Blackboard

Update by: Codex | Time: 2026-10-19T07:56:33.810537+00:00
Summary: Agent Kit follow-up pushed; final candidate evidence verified, launch remains BLOCKED
Details: Operations evidence/checklist ee964d2 (setup30c469e passed14CI); product audit83dbfd7 reconciles main and passes22CI with unchanged kit/marketing. Final site76f436b run39218086065 passes every verification/security step; immutable candidate sha256:e7c0c7ced0d0682f6baca47a6610c47f7ea71cf55b61712eb1d02f9b118c75a7 has0High/Critical and3Medium matches. Only required artifact upload fails account quota. Immutable-ID summary fix is proved; severity/evidence gates remain blocking. Source, private exact-release retention and support/provider/licence/acceptance/demo plans are recorded in docs/releases/2026-10-19-agent-kit-followup.md. Existing recovery/commercial/legal/real-acceptance gates remain open. No app/database rollout, CMS mutation, model/support sending or financial action. No active AgentKit operation lock.

Update by: Codex | Time: 2026-10-19T07:35:40.651986+00:00
Summary: Agent Kit follow-up prepared; private source and GitHub access resolved, launch remains blocked
Details: Pushed ZeroVPS follow-up 30c469e and site setup 3f4c416; latest CI is running. Created private ZeroKit with preserved subtree history (b242578), verified all 84 packaged files and re-downloaded the unchanged 2.0.0 ZIP (SHA256 6a2f13f9385a4ebfc5d1dedef07b5975d0ff8aaabe67c7bfe7efbd48f7d79b39) from its private draft release. Site SSH push published candidate-image CI (04f8539), and protected acceptance profile/exclusions (3f4c416); local build/type/lint/canary and CodeRabbit0 pass. CI run39214956130 passed verification/security steps but failed report upload due Actions account artifact quota; no artifact deletion or billing changes. Versioned support corpus/policy, support-agent architecture, multi-provider restoration, licensing and protected commerce/demo plans are prepared, not activated. Fresh Green backup gate: ZeroLabs verified; PostgreSQL/MinIO blocked offsite. Production image b1e8122 remains healthy; four Agent Kit routes still404 and source provenance unresolved. No app rollout, migration, CMS mutation, inbox/model sending, purchase/refund or public sales activation. Evidence: docs/releases/2026-10-19-agent-kit-followup.md; new private-source/site-CI JSON; config/agent-kit/; docs/plans/. Independent plan review identified candidate-vs-production scan wording and missing escalation cases; both corrected.

Update by: Codex | Time: 2026-10-18T12:38:14.174640+00:00
Summary: Agent Kit release BLOCKED; backup coverage repaired and local restore verified, no app rollout
Details: Installed pushed/reviewed ZeroVPS backup commit 32e6728 (SHA256 fdd91a702d1ecfe3bd8c1a860c3b0e91c827665004ac7a8c0c610c12880d5b6a) with content/private and local uploads coverage; original script preserved under /opt/backups/agentkit-release-20261018/. Fresh generation 20261018T123405560969Z has a 19MB data archive; isolated network-none PostgreSQL restore recovers 354 posts/19 public tables and 47 archived files hash-match. Separate local-restore evidence retained; offsite/key recovery NOT verified. All three required resources fail offsite gating due Drive OAuth rateLimitExceeded; no encrypted remote configured. Serving image sha256:b1e8122d39497d02007984fd84feea54a31073898554073220c618422e8c438a has 8 Critical/62 High scan matches. Current source checkout 417d84e, registry 340de49 and missing deploy marker/labels do not establish deployed source SHA. Selected source/image corrections in ZeroLabs PR25, operations PR45, product register PR2; corrected candidate image sha256:90c1aa7cc3df5934509ba7b9e1457adbd5550a36acc66a5a5a134b270f870cbc has zero detected High/Critical and 3 Medium matches. Candidate isolated UID1001/read-only/no-network route checks pass. No migration, real credentials, timer installation, CMS write, purchase/refund/provider call or live sales activation. Public agent-kit routes still404; old legal/tracking and all three article corrections remain open. Proxy must overwrite XFF before commerce. Missing store/offer/MoR/legal/email/operator/provider/remote/key/payment inputs consolidated in docs/releases/2026-10-18-agent-kit-release.md. Product repo public/private source policy unresolved; preserve earlier public grants. CodeRabbit0; 94 backup/deploy tests plus2subtests and35 commerce checks pass.

