a fault line.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New platform.ci-cd page: runner topology (dlx-hiveiq-runner-01), no-internet
design, workflow set, access, and failure signatures. gotchas: correct the
stale \"CI is disabled\" line and add the AdGuard DNS SPOF (hits app boxes + CI
+ Claude sessions). Grounded in runner logs from the 2026-07-01 outage.
Refs hiveiq-ops/hiveiq-devops#11
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Closes the agent-module coverage gap the reconciler flagged (activeteller + 14).
Grounded per module in hiveops-agent/hiveops-module-*; audience dev (dev-only).
Reconciler now green. Grounding surfaced agent-side bugs (log-error route
mismatch, atec poll-interval hardcoded) — to verify + file next.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scripts/coverage-reconcile.py diffs the code surface (services, agent modules,
SPAs) against documented module keys and reports gaps — catches undocumented
things (found 15 agent modules + qds-monitor). Also relabeled 63 customer tabs
Overview→Customer for role-tab consistency with the fleet pilot.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
4-tier ladder customer<internal<dev<bcos. Re-tagged Architect/Testing/Claude +
platform/technical from internal->dev; Processes stays bcos. Backend visible()
enforces a per-instance served-audiences cap at the API. bcos.dev/DLX serve all;
production sets GUIDE_SERVED_AUDIENCES=customer,internal so dev/bcos never leave
dev. Verified: capped instance returns only Customer+Internal, 404s dev/bcos.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Backend FeedbackController + GiteaFeedbackService (POST /api/v1/guide/feedback):
resolves/creates the Bug/Enhancement label, appends reporter (from JWT) + module
context, POSTs the issue via a server-side GITEA_FEEDBACK_TOKEN (reaches Gitea via
public route). Area→repo map mirrors the Browser. Reader gets a 💬 Send feedback
button + dark slide-in form (Bug/Enhancement, area prefilled from current module,
title, description) with success link. Verified e2e (created hiveops-guide #4).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ties in dlx-claude's gitea-notify webhook: closing a Gitea issue DMs the reporter
in their HiveIQ inbox using the Resolution field.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New 3-tier gating: customer < internal (MSP/BCOS) < bcos (BCOS_ADMIN only).
GuideController.isBcos + service visible() honour audience: bcos. New 'processes'
app with Develop / Main / Release / Gitea-Issue process docs (audience bcos),
rendered as a Processes nav section only BCOS_ADMIN can see. Verified: BCOS 200,
MSP/customer 404.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Every customer module now has the full 5-lens set (Customer/Internal/Architect/
Testing/Claude). Testing = frontend-only what-to-test -> pass/fail checklist vs
bcos.dev sim data (C1/C2/C3 + test logins), audience internal. Authored via
per-module fan-out (2 retried on Sonnet 5).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Per Johannes: Testing tab is a tester's what-to-test -> pass/fail checklist (UI
only, bcos.dev sim data C1/C2/C3 + test logins), not an engineering API spec.
Dropped curl/endpoints/backend. New pattern for the fan-out.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- New Testing tab (order 35, audience internal, 🧪): test accounts, manual flow,
copy-paste API smoke tests, role/scoping checks, regression watch. Fleet pilot.
- Reader shows 'Signed in as {email} · {role}' above Sign out (decoded from JWT),
so you always know which identity you're testing as.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
isOpen() helper hid the dependency on `open` from Svelte's tracking, so clicks
updated state but not the view. Inline (searching || open[key]) instead.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Restructure reader sidebar into 3 collapsible top-level sections: Modules at
top (each product app collapsible with its module list), then Platform and
Technical. Auto-expands the section/app of the active module; search expands all.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Full role-tab rollout: every customer module now has Customer/Internal/
Architect/Claude tabs, grounded per-module in real code. Backend serves 296
docs / 96 modules. Grounding surfaced ~20 real bugs across services (filed
separately after verification).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Login page: dark card/inputs, Show/Hide password toggle (manual value bind
since dynamic type can't use bind:value). Reader: dark content, tabs, and
markdown (headings/tables/code/blockquote).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
authApi baseURL is .../auth, so posting /auth/api/login double-prefixed to
/auth/auth/api/login → 403. Use /api/login and /api/users/me.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 plain-language audience:customer Overview guides, one per primary
user-facing module (analytics/aria/claims/dashboard/devices/incident/msp/
profile/recon/reports/transactions/vault + fleet), authored by a per-module
parallel pass grounded in each component's actual UI, mirroring the fleet.tasks
voice. Existing hand-made guides were skipped, not overwritten. Deployed to
guide.bcos.dev for review; all DRAFT.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New GuideReader.svelte: nav tree (apps→modules) + tabbed markdown (marked),
audience-gated server-side (admins see internal tabs, badged). Replaces the old
DB-CRUD GuidesView. Consumes GET /api/v1/guide/nav + /modules/{module}.
Deployed to guide.bcos.dev.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The per-service pass surfaced 10 topics beyond the original 5 (agent.online/
offline, fleet.task.events, incidents.created/updated/resolved, journal.
transactions.recorded, analytics.snapshot-ready, adoons.rule-suggestion.
requested/ready). All grep-confirmed as literals in producing-service source.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
One code-grounded internal guide per backend service (Responsibility / Data /
Kafka / API surface / Gotchas), authored by parallel per-service agents reading
each service's own source, then an adversarial verify pass (DB names, topics,
endpoints spot-checked against code — 0 hard errors). Several guides correctly
document CODE over stale CLAUDE.md (remote = HTTP long-poll not WebSocket;
analytics = has a DB, not stateless; devices = has its own backend).
Unconfirmed facts are marked (unverified). audience: internal, all DRAFT.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cross-cutting internal guides so admins/Claude can query HiveIQ topology,
routing, data ownership and Kafka flows without re-reading code. All
audience: internal, marked DRAFT pending review.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Phase 1 of the guide rebuild (DESIGN.md):
- MarkdownGuideService scans content/**/*.md (frontmatter: module/title/tab/order/audience)
- GET /api/v1/guide/nav + /api/v1/guide/modules/{module}; audience gated by role
(internal tabs only for MSP_ADMIN/BCOS_ADMIN)
- Removed JPA/Flyway/Postgres, Guide entity/repo/service, admin CRUD, seed migrations
- Seed content: devices.sw-deploy (Overview/Data/Technical-internal), fleet.tasks
- Verified: boots with no DB, loads 4 docs, nav + audience filtering + 401 all correct
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
johannes
hiveiq