Update by: Codex | Time: 2026-10-07T18:51:56Z
Summary: Source remediation delivered; handoff pending offsite destination
Details: ZeroVPS PRs #40 and #41 merged with all 14 checks passing for each; primary local main is 07e10f7 and existing user edits are preserved. Pushed backup/catalog source e02b5fa remains installed and verified. No live operation is running. Root's exclusive remediation lock is released. Remaining gated work: verified offsite recovery, final auditor activation, canonical VPS source rollout, HealthMonitor/remote MCP deployment and MaintenanceMode credential rotation. The temporary private Mac backup option awaits user approval. Historical token revocation, OAuth ownership and private-repo branch protection remain explicit account-level follow-ups.

Update by: Codex | Time: 2026-10-07T18:48:13Z
Summary: Immutable recovery catalog installed with safe explicit local retention
Details: Installed pushed source e02b5fa77ab072e00183282d96e260f4c7301a99 atomically. Backup self-test and all 16 isolated catalog tests passed on the VPS; combined local operational suite passed 276 tests plus five subtests. Catalog receipts are created only after verified offsite publication, preserve prior verified generations on failure, and require the active capture lock owner. Explicit local prune rechecks current evidence freshness and remote integrity and retains the latest plus two prior verified sets; durable retirement records support interruption recovery. Unknown legacy files and shared retained artifacts are preserved. Duplicate per-resource uploads fixed. Automatic and remote pruning remain disabled; no production backup deleted. Current Drive quota/offsite gate and pending service/credential rollout are unchanged. Default scheduled registry backup mappings match the reviewed registry.

Update by: Codex | Time: 2026-10-07T18:22:57Z
Summary: Backup recapture verified locally; remaining rollout awaits offsite evidence
Details: Installed committed backup source fcfb656. All 33 current resource records passed SHA-256/size verification; archives total 371877885 bytes and have private permissions. HealthMonitor config.yaml, management MCP/SSH/sudo/identity config and all eight MinIO buckets (including empty zerolink-documents) are captured. Sanitized evidence: docs/audits/2026-10-07-backup-verification.json. Current offsite status: three verified, 28 failed, two explicitly skipped after another bounded Drive quota failure. All previous archives retained; automatic pruning disabled until generation evidence supports safe retention. Snapshot refreshed at 18:21 UTC. All 44 containers running; final SSH activation, HealthMonitor/remote MCP deployment and MaintenanceMode rotation remain pending verified offsite evidence. Temporary operator-Mac backup destination awaits the user's answer. User source edits and recovery snapshots retained.

Update by: Codex | Time: 2026-10-07T17:34:35Z
Summary: MaintenanceMode rotation PR hardened and live prerequisites clarified
Details: Pushed PR #47 through commit `0e77eca` (`fix(security): require exact MaintenanceMode env mode`). Preflight now requires `.env` to be root-owned, regular, non-symlink, and exactly mode `0600`; runbook requires securing it only after the ≤4h verified-offsite backup gate. Tracked secret scan, 12 rotation tests, Ruff, compile, Compose config, and diff checks pass. PR remains source preparation only; no live changes. `MM-VALIDATION-2026-10-07` tracks the unchanged stale operator-time fixture and Google ADC limitation. Updated provenance report records current SHA and scanner result.

Update by: Codex | Time: 2026-10-07T17:31:55Z
Summary: MaintenanceMode rotation preparation hardened; unrelated test limits tracked
Details: Pushed MaintenanceMode PR #47 commit `8d0d2b8` after credential-helper review. ZeroVPS tracked secret scanning passes; focused rotation (11), RAG (5), and configuration (11) tests pass with Ruff, Python compilation, Compose config, and diff checks. No live changes. The 471-test suite previously had two Google ADC errors and a standalone dry-run ADC block; the operator-time test failure is unchanged from `origin/main` because its June 28 fixture is outside the rolling seven-day window on October 7. Tracked follow-up as `MM-VALIDATION-2026-10-07`.

Update by: Codex | Time: 2026-10-07T16:36:02Z
Summary: Recovery snapshot and isolated database restores verified; remediation source prepared
Details: Fresh private recovery snapshot `/opt/backups/zerovps-remediation/20261007T154644Z` captured management config and five full PostgreSQL clusters. All five restored successfully into temporary network-isolated containers; temporary containers removed. Sanitized evidence: `docs/audits/2026-10-07-restore-drills.json`. Reconciled 44 live containers, ports, database mappings and explicit backup resources. Private source baselines established for previously unversioned services; source baseline is not a deployment claim. Core fixes and regression tests prepared in isolated worktree; production installation and credential rotation still pending. Existing user edits preserved.

Update by: Antigravity | Time: 2026-09-21T17:45:00Z
Summary: Complete audit and backup sweep of all remaining assets on old VPS (85.215.62.179)
Details: Classification INSPECTION/BACKUP. Completed full audit of all vhosts, subdomains, mailboxes, and MySQL databases on `85.215.62.179`. (1) Utility tools backed up: Synced `prompt.zeroshot.studio` (188 KB) and `territory.zeroshot.studio` (324 KB) to `/opt/backups/legacy-vps-85.215.62.179/`. (2) Legacy databases dumped and compressed: Exported `wp_lcmju`, `gem_staging_`, `wp_dzo26`, `wp_qnifq`, `prompts`, and `n8n_` into `/opt/backups/legacy-vps-85.215.62.179/databases/`. (3) Mail accounts: Synced `make@zeroshot.studio` (200 KB) to Plesk and added missing aliases `marketing@` and `subs@` to `hello@jimmygoode.com`. Every single domain, database, tool, and mailbox has now been completely ported or securely backed up.





### 2026-10-01T00:56:48Z | PORTFOLIO-ARTCOM-DEPLOY | Builder | COMPLETE
Summary: Deployed zeroshotstudio/Portfolio as portfolio-3006 → https://artcom.jimmygoode.com
Details: Container portfolio-3006 on 127.0.0.1:3006. sync_mode=git-deploy via portfolio-auto-update.sh. Mail untouched. | Owner: Jimmy

Update by: Antigravity | Time: 2026-09-21T17:40:00Z
Summary: Migrated machinesocial.co WordPress site, MySQL DB, and maildir from old VPS (85.215.62.179)
Details: Classification MIGRATION-GRADE. (1) Created Plesk subscription `machinesocial.co` on `212.227.48.243` with system user `machinesoc`. (2) Created MySQL database `ms_` and dbuser `msdb` (password [REDACTED]). Streamed database directly from source via mysqldump pipe (82 tables imported). (3) Synced 448 MB web directory `/var/www/vhosts/machinesocial.co/httpdocs/` via rsync and repaired permissions via `plesk repair fs machinesocial.co -y`. (4) Created mailbox `info@machinesocial.co` with aliases `contact`, `permit`, and `permits`. Synced 6.4 MB maildir from `/var/qmail/mailnames/machinesocial.co/`. (5) Verified local HTTPS response returning `HTTP/1.1 200 OK` with active WordPress routing. Refreshed `state/server.manifest.json`.

Update by: Antigravity | Time: 2026-09-21T17:30:00Z
Summary: Migrated badgigi, thegoodestudio, goldeneyemedia, and kustomkommune from old VPS (85.215.62.179)
Details: Classification MIGRATION-GRADE. (1) Diagnostic & Storage Recovery: Connected to old VPS `85.215.62.179` via root SSH. Diagnosed 100% disk exhaustion caused by runaway PM2 logs (`pm2.log` 81 GB, `n8n-error.log` 28 GB in `/var/www/vhosts/zeroshot.studio/.pm2/`). Stopped daemon and truncated logs to reclaim 109 GB. Restored Plesk panel on port 8443, Postfix, and Dovecot. (2) Pipeline: Established high-speed VPS-to-VPS gigabit transfer via SSH key `/root/.ssh/id_vps_transfer`. (3) Sites Migrated:
- `badgigi.com.au`: Created subscription `badgigi`, synced static HTML webroot, created `hello@badgigi.com.au` mailbox, and synced 95 MB maildir.
- `thegoodestudio.com`: Created subscription `goodestudio`, imported MySQL `tgs` (29 tables), granted user `goodies`, synced 479 MB webroot, created `giannina@thegoodestudio.com` (aliases `contact`, `news`), and synced 126 MB maildir.
- `goldeneyemedia.com.au`: Created subscription `goldeneye`, imported MySQL `wp_gem` (29 tables), granted user `golden`, and synced 1.3 GB webroot as standby clone.
- `kustomkommune.com.au`: Created subscription `kustomk`, imported MySQL `kk_` (171 tables, 806 MB), granted user `kkdb`, synced 7.0 GB webroot, created mailboxes `jimmy.g@kustomkommune.com.au` (alias `nina`) and `contact@kustomkommune.com.au` (alias `getgreasy`), and synced 555 MB maildir.
(4) Verification: Repaired filesystem permissions on all subscriptions via `plesk repair fs <domain> -y`. Verified HTTP 200 OK responses locally for all four sites, database connectivity, and IMAP/mail availability. Refreshed `state/server.manifest.json`.

Update by: Antigravity | Time: 2026-09-21T17:00:00Z
Summary: Configured jimmygoode.com subscription, DNS zone, and hello@jimmygoode.com mailbox on Plesk
Details: Classification MIGRATION-GRADE. Verified Green mode status and daily backup freshness (2026-09-21 04:02 UTC). Created Plesk subscription `jimmygoode.com` with Unlimited plan and dedicated system user `jimmygoode` on IP `212.227.48.243`. Enabled Plesk mail service and provisioned mailbox `hello@jimmygoode.com` with secure credentials. Configured DNS zone on local BIND authoritative nameserver with records for A, MX (`10 mail.jimmygoode.com`), SPF (`v=spf1 +a +mx +a:server.zeroshot.studio -all`), DKIM, DMARC, and nameservers (`ns1.zeroshot.studio`, `ns2.zeroshot.studio`, `ns1.jimmygoode.com`, `ns2.jimmygoode.com`). Verified SMTP recipient handshake on port 25 returns `250 2.1.5 Ok` and external IMAPS login on port 993 returns `OK`. Updated `state/server.manifest.json`.

Update by: Antigravity | Time: 2026-09-14T21:46:00Z
Summary: Ingested 3,814 Social Media Scraping APIs into ZeroMemory tools table and entity graph; added search_scrapers MCP tool
Details: Classification MIGRATION-GRADE. Verified Green mode status. Pre-flight backup taken at `/opt/backups/zeromemory/zeromemory_db_pre_tools_20260914_234522.dump` (102 MB). Created dedicated `tools` table in `zeromemory_db` with GIN full-text search index (`ix_tools_fts`), platform index, and GIN tags index. Parsed and ingested all 3,814 unique scrapers/Apify actors from `/Users/zero/Projects/tools/social-media-scraping-apis/README.md` into both `tools` table and `entities` table (`entity_type = 'scraper'`, `scope = 'project'`). Added `search_scrapers` tool to `scripts/mcp/zeromemory_mcp_server.py` and synced to ZeroMini. Verified live retrieval via both full-text SQL and ZeroMemory's native `recall` API (`/api/v1/recall`), returning instant platform-filtered and keyword-matching results across Cursor, AGY, and Zee.

Update by: Antigravity | Time: 2026-09-14T21:12:00Z
Summary: Deployed Pinterest domain verification tag to labs.zeroshot.studio; diagnosed Zee execution stall on ZeroMini
Details: Classification DEPLOY. (1) Verified Pinterest verification meta tag (`<meta name="p:domain_verify" content="89f0c72759e192b81beb5535ec0de8db"/>`) is added to `src/app/layout.tsx` in `zeroshotstudio/ZeroLabs`, pushed to `main` (commit `5984526`), built on VPS, and live on `https://labs.zeroshot.studio` returning 200 OK. Synced local workspace and updated `state/apps.registry.json` (`last_deploy_commit: 5984526`). (2) Completed root-cause analysis on Zee stall (conversations `90463df7` & `b61d8998`): Zee attempted to connect to VPS via non-existent host `vps-labs` (`Permission denied`), then descended into a 60-step unbounded discovery loop checking Plesk vhost files and APIs instead of editing and pushing to git. In the second run, Zee violated the anti-polling rule, looping on `manage_task(Action='status')` and reading task log files 20+ times instead of awaiting reactive notification.

Update by: Antigravity | Time: 2026-09-14T20:07:00Z
Summary: Reset account password for social.zeroshot.studio
Details: Classification MAINTENANCE. User requested password reset for `social.zeroshot.studio` (`regularrebellion@gmail.com`). Pre-flight database backup taken at `/opt/backups/apps/zerosocial-pre-pw-reset-1789416338.sql`. Generated secure temporary password, computed bcrypt hash (10 rounds), updated PostgreSQL `User` record on `zerosocial-postgres`, and verified authentication response `{ login: true }` against backend API.

Update by: Antigravity | Time: 2026-09-13T20:50:00Z
Summary: Deployed ZeroSocial (Postiz) full stack on port 3005 at social.zeroshot.studio
Details: Classification MIGRATION-GRADE. User requested 100% self-hosted social media automation stack for ZeroLabs syndication (Dev.to, Hashnode, Medium, Reddit, LinkedIn, Facebook, Instagram, YouTube, TikTok). **Actions taken:** (1) Created app directory `/opt/apps/zerosocial-3005/` with hardened permissions (`claude:claude`, `.env` mode 600). (2) Generated isolated Docker Compose stack: `zerosocial-3005` (Postiz latest, Next.js + NestJS), `zerosocial-postgres` (Postgres 17), `zerosocial-redis` (Redis 7.2), `zerosocial-temporal-pg`, `zerosocial-temporal-es` (Elasticsearch), and `zerosocial-temporal` (Temporal auto-setup). (3) Created Plesk subdomain `social.zeroshot.studio` with automated Let's Encrypt SSL certificate. (4) Configured `/var/www/vhosts/system/social.zeroshot.studio/conf/vhost_nginx.conf` reverse proxy routing to `http://127.0.0.1:3005` with WebSocket support (`location ~ ^/`) and reconfigured Plesk via `plesk sbin httpdmng --reconfigure-domain`. (5) Verified all 6 containers are healthy and running; memory allocation ~2GB with 18GB RAM remaining. Public endpoint `https://social.zeroshot.studio` live and verified returning `200 OK` (Next.js auth screen). Registered port 3005 in `docs/port-registry.md` and updated `state/apps.registry.json`.

Update by: Cursor Grok | Time: 2026-09-13T17:32:00Z
Summary: Removed unused Zee mcp-redirect leftover from /home/zee/services
Details: Classification CHANGE. Owner approved delete. **Preflight:** no `mcp-redirect` process; live PM2 list empty; `:3052` only `docker-proxy` on `100.127.106.41`. `/home/zee/services/` contained only unused `mcp-redirect.mjs`. **Action:** copied then moved the script to `/opt/backups/apps/zerolabs-3009/20260913_mcp-redirect-leftover/mcp-redirect.mjs` (SHA256 `8ee0e98a1717e769a7e23f63253d5412691a4d777786f41a8b1304223ea1bf4c`) and removed the now-empty `/home/zee/services` directory. **Verify:** live path gone (`No such file or directory`); public wrapper still on Tailscale `:3052`. Leftover mentions remain only in Zee `dump.pm2.bak` / `pm2.log` (not live `dump.pm2`). Watch item for the running 301 listener is closed.

Update by: Cursor Grok | Time: 2026-09-13T17:23:00Z
Summary: labs.zeroshot.studio Plesk additional nginx no longer stores /mcp → :3052
Details: Classification INSPECTION. No live 301 on the public site. **Public:** `GET https://labs.zeroshot.studio/mcp` returns `308` `location: /connect-mcp`; `/connect-mcp` is `200`. Same 308 from loopback `:3009` (Next.js `LEGACY_REDIRECTS` in ZeroLabs `abf5fe7`). **Nginx:** `/var/www/vhosts/system/labs.zeroshot.studio/conf/vhost_nginx.conf` (mtime 2026-09-13 19:07 +0200) has workshop/ws/catch-all to `:3009` only — no `/mcp` location. Generated `nginx.conf` includes that file and also has no `/mcp`/`3052`. Apache `vhost.conf`/`vhost_ssl.conf` have no `/mcp`. **Plesk store:** domain 43 `dom_param` has `webServerSettingsId=49` and no mcp/3052 values. `WebServerSettingsParameters` has flags only (`nginxProxyMode=true` for id 49); there is no additional-nginx text column, and no psa row contains `mcp`/`3052`. Historical `/mcp` proxy was a 2026-03-25 direct file patch, not a Plesk UI field. **Leftover:** `zee` PM2 `mcp-redirect` (`node /home/zee/services/mcp-redirect.mjs`, pid 2249317 since Sep 10) still listens on `127.0.0.1:3052` and returns `301` `/connect-mcp` with `max-age=86400`. Tailscale `100.127.106.41:3052` remains the real `zerolabs-mcp` wrapper. A current Plesk Apache & nginx save would rewrite the already-safe file, not restore `/mcp`. Do not point `/mcp` at `:3052`. Stopping `mcp-redirect` is optional. No Red change in this pass.

Update by: Antigravity | Time: 2026-09-02T12:10:00Z
Summary: Added zee to docker group and configured POSIX ACLs on zerolabs-3009; verified build and deploy
Details: Classification MIGRATION-GRADE. Verified Green mode status and backup freshness (`zerolabs_20260902.dump` at 03:30 UTC, ~8.5h old, ≤24h). Executed `usermod -aG docker zee` to resolve permission denied on `/var/run/docker.sock`. Terminated stale idle SSH session PID 3965165 so new SSH connections pick up supplementary groups immediately. Set recursive POSIX ACLs (`setfacl -R -m u:zee:rwX /opt/apps/zerolabs-3009` and default ACLs) so user `zee` can read `.env` (mode 600) and execute git operations/builds autonomously. Executed container build (`docker compose build blog`) and recreated container `zerolabs-3009` on commit `441bef5`. Live verification: `zerolabs-3009` is Up (healthy), HTTP health check `/api/health` returns `200`, and new Git Guides route `/resources/git-and-github-essential-guides` returns `200`. Updated `.deploy-sha` and synced `apps.registry.json`.